Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde v Rīgas pašvaldības SIA ‘Rīgas satiksme’

setting out a test based on three criteria to decide whether a processing operation can rely on this ground. The Court reached a surprising conclusion, stating that while there is legitimate interest to process (disclose) data in the case at hand, the controller (a public authority) would also need a legal obligation to lawfully disclose the data.

It is accordingly clear from the scheme of Directive 95/46 and from the wording of Article 7 thereof that Article 7(f) of Directive 95/46 does not, in itself, set out an obligation, but expresses the possibility of processing data such as the communication to a third party of data necessary for the purposes of the legitimate interests pursued by that third party. As the Advocate General stated in points 43 to 46 of his Opinion, such an interpretation may also be deduced from other EU instruments touching upon personal data (see, to that effect, as regards the processing of personal data in the electronic communications sector, judgment of 29 January 2008, Promusicae, C‑275/06, EU:C:2008:54, paragraphs 54 and 55).

However, it should be pointed out that Article 7(f) of Directive 95/46 does not preclude such communication, in the event that it is made on the basis of national law, in accordance with the conditions laid down in that provision.

In that regard, Article 7(f) of Directive 95/46 lays down three cumulative conditions so that the processing of personal data is lawful, namely, first, the pursuit of a legitimate interest by the data controller or by the third party or parties to whom the data are disclosed; second, the need to process personal data for the purposes of the legitimate interests pursued; and third, that the fundamental rights and freedoms of the person concerned by the data protection do not take precedence.