Position No. 1/2007 - Position on the application of the right to personal data protection in the provision of information on the work of the public administration bodies
June 2007
The Charter of Fundamental Rights and Basic Freedoms, which is part of the constitutional order of the Czech Republic, stipulates inter alia two human rights where the relation between them may not be entirely clear in interpretation. The Office for Personal Data Protection was established to supervise compliance with part of one of them: on one side there is the right to the protection of privacy and on the other the right to information.
The protection of privacy is governed in particular by the following two provisions in the Charter:
Article 7 paragraph 1: “The inviolability of the person and of her private life is guaranteed. They may be limited only in cases provided for by law.”
Article 10 paragraph 3: “Everyone has the right to be protected from the unauthorized gathering, public revelation, or other misuse of his personal data.”
The right to information is governed in general by Article 17 paragraph 1 of the Charter, which states: “The freedom of expression and the right to information are guaranteed.” Paragraph 5 of the same Article extends the right to information to the principle of publicity for the public administration: “State bodies and territorial self-governing bodies are obliged, in an appropriate manner, to provide information with respect to their activities. The conditions and implementation thereof shall be provided for by law.”
There is specific legislation on those constitutional principles in Act No. 101/2000 Coll., on the Protection of Personal Data and on amendments to certain acts, as subsequently amended (hereinafter “Personal Data Protection Act”), for the protection of privacy, and Act No. 106/1999 Coll., on Free Access to Information, as subsequently amended (hereinafter “Free Access to Information Act”), on questions of the general right to information and the application of the constitutional principle of the public nature of state administration.
Those constitutional principles can come into conflict, as the work of the bodies of the state administration and territorial self-governing bodies is performed by people, individuals, and in many cases their work is directed at individuals. All of those individuals have of course a right to the protection of privacy, which may however clash with the public’s right to information on the work of state bodies and territorial self-governing bodies.
Both the aforementioned acts seek to resolve that potential ambiguity in the application of the law. Section 8a of the Free Access to Information Act states: “The legally-bound person shall communicate information concerning a personality, manifestations of a private nature, an individual’s privacy and personal data only in accordance with legal regulations governing their protection.” A footnote to that provision includes examples of other legislation, namely Sections 11 to 16 of Act No. 40/1964 Coll. (hereinafter “Civil Code”) and Articles 5 to 10 of the Personal Data Protection Act.
The provisions in the Civil Code govern the right to the protection of personality. From our perspective Section 11 of the Civil Code is particularly interesting: “An individual shall have the right to the protection of his or her personhood, in particular his or her life and health, civic honour and human dignity as well as his or her privacy, name and manifestations of a personal nature.” This is the general legislation on the constitutional principle of the protection of privacy, one aspect of which (and one that is crucial for our theme), the protection of personal data, is covered in the Personal Data Protection Act.
The other aforementioned provisions of the Civil Code govern the option of acquiring and publishing documents of a personal nature, portraits, pictures and visual and audio recordings concerning an individual or manifestations of a personal nature and the option for the protection of the individual against the unwarranted violation of his or her privacy.
Article 5 of the Personal Data Protection Act governs the rights and duties of the controller and processor in the processing of personal data, such as specifying the purpose, means and manner of personal data processing, processing only accurate personal data and only for the specified purpose. The second paragraph states that personal data processing is in principle only possible with the consent of the data subject, but it also lists a number of exemptions from that rule. For instance the controller may process personal data without such consent if processing is essential for fulfilment of a contract to which the data subject is a contracting party; if it relates to personal data that is lawfully published in accordance with special legislation; if it is essential for the protection of vitally important interests of the data subject, etc.
For our theme the crucial provision is Article 5 paragraph 2 (f) of the Personal Data Protection Act, according to which the controller can process personal data without the subject’s consent “if he provides personal data on a publicly active person, official or employee of public administration that reveals information on their public or administrative activity, their functional or working position.”
