SIA 'SS' – CJEU Judgment (Latvia, 2021)

In the opinion of AG Bobek, data such as phone number and car chassis number must be considered as personal data in the sense of Article 4(1) GDPR when relating to identified or identifiable individuals selling their cars via a specialized website. AG Bobek is also of the opinion that Article 6(1)(c) GDPR and Article 6(3) GDPR do not preclude national rules from laying down, without any limit in time, an obligation for Internet advertising service providers to communicate certain personal data to a tax authority, as long as there is a clear legal basis in national law for such a type of data transfer and the data requested are suitable and necessary for the tax authority to complete its official tasks. SIA ‘SS’ (‘the applicant’) is a company specialized in online advertising services. Private individuals may post and advertise various products on the applicant's website ([https://www.ss.com www.ss.com]) with a view of selling them. These products may include vehicles such as second-hand cars or motorbikes. On 28 August 2018, the director of the Latvian Tax Inspection Office (‘the defendant’) sent to the applicant request for information on the basis of Article 15(6) of the Law on taxes and duties. In that request, the defendant asked the applicant to renew the defendant's access to information, and in particular information on (1) the telephone numbers of advertisers ; (2) the chassis numbers of vehicles featured in advertisements published on the applicant’s website, and (3) information on advertisements published in the ‘Motor Vehicles’ section of the website during the period from 14 July to 31 August 2018. The applicant was asked to send the information electronically, in a format that would allow the data to be filtered and selected. The applicant was also asked to include the following information in the data file: a link to the advertisement, advertisement text, make of vehicle, model, chassis number, price, vendor’s telephone numbers. The applicant lodg