RvS - 201902604/1/A3: Difference between revisions

Latest revision as of 12:01, 24 March 2022

RvS - 201902604/1/A3

Court:	RvS (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:	Article 15 GDPR Article 35(2) Wbp
Decided:	22.01.2020
Published:	22.01.2020
Parties:	[Anonymous The chief of police]
National Case Number/Name:	201902604/1/A3
European Case Law Identifier:	ECLI:NL:RVS:2020:180
Appeal from:	Rb. Zeeland-West-Brabant (Netherlands)
Appeal to:
Original Language(s):	Dutch
Original Source:	de Rechtspraak (in Dutch)
Initial Contributor:	n/a

The Dutch State Council (Raad Van Staten) ruled that whenever the data subject is not provided with a complete overview of the personal data processed in a comprehensible form, a description of the purpose(s), the personal data's categories, the recipients or categories of recipients as well as the available information on the origin, as requested, the data controller had to search again to be compliant with Article 15 GDPR.

English Summary

Facts

The claimant was previously involved in several proceedings regarding the police's treatment towards herself and the disclosure of her personal data to the public. To know more about the processing of her personal data by the Chief of Police, she submitted a subject access request.

The Chief of Police provided her with a summary of the personal data processed with the information requested with undue delay, in June 2017. Thus, the Chief of Police set a penalty payment. Following the first answer, the Chief of Police completed with another decision in October 2017 which has been challenged by the applicant before the Court Rb. Zeeland-West-Brabant (Netherlands).

The Court Rb. Zeeland-West-Brabant annulled the decision of October 2017 as it found it incomplete. However, based on the new Chief of Police supplementing decision submitted in January 2018 during the proceedings, it also ruled that the data controller does not have to take any other decision regarding the subject access request. Indeed, the lower court considered that the supplementing decision, so-called the "new overview" decision provided enough information and was, thus, complete.

The claimant's appeal the Court Rb. Zeeland-West-Brabant's judgement before the Dutch State Council (Raad Van Staten).

The applicant claimed mainly that the new overview decision has not been provided in comprehensible form. Especially, she argued that the information related to the purpose(s) of the processing, the recipients or categories of recipients and the origin were not stated clearly. Also, she argued that the new overview decision was still incomplete, as some of the personal data were missing.

Dispute

The Raad Van Staten had to decide on whether the information provided in the proceeding were sufficient enough to comply with Article 15 GDPR and the National data protection law.

Holding

The Raad Van Staten considered that the data controller had to search another time and find all the personal data about the data subject to answer with accurate and clear information.

Comment

Share your comment here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the Dutch original for more details.

Ruling

201902604/1/A3.

Date of judgment: 22 January 2020

SECTION

ADMINISTRATIVE LAW

Ruling on the appeal of:

[appellant], residing at [residence],

against the judgment of the District Court of Zeeland-West Brabant of 19 February 2019 in Case No 17/7440 in the proceedings between:

[appellant]

and

the chief of police.

Process sequence

By decision of 2 June 2017, the Chief of Police decided, at the request of [appellant], to inform her whether he is processing personal data relating to her.

By decision of 6 October 2017, the chief of police upheld the objection made by [appellant].

By decision of 19 February 2019, the District Court upheld the appeal lodged by [appellant] against the decision of 6 October 2017, annulled the decision and determined that the legal consequences of this decision remain intact. This judgment is attached.

[Appellant] has lodged an appeal against this decision.

The chief of police has given a written explanation.

The [appellant] has granted the Division permission to give its decision partly on the basis of the information not made available for inspection.

The Section heard the case at the hearing on 3 December 2019, where [the appellant] and the Chief of Police, represented by L. van den Berg, appeared.

Considerations

Legal framework

1. The relevant laws and regulations are set out in an appendix. This forms part of the ruling.

Introduction

1.1. [appellant] is involved in several proceedings concerning the way in which she has been treated by the police and how her personal data have been handled. Personal details of [appellant] have been made public. Because [the appellant] wants to know exactly what happened to her personal data, she asked the Chief of Police on 28 February 2017 to inform her whether he is processing her personal data and, if so, what personal data is being processed, what the purpose of this is, to whom these data have been provided and what the origin, as far as known, of these data is. In addition, she has requested the Chief of Police to provide her with copies of the documents in which her personal data have been processed.

1.2. The Chief of Police confirmed receipt of the request on 21 March 2017. He noted that the request covered the period from 29 October 2013 to 28 February 2017. The appellant subsequently served notice of default on the Chief of Police for not having decided on the application in time.

By decision of 2 June 2017, the Chief of Police provided [the appellant] with a summary of the personal data processed by him. This decision states what the purpose of this is, to whom these data have been provided and what the origin, as far as known, of these data is. Because this decision was not taken on time, the chief of police set a penalty payment. In response to [appellant's] objection, the Chief of Police saw reason to supplement the overview with the decision of 6 October 2017.

Following [appellant's] notice of appeal, the chief of police amended, supplemented and substantiated this overview on a number of points. This resulted in a new overview that was appended to the statement of defence of the Chief of Police to the District Court of 16 January 2018. In this new overview, the chief of police has made a subdivision into five categories. At the hearing [appellant] stated that her appeal does not relate to category 3. Category 1 is divided into two subcategories. Subcategory a relates to documents filed with the Complaints Department. Subcategory b relates to documents from an external complaints committee. Category 2 relates to documents relating to legal proceedings conducted in a disciplinary investigation into a district attorney. Category 4 relates to documents from a Regional Service Centre. Category 5 relates to other (contact) information.

1.3. The District Court annulled the decision of 6 October 2017 because the overview accompanying that decision was incomplete in view of the amendment and addition on appeal. Subsequently, the District Court ruled that the new overview did meet the statutory requirements, so that the legal consequences of the annulled decision can be maintained. This meant that the chief of police did not have to take a new decision on [the appellant's] objection and that the new overview was considered complete. Furthermore, the District Court ruled that the Chief of Police determined the penalty payment on correct grounds.

