CASE OF VLAISAVLJEVIKJ v. NORTH MACEDONIA

SECOND SECTION

CASE OF VLAISAVLEVIKJ v. NORTH MACEDONIA

(Application no. 23215/21)

JUDGMENT

STRASBOURG

25 June 2024

This judgment will become final in the circumstances set out in Article 44 § 2 of the Convention. It may be subject to editorial revision.

In the case of Vlaisavljevikj v. North Macedonia,

The European Court of Human Rights (Second Section), sitting as a Chamber composed of:

 Arnfinn Bårdsen, President,
 Jovan Ilievski,
 Pauliine Koskelo,
 Lorraine Schembri Orland,
 Frédéric Krenc,
 Davor Derenčinović,
 Gediminas Sagatys, judges,
and Hasan Bakırcı, Section Registrar,

Having regard to:

the application (no. 23215/21) against the Republic of North Macedonia lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by a Macedonian/citizen of the Republic of North Macedonia, Mr Velimir Vlaisavljevikj (“the applicant”), on 27 April 2021;

the decision to give notice to the Government of North Macedonia (“the Government”) of the complaint concerning the authorities’ failure to protect the applicant against the alleged unlawful collection and use of his personal data and to declare inadmissible the remainder of the application;

the parties’ observations;

Having deliberated in private on 4 June 2024,

Delivers the following judgment, which was adopted on that date:

INTRODUCTION

1.  The case concerns the alleged failure of the domestic authorities to protect the applicant from the unlawful collection and use of his personal data by a private heat supplier, which repeatedly sent him invoices for a standing heating charge despite the applicant’s objections that he was not a user of the supplier’s services. The applicant complained of a violation of Article 8 of the Convention.

THE FACTS

2.  The applicant was born in 1953 and lives in Skopje. The applicant was represented by Ms D. Chakarovska-Grozdanovska, a lawyer practising in Skopje.

3.  The Government were represented by their Agent, Mrs D. Djonova.

4.  The facts of the case may be summarised as follows.

5.  On 30 July 2012 the Energy Regulatory Commission adopted the Heat Energy Supply Regulations (“the 2012 Regulations”), which provided that users of a private heating system who had been disconnected were required to pay the heat suppliers a standing heating charge (надоместок за ангажирана моќност).

6.  Beginning from January 2013 and, according to the applicant, continually until 2023, a private heat supply company B. (“the heat supplier B.”) repeatedly issued and delivered to the applicant invoices and, subsequently, requests for payment orders for the standing charge similar to those described in the case of Strezovski and Others v. North Macedonia (nos. 14460/16 and 7 others, § 7, 27 February 2020).

7.  On 15 February 2016 the applicant complained to the Personal Data Protection Directorate (“the Directorate”) that the heat supplier B. had violated his right to protection of his personal data. Notwithstanding that no heating pipes were installed in his apartment and that he had never made any contract with it, the heat supplier B. was sending him invoices for the standing charge, which he had refused to pay and had challenged in court. He submitted in support two first-instance court judgments of 1 December 2014 and 17 September 2015, in which the civil courts had accepted the applicant’s objections to certain payment orders issued upon request of the heat supplier B. (see also paragraph 16 below). He claimed that he had never provided the heat supplier B. with his personal data nor had he consented to it processing them.

8.  In reply to one of the Directorate’s requests for information, concerning in particular how it had obtained the applicant’s personal data, the heat supplier B. stated inter alia the following:

“1. The data were taken over from the previous supplier, pursuant to contract no. 15022013, which states that the legal basis for handing over the consumers’ personal data by the [company handing over those data] arises from the obligation to exercise a public interest function and the decision granting a licence for ... supplying heat... to the [heat supplier B.] by the [Energy] Regulatory Commission, valid from 1 January 2013.

2. The personal data taken over are the full first and last name, residential address, postal address, size of the apartment, [data concerning the heaters installed and the standing heating charge of the apartment, инсталирана и ангажирана моќ на стан]. Under section 154-a of the Energy Act, [the heat supplier] is entitled to process the data to collect payments, to conduct judicial or administrative proceedings and to communicate with users for the purposes of fulfilling obligations under the Energy Act and [the related by-laws].

