RvS - 201906880/1/A3: Difference between revisions
From GDPRhub
(→Facts) |
m (→Holding) |
||
| (7 intermediate revisions by 2 users not shown) | |||
| Line 49: | Line 49: | ||
| | | | ||
}} | }} | ||
The Dutch Council of State held that the Municipality of Arnhem could legally process residents' personal data via a card system controlling access to underground waste containers in accordance with Article 6(1)(e) GDPR. Among other things, the Council highlighted that controllers are not required to research all possible alternatives to a processing activity in order to determine whether it is necessary. | |||
== English Summary == | == English Summary == | ||
=== Facts === | === Facts === | ||
The Dutch DPA (the Autoriteit Persoonsgegevens, or 'AP') imposed an order subject to a periodic penalty payment on the municipality of Arnhem ('the Municipality'). The Municipality had infringed the then applicable Personal Data Protection Act (Wet bescherming persoonsgegevens or 'Wbp') by storing and retaining the personal data of individuals who disposed their waste in underground containers on the card readers attached to the containers. The order required the Municipality to open all underground containers without the use of a card, and to delete all personal data already stored and retained no later than 1 October 2017. | The Dutch DPA (the Autoriteit Persoonsgegevens, or 'AP') imposed an order subject to a periodic penalty payment on the municipality of Arnhem ('the Municipality'). The Municipality had infringed the then applicable Personal Data Protection Act (Wet bescherming persoonsgegevens or 'Wbp') by storing and retaining the personal data of individuals who disposed their waste in underground containers on the card readers attached to the containers. The order required the Municipality to open all underground containers without the use of a card, and to delete all personal data already stored and retained no later than 1 October 2017. | ||
| Line 62: | Line 59: | ||
In a decision of 16 July 2019, the AP dismissed an objection made by an appellant against the decision to lift the order as unfounded as unfounded. In a judgment of 5 September 2019, the District Court of Gelderland ('the District Court') declared an appeal lodged by the appellant against the decision as unfounded. | In a decision of 16 July 2019, the AP dismissed an objection made by an appellant against the decision to lift the order as unfounded as unfounded. In a judgment of 5 September 2019, the District Court of Gelderland ('the District Court') declared an appeal lodged by the appellant against the decision as unfounded. | ||
In the present case, the appellant appealed the judgment by the District Court. They argued that the District Court erred in finding that the processing of personal data can be based on Article 6(1)(c) GDPR. In particular, the appellant argued that pursuant to Article 6(3) GDPR, a public interest task under Article 6(1)(c) GDPR must be established by Union law or Member State law in a formal sense, and must satisfy criteria set out in Article 8(2) of the ECHR. The appellant also stated that in this case, the necessity for processing has not been demonstrated because the question of whether the waste card system is necessary for the performance of a duty under the Dutch Environmental Management Act was not adequately addressed. The District Court should have examined whether the duty could also be fulfilled without the processing of personal data. By not doing so, the District Court applied a test that was too light. The appellant requested that the AP take effective enforcement against any processing of personal data of residents in Arnhem without their consent, including when they deposit their household waste. | In the present case, the appellant appealed the judgment by the District Court. They argued that the District Court erred in finding that the processing of personal data can be based on Article 6(1)(c) GDPR. In particular, the appellant argued that pursuant to Article 6(3) GDPR, a public interest task under Article 6(1)(c) GDPR must be established by Union law or Member State law in a formal sense, and must satisfy criteria set out in Article 8(2) of the European Convention on Human Rights ('ECHR'). The appellant also stated that in this case, the necessity for processing has not been demonstrated because the question of whether the waste card system is necessary for the performance of a duty under the Dutch Environmental Management Act was not adequately addressed. The District Court should have examined whether the duty could also be fulfilled without the processing of personal data. By not doing so, the District Court applied a test that was too light. The appellant requested that the AP take effective enforcement against any processing of personal data of residents in Arnhem without their consent, including when they deposit their household waste. | ||
=== Holding === | === Holding === | ||
The Dutch Council of State held that the appeal was unfounded, and that the judgment under appeal should be upheld. The District Court correctly held that the AP was entitled to take the position that the Municipality no longer violates the GDPR | The Dutch Council of State held that the appeal was unfounded, and that the judgment under appeal should be upheld. The District Court correctly held that the AP was entitled to take the position that the Municipality no longer violates the GDPR if the order is lifted, and the District Court gave sufficient grounds for this opinion. | ||