Article 10 of the Personal Data Protection Act, to which the Free Access to Information Act refers in a footnote, and which reads “In personal data processing, the controller and processor shall ensure that the rights of the data subject are not infringed upon, in particular, the right to preservation of human dignity, and shall also ensure that the private and personal life of the data subject is protected against unauthorised interference,” is more a statement of the general subject of the Personal Data Protection Act, but it is one of the most important provisions for the aforementioned conflict of rights.
In the provision of information on the work of the state administration or territorial self-governing bodies we can come into conflict with the right to the protection of privacy for two types of individuals:
- Individuals who come into contact with bodies of the state administration or territorial self-governing bodies as citizens (petitioners, witnesses, injured parties, applicants, perpetrators, etc.);
- Individuals who contribute directly to the work of the state administration or territorial self-governing bodies (officials and other employees of state administration bodies or territorial self-governing bodies, etc.).
For the first group of citizens it may seem that under the Free Access to Information Act information on them can in principle be provided. Section 2 paragraph 1 of the Act states: “The legally-bound persons, who under this Act have the duty to provide information related to their competencies, are the state agencies, territorial self-governing bodies and public institutions.” The second paragraph in the list of legally-bound persons continues: “The legally-bound persons are further such entities who have been entrusted by law to decide on the rights, legitimate interests or duties of persons or legal entities in the area of public administration, namely to the extent of their decision-making activity only.”
It may be deduced from the wording of the Free Access to Information Act that legally-bound persons may or should also provide information on, for instance, the parties in administrative proceedings, for administrative proceedings come under the competencies of many legally-bound persons. According to Section 2 paragraph 2 their disclosure duty is restricted, but the wording “to the extent of their decision-making activity” could be interpreted to mean that those legally-bound persons provide information on their entire decision-making activity, including on those individuals for whom their decisions established, amended or annulled rights or duties.
Of course, if a legally-bound person provides information on an individual so defined or definable, and therefore of necessity on their personal data, the reference by Section 8a of the Free Access to Information Act to the relevant provisions of the Personal Data Protection Act applies. In that situation it is necessary to apply Article 5 paragraph 2 of the Personal Data Protection Act, that personal data may only be processed with the consent of the data subject, where according to Article 4 (e) of the Act processing covers inter alia the disclosure, dissemination and publishing of personal data. The provision of personal data on those individuals is not covered by any of the exemptions in Article 5 paragraph 2. The aforementioned exemption in Article 5 paragraph 2 (f) of the Personal Data Protection Act covers a situation in which personal data on a publicly-active person, official or employee of the public administration may be provided without their consent, but not on other individuals who, while they have come into contact with the state administration or territorial self-administration, by no means work for it.
On that point it can be summarised that bodies or persons performing the state administration or territorial self-administration cannot publish or provide, in response to a request according to the Free Access to Information Act, personal data that they have obtained in connection with the performance of the state administration or territorial self-administration without the consent of the data subject, unless a special regulation stipulates otherwise, or unless a special regulation includes legislation on the publishing of information, including personal data (e.g. Act No. 183/2006 Coll., on the town and country planning and building code [the Building Act], Act No. 500/2004 Coll., the Administrative Code, or Act No. 56/2001 Coll., on the conditions for the operation of vehicles on roadways and on the amendment of Act No. 168/1999 Coll., on liability insurance for damage caused by the operation of vehicles and on amendments to certain related acts [the Motor Third-Party Liability Insurance Act], in the wording of Act No. 307/1999 Coll., including Decree No. 243/2001 Coll., on vehicle registration, etc.).
For the second group of persons presented above, when information is provided on the work of the state administration and territorial self-administration, their right to the protection of privacy and personal data must be weighed against the necessity of applying the principle of making the work of the public administration public. Those persons are those who perform public administration at a body of the public administration, and those who have been entrusted by a special act to decide on the rights, legitimate interests and duties of other persons. Especially for those persons the aforementioned constitutional principles may conflict, when on one side there is the public’s interest in information on the public administration, and on the other side the question of the privacy of a specific individual who contributes or has contributed to the performance of the state administration of territorial self-administration.
The aforementioned provision of Article 5 paragraph 2 (f) of the Personal Data Protection Act is crucial for that question. According to it the controller can process personal data without the subject’s consent “if he provides personal data on a publicly-active person, official or employee of the public administration that reveals information on their public or administrative activity, their functional or working position.”