The appeal

1.4. [appellant] first of all submits on appeal that the course of the proceedings recorded by the court in the judgment is incorrect. Subsequently, [appellant] argues that the chief of police forfeited a penalty payment rather than assumed by the District Court. Finally, [appellant] argues that the District Court has wrongly ruled that the new overview is complete.

1.5. The Division will assess these arguments below.

The course of the proceedings

2. According to [appellant], the course of the proceedings is incorrect because it follows that on 12 December 2018 the District Court would have announced that no further hearing would take place. However, [appellant] was not aware of this.

2.1. As follows from the judgment of the Division of 14 November 2018, ECLI:NL:RVS:2018:3729, the course of the proceedings provides a brief description of the proceedings. By letter of 9 October 2018, the District Court announced that no further hearing would take place, unless the parties indicated that they wished to be heard orally at the hearing. By letter of 14 November 2018, the District Court reminded the parties of the letter of 9 October 2018. By letter of 17 November 2018, [appellant] responded by stating that it no longer needed to be heard at the hearing. The fact that the court mentions a letter of 12 December 2018 in the course of the proceedings must be based on a manifest error. There is therefore no reason to draw any consequences from this.

The argument fails.

The penalty payment

3. [appellant] served notice on the chief of police on 8 April 2017. By letter dated 12 April 2017, the chief of police informed [appellant] that the notice of default could not be dealt with because it had been received by e-mail. The chief of police informed [appellant] that it is not possible to send a notice of default by e-mail. Subsequently, [appellant], by letter dated 17 April 2017, again served notice of default on the Chief of Police.

3.1. [appellant] states that she served notice of default on the Chief of Police on 8 April 2017 by both e-mail and ordinary mail. The chief of police had attached a reply envelope to his letter of 30 March 2017, with which she sent a letter in which she responded to a request for inspection. She also sent a notice of default, as she wrote in her letter of 17 April 2017.

3.2. [Appellant] submitted its request on 28 February 2017. Pursuant to Section 35(1) of the Wbp, the term allowed to the Chief of Police to decide on that request was four weeks. The chief of police should therefore have taken a decision on the application before 28 March 2017. Subsequently, [the appellant] served notice of default on the chief of police by e-mail of 8 April 2017, gave him a term to decide on her request within two weeks and stated that if he did not do so, he would forfeit a penalty payment. It has not become apparent, nor has [the appellant] demonstrated that she also sent a notice of default by ordinary post on that day. The chief of police denies having received such a letter. By letter dated 12 April 2017, the chief of police informed [appellant] that a notice of default cannot be submitted by e-mail but must be submitted by ordinary mail. By letter of 17 April 2017, [appellant] again served notice of default on the Chief of Police, gave him a period of two weeks to decide on her request and stated that if he fails to do so, he would forfeit a penalty payment.

The Section is of the opinion that the first day on which the Chief of Police owes a penalty payment is 2 May 2017. This is the day after two weeks had elapsed for a decision to be made after the letter of 17 April 2017. The chief of police has not yet opened the digital route for submitting applications and therefore the e-mail from [appellant] of 8 April 2017 cannot be regarded as a notice of default. Since the simultaneous dispatch by ordinary mail on that date has not been proved and receipt is denied, 8 April 2017 cannot be assumed. The District Court has rightly reached the same conclusion.

The argument fails.

The overview of personal data processed

The argument of [appellant]

4. [Appellant] argues that the Court wrongly held that the personal data included in the new overview have been provided in a comprehensible form, that they are provided with a description of the purpose(s) of the processing, that it is clear to which categories of data the processing relates, that it is clear who the recipients or categories of recipients are and that it is clear what the origin of the data is. Moreover, according to [Appellant] not all personal data are mentioned on the overview. For example, data sent by the Chief of Police to the Central Board of Appeal (hereinafter: CRvB) are not mentioned on the overview. The Chief of Police should also have included processing relating to internal consultations, her contact with police officers, letters, e-mail messages, telephone and internal notes and minutes of conversations in the new overview. For these reasons, she did not have sufficient access to her personal data. Furthermore, the chief of police wrongly included some processing operations in the overview, according to [appellant].

Assessment

4.1. Pursuant to Section 35(2) of the Personal Data Protection Act (Wbp), a data subject is entitled, if an administrative body processes his personal data, to a complete overview of the processing of personal data in a comprehensible form, a description of the purpose(s) of the processing, the categories of data to which the processing relates and the recipients or categories of recipients, as well as the available information about the origin of the data.

4.2. In his defence, the Chief Constable took the position that [the appellant] lodged an appeal in order to express his dissatisfaction with the way in which he dealt with her interests in the appeal procedure instituted by the District Attorney following the disciplinary investigation. At the hearing, the Chief of Police explained that if he searches again, he will undoubtedly be able to find more e-mails containing personal information about [the appellant], but that there is a limit to what can be considered a reasonable effort to investigate which personal information is held by him. According to the chief of police, he has reached that limit. Furthermore, the chief of police has explained that the fifteen documents he sent to the CRvB look familiar to him. These documents are not mentioned on the new overview. The chief of police has explained that at least one of these documents processed the personal data of [the appellant].

4.3. In view of the provisions of 4.2. alone, the new overview does not meet the requirements of Article 35, second paragraph, of the Wbp. The fact that [the appellant] started this procedure according to the Chief of Police in order to express her dissatisfaction with the way in which he handled her interests does not release the Chief of Police from his legal obligation to provide her with a complete overview of the processing of [the appellant's] personal data. Therefore, the Chief of Police must again search for personal data of [appellant] that he processed in the period from 29 October 2013 to 28 February 2017. This concerns only the processing of personal data of [appellant] by the Chief of Police and not the processing of personal data of [appellant] by third parties. In this new search, the Chief of Police must provide insight into the manner in which he has searched for the processing of her personal data. Because the Wbp was repealed on 25 May 2018 and the General Data Protection Regulation (hereafter: AVG) applies from that moment on, the chief of police must apply the AVG when providing a new overview and check whether the overview is in accordance with it. In view of the above, the District Court wrongly maintained the legal consequences of the annulled decision.