The Council of State | The Council of State agreed with the appellant that the short-term processing of personal data on the volatile memory of the card reader is processing within the meaning of the GDPR. However, it did not agree with the appellant that processing on the basis of Article 6(1)(e) GDPR must derive from law in a formal sense. Neither the GDPR, nor the Dutch Constitution, nor the EU Charter of Fundamental Rights require this. Instead, it follows from Recitals 41 and 45 that the GDPR does not require specific legislation for each individual processing operation; it is sufficient to have legislation that serves as a basis for several processing operations. The processing only has to be traceable to a law, which may therefore also be a lower regulation. | ||
The | The Council of State found that the responsibility of the municipality to ensure the collection of household waste can be regarded as a task carried out in the public interest. The duty to exercise this task arises from Section 10.21 of the Environmental Management Act ('the Act'), the National Waste Management Plan adopted pursuant thereto, and the municipal waste plan 2012-2020. The Act instructs the Municipality to collect waste, as well as to into take account the current municipal waste management plan. In view of this, the processing of personal data in to prevent the use of waste containers by non-residents, in order to keep residual waste to a minimum - which is a principle outlined in the municipality waste management plan - falls under the Municipality's public interest. The Council of State highlighted here that generally, the purpose of data processing does not necessarily have to be aimed at a certain group of data subjects, rather it can be aimed at ''excluding'' another group, e.g. in this case non-residents. | ||
The Council of State held that in determining whether the processing was | The Council of State also held that, in determining whether the processing of personal data was necessary to prevent non-residents from using the waste containers, the Municipality was not required to review all possible alternatives; the fact that an alternative exists, does not in and by itself make the processing unnecessary, as controllers have some degree of freedom to decide how they carry out their tasks. That said, the Council of State emphasised that the more detailed, or 'intensive' the description of an alternative by a data subject, the more comprehensive the AP's investigation must be. | ||
In addition, the Council of State emphasized that the fact that the processing of data must be necessary, does not mean that the processing is lawful only if the task in the public interest cannot be fulfilled without the processing of data. Processing will only not be necessary if there are other methods that can achieve the same objective, or if the processing is disproportionate. | |||
The Council of State considered that the AP was entitled to take the position that the Municipality sufficiently demonstrated that the proposed alternatives do not achieve the intended purpose. For example, if the containers were open, it would not be possible to prevent non-residents from dumping their waste in them. Further, the use of a waste pass that is not linked to an address cannot achieve the aim of preventing abuse. In that case the circulation of waste cards cannot be monitored by the municipality and there is a chance that the waste cards will end up with companies or non residents. objective cannot reasonably be achieved in another manner that is less detrimental to data subject. | The Council of State considered that the AP was entitled to take the position that the Municipality sufficiently demonstrated that the proposed alternatives do not achieve the intended purpose. For example, if the containers were open, it would not be possible to prevent non-residents from dumping their waste in them. Further, the use of a waste pass that is not linked to an address cannot achieve the aim of preventing abuse. In that case the circulation of waste cards cannot be monitored by the municipality and there is a chance that the waste cards will end up with companies or non residents. objective cannot reasonably be achieved in another manner that is less detrimental to data subject. | ||
Further, the Council of State found that the necessity test in the ECHR is not stricter than the necessity test in the GDPR. Therefore, as the processing of data complies with Article 6 GDPR, the AP was entitled to take the view that the data processing does not violate Article 8 ECHR. Further, contrary to what the appellant argues, the extent of the processing plays a role in the consideration of the proportionality of the processing under Article 8(2), since from waste disposal pass are stored briefly on the volatile memory of the card reader so they can be checked against data on authorisation list. Data is then anonymised. and is thereafter not stored. This is limited in scope and restricted to what is necessary. | |||