3. [The applicant] has the status of a disconnected user and pays a standing heating charge, in accordance with law, and [his] data were taken over from the previous supplier.

4. [The Directorate] and all other appropriate bodies were duly informed of the whole procedure for taking over and transfer of the data.”

9.  On 1 April 2016 an inspector of the Directorate stayed the proceedings, finding that a preliminary question arose as to whether the applicant was either a connected or disconnected user of heat energy.

10.  On 29 June 2017 the Administrative Court upheld the applicant’s administrative dispute claim and quashed the decision of 1 April 2016, instructing the Directorate to take a decision on the applicant’s complaint, which concerned not the determination of proprietary matters (односи од имотно-правен карактер) but the applicant’s right to protection of his personal data.

11.  On 16 October 2017 the inspector dismissed the applicant’s complaint, finding no violation of his right to protection of his personal data. She referred to, among other things, the 2012 Regulations. She found that the applicant’s data had been transferred to the heat supplier B. by way of the contract made in 2013 with the previous heat supplier C. She further found as follows:

“... the inspector assessed the [applicant’s] allegations that [the heat supplier B.] had not made a contract with him, nor did [the applicant] provide [it] with his data, but she considered [those allegations] to be irrelevant... Namely, in the specific case of the processing of [the applicant’s] personal data, sections 6 (1) (3), (5) and (6) of the Personal Data Protection Act are directly applicable... as an entity holding a licence to supply heat energy [the heat supplier B.] has a duty to invoice and collect payment for the quantity of heat delivered, for which purposes it has been processing [the applicant’s] personal data, which it has a legitimate interest in doing and which is in line with section 5 of the Personal Data Protection Act.

Without entering into the proprietary relations (имотно-правните односи) of the [applicant] (whether he is a user of heat or a disconnected consumer), the following considerations were taken into account...

- whether [the applicant’s] data have been lawfully collected;

- whether the processing of the data was fair and in accordance with law;

- whether [the heat supplier] processed the data for purposes established by law?

It is undisputed that [the applicant’s] data have been collected in a lawful and legitimate way, [that is] for the purposes of [fulfilling] an obligation established by law – the invoicing and collection of payment for a quantity of heat delivered, to fulfil a legitimate interest of the [heat supplier B. The applicant’s] personal data have been processed in accordance with the energy rules, and in correlation with the personal data protection rules.

In addition, in so far as the processing of [the applicant’s] personal data for the purposes of the lodging of civil claims [by the heat supplier B.] is concerned, it is undisputed that [it] can collect and use or process [the applicant’s] data (name, surname and address), for a lawful and legitimate interest under section 154-a (3) (2) and (3) of the Energy Act, that is, to collect payments and to conduct judicial or administrative proceedings. Namely, the processing of personal data for the conduct of judicial proceedings is not, and cannot be, an abuse of personal data. Anything else would amount to a destruction of the legal system and would create legal uncertainty, whereby before a person is taken to court [he or she] is to be asked whether [his or her] personal data can be processed, namely included in [either] a civil claim, or in a proposal to a notary public or in an invoice, which would be a legal nonsense.

The question concerning the grounds of the pecuniary claim for which the personal data of a claimant may be processed is one to be answered by a civil court, but it cannot and must not in any way be taken to mean that the processing of the personal data was or is unlawful.

Accordingly, the inspector, having in mind sections [5] and 6 (1)(3) and (6) of the Personal Data Protection Act, concluded that in the particular case, the legitimate interest of the [heat supplier B.] had been directed towards fulfilling a legal obligation, namely... the duties and responsibilities established in the energy rules (the Heat Energy Supply Regulations), for the purposes of which the [applicant’s] personal data have been processed, in relation to the payment for heat energy that has been delivered or for a standing heating charge.

...”

12.  The applicant challenged the inspector’s decision in the Administrative Court. He argued, among other things, that the 2012 Regulations concerned disconnected heat consumers, whereas he himself had never been connected to the heating system. His data had therefore been unlawfully obtained, or “stolen”. He further argued that the heat supplier B., being a private company, did not have a legitimate interest in processing his personal data.