The argument succeeds.

Conclusion

5. The foregoing means that the appeal is well-founded. The judgment under appeal must be set aside to the extent that the court has upheld the legal consequences of the annulled decision. In doing what the District Court should do, the Division will determine that the Chief of Police must again make a decision on [the appellant's] objection, with due observance of this judgment. The argument of [appellant] that the court should have assessed whether the overview complies with the AVG when maintaining the legal consequences can therefore also be disregarded. With a view to an efficient settlement of the dispute, the Division also sees reason, pursuant to Section 113(2) of Section 8:113 of the General Administrative Law Act (Awb), to provide that the new decision can only be appealed against by the Division. Incidentally, it emerged at the hearing that it is not excluded that [the appellant] and the chief of police may reach an amicable solution.

6. The chief of police should be ordered to pay the costs of the proceedings in a manner to be reported.

Decision

The Administrative Jurisdiction Division of the Council of State:

I. declares the appeal well-founded;

II. sets aside the judgment of the District Court of Zeeland-West Brabant of 19 February 2019 in case no. 17/7440 in so far as the District Court has upheld the legal consequences of the annulled decision of 6 October 2017;

III. provides that the Chief of Police must take a new decision on [appellant's] objection;

IV. provides that the new decision to be taken can only be appealed to the Division;

V. orders the chief of police to compensate [appellant] for legal costs incurred by [appellant] in connection with the handling of the appeal up to an amount of € 39.70 (in words: thirty-nine euros and seventy cents);

VI. orders the chief of police to reimburse to [appellant] the court fee paid by her in connection with the handling of the appeal in the amount of € 259.00 (in words: two hundred and fifty-nine euros).

Thus determined by C.H.M. van Altena, chairman, and G.M.H. Hoogvliet and H.C.P. Venema, members, in the presence of S. Langeveld-Mak, registrar.

w.g. Van Altena w.g. Langeveld-Mak

chairman of the court clerk

Pronounced in public on 22 January 2020

317-857.

ANNEX

General Administrative Law Act

Article 2:14

1. An administrative body may send a message addressed to one or more addressees electronically insofar as the addressee has indicated that he or she can be sufficiently reached by this means.

[…]

Article 4:17

1. If a decision on an application is not made in time, the administrative body shall forfeit to the applicant a penalty payment for each day that it is in default, but for a maximum of 42 days. The General Time-Limits Act does not apply to the latter period.

2. The penalty payment is € 23 per day for the first fourteen days, € 35 per day for the following fourteen days and € 45 per day for the remaining days.

3. The first day on which the periodic penalty payment is due is the day on which two weeks have elapsed after the day on which the period for making the decision has expired and the administrative body has received a written notice of default from the applicant.

[…]

Personal Data Protection Act [as it stood until 25 May 2018].

Article 35

1. The data subject shall have the right to address himself/herself freely and at reasonable intervals to the data controller with a request to inform him/her whether personal data relating to him/her are being processed. The data controller shall inform the data subject in writing within four weeks whether personal data relating to him or her are being processed.

2. Where such data are being processed, the communication shall contain a comprehensive overview thereof in a comprehensible form, a description of the purposes or purposes of the processing, the categories of data concerned by the processing and the recipients or categories of recipients, as well as available information as to the origin of the data.

[…]

