# CJEU, Judgment of 4 May 2017, C-13/16, Rīgas satiksme

Interpretation of the balancing-of-interests clause in Article 7(f) of the Data Protection Directive; three-stage test and the standard of necessity.

> Quelle: https://www.thomashelbing.com/en/wissen/dsgvo-hub/rechtsprechung/1.4.12-eugh-rigas-satiksme
> Sprache: en



## 1 Overview [#1-overview]

The proceedings concerned the disclosure of the personal data of a road user by the Latvian police to a transport undertaking that wished to pursue civil claims for compensation. The CJEU takes the opportunity to interpret the balancing-of-interests clause in Article 7(f) of the Data Protection Directive.

Reference: [CJEU, judgment of 4 May 2017, C-13/16, Rīgas satiksme](https://curia.europa.eu/juris/liste.jsf?num=C-13/16\&language=de)

## 2 Three-stage test [#2-three-stage-test]

For the first time, the Court expressly formulates the three cumulative conditions of that legal basis, which continue to apply under the GDPR as the three-stage test:

1. the pursuit of a legitimate interest of the controller or of a third party,
2. the necessity of the processing in order to achieve that interest,
3. the absence of an overriding of the fundamental rights and freedoms of the data subject.

## 3 Significance for Article 6(1)(f) GDPR [#3-significance-for-article-61f-gdpr]

The decision is consistently relied upon, both by the CJEU itself and by national case law, for the interpretation of Article 6(1)(f) GDPR. It provides the methodological framework for the balancing of interests, which is just as central under the GDPR as it previously was under the Directive.


---

## About the author

This article was written by [Dr. Thomas Helbing, specialist lawyer for IT law in Munich](https://www.thomashelbing.com/en).

Since 2020 and continuously through today (2026), Handelsblatt has [recognized](https://www.thomashelbing.com/en#auszeichnungen) Dr. Helbing as one of **"Germany's Best Lawyers"** in IT law and data protection law.

According to Kanzleimonitor.de (2024 to 2026 editions), he ranks among the **leading lawyers for data protection and IT law** and is listed among the **top 100 lawyers in Germany (2024/25)**. Kanzleimonitor is considered a particularly meaningful market study because it is based exclusively on personal recommendations from in-house counsel.

Dr. Helbing has **many years of advisory experience in data protection and IT law** and advises clients of all sizes, from startups through fast-growing SaaS companies and unicorns to international corporate groups.

His [professional background](https://www.thomashelbing.com/en#stationen) covers the **full spectrum of IT and technology law practice**. He began his career at a major international law firm, then gained **in-house experience at a DAX-listed company**, and is himself an **entrepreneur and founder of several digital ventures**. He also has **hands-on programming experience**, which allows him to understand technical systems, software architectures and digital business models not only from a legal perspective but also from a technical one.

For many years, his [clients](https://www.thomashelbing.com/en#referenzen) have included **technology companies and SaaS providers**, leading **German research institutions** and a **systemically important German bank**. His advisory focus lies in particular on **GDPR compliance, the data economy, SaaS, AI regulation and IT contract law**.