13.  On 11 January 2019 the Administrative Court upheld the applicant’s claim and quashed the decision of 16 October 2017. It found that the heat supplier B. had indeed obtained the applicant’s data by way of a contract with the previous supplier C. concluded in March 2013, but it remained a matter of dispute how the supplier C. had obtained those data, given that the applicant had never been connected to the heating system; he could therefore not have the status of a user who had been disconnected from the heating system. The previous supplier C. was not entitled to collect, retain or transfer the applicant’s personal data to the heat supplier B. The court referred to a first-instance civil court judgment of 17 September 2015 (see paragraph 16 below) and to a legal opinion of the Supreme Court of February 2018 to the effect that persons who had never contracted with a heat supplier and had no heating installed in their apartments did not have the status of disconnected heat users (see Strezovski and Others, cited above, § 20).

14.  The Directorate, through the Solicitor General (државен правобранител), appealed against the Administrative Court’s judgment, reiterating the reasoning set out in the decision of 16 October 2017 (see paragraph 11 above). It further argued that the Supreme Court’s legal opinion had post-dated that decision, that in the light of that the applicant could lodge a new application for personal data protection, and that the Directorate had not received an update on whether the civil court judgment of 17 September 2015 had become final.

15.  On 2 October 2020 the Higher Administrative Court overturned the Administrative Court’s judgment of 11 January 2019 and confirmed the inspector’s decision of 16 October 2017. It referred to, among other provisions, sections 5 and 6 (1) (6) of the Personal Data Protection Act, section 154-a of the Energy Act and the 2012 Regulations. The relevant part of its judgment reads as follows:

“In the specific case, ... the legal entities have correctly processed the [applicant’s] personal data, in accordance with the aim for which the data had been collected and processed; [that is to say], they had a legal basis for the processing of [the applicant’s] personal data under the licence to supply energy (лиценцата за вршење енергетска дејност) and the distribution of [heat] users according to the place of the streets where [the applicant] was considered to be a consumer of heat energy, whereas [the heat supplier B.] had obtained [the applicant’s] personal data from the previous holder of the licence through a contract which transferred personal data. [The Directorate]’s decision was correctly taken solely on the issue of the processing of [the applicant’s] personal data and the creditor-debtor relationship between the [applicant] and [the heat supplier B.] were not taken into consideration, as they were irrelevant to the case.”

16.  By thirteen first-instance judgments issued in nine different sets of proceedings between 1 December 2014 and 31 May 2022 (including that of 17 September 2015 and including such before remittals) and twelve second‑instance judgments issued between 9 February 2017 and 11 February2021, the domestic civil courts upheld the applicant’s objections to being ordered to pay the standing heating charge for various periods, the most recent being from January to July 2021 (the first-instance judgment of 31 May 2022). They found that the applicant did not have to pay the standing heating charge because he had never been a user of the heating network, he had never been disconnected from it, or because there had never been a contract between the heat supplier and the applicant.

RELEVANT LEGAL FRAMEWORK AND PRACTICE

17.  Article 18 of the Constitution guarantees the security and secrecy of personal data, and protection from the violation of personal integrity stemming from the recording of information through data processing.

18.  Article 108 provides that the Constitutional Court safeguards constitutionality and legality. Under Article 110, it reviews the constitutionality and legality of laws and other regulations. Article 112 provides that, inter alia, it can repeal (укине) or annul (поништи) a law or regulation if it is not in conformity with the Constitution or laws.

19.  Section 5 of the Personal Data Protection Act, applicable at the material time, provided, inter alia, that personal data were to be processed fairly and in accordance with the law and were to be collected for specific and clear aims specified by law and in a manner corresponding to those aims. Personal data was to be retained in a form which allowed for the identification of the person concerned, and for no longer than necessary to fulfil the purposes for which it had been collected. After the time-limit for storing the personal data had expired, it could only be processed for historical, scientific or statistical purposes.