@@ Line 1: / Line 1: @@
-{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"
+{{COURTdecisionBOX
-! colspan="2" |RvS - 201902604/1/A3
-|-
-| colspan="2" style="padding: 20px; background-color:#ffffff;" |[[File:courtsNL.png|center|250px]]
-|-
-|Court:||[[:Category:RvS (Netherlands)|RvS (Netherlands)]]
-[[Category:RvS (Netherlands)]]
-|-
-|Jurisdiction:||[[Data Protection in the Netherlands|Netherlands]]
-[[Category:Netherlands]]
-|-
-|Relevant Law:||[[Article 4 GDPR#7|Article 4(7) GDPR]]
-[[Category:Article 4(7) GDPR]]
-[[Article 15 GDPR]]
+|Jurisdiction=Netherlands
-[[Category:Article 15 GDPR]]
+|Court-BG-Color=
-|-
+|Courtlogo=Courts_logo1.png
-|Decided:||22. 01. 2020
+|Court_Abbrevation=RvS
-[[Category:2020]]
+|Court_With_Country=RvS (Netherlands)
-|-
-|Published:||22. 01. 2020
-|-
-|Parties:||[https://www.ggdflevoland.nl/ GGD Flevoland]
-|-
-|National Case Number:||201902604/1/A3
-|-
-|European Case Law Identifier:||<small>ECLI:NL:RVS:2019:3848</small>
-|-
-|Appeal from:||Rb. Midden-Nederland (District Court of First Instance)
-|-
-|Language:||[[:Category:Dutch|Dutch]]
-[[Category:Dutch]]
-|-
-|Original Source:||[https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RVS:2020:180&showbutton=true&keyword=AVG de Rechtspraak (in NL)]
-|}
-The Dutch State Council (''Raad Van Staten'') decided on the equal treatment by joint controllers of a data subject's access request.
+|Case_Number_Name=201902604/1/A3
+|ECLI=ECLI:NL:RVS:2020:180
+|Original_Source_Name_1=de Rechtspraak
+|Original_Source_Link_1=https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RVS:2020:180&showbutton=true&keyword=AVG
+|Original_Source_Language_1=Dutch
+|Original_Source_Language__Code_1=NL
+|Original_Source_Name_2=
+|Original_Source_Link_2=
+|Original_Source_Language_2=
+|Original_Source_Language__Code_2=
+|Date_Decided=22.01.2020
+|Date_Published=22.01.2020
+|Year=2020
+|GDPR_Article_1=Article 15 GDPR
+|GDPR_Article_Link_1=Article 15 GDPR
+|GDPR_Article_2=
+|GDPR_Article_Link_2=
+|EU_Law_Name_1=
+|EU_Law_Link_1=
+|EU_Law_Name_2=
+|EU_Law_Link_2=
+|National_Law_Name_1=Article 35(2) Wbp
+|National_Law_Link_1=https://maxius.nl/wet-bescherming-persoonsgegevens/artikel35
+|National_Law_Name_2=
+|National_Law_Link_2=
+|Party_Name_1=The chief of police
+|Party_Link_1=Anonymous
+|Party_Name_2=
+|Party_Link_2=
+|Party_Name_3=
+|Party_Link_3=
+|Appeal_From_Body=Rb. Zeeland-West-Brabant (Netherlands)
+|Appeal_From_Case_Number_Name=
+|Appeal_From_Status=
+|Appeal_From_Link=
+|Appeal_To_Body=
+|Appeal_To_Case_Number_Name=
+|Appeal_To_Status=
+|Appeal_To_Link=
+|Initial_Contributor=
+|
+}}
+The Dutch State Council (''Raad Van Staten'') ruled that whenever the data subject is not provided with a complete overview of the personal data processed in a comprehensible form, a description of the purpose(s), the personal data's categories, the recipients or categories of recipients as well as the available information on the origin, as requested, the data controller had to search again to be compliant with [[Article 15 GDPR]].
 ==English Summary==
 ===Facts===
-The claimant’s son applied for social support at home. Following the application, the City Public Health Department investigated and addressed a recommendation on whether the social support should be granted to the City Council. The City Council decided to not grant the social support. Then, the claimant requested a copy of the files processed during the application process, including the son's personal data related to his medical files. The City Council refused to grant the access.
+The claimant was previously involved in several proceedings regarding the police's treatment towards herself and the disclosure of her personal data to the public. To know more about the processing of her personal data by the Chief of Police, she submitted a subject access request.
+The Chief of Police provided her with a summary of the personal data processed with the information requested with undue delay, in June 2017. Thus, the Chief of Police set a penalty payment. Following the first answer, the Chief of Police completed with another decision in October 2017 which has been challenged by the applicant before the Court Rb. Zeeland-West-Brabant (Netherlands).
+The Court Rb. Zeeland-West-Brabant annulled the decision of October 2017 as it found it incomplete. However, based on the new Chief of Police supplementing decision submitted in January 2018 during the proceedings, it also ruled that the data controller does not have to take any other decision regarding the subject access request. Indeed, the lower court considered that the supplementing decision, so-called the "new overview" decision provided enough information and was, thus, complete.
+The claimant's appeal the Court Rb. Zeeland-West-Brabant's judgement before the Dutch State Council (Raad Van Staten).
+The applicant claimed mainly that the new overview decision has not been provided in comprehensible form. Especially, she argued that the information related to the purpose(s) of the processing, the recipients or categories of recipients and the origin were not stated clearly. Also, she argued that the new overview decision was still incomplete, as some of the personal data were missing.
 ===Dispute===
-Who is the relevant controller?
+The ''Raad Van Staten'' had to decide on whether the information provided in the proceeding were sufficient enough to comply with [[Article 15 GDPR]] and the National data protection law.
 ===Holding===
-The Court first considered that all public entities involved in the application process and not only the City Council were joint controllers. Thus, the access request regarding the personal data could have been sent to the City Public Health Department as well. Then, the Court considered that the access to the personal data should have been granted by the City Council under the data protection law. However, the City Council already destroyed the personal data after it refused to grant the social support. Therefore, the Court considered that the refusal was legitimate.
+The ''Raad Van Staten'' considered that the data controller had to search another time and find all the personal data about the data subject to answer with accurate and clear information.
 ==Comment==
@@ Line 56: / Line 87: @@
 ==English Machine Translation of the Decision==
-The decision below is a machine translation of the original. Please refer to the Dutch original for more details. <pre>DECISION
+The decision below is a machine translation of the original. Please refer to the Dutch original for more details. <pre>
+Ruling
-201901832/1/A3
+201902604/1/A3.
-Date of judgment: 13 November 2019
+Date of judgment: 22 January 2020
 SECTION
 ADMINISTRATIVE LAW
 Ruling on the appeal of:
-[Appellant A] and [Appellant B], both residing at [residence],
-against the judgment of the District Court of Midden-Nederland of 31 January 2019 in Case No 18/1037 in the proceedings between:
+[appellant], residing at [residence],
-[appellants]
+against the judgment of the District Court of Zeeland-West Brabant of 19 February 2019 in Case No 17/7440 in the proceedings between:
+[appellant]
 and
-the day-to-day management of the GGD Flevoland.
+the chief of police.
 Process sequence
-By decision of 10 August 2017, the Executive Board rejected the request of [appellants] for access to and a copy of their personal data contained in [person's] file.
-By decision of 30 January 2018, the Executive Board declared the objection made by [appellants] unfounded.
-By interlocutory judgment of 27 July 2018, the District Court gave the Executive Board the opportunity to rectify the established defect in the decision of 30 January 2018 within six weeks after the interlocutory judgment was sent.
