Judgment;Abstract — ECLI:EU:C:2021:504
Date: 2021-06-22
Language of the case: Latvian
Court formation: Grand Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Approximation of laws;Data protection
Procedure: Reference for a preliminary ruling
Origin: Latvia

Summary C-439/19 — 1 
Case C-439/19 
Summary of the Request for a Preliminary Ruling pursuant to Article 98(1) 
of the Rules of Procedure of the Court of Justice 
Date lodged:  
11 June 2019 
Referring court:  
Satversmes tiesa (Constitutional Court, Latvia) 
Date of the decision to refer: 
4 June 2019 
Applicant:  
B 
Body responsible for the act the constitutionality of which is at issue: 
Latvijas Republikas Saeima (Parliament of the Republic of Latvia)  
  
Subject matter of the main proceedings 
The purpose of the proceedings is to determine the compatibility with Article 96 
of the Latvijas Republikas Satversme (Constitution of the Republic of Latvia), 
concerning the inviolability of private life, of Article 14.1(2) of the Ceļu satiksmes 
likums (Law on motoring), inasmuch as it provides, inter alia, that information 
relating to penalty points recorded against drivers for motoring offences falls 
within the public domain. 
Subject matter and legal basis of the request for a preliminary ruling 
On the basis of Article 267 TFEU, the referring court seeks an interpretation of 
Regulation 2016/679 and Directive 2003/98 with a view to determining whether 
they prohibit Member States from stipulating in their legislation that information 
relating to penalty points recorded against drivers for motoring offences falls 
within the public domain, thus allowing such personal data to be processed by 
being communicated and transmitted for re-use. 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING — CASE C-439/19 
 
2  
In the alternative, the referring court also seeks an interpretation of the principles 
of the primacy of EU law and legal certainty in order to clarify whether the 
national provision at issue in the main proceedings is applicable and whether its 
legal effects can be maintained until such time as the decision which the referring 
court ultimately gives on its constitutionality becomes final. 
Questions referred for a preliminary ruling 
1. Must the expression ‘[p]rocessing of personal data relating to criminal 
convictions and offences or related security measures’, used in Article 10 of 
Regulation 2016/679, be interpreted as meaning that it includes the 
processing of information relating to penalty points recorded against drivers 
for motoring offences as provided for in the provision at issue? 
2. Irrespective of the answer to the first question, can the provisions of 
Regulation 2016/679, in particular the principle of ‘integrity and 
confidentiality’ referred to in Article 5(1)(f) thereof, be interpreted as 
meaning that they prohibit Member States from stipulating that information 
relating to penalty points recorded against drivers for motoring offences falls 
within the public domain and from allowing such data to be processed by 
being communicated? 
3. Must recitals 50 and 154 and Articles 5(1)(b) and 10 of Regulation 2016/679 
and Article 1(2)(cc) of Directive 2003/98/EC be interpreted as meaning that 
they preclude legislation of a Member State which allows information 
relating to penalty points recorded against drivers for motoring offences to 
be transmitted for the purposes of re-use? 
4. If any of the foregoing questions is answered in the affirmative, must the 
principle of the primacy of EU law and the principle of legal certainty be 
interpreted as meaning that it might be permissible to apply the provision at 
issue and maintain its legal effects until such time as the decision ultimately 
adopted by the Constitutional Court becomes final? 
Most relevant provisions of EU law 
Treaty on the Functioning of the European Union, Article 16(1). 
Charter of Fundamental Rights of the European Union, Article 8(1). 
Directive 95/46/EC (Data Protection Directive). Article 94. 
Regulation (EU) 2016/679 (General Data Protection Regulation). Recitals 4, 9, 50 
and 154 and Articles 4, 5, 6, 10 and 94. 
Directive 2003/98/EC on the re-use of public sector information. Recital 21 and 
Article 1. 
LATVIJAS REPUBLIKAS SAEIMA 
 