Finally, the Council of State noted that it did not follow the appellant's argument that the data processing conflicts with the principle of data minimisation. It stated that the starting point of the GDPR is not the prohibition of the processing of regular personal data, rather, the GDPR ''regulates'' such processing. There is also no fundamental right not to process regular personal data. | |||
== Comment == | == Comment == | ||
Jeroen Terstegge explains that the Dutch Council of State is the highest Dutch Court in GDPR cases:https://www.linkedin.com/posts/jeroenterstegge_zoekresultaat-inzien-document-activity-6817436353052065792-0XMS/ | |||
== Further Resources == | == Further Resources == | ||
Latest revision as of 10:14, 27 June 2024
| RvS - RvS - 201906880/1/A3 | |
|---|---|
 | |
| Court: | RvS (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 5 GDPR Article 6(1) GDPR |
| Decided: | 30.06.2021 |
| Published: | 30.06.2021 |
| Parties: | Autoriteit Persoonsgegevens |
| National Case Number/Name: | RvS - 201906880/1/A3 |
| European Case Law Identifier: | Zoekresultaat - inzien document ECLI:NL:RVS:2021:1420 |
| Appeal from: | |
| Appeal to: | Not appealed |
| Original Language(s): | Dutch |
| Original Source: | de Rechtspraak (in Dutch) |
| Initial Contributor: | n/a |
The Dutch Council of State held that the Municipality of Arnhem could legally process residents' personal data via a card system controlling access to underground waste containers in accordance with Article 6(1)(e) GDPR. Among other things, the Council highlighted that controllers are not required to research all possible alternatives to a processing activity in order to determine whether it is necessary.
English Summary
Facts
The Dutch DPA (the Autoriteit Persoonsgegevens, or 'AP') imposed an order subject to a periodic penalty payment on the municipality of Arnhem ('the Municipality'). The Municipality had infringed the then applicable Personal Data Protection Act (Wet bescherming persoonsgegevens or 'Wbp') by storing and retaining the personal data of individuals who disposed their waste in underground containers on the card readers attached to the containers. The order required the Municipality to open all underground containers without the use of a card, and to delete all personal data already stored and retained no later than 1 October 2017.
On 14 March 2019, the AP decided to lift the order subject to penalty payments imposed on the Municipality at the request of the Municipality. The Municipality wanted the underground containers to be accessible only to residents and businesses of the Municipality, and therefore wanted to open a new waste card system. With the new system, residents are given a card with an internal chip code which is linked to their residential address. When the card is held in front of the card reader, the chip code is processed and compared to a whitelist of chip codes. To do this, the chip code is stored on the card reader's volatile memory. It is then converted almost instantly into a generic 9999 number, and removed from the whitelist when the container is closed. The AP could not foresee any violation of the GDPR by this new system, namely because data may be processed on the basis of Article 6(1)(e) GDPR, which states that a controller may process personal data which is lawful and necessary for the performance of a task carried out in the public interest.
In a decision of 16 July 2019, the AP dismissed an objection made by an appellant against the decision to lift the order as unfounded as unfounded. In a judgment of 5 September 2019, the District Court of Gelderland ('the District Court') declared an appeal lodged by the appellant against the decision as unfounded.
In the present case, the appellant appealed the judgment by the District Court. They argued that the District Court erred in finding that the processing of personal data can be based on Article 6(1)(c) GDPR. In particular, the appellant argued that pursuant to Article 6(3) GDPR, a public interest task under Article 6(1)(c) GDPR must be established by Union law or Member State law in a formal sense, and must satisfy criteria set out in Article 8(2) of the European Convention on Human Rights ('ECHR'). The appellant also stated that in this case, the necessity for processing has not been demonstrated because the question of whether the waste card system is necessary for the performance of a duty under the Dutch Environmental Management Act was not adequately addressed. The District Court should have examined whether the duty could also be fulfilled without the processing of personal data. By not doing so, the District Court applied a test that was too light. The appellant requested that the AP take effective enforcement against any processing of personal data of residents in Arnhem without their consent, including when they deposit their household waste.
Holding
The Dutch Council of State held that the appeal was unfounded, and that the judgment under appeal should be upheld. The District Court correctly held that the AP was entitled to take the position that the Municipality no longer violates the GDPR if the order is lifted, and the District Court gave sufficient grounds for this opinion.
