Supreme Administrative Court - Even someone committing a crime is entitled to personal data protection

The Supreme Administrative Court recently decided on an important dispute related to balancing the rights for personal data protection and the protection of property. This case, which was a hot topic among the professional and general public, concerned the penalties of the Personal Data Protection Office imposed on an operator of an electric bicycle rental business who disclosed on social media photos from security cameras of a person accused of stealing bicycles at their premises.

In this case, the Supreme Administrative Court tended to agree with the Personal Data Protection Office. It rescinded the original decision of the Municipal Court and returned the case for further deliberation. In its argumentation, the Court stressed the role of the legal state and the police when investigating perpetrators of criminal acts and also emphasised the importance of the presumption of innocence which relates directly to the protection of personal data. The police and other authorities active in criminal proceedings have the authority under law to disclose any amount of personal data necessary for carrying out their tasks in relation to the investigation of people. However, legal liability for such steps goes hand in hand with this authority. Acknowledging the same type of authority for any person under private law that is not subject to the same checks and balances as a public authority could lead to unfavourable outcomes. As the Court states in its justification: “The notion that the administrator of this camera system can independently decide without any control or limitations who is the perpetrator of a criminal act and publicly stigmatise this individual because its photography has been placed on the Internet, is in contradiction with respect for the private and personal life of anyone, including a perpetrator of a criminal act.”