Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde v Rīgas pašvaldības SIA "Rīgas satiksme".
Date: 2017-05-04
26


It is accordingly clear from the scheme of Directive 95/46 and from the wording of Article 7 thereof that Article 7(f) of Directive 95/46 does not, in itself, set out an obligation, but expresses the possibility of processing data such as the communication to a third party of data necessary for the purposes of the legitimate interests pursued by that third party. As the Advocate General stated in points 43 to 46 of his Opinion, such an interpretation may also be deduced from other EU instruments touching upon personal data (see, to that effect, as regards the processing of personal data in the electronic communications sector, judgment of 29 January 2008, Promusicae, C‑275/06, EU:C:2008:54, paragraphs 54 and 55).
28


In that regard, Article 7(f) of Directive 95/46 lays down three cumulative conditions so that the processing of personal data is lawful, namely, first, the pursuit of a legitimate interest by the data controller or by the third party or parties to whom the data are disclosed; second, the need to process personal data for the purposes of the legitimate interests pursued; and third, that the fundamental rights and freedoms of the person concerned by the data protection do not take precedence.
29


As regards the condition relating to the pursuit of a legitimate interest, as the Advocate General stated in points 65, 79 and 80 of his Opinion, there is no doubt that the interest of a third party in obtaining the personal information of a person who damaged their property in order to sue that person for damages can be qualified as a legitimate interest (see, to that effect, judgment of 29 January 2008, Promusicae, C‑275/06, EU:C:2008:54, paragraph 53). That analysis is supported by Article 8(2)(e) of Directive 95/46, which provides that the prohibition on the processing of certain types of personal data, such as those revealing racial origin or political opinions, is not to apply, in particular, where the processing is necessary for the establishment, exercise or defence of legal claims.
30


As regards the condition relating to the necessity of processing personal data, it should be borne in mind that derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly necessary (judgments of 9 November 2010, Volker und Markus Schecke and Eifert, C‑92/09 and C‑93/09, EU:C:2010:662, paragraph 86; of 7 November 2013, IPI, C‑473/12, EU:C:2013:715, paragraph 39; and of 11 December 2014, Ryneš, C‑212/13, EU:C:2014:2428, paragraph 28). In that regard, according to the information provided by the national court, communication of merely the first name and surname of the person who caused the damage does not make it possible to identify that person with sufficient precision in order to be able to bring an action against him. Accordingly, for that purpose, it is necessary to obtain also the address and/or the identification number of that person.
31


Finally, as regards the condition of balancing the opposing rights and interests at issue, it depends in principle on the specific circumstances of the particular case (see, to that effect, judgments of 24 November 2011, Asociación Nacional de Establecimientos Financieros de Crédito, C‑468/10 and C‑469/10, EU:C:2011:777, paragraph 40, and of 19 October 2016, Breyer, C‑582/14, EU:C:2016:779, paragraph 62).
32


In that regard, the Court has held that it is possible to take into consideration the fact that the seriousness of the infringement of the data subject’s fundamental rights resulting from that processing can vary depending on the possibility of accessing the data at issue in public sources (see, to that effect, judgment of 24 November 2011, Asociación Nacional de Establecimientos Financieros de Crédito, C‑468/10 and C‑469/10, EU:C:2011:777, paragraph 44).