“Public or administrative activity” is not defined by the Act and is therefore problematic. According to the wording of the Act it concerns data other than functional or working position, therefore information other than the information that a specific person occupies a specific function or is assigned to a particular working position in the performance of public administration, which under the Free Access to Information Act can be provided on request without the consent of the person concerned.
The Judgement of the Constitutional Court I. US 453/03 offers some help in clarifying those terms. It states “All the agendas of state institutions, as well as the activity of persons active in public life, e.g. the activity of local and national politicians, officials, judges, attorneys, or candidates or trainees for these offices are a public matter. These public matters, or the public activities of individual persons, may be judged publicly.” The public activity of specific persons that is crucial for our theme is then the performance of the agendas of state institutions (and of course the agendas of territorial self-governing bodies) and the related activities of officials. However, even then account must be taken of any amendment by special regulations. For instance, for territorial self-administration that is Act No. 128/2000 Coll., on Municipalities (the Municipal Order), which includes legislation on publishing minutes from sittings of the municipal board and municipal council, where according to Section 101 of that Act the minutes from a sitting of the board may only be viewed by members of the council, while minutes from proceedings of the council are, pursuant to Section 16 of that Act, available to all citizens in the municipality or individuals over 18 years of age who own property within the municipality.
According to the Constitutional Court ruling, the wording of Section 2 paragraphs 1 and 2 of the Free Access to Information Act and Article 5 paragraph 2 (f) of the Personal Data Protection Act can be summarised as saying that legally-bound persons shall provide information on individual persons who perform public activities at a legally-bound entity provided those public activities are related to their competencies. For legally-bound entities that public and administrative activity is the agendas of state institutions and territorial self-governing bodies, including the activities of their officials.
Each legally-bound entity is established on the basis of an act: ministries and other central administration bodies by Act No. 2/1969 Coll., on the establishment of ministries and other central state administration bodies of the Czech Republic; other central administration offices by special acts, e.g. the Office for Personal Data Protection by the Personal Data Protection Act, regional offices by Act No. 129/2000 Coll., on regions (Regional Government), municipal offices on the basis of Act No. 128/2000 Coll., on municipalities (the Municipal Order), etc. Those special acts then define for the legally-bound entities the subject and extent of their competencies and powers. In general therefore information can only provided on the activities of individual persons within the scope of the competencies of the legally-bound entities.
Of course, even with that narrower definition of the conditions for providing information on persons who contribute to public administration, it is not possible to formulate a general conclusion on how to proceed in specific cases of requests for the provision of information pursuant to the Free Access to Information Act; it is not possible to stipulate strictly which category of data a legally-bound entity can provide and which it cannot. The solution always depends on the given situation, on the unique content of the request for the provision of information and on the legally-bound entity’s assessment of the entire matter.
Conclusion: Although the right to the protection of privacy for persons who contribute to the performance of the state administration and territorial self-administration is in part weakened, it definitely is not annulled, and when appraising each request it is necessary to consider carefully what can be disclosed on a specific person without excessive violation of his or her privacy. The Constitutional Court reached a similar conclusion in its Judgement I. US 321/2006: “The right to the protection of private life is an inalienable human right which unquestionably also includes the right of an individual to decide at his or her discretion whether, to what extent and in what manner the facts of his or her private life be made available to other parties. That right can nevertheless be restricted for the purpose of protecting the fundamental rights of other persons, or for the purpose of protecting the public interest, which is contained in the constitutional order in the form of a principle or value. Simultaneously care must be taken to achieve the broadest possible exercise of both protected values.”
It can be said that in principle it is possible to restrict the right to the protection of the privacy of a person contributing to the performance of the state administration or territorial self-administration for reason of the exercise of the constitutional right to information. That weakening does not however mean the forfeiture of the right to the protection of privacy and in every case the legally-bound entity that decides on the provision of information must seek to satisfy as far as possible both the principle of the protection of privacy and personal data, and the right to information on the activities of the state administration and territorial self-administration.