The Council of State agreed with the appellant that the short-term processing of personal data on the volatile memory of the card reader is processing within the meaning of the GDPR. However, it did not agree with the appellant that processing on the basis of Article 6(1)(e) GDPR must derive from law in a formal sense. Neither the GDPR, nor the Dutch Constitution, nor the EU Charter of Fundamental Rights require this. Instead, it follows from Recitals 41 and 45 that the GDPR does not require specific legislation for each individual processing operation; it is sufficient to have legislation that serves as a basis for several processing operations. The processing only has to be traceable to a law, which may therefore also be a lower regulation.
The Council of State found that the responsibility of the municipality to ensure the collection of household waste can be regarded as a task carried out in the public interest. The duty to exercise this task arises from Section 10.21 of the Environmental Management Act ('the Act'), the National Waste Management Plan adopted pursuant thereto, and the municipal waste plan 2012-2020. The Act instructs the Municipality to collect waste, as well as to into take account the current municipal waste management plan. In view of this, the processing of personal data in to prevent the use of waste containers by non-residents, in order to keep residual waste to a minimum - which is a principle outlined in the municipality waste management plan - falls under the Municipality's public interest. The Council of State highlighted here that generally, the purpose of data processing does not necessarily have to be aimed at a certain group of data subjects, rather it can be aimed at excluding another group, e.g. in this case non-residents.
The Council of State also held that, in determining whether the processing of personal data was necessary to prevent non-residents from using the waste containers, the Municipality was not required to review all possible alternatives; the fact that an alternative exists, does not in and by itself make the processing unnecessary, as controllers have some degree of freedom to decide how they carry out their tasks. That said, the Council of State emphasised that the more detailed, or 'intensive' the description of an alternative by a data subject, the more comprehensive the AP's investigation must be.
In addition, the Council of State emphasized that the fact that the processing of data must be necessary, does not mean that the processing is lawful only if the task in the public interest cannot be fulfilled without the processing of data. Processing will only not be necessary if there are other methods that can achieve the same objective, or if the processing is disproportionate.
The Council of State considered that the AP was entitled to take the position that the Municipality sufficiently demonstrated that the proposed alternatives do not achieve the intended purpose. For example, if the containers were open, it would not be possible to prevent non-residents from dumping their waste in them. Further, the use of a waste pass that is not linked to an address cannot achieve the aim of preventing abuse. In that case the circulation of waste cards cannot be monitored by the municipality and there is a chance that the waste cards will end up with companies or non residents. objective cannot reasonably be achieved in another manner that is less detrimental to data subject.
Further, the Council of State found that the necessity test in the ECHR is not stricter than the necessity test in the GDPR. Therefore, as the processing of data complies with Article 6 GDPR, the AP was entitled to take the view that the data processing does not violate Article 8 ECHR. Further, contrary to what the appellant argues, the extent of the processing plays a role in the consideration of the proportionality of the processing under Article 8(2), since from waste disposal pass are stored briefly on the volatile memory of the card reader so they can be checked against data on authorisation list. Data is then anonymised. and is thereafter not stored. This is limited in scope and restricted to what is necessary.
Finally, the Council of State noted that it did not follow the appellant's argument that the data processing conflicts with the principle of data minimisation. It stated that the starting point of the GDPR is not the prohibition of the processing of regular personal data, rather, the GDPR regulates such processing. There is also no fundamental right not to process regular personal data.
Comment
Jeroen Terstegge explains that the Dutch Council of State is the highest Dutch Court in GDPR cases:https://www.linkedin.com/posts/jeroenterstegge_zoekresultaat-inzien-document-activity-6817436353052065792-0XMS/
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
Body
Council of State
Date of judgment
30-06-2021
Date of publication
30-06-2021
Case number
201906880/1/A3
Jurisdictions
Administrative law
Special characteristics
Appeal
Content indication
By decision of 14 March 2019, the Dutch Data Protection Authority lifted the order subject to a penalty imposed on the Municipal Executive of Arnhem at its request. The AP has imposed a cease and desist order on the college. The Commission violated the then applicable Personal Data Protection Act (hereinafter: the Wbp) because the data of persons who disposed of their waste in underground containers were stored via the address-related waste card and stored on the card readers attached to the containers. The burden entails that the municipal executive must open all underground containers without the use of the waste pass being necessary and that it must have deleted all already stored and saved personal data by 1 October 2017 at the latest. The council wants the underground containers to be only accessible to residents and companies of the municipality and therefore wants to introduce a new waste pass system. The underground containers must be closed for this.
