The Right to a Personal Name and the Right to Personal Data Protection: Where Is the Boundary?
The Court of Appeal in Belgrade recently issued a significant judgment addressing the relationship between the right to a personal name and the right to personal data protection. The dispute arose from the unauthorized use of a former employee’s name in company documents after the termination of employment, raising questions about the scope of protection of these two rights and the applicable legal framework under the Family Law and the Law on Personal Data Protection.
Factual Background
The plaintiff was employed by the defendant as a customer service representative and call center agent until March 2020. In May of the same year, invoices were issued listing the plaintiff’s full name as the contact person responsible for processing orders. These invoices were sent to third parties, including customers and accounting agencies. Upon discovering this, the plaintiff first submitted a request to the company to cease further use of his personal data and to compensate for the violation of his right to a personal name. Subsequently, he filed a lawsuit before the competent court.
Legal Framework
The right to a personal name and its protection are regulated by the Family Law ("Official Gazette of the RS," No. 18/05, 72/11), which grants protection to individuals whose right to a personal name has been violated, including cases of unauthorized use.
At the same time, when a personal name is used as personal data and processed without a legal basis or legitimate purpose, protection is provided under the Law on Personal Data Protection ("Official Gazette of the RS," No. 87/18) as a special law.
Case Epilogue
In the first-instance proceedings, the court upheld the plaintiff's claim for damages due to the violation of the right to a personal name and the unlawful processing of personal data. The court found that the defendant, as the data controller, continued processing the plaintiff's personal data without a legal basis after the termination of his employment and subsequently disclosed the data to third parties without authorization. The court concluded that this constituted a violation of the provisions of the Law on Personal Data Protection, as there was no legal basis for the processing. Additionally, the court determined that the defendant had infringed upon the plaintiff’s right to a personal name by unlawfully using his full name in business documents, thereby also violating the provisions of the Family Law.
However, in the appellate proceedings, the Court of Appeal in Belgrade annulled the ruling in the part concerning the determination of unlawful data processing and the prohibition of further use of the data, emphasizing that the first-instance court had misapplied substantive law and failed to properly assess all relevant facts. The Court of Appeal highlighted that the right to a personal name is protected under the Family Law, whereas unauthorized data processing falls under the scope of the Law on Personal Data Protection. This distinction means that the key factor is whether the unauthorized use of the name occurred within the context of personal data processing.
The appellate court further pointed out that the first-instance court had failed to assess whether the claim for determining unlawful data processing was filed in accordance with the Law on Personal Data Protection and whether that part of the lawsuit was even admissible under the Civil Procedure Law. Additionally, the appellate court stated that the lower court should have examined whether the plaintiff had the right to request a prohibition on further use of his data under Article 84, Paragraphs 2 and 3 of the Law on Personal Data Protection. Due to these deficiencies, the Court of Appeals annulled the relevant parts of the first-instance decision and remanded the case for reconsideration.
Impact of the Judgment on Judicial Practice
The judgement of the Court of Appeal in Belgrade raises significant questions about the interplay between judicial protection of the right to a personal name and the right to personal data protection.
As the proceeding is still ongoing, the first-instance court will have to address key legal issues in the retrial, including whether the claim for determining unlawful processing is admissible at all and whether the conditions for prohibiting further use of the data have been met. Following the new decision of the first-instance court, the parties will again have the right to appeal, meaning that the final word may once again rest with the Court of Appeal.
Whether the outcome of this case will contribute to a clearer delineation of these two rights and establish a standard for future judicial practice remains to be seen.
Sonja Stojčić
Senior Associate
sonja.stojcic@prlegal.rs; legal@prlegal.rs;