Headnotes: 

The provisions of Section 20z (1) of the Consumer Protection Act include a comprehensive and detailed regulation of the terms and conditions under which sellers may obtain information on consumers’ creditworthiness even without their consent. Taken together, this legal regulation provides sufficient safeguards against the disproportionate disclosure of consumers’ personal data. The provisions of Section 20z (1), sentence three and four of the Consumer Protection Act are in accordance with the constitutional order and may be interpreted in a manner consistent with Art. 8 (2) of the Convention on the Protection of Human Rights and Fundamental Freedoms and Art. 8 (2) of the Charter of Fundamental Rights of the European Union.

Although the contested provisions constitute an interference with the consumers’ right to privacy and informational self-determination within the meaning of Art. 10 (3) of the Charter of Fundamental Rights and Freedoms, they do not result in violating these constitutionally guaranteed rights, as the interference is balanced by a strong public interest in preventing consumers’ over-indebtedness. This public interest is related to the legitimate interests of entrepreneurs providing consumers with financial services.

Summary: 

I. The Municipal Court in Prague sought annulment of the aforementioned provisions of the Consumer Protection Act in relation to the judicial proceedings initiated by the SOLUS Interest Association of Legal Entities and directed against decisions of the Office for Personal Data Protection. The content of the action was directed against the Office’s decisions imposing on the Association a penalty for an administrative offence consisting in processing consumers’ personal data in the information database on the creditworthiness and credibility of a consumer (the so-called negative register of debtors). In fact, the particular consumers either withdrew their consent to personal data processing or failed to grant it at all. The instant case required the application of the relevant provision stipulating that exchanging information and processing personal data in the register does not necessitate the consumer’s consent. This provision was incorporated in the Consumer Protection Act by means of Act No. 378/2015 Coll., becoming effective on 1 February 2016. The substance of the petition of the Municipal Court consists in processing consumers’ personal data in the register without their consent, which is perceived as inconsistent with the right to be protected from any unauthorised intrusion into private life under Art. 10 (2) of the Charter and with the right to be protected from the unauthorised gathering of personal data under Art. 10 (3) of the Charter.

By means of a later petition (originally recorded under file ref. Pl. ÚS 20/17), a group of senators sought the annulment of the identical provision, while also seeking the annulment of the third sentence of the provision. The third sentence of the quoted provision defines the terms and conditions to be complied with by the register’s operator. They must be a legal entity which however must not be a seller under Section 2 (1) (b) of the Consumer Protection Act, i.e. an entrepreneur selling products or providing consumers with services. At the same time, the primary object of this legal entity must not include enterprise. The manner of processing the data and access to it is regulated in detail in the subsequent paragraphs of Section 20z of the Consumer Protection Act. The group of senators followed the arguments of the Municipal Court in their petition.

II. The Constitutional Court reviewed the contested provisions through the prism of the right to informational self-determination, which is part of the fundamental right to privacy within the meaning of Art. 7 (1) and Art. 10 (2) and (3) of the Charter, as the instant case consists primarily in the conflict of the consumers’ right to protection against unauthorised processing of their personal data with the interest of entities providing them with financial services which may, under certain term and conditions, obtain information from the register, or the conflict with the society’s interest in the solvency of consumers as buyers. The Constitutional Court assessed this conflict of fundamental rights and freedoms, or their conflict with another constitutionally protected value, using the proportionality principle and came to the conclusion that the contested provisions of the Consumer Protection Act would stand the constitutionality test. The contested legal regulation is not exceptional in the European comparison. Similar registers collecting personal data on consumer debt repayment are available, for example, in the Slovak Republic, the Republic of Austria, the Netherlands or the United Kingdom. In these countries, it is common that several private companies keep registers and provide data to banks.

Although this is a very sensitive area and interference with fundamental rights (albeit legitimate) must be perceived as serious, the Constitutional Court concluded that in the instant case, the contested regulation is appropriate, necessary and proportionate, pursuing a legitimate and important goal in modern society. The purpose of the contested provisions is to enable sellers to make an effective assessment of the creditworthiness of consumers and to protect them, and therefore society as a whole and the operation of the economy, from disproportionate over-indebtedness of its members. If public authorities could not create legal instruments to prevent consumer recklessness in applying for loans, society would become vulnerable to certain, potentially dishonest or reckless conduct of individuals who are accountable not only to themselves and to each other, but also to society as a whole. The provisions of Section 20z of the Consumer Protection Act have considerable precision, allowing consumers to regulate their behaviour and satisfying other minimum criteria for the processing of personal data without the consent of the relevant entity. This is also related to the enshrined guarantees and the effective protection against the misuse of recorded personal data. Operators are required to remove from the register all data concerning the consumer on obligations which have not been defaulted on, they must correct inaccurate or incorrect data, and the provisions exclude that data on the consumer be kept without their knowledge.

The Constitutional Court recalled that if, despite the wording of the statute, personal data of consumers are unjustifiably recorded in the register, the consumers concerned have the opportunity to turn to the Office for Personal Data Protection or to a court. At the same time, it was not found that such errors occurred to a large extent, nor is there any reason to believe that they would possibly be the result of the unconstitutionality of the reviewed legal regulation. The public authorities, in particular the Office and the courts, may not waive the obligation to effectively monitor the conduct of operators in the exercise of their rights and complying with their obligations under the contested provisions and associated rules. They must also make efforts to prevent unauthorised or accidental access to and unauthorised processing of personal data, as well as any other misuse.

According to the Constitutional Court, it is impossible to agree with the objection of the group of senators that it would be more considerate to entrust the register to sellers carrying business in the specific sector. As a consequence of the applicable regulation, even though the personal data are available to operators, it is the entity not acting as a seller, not established for the purposes of engaging in enterprise, and not participating in commercial-law relations with consumers that is supposed to provide more extensive guarantees against misuse of recorded information. On the contrary, in the sellers’ hands, there would be a threat of tampering with the data to be shared with their direct competitors. In the event of the impossibility to share the recorded data, it would be difficult to achieve the purpose of the regulation, as in such a case, sellers would have information only about their clients’ obligations towards them. The interference may be deemed inappropriate, for instance, in a situation in which the operator would be an uninvolved entity, operating completely outside the relation between the seller and the consumer. However, according to Section 20z (1), sentence three of the Consumer Protection Act, it is an entity established for the purpose of keeping the register, and in addition, according to the related provisions of the Consumer Protection Act, in a contractual relationship with sellers within which additional guarantees of shared data protection must be regulated.

The Constitutional Court concluded that the contested legal regulation complied with the requirement of the proportionality of the interference with the right to be protected from the unauthorised gathering, public revelation or other misuse of personal data pursuant to Art. 10 (3) of the Charter and the related case law of the Constitutional Court and the European Court of Human Rights and might be interpreted in a constitutionally conforming manner also consistent with Art. 8 (2) of the Convention and Art. 8 (2) of the Charter of Fundamental Rights of the European Union.

III. Radovan Suchánek served as the Judge Rapporteur in the instant case. A dissenting opinion was submitted by Judge Jiří Zemánek.