Locations
Rechtspraak.nl
Enhanced pronunciation
Share pronunciation
print
Save as PDF
Copy link
Statement
201906880/1/A3.
Judgment date: June 30, 2021
DEPARTMENT
ADMINISTRATIVE JURISDICTION
Decision on the appeal of:
[appellant], living in [place of residence],
against the decision of the preliminary relief judge of the Gelderland District Court (hereinafter: the District Court) of 5 September 2019 in cases no. 19/4218 and 18/4217 in the proceedings between:
[appellant]
and
Authority Personal Data.
Process sequence
By decision of 14 March 2019, the AP lifted the order subject to a penalty imposed on the Municipal Executive of Arnhem at his request.
By decision of 16 July 2019, the AP declared the objection lodged by [appellant] unfounded.
By decision of 5 September 2019, the court dismissed the appeal lodged by [appellant] against it. This statement is attached.
The appellant appealed against this decision.
The AP has given a written explanation.
The college has filed a response.
[Appellant] has submitted further documents.
The Division dealt with the case in court on 11 May 2021, where [appellant] via an audio connection and the AP, represented by E. Nijhof and O.S. Niveld, have appeared. Furthermore, the Board, represented by mr. M.B.J. Thijssen and mr. L.J. Gerritsen, both lawyers in Nijmegen, and C.A.M. Berntsen, heard.
Considerations
preface
1. The relevant legal framework is included in the appendix to this ruling. The appendix is part of the ruling.
2. The AP has imposed an order subject to a penalty on the municipal executive. The Commission violated the then applicable Personal Data Protection Act (hereinafter: the Wbp) because the data of persons who disposed of their waste in underground containers were stored via the address-related waste card and stored on the card readers attached to the containers. The burden entails that the municipal executive must open all underground containers without the use of the waste pass being necessary and that it must have deleted all already stored and saved personal data by 1 October 2017 at the latest.
The council wants the underground containers to be only accessible to residents and companies of the municipality and therefore wants to introduce a new waste pass system. The underground containers must be closed for this. The Commission has therefore requested that the load be lifted or that the part of the load relating to the opening of the containers be changed in the sense that the containers may be closed. According to the AP, this is possible because the college has complied with the entire burden and no violations have occurred for a year. The data processing that takes place after the introduction of the new system is also in accordance with the regulations. [Appellant] disagrees.
decide
3. The AP has taken the position maintained in the objection that, on the basis of Article 5:34, second paragraph, of the General Administrative Law Act (hereinafter: the Awb) it has the authority to suspend the order at the request of the Commission. because the decision has been in force for a year without the penalty payment being forfeited. With the new system, the processing of personal data after opening the waste containers consists of the process of converting this data. According to the AP, no personal data is processed on the card readers because the internal chip code of the waste card, which is linked to a residential address, is immediately converted into the generic 9999 number after comparison with the authorization list to open the container. The AP does not see in advance that this processing is in conflict with the successor to the Wbp, the General Data Processing Regulation (EU) 2016/679 (hereinafter: the GDPR).
Attacked verdict
4. The court considered that the AP was in principle authorized to lift the order subject to a penalty. The AP was also able to make reasonable use of that power in this case. The processing is carried out in order to fulfill a task carried out in the public interest and is also necessary. The possible possibility that the software will be adjusted in the future and the introduction or not of the so-called Diftar system need not be included in this. Furthermore, the AP was allowed to take the position that the aim of the waste pass system cannot be achieved with the alternatives proposed by [appellant], according to the court.