3 
Most relevant provisions of national law 
Latvijas Republikas Satversme (Constitution of the Republic of Latvia). 
Articles 32, 89 and 96. 
Ceļu satiksmes likums (Law on motoring). Articles 14.1 and 43.1. 
Sodu reģistra likums (Law on the register of penalties). Article 1. 
Fizisko personu datu aizsardzības likums (Law on the protection of the data of 
natural persons). 
Fizisko personu datu apstrādes likums (Law on the processing of the data of 
natural persons). 
Informācijas atklātības likums (Law on the disclosure of information). Article 1. 
Case-law of the Court of Justice 
Judgment of the Court of Justice of 16 January 2019, Deutsche Post AG 
(C-496/17, EU:C:2019:26), paragraph 57. 
Judgment of the Court of Justice of 21 June 2007, Stichting ROM projecten 
(C-185/06, EU:C:2007:370), paragraph 24. 
Judgment of the Court of Justice of 10 March 2009, Gottfried Heinrich (C-345/06, 
EU:C:2009:140), paragraph 44. 
Judgment of the Court of Justice of 9 March 1978, Simmenthal (106/77, 
EU:C:1978:49), paragraph 17. 
Judgment of the Court of Justice of 8 September 2010, Winner Wetten GmbH 
(C-409/06, EU:C:2010:503), paragraph 67. 
Brief presentation of the facts and main proceedings 
1 Article 14.1(2) of the Latvian Law on motoring, in the amended version thereof 
that entered into force on 10 May 2018, is worded as follows: 
‘(2) Information relating to a vehicle owned by a legal person, … to a person’s 
right to drive vehicles, to fines for the commission of motoring offences which 
have been imposed on a person but not paid within the time limits laid down by 
law and other information recorded in the national register of vehicles and drivers, 
as well as in the system of information on means of traction and drivers, shall be 
regarded as information in the public domain’. 
2 The ‘Ceļu satiksmes drošības direkcija’ (Road Safety Directorate) (‘the 
Directorate’), a national company limited by shares, recorded in the national 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING — CASE C-439/19 
 
4  
register of vehicles and drivers (‘the national vehicle register’) the penalty points 
that had been awarded against the applicant for motoring offences, this being 
information which, in accordance with Article 14.1(2) of the Law on motoring 
(‘the provision at issue’), falls within the public domain and can be communicated 
to anyone. That information was transmitted for re-use to two legal persons (‘re-
use operators’). 
3 The applicant initiated proceedings before the referring court relating to the 
constitutionality of the provision at issue. 
Essential arguments of the parties to the main proceedings 
4 The applicant submits that the provision at issue is not consistent with Article 96 
of the [Latvian] Constitution, relating to the inviolability of private life, because it 
permits the processing of his personal data. In particular, the information 
contained in the vehicle register with respect to penalty points for motoring 
offences must be regarded as personal data relating to penalties imposed in 
punitive administrative proceedings and, as such, falls within the scope of 
Article 10 of Regulation 2016/679. He states that personal data relating to 
penalties imposed in administrative proceedings may be processed only by 
persons designated by statute, but there is no statute that confers that right on the 
Directorate. As regards the re-use of personal data, the applicant maintains that the 
principle of re-use must be implemented and applied in full compliance with the 
principles that govern the protection of personal data. He states that the 
Directorate is not empowered to process for the purposes of re-use the public-
domain information that is in its possession. The applicant further argues that the 
processing of personal data entails a duty to observe the principles of lawfulness, 
minimum intervention, equity and anonymity, as well as the principles of 
participation and transparency. 
5 The Saeima (Parliament) maintains that the provision at issue is consistent with 
Article 96 of the [Latvian] Constitution. In order to understand the meaning of the 
provision at issue, it is necessary to take into account the practice by which it is 
applied and the legal system within which it operates. In practice, information 
relating to penalty points for motoring offences is not automatically available to 
the general public. The Parliament submits that the provision at issue is closely 
linked to the introduction in Latvia of the system of penalty points for motoring 
offences as one of the measures to improve road safety. This system has two 
principal purposes: to identify motor vehicle drivers who systematically and 
wilfully infringe road traffic rules and to operate as a precaution in relation to the 
conduct of road users. Those purposes cannot be fully and effectively achieved if 
that information does not fall within the public domain. Consequently, in 
stipulating that such information falls within the public domain, the legislature 
guaranteed the right of third parties to access information, as provided for in 
Article 100 of the [Latvian] Constitution, and, at the same time, secured the 
attainment of the main objective of protecting the rights of third parties and public 
LATVIJAS REPUBLIKAS SAEIMA 
 
