Key facts of the case: 

The police conducted a criminal procedure that concerned the applicant. This prosecution applied for a surveillance order and according to the order, the applicant's mobile phone was wiretapped from 27 October 2010 until 26 November 2010. In July 2012, the criminal procedure was suspended as it was found that there were no grounds for it. In January 2014, the applicant was informed of the wiretapping and the collected information was presented to the applicant. The applicant requested access to the whole file of the criminal procedure on the basis of Article 19 of the Personal Data Protection Act (PDPA); he was denied access to it by both the Police and Border Guard Board (PBGB) and the Public Prosecutors Office. The file had been archived, access to the file had been restricted, and it had been classified as internal in accordance with the Article 34 and Article 35 para 1 p. 1 of the Public Information Act (PIA). The applicant claimed that the PDPA allowed restrictions to the personal data only based on Article 20. According to this Article, access to the data can be restricted to any applicant if this may: “1) damage rights and freedoms of other persons; 2) endanger the protection of the confidentiality of filiation of a child; 3) hinder the prevention of a criminal offence or apprehension of a criminal offender; 4) complicate the ascertainment of the truth in a criminal proceeding.”

Two lower levels of the court came to differing views on how to interpret the right to access private data and which are the permissible grounds for limiting this right and which law to apply in such a case. They used different legal grounds (PDPA or PIA) as the basis of their arguments.

The claimant appealed the decisions of the Police and Border Guard Board (PBGB) and the lower instance courts in the Supreme Court and relied on Article 19 of the PDPA; he requested to have access to the criminal file including his personal information. The applicant was not a suspect or accused person in the criminal proceedings, however, there is no doubt that the criminal file included personal information about the applicant.

Outcome of the case: 

The Supreme Court decided that access to the personal information is regulated by the Personal Data Protection Act. The fact that the data has been restricted as internal does not influence the right of the person to get access to the personal information collected about him. The Supreme Court admitted that the legal regulation on access to the data collected during the criminal procedure could be more extensive and clear, also taking into account the Directive (EU) 2016/680.

Protection of the personal information is covered by Article 8 para 1 of the Charter of Fundamental Rights. This right includes at its core the right to access to personal information. Only law can limit the right to access to information on the grounds enumerated in Article 44 para 3 of the Constitution. These grounds cannot be interpreted widely.

As the PBGB had not analysed all the grounds for limiting access to the file as required by the Article 20 of the PDPA, the Supreme Court ordered that the application is reviewed and re-decided by the PBGB in light of the interpretation to the law as provided by the Supreme Court.