Appeal
5. [appellant] argues that the court wrongly ruled that there is a legal basis for the processing and that the processing is necessary, while the court previously ruled that there was not. The fact that the data is stored for a shorter period of time with the new system and therefore the infringement is less serious cannot be a reason for that difference, because in the digital world half a second is an eternity. Limited processing of personal data must also meet the requirements of the GDPR. According to [appellant], the necessity for the processing must arise from a law in the formal sense and meet the criteria referred to in Article 8, second paragraph, of the Convention for the Protection of Human Rights and Fundamental Freedoms (hereinafter: the ECHR). ). In addition, it must also be assessed whether there is a need for the method chosen by the municipality in performing its task of general interest, according to [appellant]. In this case, according to [appellant], the necessity has not been demonstrated because the question of whether the waste pass system is indeed necessary for the fulfillment of the task under the Environmental Management Act is wrongly ignored. Furthermore, [appellant] argues that the court should have assessed whether that task can also be performed without the processing of personal data. By failing to do so, the court has applied too light a review in violation of the GDPR and the ECHR. According to [appellant], it follows from the fact that the municipal council has decided to hold an advisory referendum on the question "Stop paying per waste bag, unlock containers and ensure that a normal waste bag fits in again", according to [appellant] that the necessity of the data processing is not there.
The court wrongly placed the burden of proof for the necessity on him instead of on the municipality. [appellant] further argues that the court did not discuss a number of his grounds of appeal in the appealed decision. There is also a lack of proper balancing of interests and therefore effective legal protection.
[appellant] requests the AP to instruct the AP to take effective enforcement action against any processing of personal data of residents of Arnhem, without their consent, when they correctly deposit their household waste, for example in underground waste containers.
Assessment by the Department
What is not or is no longer in dispute?
6. It is not in dispute that during one year after the order was imposed, no violation was established and no penalty was forfeited. It is therefore not in dispute that the AP was, in principle, authorized to decide to cancel the order pursuant to Article 5:34, second paragraph, of the Awb.
It is also not in dispute that the assessment must be based on the new software program that is used for opening the container with the waste card and the new waste card system. It is therefore not necessary to assume the situation as it was before the imposition of the order subject to penalty. The court was therefore not bound by the judgment of the judge in preliminary relief proceedings of the court from 2017 about this old waste pass system.
It is no longer in dispute that the burden relates to the storage and retention of personal data. Finally, it is no longer in dispute that the so-called Diftar system will not be introduced. The Division will therefore not discuss the grounds put forward by [appellant] in this regard.
The scope of the request
7. [appellant] has requested the Department to instruct the AP to take enforcement action against any processing of personal data by the municipality.
This procedure concerns the lifting of the order subject to periodic penalty payments in connection with the collection of household waste in underground waste containers. The request that [appellant] submitted to the Division on appeal to order the AP to take action against any processing of personal data by the municipality is significantly broader and falls outside the scope of the original request. The Division will not grant this request for that reason alone.
What is in dispute?
8. It is in dispute whether the AP was allowed to take the position that the burden could be lifted because the new software program no longer violates the AVG with the processing of the data from the waste pass when opening the containers.
What data is processed?
9. The data that is processed is the number that is stated on the waste pass. A waste pass is linked to each residential address with its own number, the so-called internal chip code. This number is processed when a holder holds his waste pass in front of the card reader on the waste container and the internal chip code of the waste pass is compared with an authorization list stored on the card reader. For this, the internal chip code is stored on the volatile memory of the card reader, the so-called whitelist. The internal chip code of a holder's waste card is then almost immediately converted into a generic 9999 number and removed from the whitelist again when the container closes. As soon as the number of the waste card has been anonymised, the address associated with that number can no longer be traced. The anonymized number is stored on the card reader along with the time when the container was opened and a number of technical aspects of the container.
Insofar as [appellant] argues that fraud can be committed with this system, as a result of which data are processed more and longer, that does not play a role in determining the basis of the processing. The risk of misuse of the system relates to its security and is not important for determining the lawfulness of the processing.
Should the task of public interest be in a formal law?
10. According to the AP, the data can be processed in this case on the basis of Article 6, first paragraph, preamble and under e, of the GDPR. This paragraph provides that the processing, insofar as it is relevant, is lawful if it is necessary for the performance of a task carried out in the public interest. Pursuant to the third paragraph of Article 6, a task of general interest must be established by Union or Member State law.
It follows from recitals 41 and 45 of the preamble that the GDPR does not require specific legislation for each individual processing. Legislation that serves as the basis for various processing operations will suffice. That legislation must be clear and precise and its application must be predictable for those to whom it applies. It does not follow from these considerations that the necessity for the processing must arise from a law in the formal sense, as [appellant] argues. Nor does such an obligation arise from the Charter of Fundamental Rights of the European Union (hereinafter: the EU Charter).