5 
safety. In the opinion of the Parliament, penalty points for motoring offences 
cannot be regarded as data relating to penalties imposed in administrative 
proceedings within the meaning of Article 10 of Regulation 2016/679. Penalty 
points for motoring offences do not constitute a form of administrative penalty. 
Furthermore, in addition to the vehicle register, Latvia also has a register of 
penalties, which contains a record of persons who commit both criminal and 
administrative offences. Article 43.1(1) of the Law on motoring expressly provides 
that administrative offences committed by drivers are to be recorded in the register 
of penalties, while penalty points for motoring offences are to be recorded in the 
vehicle register. It submits that, even if Article 10 of Regulation 2016/679 were 
applicable to penalty points for motoring offences, the processing of those penalty 
points by the Directorate would be fully compliant with the conditions laid down 
in that provision. The processing of that information is based on Article 6(1)(c) 
and (e) of Regulation 2016/679. In addition, the applicable national legislation 
provides appropriate safeguards for the rights and freedoms of data subjects. 
6 The Datu valsts inspekcija (State agency for data protection), a party which has 
been invited to participate in this case, submits that, in order to assess the 
constitutionality of the provision at issue, it is necessary first of all to analyse the 
legal nature and scope of the expression ‘penalty points for offences’. The purpose 
of recording penalty points awarded for motoring offences is to have a register of 
motoring-related administrative offences so that, depending on the number of 
offences committed, additional measures can be taken to influence the conduct of 
drivers. Penalty points for motoring offences may be regarded as personal data 
within the meaning of Regulation 2016/679, since they relate to an identified 
natural person and form part of private life. The State agency for data protection 
submits that personal data containing information on private life and liability to 
the administrative authorities (as a result of a penalty) warrant special protection 
within the meaning of Regulation 2016/679. If the provision at issue stipulates 
that information on penalty points for motoring offences falls within the public 
domain, then, without any doubt, the corresponding limitation of fundamental 
rights must necessarily be directed towards the attainment of a legitimate aim and 
respect the principle of proportionality. 
7 The Directorate recognises that it processed the applicant’s personal data in the 
vehicle register. It states that the provision at issue stipulates that that information 
falls within the public domain and that the national legislation does not impose 
any limitations on its re-use. 
Brief presentation of the reasons for the request for a preliminary ruling 
8 As regards the legal nature of the system of penalty points for motoring offences, 
the referring court notes that, according to Article 43.1(1) of the Law on motoring, 
administrative offences committed by drivers are to be recorded in the register of 
penalties and penalty points awarded for motoring offences are to be recorded in 
the vehicle register. The register of penalties is a single register of persons who 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING — CASE C-439/19 
 