20.  Section 6 provided, inter alia, that personal data could be processed to fulfil a legal obligation (section 6 (1) (3)), for the performance of public interest activities (работи од јавен интерес) or of an official function (службено овластување) (section 6 (1) (5)) or to fulfil a legitimate interest of the entity processing the data, unless the rights and freedoms of the subject of the personal data prevailed (section 6 (1) (6)).

21.  The Energy Act applicable at the material time provided that users of the energy system were obliged to provide certain personal data to energy suppliers (section 154-a (1)), who had to keep a record of such data and were entitled to process, update and exchange those data among themselves for the purposes of fulfilling their obligations under the Act (section 154-a (2)). The data could be used inter alia for collecting payments, conducting judicial and administrative proceedings and communicating with the users of the energy system (sections 154-a (3) (2), (3) and (4)).

22.  Rule 10 of the Network Rules for Heat Energy Distribution required an application for connection to the energy distribution system to be accompanied by, inter alia, a list of potential users, in accordance with Article 154-a of the Energy Act.

23.  The relevant Rules of Procedure of the Constitutional Court have recently been summarised in the case of Elmazova and Others v. North Macedonia (nos. 11811/20 and 13550/20, §§ 26 and 30, 13 December 2022).

24.  By decision У.бр.141 а, б and в of 18 July 2001, the Constitutional Court repealed a provision of the Telecommunications Act as contrary to the guarantee of data protection in Article 18 of the Constitution. By other decisions (У.бр. 134/2002-I of 22 January 2003; У.бр. 42/2008 and 77/2008 of 24 March 2010; and У.бр. 156/2010 of 29 February 2012), the Constitutional Court repealed provisions of various acts because of, inter alia, concerns related to the collection or processing of personal data.

25.  The Government submitted copies of fourteen judgments of the Administrative Court, issued between March 2015 and February 2020, either confirmed by the Higher Administrative Court or not challenged in it, dismissing individuals’ data protection claims against heat suppliers. In some of those cases (for example У-5 бр. 131/2017), the courts established that the processing of data of disconnected heat users had been lawful and proportionate; that the data had been obtained by way of a contract between a previous and a “new” heat supplier; and that the creditor- debtor relationship between the heat suppliers and the person concerned had correctly not been taken into account. In three other cases (judgments of the Administrative Court У-5 бр. 916/2018, У-5 бр. 399/2019 and У-5 бр. 12/2018, confirmed by the Higher Administrative Court with judgments УЖ-3 бр. 933/2019 of 6 February 2020 and УЖ-1 бр. 428/2020 and УЖ-3 бр. 935/2019 of 2 October 2020 respectively) the courts expressly dismissed the argument that the person concerned had never been connected to the heating system. In the judgment УЖ-3 бр. 933/2019 the Higher Administrative Court found, inter alia, that the Supreme Court’s legal opinion of 20 February 2018 (see paragraph 13 above and Strezovski and Others, cited above, § 20) was relevant only to a creditor-debtor relationship and not to a personal data protection claim.

26.  The relevant parts of the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108), which entered into force in respect of the respondent State on 1 July 2006, have been summarised in L.B. v. Hungary [GC] (no.  36345/16, § 42, 9 March 2023). The Modernised Convention for the Protection of Individuals with regard to the Processing of Personal Data was ratified by the respondent State on 26 November 2021 and will enter into force on ratification by all Parties to Treaty ETS No. 108, or (as from 11 October 2023) once thirty-eight Parties to the Convention have ratified the Modernised Convention; its Article 5 was also quoted in L.B. v. Hungary (cited above, § 43).

THE LAW

I. ALLEGED VIOLATION OF ARTICLE 8 OF THE CONVENTION

27.  The applicant complained that the domestic authorities had failed to protect him against the unlawful collection and use of his personal data, in violation of Article 8 of the Convention, which reads as follows:

“1.  Everyone has the right to respect for his private ... life ...