-The Executive Board took this opportunity and declared the objection inadmissible by decision of 9 August 2018. In doing so, the Executive Board annulled the decision of 30 January 2018.
-By decision of 31 January 2019, the District Court upheld the appeal lodged by [appellants] against the decision of 9 August 2018 and annulled that decision insofar as it relates to the application under the Personal Data Protection Act (Wbp). It declared the objection lodged against the decision of 10 August 2017 to be well-founded and rejected the request for inspection. In doing so, it determined that its decision will replace the decision of 9 August 2018 insofar as it has been annulled. Finally, she rejected the claim for damages. This judgment is attached.
+By decision of 2 June 2017, the Chief of Police decided, at the request of [appellant], to inform her whether he is processing personal data relating to her.
+By decision of 6 October 2017, the chief of police upheld the objection made by [appellant].
+By decision of 19 February 2019, the District Court upheld the appeal lodged by [appellant] against the decision of 6 October 2017, annulled the decision and determined that the legal consequences of this decision remain intact. This judgment is attached.
+[Appellant] has lodged an appeal against this decision.
+The chief of police has given a written explanation.
+The [appellant] has granted the Division permission to give its decision partly on the basis of the information not made available for inspection.
-[Appellants] have lodged an appeal against this decision.
+The Section heard the case at the hearing on 3 December 2019, where [the appellant] and the Chief of Police, represented by L. van den Berg, appeared.
-The Executive Board has given a written explanation.
-[Appellants] have submitted further documents.
-The Division heard the case on 30 October 2019, where [appellants] and the Executive Board, represented by P.D.J. Vegter, appeared.
 Considerations
-.    The legal framework, including the relevant provisions of Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter the APC), is set out in an Annex. This annex is part of the judgment.
+Legal framework
+.    The relevant laws and regulations are set out in an appendix. This forms part of the ruling.
 Introduction
-.    [person] is the adult son of [appellants]. He applied to the municipality of Almere in 2017 for an indication 'Protected Living' under the Social Support Act 2015 (hereinafter: Wmo 2015). He made this application without the knowledge of his parents. In the context of this application, GGD Flevoland carried out the research referred to in Article 2.3.2 of the Wmo 2015 and on 1 June 2017 issued an advisory report to the Municipal Executive of Almere (hereinafter also referred to as: Municipal Executive). This advice is based on a file which includes medical details of [person] and a report of an interview between employees of GGD Flevoland and [person] about protected housing.
-.1.    On 31 July 2017, [appellants] asked the Executive Board for access to and a copy of the personal data relating to them that were processed as part of the investigation carried out by GGD Flevoland in connection with their son's application. By decision of 10 August 2017, the Executive Board rejected that request because [person's] file is a medical file and he did not grant permission to inspect it. By decision on the objection of 30 January 2018, the Executive Board declared the objection of [appellants] unfounded.
+.1.    [appellant] is involved in several proceedings concerning the way in which she has been treated by the police and how her personal data have been handled. Personal details of [appellant] have been made public. Because [the appellant] wants to know exactly what happened to her personal data, she asked the Chief of Police on 28 February 2017 to inform her whether he is processing her personal data and, if so, what personal data is being processed, what the purpose of this is, to whom these data have been provided and what the origin, as far as known, of these data is. In addition, she has requested the Chief of Police to provide her with copies of the documents in which her personal data have been processed.
-The interim and final verdict of the court
+.2.    The Chief of Police confirmed receipt of the request on 21 March 2017. He noted that the request covered the period from 29 October 2013 to 28 February 2017. The appellant subsequently served notice of default on the Chief of Police for not having decided on the application in time.
-.    In its interlocutory judgment of 27 July 2018, the Court rejected the argument of [appellants] that only the Municipal Executive of Almere is responsible within the meaning of Section 1(d) of the Wbp. It further established that, contrary to what the Executive Board had assumed, the request of [appellants] of 31 July 2017 was based on the Wbp. In its decision on objection of 30 January 2018, the Executive Board therefore wrongly did not (also) assess the request for inspection on the basis of the Wbp. The District Court then gave the Executive Board the opportunity to rectify this shortcoming. In order to rectify the defect, the Executive Board had to decide on [appellants'] request for inspection in accordance with Section 35 of the Wbp, according to the District Court.
-.1.    The Executive Board took this opportunity and again decided on [Appellants'] objection. By decision on the objection of 9 August 2018, the Executive Board revoked the earlier decision of 30 January 2018 and declared the objection inadmissible as yet. According to the Executive Board, the rejection of the request for access to and a copy of personal data, insofar as these relate to [person's] medical file, does not constitute a decision within the meaning of Article 1:3 of the General Administrative Law Act (hereinafter: Awb). With regard to the request for inspection pursuant to Section 35 of the Wbp, the Executive Board has not applied this provision because of the protection of the person concerned or of the rights and freedoms of others, as referred to in Section 43, opening words and under e, of the Wbp.
+    By decision of 2 June 2017, the Chief of Police provided [the appellant] with a summary of the personal data processed by him. This decision states what the purpose of this is, to whom these data have been provided and what the origin, as far as known, of these data is. Because this decision was not taken on time, the chief of police set a penalty payment. In response to [appellant's] objection, the Chief of Police saw reason to supplement the overview with the decision of 6 October 2017.
-.2.    In its final judgment of 31 January 2019, the District Court ruled that, insofar as the rejection of the application was based on Section 7:457 of the Dutch Civil Code, the objection was rightly declared inadmissible. In so far as the application is a matter of private law, according to the District Court. In so far as the rejection of the application is based on the Wbp, the Executive Board wrongly failed to recognize that the AGM had entered into force in the meantime. The decision of 9 August 2018 therefore contains a lack of reasoning. The District Court subsequently ruled that, contrary to the opinion of [the appellants], the AGM does not entitle [person] to actually obtain the file and the contents of the interview report between [person] and the employees of GGD Flevoland about the home situation. However, the Executive Board should have given access to the processing of [appellants'] personal data in the call report. To that extent, the Executive Board wrongly declared the objection inadmissible, according to the District Court. The District Court declared the objection of [appellants] well-founded. Since the file has been destroyed in the meantime, the District Court has reason to reject the request for inspection on the basis of the AGM. Finally, the District Court rejected the application for damages. For this purpose, it considered it important that although the decision of 9 August 2018 was unlawful, [the appellants] did not make it plausible that the alleged immaterial damage was the result of the unlawful decision of 9 August 2018.