6  
have committed criminal and administrative offences; it records information on 
persons who have committed administrative offences, including information on 
the administrative offence and the administrative penalty imposed. The purpose of 
recording penalty points awarded for motoring offences, on the other hand, is to 
track motoring-related administrative offences so that, depending on the number 
committed, additional measures can be taken to influence the conduct of drivers. 
Records of penalty points awarded for motoring offences are removed from the 
register when the points expire.  
9 The referring court notes that information relating to natural persons falls within 
the concept of the ‘right to the inviolability of private life’, which appears in 
Article 96 of the [Latvian] Constitution. The scope of that concept encompasses 
the processing of data relating to private life and includes the communication and 
storage of such data. 
10 In order to clarify the content of and apply the national legislation, it is necessary 
to take into account EU law and its interpretation in the case-law of the Court of 
Justice. Under Article 16(1) TFEU and Article 8(1) of the Charter of Fundamental 
Rights of the European Union, everyone has the right to the protection of personal 
data concerning them, the protection of such data being governed by Regulation 
2016/679. As regards the processing of data, the referring court mentions the case-
law of the Court of Justice (judgment in Case C-496/17, Deutsche Post, 
paragraph 57) which recognises that all processing of personal data must comply, 
first with the principles relating to data quality set out in Article 5 of Regulation 
2016/679 and, second, with one of the criteria governing the legitimacy of data 
processing listed in Article 6 of that regulation. The referring court also notes that, 
in accordance with Article 10 of Regulation 2016/679, processing of personal data 
relating to criminal convictions and offences or related security measures based on 
Article 6(1) are to be carried out only under the control of official authority or 
when the processing is authorised by Union or Member State law providing for 
appropriate safeguards for the rights and freedoms of data subjects. It follows 
from the case-law of the referring court that certain categories of personal data 
warrant special protection. Since Article 10 of Regulation 2016/679 allows such 
data to be processed only under the control of official authority or when the 
processing is authorised by Union or Member State law providing appropriate 
safeguards for the rights and freedoms of data subjects, legislation enacted by 
Member States may give authorisation to engage in the processing of data, 
including in the form of communication, only to the persons mentioned in the 
legislation in question. This therefore means, first, that the further processing of 
such data is permitted only where it takes place under the control of official 
authority. Secondly, the classification of a particular piece of information as 
falling within the public domain may, by definition, make it impossible to provide 
appropriate safeguards for the rights and freedoms of data subjects, since that 
information is available to anyone. Consequently, the referring court concludes 
that the scope of Article 96 of the [Latvian] Constitution includes the protection of 
information relating to the criminal convictions and offences of natural persons.  
LATVIJAS REPUBLIKAS SAEIMA 
 
7 
11 The referring court observes that the provision at issue gives anyone a subjective 
right to seek and obtain from the Directorate information contained in the vehicle 
register with respect to penalty points recorded against drivers for motoring 
offences. However, the documents before the court show that, when the provision 
at issue is applied in practice, such information is provided if the person 
requesting it gives the personal identification numbers of the drivers in question. It 
follows from this that information relating to the forenames and surnames of 
identifiable natural persons and the penalty points awarded against them for 
motoring offences must be regarded as personal data and the communication of 
those details must be regarded as the processing of personal data within the 
meaning of Article 96 of the [Latvian] Constitution. 
12 The referring court submits that this case calls for a clarification of the content of 
Article 10 of Regulation 2016/679. That article applies to the processing of 
personal data relating to criminal convictions and offences or related security 
measures. At first sight, that provision appears not to be concerned with 
persondata on penalties for administrative offences. In accordance with recital 9 of 
Regulation 2016/679, the objectives and principles of Directive 95/46/EC 
continue to apply and, in accordance with Article 94(2) of that regulation, 
references to the repealed directive are to be construed as references to Regulation 
2016/679. Article 8(5) of Directive 95/46/EC provided that the processing of data 
relating to offences, criminal convictions or security measures may be carried out 
only under the control of official authority or if suitable specific safeguards are 
provided under national law, subject to derogations which may be granted by the 
Member State under national provisions providing suitable specific safeguards. 
However, a complete register of criminal convictions may be kept only under the 
control of official authority. Member States may provide that data relating to 
administrative sanctions or judgments in civil cases shall also be processed under 
the control of official authority. It follows, according to the referring court, that, 
during the period of validity of Directive 95/46, it fell to the Member States to 
ensure compliance with certain special conditions governing the processing of 
personal data relating to offences, criminal convictions or security measures, 
while the approval of specific provisions on personal data relating to 
administrative penalties was left to the discretion of the Member States. In Latvia, 
the conditions laid down in Directive 95/46/EC were transposed, in particular, by 
the Law on the protection of the data of natural persons, Article 12 of which 
stipulated that personal data relating to, inter alia, criminal offences, criminal 
convictions and penalties adopted in administrative proceedings could be 
processed only by the persons, and in the circumstances, provided for by law. That 
Law was repealed on 5 July 2018, on the entry into force of the Law on the 
processing of the data of natural persons, which, on the basis of the application of 
Regulation 2016/679, is intended to create the legal preconditions necessary for 
the establishment of a system for protecting the personal data of natural persons at 
national level. Consequently, for more than 10 years, that is to say up until the 
entry into force of Regulation 2016/679, the Latvian legal system applied similar 
conditions to the processing of personal data relating to criminal convictions, on 
the one hand, and penalties imposed in administrative proceedings, on the other. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING — CASE C-439/19 
 