Also according to the ECHR, contrary to what [appellant] argues, a formal law is not required. The requirement that interference must be provided for 'by law' within the meaning of Article 8(2) ECHR merely means that the contested measure must have a basis in national law and be in accordance with the requirements of the rule of law. That can also be lower regulations.
Nor can it be inferred from Article 10(1) of the Constitution that each individual infringement must also be provided for by formal law. The term 'by or pursuant to the law' allows subordinate legislation to impose restrictions. In this case, the required law that must lay down rules for the protection of privacy pursuant to Article 10, second paragraph, of the Constitution is the GDPR and the Implementation Act of the General Data Protection Regulation (hereinafter: the UAVG).
The argument fails.
What is the assessment framework?
11. The processing of personal data may be lawful if it is necessary for the performance of a task carried out in the public interest. To this end, it must first be assessed whether the purpose for which the personal data are processed is well-defined and explicitly described. It must also be assessed whether the relevant purpose is also achieved with the processing of the personal data at issue. In doing so, the goal must fit within the task of general interest. In the event that the processing of the personal data is necessary for achieving the specific purpose in this sense, it must then be assessed whether the invasion of privacy is proportionate to the interests served by the processing of the personal data. As the Division previously ruled in the judgment of 20 September 2017, ECLI:NL:RVS:2017:2555, in the light of the EU Charter it must be assessed whether the invasion of privacy is limited to what is intended to achieve the purpose is strictly necessary. In particular, it must be assessed whether the purpose for which the personal data are processed cannot reasonably be achieved in another way that is less detrimental to the persons involved in the processing of personal data. The intensity with which this must be done is partly determined by the specificity of the proposed alternatives. In other words: the more detailed the person concerned describes the alternative, the more intrusive the investigation of the AP must be.
With this assessment of the interests in the specific case, the GDPR is in accordance with Article 8 of the ECHR. Contrary to what [appellant] argues, that article does not entail that a separate, broader assessment should take place in addition to this test of interests.
What is the public interest task?
12. Together with the court, the Division is of the opinion that the responsibility of the municipality to ensure the collection of household waste must be regarded as a task of general interest. This task arises from Article 10.21 of the Environmental Management Act, the National Waste Management Plan drawn up on the basis thereof and the 2012-2020 municipal waste plan based on it. The Environmental Management Act not only instructs the municipality to collect waste, but also to take into account the applicable waste management plan and the preferential order included therein. In view of this, the AP rightly takes the position that the prevention of residual waste and the separate collection of household waste also fall under this task of general interest of the municipality. The municipal authorities are given a certain amount of leeway to fulfill this task. The principles of the municipal waste plan are to minimize residual waste and to provide as much as possible separated reusable materials such as paper, glass, plastic, etc., so that they can be reused.
What are the purposes?
13. The purposes served by the processing of the personal data concern the prevention of use of the containers by companies and by non-Arnhemmers, determining which collection routes are followed and determining in which districts information is required about the separation of waste.
In the opinion of the Division, these goals are well-defined and explicitly defined. The Division is also of the opinion that those purposes are achieved with the processing of the data. After all, the containers can only be opened with waste passes that have been issued to people who live at an address in Arnhem. Furthermore, the waste pass system can keep track of when and how quickly a container for residual waste is full. This makes it possible to determine which containers must be emptied and in which districts information about the separation of waste is necessary to further reduce the amount of residual waste.
Is the processing necessary for the performance of a task carried out in the public interest?
14. As explained above, the necessity assessment involves weighing up alternatives and interests. The fact that the processing of the data must be necessary within the meaning of Article 6(1)(e) of the GDPR does not therefore mean that the processing is only lawful if the task of public interest cannot be fulfilled without data being collected. are processed. In other words, as [appellant] rightly states, the collection of household waste can take place without data being processed. This does not mean, however, that for that reason alone there is no need for data processing when collecting household waste in containers that must be opened with an address-bound waste card. This is only the case if there are other ways of fulfilling the task of general interest that can achieve the same purpose or if the processing is disproportionate.