+    Following [appellant's] notice of appeal, the chief of police amended, supplemented and substantiated this overview on a number of points. This resulted in a new overview that was appended to the statement of defence of the Chief of Police to the District Court of 16 January 2018. In this new overview, the chief of police has made a subdivision into five categories. At the hearing [appellant] stated that her appeal does not relate to category 3. Category 1 is divided into two subcategories. Subcategory a relates to documents filed with the Complaints Department. Subcategory b relates to documents from an external complaints committee. Category 2 relates to documents relating to legal proceedings conducted in a disciplinary investigation into a district attorney. Category 4 relates to documents from a Regional Service Centre. Category 5 relates to other (contact) information.
-The dispute on appeal
+.3.    The District Court annulled the decision of 6 October 2017 because the overview accompanying that decision was incomplete in view of the amendment and addition on appeal. Subsequently, the District Court ruled that the new overview did meet the statutory requirements, so that the legal consequences of the annulled decision can be maintained. This meant that the chief of police did not have to take a new decision on [the appellant's] objection and that the new overview was considered complete. Furthermore, the District Court ruled that the Chief of Police determined the penalty payment on correct grounds.
-i.    Processing manager
+The appeal
-.    [appellants] first of all argue that the District Court has misunderstood that it is not GGD Flevoland that is responsible for processing, but the Municipal Executive of Almere. GGD Flevoland is only an advisor hired by the Municipal Executive and the Municipal Executive remains, in view of Article 5.1.1 of the Wmo 2015, fully competent and responsible for the processing of personal data in the context of the investigation referred to in Article 2.3.2 of the Wmo 2015, according to [Appellants].
+.4.    [appellant] first of all submits on appeal that the course of the proceedings recorded by the court in the judgment is incorrect. Subsequently, [appellant] argues that the chief of police forfeited a penalty payment rather than assumed by the District Court. Finally, [appellant] argues that the District Court has wrongly ruled that the new overview is complete.
-.1.    The controller within the meaning of Article 4(7) of the Avg is a natural or legal person, a public authority, a service or other body which, alone or jointly with others, determines the purpose and means of processing personal data. As rightly considered by the court, GGD Flevoland has control over the preparation and content of the advice it issues to the Municipal Executive in the context of Article 2.3.2 of the Wmo 2015. For the purpose of this independent advice, a file is created in which, among other things, the medical file and the report of the interview with [person] were located. Although this file forms the basis of the advice, the file itself, as confirmed once again by the Executive Board at the session of the Division, is not transferred to the College. The Board only has access to the advice. The fact that an opinion is issued to the Board does not make it, as the District Court rightly ruled, controller for the processing of the personal data included in the file on which the opinion is based. As the District Court also rightly ruled, the circumstance that the Municipal Executive is authorized pursuant to Section 5.1.1 of the Wmo 2015 to process personal data received in connection with the application for a Protected Living Indication does not lead to a different conclusion. This exclusively concerns the processing of personal data by the Municipal Executive. Moreover, the Avg does not rule out the possibility that several government bodies may be responsible for processing. Insofar as the Municipal Executive also processes personal data of [appellants], they are free to submit a request for inspection to the Municipal Executive, as also considered by the District Court.
+.5.    The Division will assess these arguments below.
-The argument fails.
+The course of the proceedings
-ii.    The annulment of the file
+.    According to [appellant], the course of the proceedings is incorrect because it follows that on 12 December 2018 the District Court would have announced that no further hearing would take place. However, [appellant] was not aware of this.
-.    [Appellants] further submit that they have doubts as to whether the file was actually destroyed because the Executive Board failed to provide evidence thereof. According to them, the Court wrongly saw no reason to request such documentary evidence. They further argue that the decision to destroy the file is a decision as referred to in Section 6:19 of the Awb, because the file is the subject of the dispute. This nullification is unlawful, because the Executive Board was not authorised to take a decision to nullify the file. According to [the appellants], this power rests exclusively with the Executive Board. For this reason the Executive Board performed acts and took decisions as referred to in Section 8:88(1)(a) and (b) of the General Administrative Law Act. According to [Appellants], contrary to the Court's judgment, the immaterial damage suffered is directly and exclusively related to the unlawful decision to destroy the file and the destruction itself.
+.1.    As follows from the judgment of the Division of 14 November 2018, ECLI:NL:RVS:2018:3729, the course of the proceedings provides a brief description of the proceedings. By letter of 9 October 2018, the District Court announced that no further hearing would take place, unless the parties indicated that they wished to be heard orally at the hearing. By letter of 14 November 2018, the District Court reminded the parties of the letter of 9 October 2018. By letter of 17 November 2018, [appellant] responded by stating that it no longer needed to be heard at the hearing. The fact that the court mentions a letter of 12 December 2018 in the course of the proceedings must be based on a manifest error. There is therefore no reason to draw any consequences from this.
-.1.    In a letter dated 6 September 2018, the Executive Board informed the District Court that the file on which the advice on the indication Protected Living was based had been destroyed at the request of [person]. Like the District Court, the Division does not see any reason to doubt this notification, so the District Court was not obliged to collect any further evidence of this.
+    The argument fails.
-.2.    The argument of [appellants] that the setting aside of [person's] file is a decision within the meaning of Section 6:19(1) of the Awb and therefore had to be included in the proceedings before the District Court was unsuccessful. Pursuant to Section 6:19(1) of the General Administrative Law Act, the appeal also relates by operation of law to a decision to revoke, amend or replace the contested decision, unless the parties have an insufficient interest in doing so. The subject matter of the dispute before the court was the decisions on objection of 30 January and 9 August 2018 regarding the rejection of the request for access to [appellants'] personal data in [person's] file. Although the dispute ultimately revolved around access to that file, the Executive Board did not revoke, amend or replace the decisions of 30 January and 9 August 2018 by annulling the file. The destruction of the file at the request of [person] is therefore, contrary to what [appellants] assume, not a decision within the meaning of Article 6:19 of the General Administrative Law Act.