8  
The referring court notes that, according to recital 4 of Regulation 2016/679, the 
right to the protection of personal data must be considered in relation to its 
function in society. The function in society of Article 10 of Regulation 2016/679 
is to protect personal data relating to criminal convictions and offences and to 
ensure that a person’s private and professional life is not unduly adversely 
affected as a result of a penalty imposed on that person in the past. That function 
could be applied in a similar way to the protection of personal data relating both to 
convictions in criminal cases and to penalties adopted in punitive administrative 
proceedings. Furthermore, in the light of Article 6 of the European Convention on 
Human Rights and the case-law of the European Court of Human Rights, the 
referring court has recognised that, so far as concerns the guarantees derived from 
the right to a fair trial, punitive administrative proceedings may be classified as 
criminal cases when certain criteria are met. If Article 10 of Regulation 2016/679 
also laid down specific rules on the processing of personal data relating to 
administrative penalties and offences in a situation such as that at issue here, 
information relating to penalty points awarded against an individual for motoring 
offences could not be regarded as falling within the public domain. The Court of 
Justice has no settled case-law on the issue raised by the referring court. In those 
circumstances, the provisions of Regulation 2016/679 cannot be regarded as 
laying down clear and precise obligations which, from the point of view of their 
discharge or their consequences, are independent of the later adoption of a legal 
act. It follows that, in the present case, the doctrine of acte éclairé is not 
applicable and there are doubts as to whether Regulation 2016/679 actually 
attaches specific conditions to the processing of personal data relating to punitive 
administrative proceedings. 
13 In accordance with the case-law of the Court of Justice, all processing of personal 
data must also comply with the principles relating to data quality set out in 
Article 5 of Regulation 2016/679, including the principle of ‘integrity and 
confidentiality’. That principle is contained in Article 5(1)(f) of Regulation 
2016/679, which provides that personal data must be processed in a manner that 
ensures appropriate security of the personal data, including protection against 
unauthorised or unlawful processing. Furthermore, in accordance with recital 39 
of Regulation 2016/679, personal data should be processed in a manner that 
ensures appropriate security and confidentiality of the personal data, including for 
preventing unauthorised access to or use of personal data. In the present case, the 
provision at issue stipulates that information on penalty points recorded against 
drivers for motoring offences (which the referring court regards as personal data) 
falls within the public domain and allows that information to be communicated 
(which the referring court regards as the processing of personal data) to anyone, 
regardless of whether or not the person in question has reasonable grounds for 
obtaining that information. The referring court is of the opinion that, in a situation 
where it is stipulated that personal data fall within the public domain, it might not 
be possible to ensure appropriate security and confidentiality of such data. The 
provision at issue effectively provides for the unconditional processing of such 
personal data in the form of communication and allows the Directorate, on 
request, to communicate information relating to such personal data without taking 
LATVIJAS REPUBLIKAS SAEIMA 
 
