As part of their work, lawyers often require access to personal data from state authorities, companies, and other entities to provide legal assistance to their clients. This right is established by the Law on the Legal Profession.

However, in practice, institutions frequently refuse to disclose such information to lawyers, In reference to regulations on personal data protection.

The issue of lawyers’ right to collect data has been brought before the Commissioner for Information of Public Importance and Personal Data Protection (“Commissioner”), whose official opinion on this matter was published in the latest edition of the Commissioner’s Collection of Opinions, Positions, and Practices.

Legal Framework

The Law on the Legal Profession grants lawyers the right to request and obtain information, documents, and evidence from state authorities, institutions, companies, and other organizations that hold or control such data, for the purpose of providing legal assistance to their clients. Furthermore, the same law prescribes the obligation of these entities to allow lawyers access to the requested data, in accordance with the law.

Other regulations also govern lawyers’ right to obtain data, such as:

• The Law on Enforcement and Security stipulates that state authorities, legal entities, and entrepreneurs must provide the enforcement creditor—or a lawyer acting as their attorney—with all necessary data free of charge. The lawyer must indicate the claim for which they intend to initiate enforcement or security proceedings and provide an enforcement document or promissory note containing the claim. These entities are obliged to submit the same data they would provide to courts and public enforcement officers, except for tax return data for the past three years.
• The Criminal Procedure Code stipulates that state authorities must provide necessary assistance, upon request, to the public prosecutor, court, defendant, or their defense attorney in gathering evidence.

Although there are legal grounds allowing lawyers to collect data, the practice of state authorities and other entities in providing such information remains inconsistent. Institutions often reject requests by invoking the Law on Personal Data Protection, which has led lawyers to seek the Commissioner’s opinion on the proper application of regulations in these cases.

Opinion of the Commissioner

The Commissioner has taken the position that the Law on the Legal Profession, by itself, does not constitute a legal basis for disclosing personal data of a specific individual to a lawyer for the purpose of providing legal assistance. According to the Commissioner’s interpretation, the Law on the Legal Profession refers to the application of a special law, meaning that the processing of personal data would only be permitted if the legal basis for processing is prescribed by a special law.

When deciding whether to grant a lawyer access to information, data controllers must take into account the relevant regulations governing their obligations and authorizations. If a special law mandates the disclosure of certain data, the data controller is required to comply while adhering to data processing principles such as lawfulness, purpose limitation, and data minimization.

The Commissioner emphasized that lawyers must demonstrate the legal basis and purpose of processing for each individual request for data disclosure. This means, for example, that when submitting a request under the Law on Enforcement and Security, a lawyer must prove the existence of a claim and provide evidence that the data is necessary for the enforcement proceedings. Additionally, the collected data may only be used for the purpose for which it was obtained, without the possibility of further processing for other purposes.

Practical Aspects and Implementation Challenges

The Commissioner’s opinion highlights the need for an individualized approach—each request for data disclosure must be assessed on a case-by-case basis, ensuring compliance with the principles of lawfulness and clearly defined processing purposes. Although the Commissioner has provided guidance on handling lawyers’ requests, the practical application of regulations and the harmonization of practices remain the responsibility of the authorities that decide on these requests.

Whether the Commissioner’s opinion will lead to the consistent application of regulations and facilitate lawyers’ access to data essential for providing legal assistance, remains to be seen.

This article is to be considered as exclusively informative, with no intention to provide legal advice. If you should need additional information, please contact us directly.