+The penalty payment
-.3.    The Court has rightly seen no reason to include the annulment of [person's] file in the appeal procedure.
+.    [appellant] served notice on the chief of police on 8 April 2017. By letter dated 12 April 2017, the chief of police informed [appellant] that the notice of default could not be dealt with because it had been received by e-mail. The chief of police informed [appellant] that it is not possible to send a notice of default by e-mail. Subsequently, [appellant], by letter dated 17 April 2017, again served notice of default on the Chief of Police.
-Final sum
+.1.    [appellant] states that she served notice of default on the Chief of Police on 8 April 2017 by both e-mail and ordinary mail. The chief of police had attached a reply envelope to his letter of 30 March 2017, with which she sent a letter in which she responded to a request for inspection. She also sent a notice of default, as she wrote in her letter of 17 April 2017.
-.    The appeal is unfounded. The judgment under appeal must be upheld insofar as it is under appeal.
+.2.    [Appellant] submitted its request on 28 February 2017. Pursuant to Section 35(1) of the Wbp, the term allowed to the Chief of Police to decide on that request was four weeks. The chief of police should therefore have taken a decision on the application before 28 March 2017. Subsequently, [the appellant] served notice of default on the chief of police by e-mail of 8 April 2017, gave him a term to decide on her request within two weeks and stated that if he did not do so, he would forfeit a penalty payment. It has not become apparent, nor has [the appellant] demonstrated that she also sent a notice of default by ordinary post on that day. The chief of police denies having received such a letter. By letter dated 12 April 2017, the chief of police informed [appellant] that a notice of default cannot be submitted by e-mail but must be submitted by ordinary mail. By letter of 17 April 2017, [appellant] again served notice of default on the Chief of Police, gave him a period of two weeks to decide on her request and stated that if he fails to do so, he would forfeit a penalty payment.
-.    There are no grounds for an order to pay the costs of the proceedings.
+    The Section is of the opinion that the first day on which the Chief of Police owes a penalty payment is 2 May 2017. This is the day after two weeks had elapsed for a decision to be made after the letter of 17 April 2017. The chief of police has not yet opened the digital route for submitting applications and therefore the e-mail from [appellant] of 8 April 2017 cannot be regarded as a notice of default. Since the simultaneous dispatch by ordinary mail on that date has not been proved and receipt is denied, 8 April 2017 cannot be assumed. The District Court has rightly reached the same conclusion.
-Decision
+    The argument fails.
+The overview of personal data processed
+The argument of [appellant]
-The Administrative Jurisdiction Division of the Council of State:
+.    [Appellant] argues that the Court wrongly held that the personal data included in the new overview have been provided in a comprehensible form, that they are provided with a description of the purpose(s) of the processing, that it is clear to which categories of data the processing relates, that it is clear who the recipients or categories of recipients are and that it is clear what the origin of the data is. Moreover, according to [Appellant] not all personal data are mentioned on the overview. For example, data sent by the Chief of Police to the Central Board of Appeal (hereinafter: CRvB) are not mentioned on the overview. The Chief of Police should also have included processing relating to internal consultations, her contact with police officers, letters, e-mail messages, telephone and internal notes and minutes of conversations in the new overview. For these reasons, she did not have sufficient access to her personal data. Furthermore, the chief of police wrongly included some processing operations in the overview, according to [appellant].
-confirms the decision of the court, if attacked.
+Assessment
-Thus determined by Mr C.J. Borman, member of the single chamber, in the presence of Mr R. Grimbergen, Registrar.
+.1.    Pursuant to Section 35(2) of the Personal Data Protection Act (Wbp), a data subject is entitled, if an administrative body processes his personal data, to a complete overview of the processing of personal data in a comprehensible form, a description of the purpose(s) of the processing, the categories of data to which the processing relates and the recipients or categories of recipients, as well as the available information about the origin of the data.
-w.g. Borman w.g. Grimbergen
+.2.    In his defence, the Chief Constable took the position that [the appellant] lodged an appeal in order to express his dissatisfaction with the way in which he dealt with her interests in the appeal procedure instituted by the District Attorney following the disciplinary investigation. At the hearing, the Chief of Police explained that if he searches again, he will undoubtedly be able to find more e-mails containing personal information about [the appellant], but that there is a limit to what can be considered a reasonable effort to investigate which personal information is held by him. According to the chief of police, he has reached that limit. Furthermore, the chief of police has explained that the fifteen documents he sent to the CRvB look familiar to him. These documents are not mentioned on the new overview. The chief of police has explained that at least one of these documents processed the personal data of [the appellant].
-member of the single chamber of the Registrar
+.3.    In view of the provisions of 4.2. alone, the new overview does not meet the requirements of Article 35, second paragraph, of the Wbp. The fact that [the appellant] started this procedure according to the Chief of Police in order to express her dissatisfaction with the way in which he handled her interests does not release the Chief of Police from his legal obligation to provide her with a complete overview of the processing of [the appellant's] personal data. Therefore, the Chief of Police must again search for personal data of [appellant] that he processed in the period from 29 October 2013 to 28 February 2017. This concerns only the processing of personal data of [appellant] by the Chief of Police and not the processing of personal data of [appellant] by third parties. In this new search, the Chief of Police must provide insight into the manner in which he has searched for the processing of her personal data. Because the Wbp was repealed on 25 May 2018 and the General Data Protection Regulation (hereafter: AVG) applies from that moment on, the chief of police must apply the AVG when providing a new overview and check whether the overview is in accordance with it. In view of the above, the District Court wrongly maintained the legal consequences of the annulled decision.
-Pronounced in public on 13 November 2019
+    The argument succeeds.
-.
+Conclusion
-ANNEX