9 
measures to ensure the security of the personal data in question. Consequently, in 
order to be able to give judgment in these proceedings, the referring court requires 
some clarification of the substance of the principle of ‘integrity and 
confidentiality’ referred to in Article 5(1) of Regulation 2016/679.  
14 The referring court maintains that, in order to give judgment in the present case, it 
may be relevant to examine whether information relating to penalty points 
recorded against drivers for motoring offences can be transmitted for re-use. The 
conditions laid down in Directive 2003/98 were transposed in Latvia by the Law 
on the disclosure of information. In accordance with recital 21 and Article 1(4) of 
Directive 2003/98, that directive leaves intact and in no way affects the level of 
protection of individuals with regard to the processing of personal data under the 
provisions of Community and national law, and in particular Regulation 2016/679. 
Recital 154 of Regulation 2016/679 also emphasises that Directive 2003/98 does 
not alter the obligations and rights set out in that regulation. Article 5 of 
Regulation 2016/679 lays down the principles relating to the processing of 
personal data, including the principle of ‘purpose limitation’, which means that 
personal data are to be collected for specified, explicit and legitimate purposes and 
are not to be further processed in a manner that is incompatible with those 
purposes. The referring court takes the view that, if information relating to penalty 
points recorded against drivers for motoring offences could be communicated to 
anyone, including re-use operators, it would not be possible to identify the 
purposes of the further processing of the data and it would be effectively 
impossible to evaluate whether personal data are being processed in a manner 
incompatible with those purposes. Article 10 of Regulation 2016/679 attaches 
specific conditions to the processing of personal data relating to criminal 
convictions and offences or related security measures. If those conditions are to be 
regarded as a regime governing access that limits access to certain information on 
grounds of protection of personal data, within the meaning of recital 154 of 
Regulation 2016/679 and Article 1(2)(cc) of Directive 2003/98, the personal data 
referred to in Article 10 of Regulation 2016/679 could not be transmitted for re-
use. Consequently, for the purposes of giving judgment in the present case, it 
might be necessary to clarify whether recitals 50 and 154, Article 5(1)(b) and 
Article 10 of Regulation 2016/679 and Article 1(2)(cc) of Directive 2003/98 are to 
be interpreted as meaning that they preclude legislation of a Member State which 
allows information relating to penalty points recorded against drivers for motoring 
offences to be transmitted for re-use.  
15 With respect to maintenance of the effects of the provision at issue, the referring 
court notes that, if, in the present case, the view is taken that that provision is 
contrary to the provisions of Regulation 2016/679 and Article 96 of the [Latvian] 
Constitution, the referring court could rule on when the provision at issue ceases 
to be in force. However, the referring court states that such a decision must take 
into account the fact that the principle of legal certainty forms part of the legal 
order of the European Union. As the Court of Justice recognised in the judgment 
in Heinrich (C-345/06), the principle of legal certainty requires that EU rules 
enable those concerned to know precisely the extent of the obligations which are 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING — CASE C-439/19 
 
10  
imposed on them. In the opinion of the referring court, compliance with the 
principle of legal certainty must be assessed in conjunction with the principle of 
the primacy of EU law, according to which the relationship between provisions of 
the Treaty and directly applicable measures of the institutions, on the one hand, 
and the national law of the Member States, on the other, is such that those 
provisions and measures, by virtue of the very fact of their entry into force, render 
automatically inapplicable any conflicting provision of current national law. 
Nonetheless, it has to date been the case-law of the Court of Justice that, where 
overriding considerations of legal certainty involving all the interests, public as 
well as private, are at stake, there may exceptionally be circumstances in which, 
subject to the conditions which the Court of Justice alone may impose, the 
primacy of EU law is limited (judgment of 8 September 2010, Winner Wetten 
GmbH, C-409/06, EU:C:2010:503, paragraph 67). The referring court is of the 
opinion that those considerations of legal certainty may be present in this case, 
meaning that the provision at issue, although not compliant with the provisions of 
Regulation 2016/679, is applicable and the legal effects of that provision will be 
maintained until such time as the decision which the referring court ultimately 
adopts becomes final. Consequently, in order to be able to give judgment in the 
case at issue, the referring court may require an interpretation of the principle of 
legal certainty and the principle of the primacy of EU law.