2.  There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”

28.  The Government submitted that the applicant had lodged the application outside the six-month time-limit, because he had waited for the outcome of his complaint to the Directorate and the subsequent administrative-dispute claim, which had been ineffective remedies. Namely, in view of the clear text of section 154-a of the Energy Act and section 6 of the Personal Data Protection Act and the related case-law of the administrative courts (see paragraphs 20, 18 and 25), the proceedings pursued by the applicant lacked any prospect of success, which was or should have been known to his lawyer. Even if the Administrative Court’s judgment of 11 January 2019, by which the applicant’s claim had been upheld, had created hope as to the outcome of the administrative-dispute claim, the position of the Higher Administrative Court should have been known to him at least from February 2020 onwards, in view of its established case-law (paragraph 25 above).

29.  The Government further submitted that the applicant had not exhausted domestic legal remedies, notably by failing to challenge the provisions of the Personal Data Protection Act, the Energy Act or the relevant by-laws (paragraphs 5 and 22 above) in the Constitutional Court. The applicant’s situation stemmed from statutory or by-law provisions and the Directorate and the administrative courts were not competent ratione materiae to assess their compatibility with the Constitution or (in respect of the by-laws) with the relevant Acts.

30.  The applicant contested the Government’s arguments. He argued that, had he not initiated an administrative dispute, his application before the Court would have been declared inadmissible for non-exhaustion of domestic remedies. Moreover, the Administrative Court had upheld his claim and he could not be required to lodge an application before the Court against a judgment in his favour. The administrative courts’ case-law submitted by the Government was not relevant to his case because it concerned either the personal data of disconnected users or data obtained by way of transfer from other companies, unlike his case where the previous heat supplier C. could not have held his personal data. He further submitted that the violation in his case stemmed from an individual action against him; he had not complained that the relevant provisions of the Personal Data Protection Act and the Energy Act had been unconstitutional.

31.  The relevant Convention principles regarding the close interplay between the exhaustion of domestic remedies and the six-month period have been summarised in Jeronovičs v. Latvia ([GC], no. 44898/10, § 75, ECHR 2016) and El-Masri v. the former Yugoslav Republic of Macedonia ([GC], no. 39630/09, § 136, ECHR 2012). The relevant principles concerning exhaustion of domestic remedies have been summarised in Communauté genevoise d’action syndicale (CGAS) v. Switzerland [GC] (no. 21881/20, §§ 138-145, 27 November 2023; see also Liebscher v. Austria, no. 5434/17, § 41, 6 April 2021).

32.  Turning to the present case, the Court observes that under the relevant rules of constitutional review (see paragraphs 18 and 23 above) it is not in doubt that an application for a constitutional review was available to the applicant. However, the applicant did not complain that the statutory entitlement of heat suppliers to collect and use personal data of users or consumers of heat energy was unconstitutional (see, similarly, Liebscher, cited above, § 43; and Elmazova and Others, cited above, § 55). He rather complained that the domestic authorities had not protected him from the collection and use by the heat supplier B. of his personal data, which had been unlawful given that he had never been a user of heat energy. In the Court’s view, this complaint does not concern the actual wording of the relevant provisions of the Energy Act, the Personal Data Protection Act or the relevant by-laws (contrast Grišankova and Grišankovs v. Latvia ((dec.), no. 36117/02, ECHR 2003‑II (extracts)), but rather how the law was applied in the applicant’s case. For these reasons, the Court does not consider that an application for constitutional review to the Constitutional Court would have been appropriate for the applicant’s complaint or that his failure to avail himself of that remedy was tantamount to non‑exhaustion of domestic remedies.

33.  The Court further notes that the applicant lodged a complaint for personal data protection with the Directorate, followed by administrative‑dispute proceedings at two levels of the administrative courts. The Court reiterates that Article 35 § 1 cannot be interpreted so as to require an applicant to inform the Court of his complaint before his position in connection with the matter has been finally settled at the domestic level, otherwise the principle of subsidiarity would be breached (see, among many others, Lekić v. Slovenia [GC], no. 36480/07, § 65, 11 December 2018). Accordingly, it considers it reasonable for the applicant to have waited for the final resolution of his administrative-dispute complaint, a usual remedy in the appropriate tribunals, before submitting his application to the Court. The Court considers that the case-law of the Higher Administrative Court (paragraph 25 above), which was being established while the applicant’s case was proceeding, cannot lead to a different conclusion. Thus, the application cannot be rejected for failure to comply with the six-month time-limit.

