Romania, Înalta Curte de Casa?ie ?i Justi?ie, (High Court of Justice and Cassation) - Decision no. 1059 of 16 June 2017

Data protection - Intellectual property and data protection: balance of interests

The plaintiffs made a claim according to special legislation and in tort against the defendants for unlawful use, on their website, of a catalogue looking to commercialise perfumes by direct reference to the denominations and indicators protected by the plaintiff’s intellectual/industrial property rights.
The plaintiffs also made their claim against S SA, the administrator of the web domain (.ro) of the website in question, moreover asking that the court compel S SA to disclose information concerning the users of the website (the persons who accessed the other defendant’s catalogue and who may have been implicated in the distribution of the perfumes through the other plaintiff’s website).
The Bucharest Tribunal granted the plaintiff’s request against the owner of the website, but rejected the claim (in tort and concerning disclosure of personal data) against the administrator of the web domain. The litigation reached the HCCJ in a first cycle, the supreme court deciding to repeal the initial decision of the Bucharest Court of Appeal and to send the case for retrial of the appeal. The second special appeal was the subject of scrutiny by the Court in the analysed decision.

The High Court of Cassation and Justice rejected the plaintiffs’ special appeal, and maintained that the defendant S SA, the administrator of the web domain, could not be held liable for damages suffered by the plaintiffs, and may not (let alone be obliged to) disclose personal information of the persons who accessed the website of the other defendant.
In its reasoning, the Court started from an analysis of art. 8 GEO 100/2005, correspondent to art. 8 of Directive 2004/48/EC, which provides that information on the origin and distribution networks of the goods or services which infringe an intellectual property right has to be provided by the infringer or by the person found to be providing on a commercial scale services used in infringing activities, upon request of the competent court.
The Court decided that, in order to asses both the claims (in tort and concerning disclosure of personal data), it needed to analyse whether S SA, the administrator of the web domain, was a person providing commercial services used in infringing the intellectual rights of the plaintiffs. The court found that that S SA, as administrator of the domain .ro, had provided, through two subdomains, services consisting exclusively on storage and hosting.
In the above-mentioned assessment, the Court relied on the rulings of the CJEU in joint cases C-237-239/08, Google France SARL and case C-324/2009, L'Oreal v. Ebay, and found that, since the through the two subdomains S SA had only provided services of hosting and storage, not administration, it had no connection to data on the websites and no gain from it.
Unlike the persons directly involved in the infringement, clearly obliged to disclose information concerning their own activity, in case of suppliers of services of electronic communications, the issue is whether they may disclose personal data which they had processed on account of a legal abilitation to do so.
The Court found that the general claim concerning disclosure, involving the activity of another defendant, was not precise enough, and required more analysis of the context. In that analysis, the Court found that the plaintiffs claimed that S SA itself had commited an infringement, and therefore assumed that it had access to data concerning the commercial activity of the other defendant; the claim in the special appeal was thus found to have been based on the legal relationship between the two defendants, not between the S SA and its other clients.
Since the request for disclosure of the information was made in the context of infringement done by the other defendant, based not on a legal relationship between S SA and its clients, the Court found that the request was not sufficiently well grounded on art. 8 GEO 100/2005, and the necessity arose to analyse the proportionality between the request of disclosure, as a means to protect intellectual property, and other fundamental human rights of the website users, such as the right to private life and to protection of personal data.
In its assessment of proprotionality, the Court relied on the decision given by the CJEU in case C-461/10, Bonnier Auto, paras 59-60, and found that disclosure of the identity data of an internet user, prohibited by the principle of personal data protection, was not allowed in the case at hand, whose object was infringement of intellectual property by a person other than the respective user.
For the abovementioned reasons, the Court found that the plaintiffs’ special appeal was unfounded, and that S SA was not liable for damages caused by infringement of intellectual property rights by an owner of a website belonging to a subdomain it managed, and was not allowed to disclose to the plaintiffs the identity data of the users of that respective website

In its ruling, the Court did not make a separate analysis of the provisions of the Charter, analysing the protection of personal data exclusively from the perspective of national law, with reference to the jurisprudence of the CJEU.

The High Court of Cassation and Justice relied exclusively on national legislation, bud did make several references to the jurisprudence of the CJEU. It did not make any reference to the Charter, nor to the relationship between the CFR and the ECHR. There were no references to the jurisprudence of the ECtHR.