+.    The foregoing means that the appeal is well-founded. The judgment under appeal must be set aside to the extent that the court has upheld the legal consequences of the annulled decision. In doing what the District Court should do, the Division will determine that the Chief of Police must again make a decision on [the appellant's] objection, with due observance of this judgment. The argument of [appellant] that the court should have assessed whether the overview complies with the AVG when maintaining the legal consequences can therefore also be disregarded. With a view to an efficient settlement of the dispute, the Division also sees reason, pursuant to Section 113(2) of Section 8:113 of the General Administrative Law Act (Awb), to provide that the new decision can only be appealed against by the Division. Incidentally, it emerged at the hearing that it is not excluded that [the appellant] and the chief of police may reach an amicable solution.
-Social Support Act 2015
-Article 2.3.2
+.    The chief of police should be ordered to pay the costs of the proceedings in a manner to be reported.
-. If a need for social support is reported to the Municipal Executive, the Municipal Executive will carry out an investigation in accordance with the second to eighth paragraphs as soon as possible, but no later than within six weeks, in consultation with the person by or on behalf of whom the report was made and, where possible, with the informal carer or informal carers or his representative. The Municipal Executive will confirm receipt of the report.
+Decision
-[…].
+The Administrative Jurisdiction Division of the Council of State:
-Article 5.1.1
+I. declares the appeal well-founded;
-. The Municipal Executive is authorised to process the client's personal data, including data concerning health which are necessary for the assessment of the client's need for support for his participation or self-reliance or shelter or protected living, as well as personal data of the client's spouse, parents, children living at home and other housemates which are necessary in order to determine what assistance they offer or can offer to the client, insofar as these have been obtained within the framework of the investigation referred to in Article 2.3.2 or by virtue of Article 2.3.8, 5.2.2, 5.2.3, 5.2.4 or 5.2.5 and necessary for the implementation of Article 2.1.4, 2.1.5, 2.3.2, 2.3.3, 2.3.5, 2.3.6, 2.3.9, 2.3.10, 2.4.1 or 2.4.3.
+II. sets aside the judgment of the District Court of Zeeland-West Brabant of 19 February 2019 in case no. 17/7440 in so far as the District Court has upheld the legal consequences of the annulled decision of 6 October 2017;
-[…].
+III. provides that the Chief of Police must take a new decision on [appellant's] objection;
-Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
+IV. provides that the new decision to be taken can only be appealed to the Division;
-Article 4
+V. orders the chief of police to compensate [appellant] for legal costs incurred by [appellant] in connection with the handling of the appeal up to an amount of € 39.70 (in words: thirty-nine euros and seventy cents);
-For the purposes of this Regulation, the following definitions shall apply:
+VI. orders the chief of police to reimburse to [appellant] the court fee paid by her in connection with the handling of the appeal in the amount of € 259.00 (in words: two hundred and fifty-nine euros).
-[…];
+Thus determined by C.H.M. van Altena, chairman, and G.M.H. Hoogvliet and H.C.P. Venema, members, in the presence of S. Langeveld-Mak, registrar.
-(7) 'controller' means a natural or legal person, a public authority, a service or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of such processing are laid down in Union or Member State law, it may specify the controller or the criteria for designating the controller;
+w.g. Van Altena w.g. Langeveld-Mak
-[…].
+chairman of the court clerk
-Article 15
+Pronounced in public on 22 January 2020
-. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data relating to him or her are being processed and, if so, to obtain access to those personal data and to the following information:
+-857.
-(a) the purposes of the processing;
-(b) the categories of personal data concerned;
+ANNEX
-(c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
-(d) if possible, the period for which the personal data are to be stored or, if this is not possible, the criteria for determining it;
+General Administrative Law Act
-(e) that the data subject shall have the right to obtain from the controller the rectification, erasure or restriction of the processing of personal data relating to him or her and the right to object to such processing;
+Article 2:14
-(f) the data subject shall have the right to lodge a complaint with a supervisory authority;
+. An administrative body may send a message addressed to one or more addressees electronically insofar as the addressee has indicated that he or she can be sufficiently reached by this means.
-(g) where personal data are not collected from the data subject, any available information as to their source;
+[…]
-(h) the existence of automated decision making, including the profiling referred to in Article 22(1) and (4), and, at least in those cases, useful information on the underlying logic and the importance and likely impact of that processing on the data subject.
+Article 4:17
-[…].
+. If a decision on an application is not made in time, the administrative body shall forfeit to the applicant a penalty payment for each day that it is in default, but for a maximum of 42 days. The General Time-Limits Act does not apply to the latter period.
-Implementing Act General Data Protection Regulation
+. The penalty payment is € 23 per day for the first fourteen days, € 35 per day for the following fourteen days and € 45 per day for the remaining days.
-Article 34
+. The first day on which the periodic penalty payment is due is the day on which two weeks have elapsed after the day on which the period for making the decision has expired and the administrative body has received a written notice of default from the applicant.
-A written decision on a request as referred to in Articles 15 to 22 of the Regulation shall be taken within the time limits referred to in Article 12(3) of the Regulation and, insofar as it has been taken by an administrative body, shall be deemed to be a decision within the meaning of the General Administrative Law Act.
+[…]
-Book 7 of the Dutch Civil Code
+Personal Data Protection Act [as it stood until 25 May 2018].
-Article 7:457
+Article 35
-. Without prejudice to the provisions of Article 448(3), second sentence, the counsellor shall ensure that no information relating to the patient or access to or copy of the documents referred to in Article 454 shall be given to anyone other than the patient without the patient's consent. If such information is provided, it shall only be provided in so far as this does not harm another person's privacy. Provision may be made without observing the restrictions referred to in the preceding sentences, if required by or pursuant to the law.
+. The data subject shall have the right to address himself/herself freely and at reasonable intervals to the data controller with a request to inform him/her whether personal data relating to him/her are being processed. The data controller shall inform the data subject in writing within four weeks whether personal data relating to him or her are being processed.
+. Where such data are being processed, the communication shall contain a comprehensive overview thereof in a comprehensible form, a description of the purposes or purposes of the processing, the categories of data concerned by the processing and the recipients or categories of recipients, as well as available information as to the origin of the data.
+[…]
 </pre><br />