34.  The Court therefore rejects the Government’s inadmissibility objections. It further considers that this complaint is neither manifestly ill‑founded nor inadmissible on any other grounds listed in Article 35 of the Convention. It must therefore be declared admissible.

35.  The applicant complained that the heat supplier B. had unlawfully obtained his personal data and used them to send him invoices for the standing heating charge, as well as to initiate judicial proceedings against him. The domestic authorities had failed to establish how it had obtained his personal data, given that the previous heat supplier C. itself had not possessed that data and could not have transferred it by way of a contract, as concluded by the domestic authorities. The heat supplier had issued invoices as early as January, February and March 2013, and the contract concerning the data transfer had dated March 2013. There had been numerous civil proceedings in which the domestic courts dismissed the heat supplier’s claims against the applicant for payment of a standing heating charge, given that he had never been a heat user within the meaning of section 154-a of the Energy Act, not even a disconnected one. As he had not been connected to the heating system, there was no legitimate interest in processing his data. Even after the disputed proceedings, the heat supplier B. had continued sending him invoices for the standing heating charge; it had been “harassing” the applicant for more than ten years. Its authorisation under domestic law to process personal data was extensive. The heat supplier B. had also contacted him by telephone and sent him promotional materials by post.

36.  The Government submitted that the applicant’s personal data had been collected and processed by a private company and that therefore there had been no interference by the State authorities with the applicant’s rights, but the positive obligation of the State under Article 8 was in question. The heat supplier B. had obtained the applicant’s personal data by way of the contract with the previous heat supplier C. Even assuming that the data had been transferred before the contract had been concluded in March 2013, the contract remedied that situation. Furthermore the data had been collected and processed in accordance with sections 5 and 6 of the Personal Data Protection Act, section 154-a of the Energy Act and the relevant by-laws (the Network Rules for Heat Distribution and the 2012 Regulations), which obliged the heat suppliers to keep records of users’ data. The domestic law was clear, accessible, and compatible with the rule of law requirement and its interpretation was foreseeable, given the practice of the administrative courts (paragraph 25 above). It had not been necessary for the applicant to consent to the collection and use of the data. His data had been collected and used for the legitimate aim of collecting payments and conducting judicial and administrative proceedings; that had been necessary for the heat supplier B. to operate and for the stability of the energy system, which was a matter of public interest. It had not been established that the heat supplier B. had contacted the applicant by telephone or sent him promotional materials. The applicant’s data was not sensitive and it had not been publicised or disclosed to third parties. Moreover, data concerning the applicant’s apartment (its address, surface etc.) was publicly accessible on the website of the Land Registry and the applicant had not objected to that. There were procedural safeguards through which the applicant could effectively challenge the collection and use of his data. The domestic authorities had provided relevant and sufficient reasons for their findings. The civil courts’ judgments (paragraph 16 above) were immaterial to the applicant’s personal data protection claim. The applicant had not fully substantiated his allegation that his data were used continuously even after the disputed proceedings. The Government concluded that the State had not overstepped its broad margin of appreciation.

(a)   Whether the applicant’s rights under Article 8 were affected

37.  The Court reiterates that the right to protection of personal data is guaranteed by the right to respect for private life under Article 8. Article 8 thus provides for the right to a form of informational self-determination, allowing individuals to rely on their right to privacy as regards data which, albeit neutral, are collected, processed and disseminated collectively and in such a form or manner that their Article 8 rights may be engaged. In determining whether the personal information retained by the authorities involved any private-life aspects, it had due regard to the specific context in which the information at issue has been recorded and retained, the nature of the records, the way in which these records are used and processed and the results that may be obtained (see L.B., cited above, § 103, with further references).

38.  Turning to the present case, the Court will limit its consideration to the collection of the data, as described by the heat supplier B. (see paragraph 8 above), namely the applicant’s name, address and information concerning his apartment relevant to the calculation of the standing heating charge, and to the use of that data for the purposes of billing for the standing charge and of the conduct of any related judicial proceedings. The Court observes that the private heat supplier obtained, retained and used the applicant’s personal data from the beginning of 2013 until at least July 2021 (see paragraph 16 above), for the purposes of billing for and collecting payment of the standing heating charge. The applicant did not substantiate his claim that the heat supplier B. had sent him promotional materials and had contacted him by telephone.

39.  It is common ground between the parties that the complaint raised under Article 8 of the Convention, concerning the collection and use of information by the heat supplier B., related to the right to respect for the applicant’s private life. The Court does not see a reason to hold otherwise. It has already found that the processing and publication of data such as an applicant’s name and home address concerned information about that applicant’s private life (see L.B., cited above, § 104; and Alkaya v. Turkey, no. 42811/06, § 30, 9 October 2012). In addition, whereas most of the applicant’s data that was obtained, retained and processed by the heat supplier B. could have been accessed on the Land Registry’s website, which is public, the fact that personal data are already in the public domain or can be accessed by the public does not necessarily remove such data from the protection of Article 8 (see Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland [GC], no. 931/13, § 134, 27 June 2017; see also the analyses of the jurisprudence of the Court of Justice of the European Union in Jehovah’s Witnesses v. Finland, no. 31172/19, § 94, 9 May 2023). Lastly, although the heat supplier B. did not publicise the applicant’s personal data or transfer them to a third party, it used them repeatedly to issue and deliver invoices and payment orders to the applicant over a period of at least eight years. The Court concludes that the applicant’s Article 8 rights were affected.

(b)   Whether the case concerns the negative or the positive obligation of the State

40.  The Court observes that the applicant’s personal data were obtained and processed by a private heat supply company. Whereas the Directorate found that the collection and use of the applicant’s data arose in the context of a public service (heat supply), this does not bring the heat supplier within the definition of a public authority within the meaning of Article 8 of the Convention (contrast Vukota-Bojić v. Switzerland, no. 61838/10, § 47, 18 October 2016, and Libert v. France, no. 588/13, § 38, 22 February 2018). The applicant did not complain that the heat supplier had collected and used his data pursuant to a legal obligation under domestic law (contrast Breyer v. Germany, no. 50001/12, § 59, 30 January 2020) but rather that it did so in contravention of the relevant domestic law, as he had never been a user of heat energy. In the absence of any arguments of the applicant to the contrary, the Court accepts that the case concerns the State’s positive obligation to guarantee the applicant’s right to respect for his private life.

(c)   Whether the State complied with its obligation

41.  The relevant Convention principles concerning the State’s positive obligations under Article 8 of the Convention have been summarised in López Ribalda and Others v. Spain [GC] (nos. 1874/13 and 8567/13, §§ 111-13, 17 October 2019, with further references).

42.  Having regard to the applicant’s allegations, the Court will examine whether the manner in which the domestic authorities applied the relevant legal framework in his case was compatible with Article 8 requirements.

43.  The Court observes that under Article 154-a heat suppliers had the power to collect and transfer personal data (see paragraph 18 above). It accepts that this power is aimed at enabling heat suppliers to collect the standing heating charge from users, in order to ensure the proper functioning of the heat supply system, as a matter of public interest. The Court further observes that the domestic authorities established in the applicant’s case that the heat supplier B. had obtained the applicant’s personal data by way of the contract of March 2013 with the previous heat supplier C. However, the applicant repeatedly asserted in the disputed proceedings that he had never entered into any contractual relationship with the heat supplier C. or any other heat supplier and that consequently C. could not properly have possessed and transferred his personal data to heat supplier B. The applicant’s arguments in this respect were not addressed by the Higher Administrative Court when it decided the applicant’s case.

44.  Furthermore, the heat supplier B. used the applicant’s data, which was not particularly sensitive, for the purposes of issuing invoices or payment orders for the standing heating charge. There is no indication that the applicant’s data was shared with any third parties outside that context.  However, in multiple civil proceedings the domestic courts found, in final judgments dating as early as February 2017 (see paragraph 16 above), that the applicant was under no obligation to pay the standing heating charge since he had never been connected to the heating system. The Court is therefore concerned as to whether the retention and use of the applicant’s personal data was justified by the aims identified in paragraph 43 above.

45.  Nevertheless, when deciding the applicant’s data protection complaint both the Directorate and the Higher Administrative Court refused to consider whether he had been obliged to pay the standing heating charge or not, holding that the proprietary rights or any creditor-debtor relationship was irrelevant to their assessment of the applicant’s personal data protection complaint. In particular, they did not give any weight to the specific circumstances of the applicant’s case, notably the applicant’s claim that he had never been connected to the heating system and the fact that the domestic civil courts had found the applicant not liable to pay the standing heating charge, whereas had he been, as explained above, that could have justified the collection and use of his personal data. This being so, the Court cannot but conclude that the domestic courts never actually examined the core of the applicant’s claim because of the lack of a comprehensive examination of the question whether, in the absence of a contractual or any other legal relationship between the applicant and the heat supplier, the continued retention and use of the applicant’s data corresponded to that legitimate aim.

46.  In view of the above considerations, the Court concludes that the domestic courts failed to provide an effective protection for the applicant’s right to respect for his private life.

47.  There has accordingly been a violation of Article 8 of the Convention.

II. APPLICATION OF ARTICLE 41 OF THE CONVENTION

48.  Article 41 of the Convention provides:

“If the Court finds that there has been a violation of the Convention or the Protocols thereto, and if the internal law of the High Contracting Party concerned allows only partial reparation to be made, the Court shall, if necessary, afford just satisfaction to the injured party.”

49.  The applicant claimed 15,000 euros (EUR) in respect of non-pecuniary damage.

50.  The Government submitted that there was no causal link between the violation found and the alleged non-pecuniary damage suffered. Alternatively, they argued that finding of a violation constituted sufficient just satisfaction, and that the claim was excessive.

51.  The Court considers that the applicant must have suffered non‑pecuniary damage that cannot be compensated for solely by the finding of a violation. Making an assessment on an equitable basis, the Court awards the applicant EUR 1,400 in respect of non-pecuniary damage, plus any tax that may be chargeable.

52.  The applicant also claimed EUR 50 for the costs and expenses of legal representation incurred before the domestic courts (specifically for court fees) and EUR 200 for those incurred before the Court. In support of the latter claim, he submitted a fiscal receipt issued by his lawyer for 12,000 Macedonian denars (MKD, corresponding to approximately EUR 195), which contains no information that can bring it in relation to the applicant’s case before the Court.

53.  The Government contested these claims as unsubstantiated.

54.  According to the Court’s case-law, an applicant is entitled to the reimbursement of costs and expenses only in so far as it has been shown that these were actually and necessarily incurred and are reasonable as to quantum (see, among many other authorities, L.B., cited above, § 149). That is to say, the applicant must have paid them, or be bound to pay them, pursuant to a legal or contractual obligation (see Elmazova and Others, cited above, § 86). In the present case, regard being had to the above criteria and the absence of any relevant supporting documents to show that the applicant paid the claimed amounts or was bound to do so, the Court rejects his claim as unsubstantiated.

FOR THESE REASONS, THE COURT, UNANIMOUSLY,

(a)  that the respondent State is to pay the applicant, within three months from the date on which the judgment becomes final in accordance with Article 44 § 2 of the Convention, EUR 1,400 (one thousand and four hundred euros), plus any tax that may be chargeable, in respect of non-pecuniary damage, to be converted into the currency of the respondent State at the rate applicable at the date of settlement;

(b)  that from the expiry of the above-mentioned three months until settlement simple interest shall be payable on the above amounts at a rate equal to the marginal lending rate of the European Central Bank during the default period plus three percentage points;

Done in English, and notified in writing on 25 June 2024, pursuant to Rule 77 §§ 2 and 3 of the Rules of Court.

 Hasan Bakırcı Arnfinn Bårdsen
 Registrar President