The freedom that the Municipal Executive has in fulfilling its task in the public interest also means that the mere fact that the Municipal Executive has held an advisory referendum does not mean that processing is therefore not necessary, as [appellant] argues.
The Division does not follow [appellant] in his argument that this method of testing is contrary to the principle of minimal data processing as referred to in Article 5, first paragraph, opening words and under c, of the GDPR. The basic principle of the GDPR is not that the processing of so-called ordinary personal data, such as an address, is prohibited. The GDPR aims to regulate the processing of this data. There is also no fundamental right not to process this type of personal data.
15. As [appellant] rightly argues, even if only a single piece of data is processed for a short period of time, that processing must comply with the GDPR. Contrary to what [appellant] argues, the extent of the processing does, however, play a role in considering whether the processing is proportional. In this case, the data of the waste card is briefly stored on the volatile memory of the card reader in order to be able to check it with the data on the authorization list. The data is anonymized immediately afterwards and is therefore not stored. The Division is of the opinion that this processing is small and limited to what is necessary to achieve the objectives of the municipality. The AP was therefore allowed to take the position that the infringement for [appellant] is proportionate to the purpose to be served by the processing.
16. Like the court, the Division is of the opinion that the AP could take the position that the Commission has sufficiently demonstrated that the proposed alternatives do not achieve the intended goals.
The controller must demonstrate that processing is necessary for the achievement of a particular purpose. However, the controller does not have to think of all possible alternatives. Contrary to what [appellant] argues, the fact that he has to present alternatives does not mean that the burden of proof is reversed.
It is plausible that if the containers were opened again, it would not be possible to prevent non-residents of Arnhem and companies from dumping their waste there. At the hearing on appeal, the representative of the Board stated that 7% more residual waste was deposited in the containers during the period in which the containers were opened. The purpose of preventing misuse cannot be achieved by using a waste pass that is not linked to an address. After all, in that case the circulation of the waste cards cannot be controlled by the municipality and there is a chance that waste cards will end up with companies or non-residents of Arnhem. Finally, the Commission has made it plausible that with the introduction of garbage bags with a price surcharge, the objectives of the municipal waste plan 2012-2020 will not be achieved because the waste will be separated less well and will lead to more nuisance in public spaces.
17. From the necessity criterion, which results from Article 8 of the ECHR, no stricter requirements arise in a case such as this one than the test that must be carried out on the basis of Article 6 of the GDPR. Now that the processing of the data complies with (Article 6 of) the GDPR, the AP was allowed to take the position that the data processing does not violate Article 8 of the ECHR.
18. In view of the foregoing, the Division agrees with the District Court that the purpose cannot reasonably be achieved in a different manner that is less detrimental to the person involved in the processing of personal data. The court has therefore rightly ruled that the AP was allowed to take the position that the board will no longer violate the GDPR if the burden is lifted. The court has also sufficiently substantiated this judgment. The fact that the court does not explicitly mention all the grounds of appeal of [appellant] does not mean that it has not taken them into account in its decision. [Appellant's] argument fails.
Conclusion
19. The appeal is unfounded. The impugned verdict must be affirmed.
20. The AP does not have to reimburse legal costs.
Decision
The Administrative Jurisdiction Division of the Council of State
confirms the attacked statement.
Adopted by mr. J.A.W. Scholten-Hinloopen, chairman, and mr. B.P. Vermeulen and mr. E.J. Daalder, members, in the presence of mr. S.C. van Tuyll van Serooskerken, clerk of the court.
The chairman is unable to sign the decision.
The clerk is unable to sign the decision.
Pronounced in public on June 30, 2021
290
APPENDIX
ECHR
Article 8:
1. Everyone has the right to respect for his private and family life, his home and his correspondence.
2. No interference by any public authority is permitted in the exercise of this right, except to the extent provided for by law and necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country , the prevention of disorder and crime, the protection of health or morals or the protection of the rights and freedoms of others.
charter
Article 8:
1. Everyone has the right to the protection of their personal data.
2. This data must be processed fairly, for specified purposes and with the consent of the data subject or on any other legitimate basis provided for by law. Everyone has the right to inspect the data collected about him and to rectify it.
3. An independent authority ensures that these rules are observed.
GDPR
Article 5 Principles regarding the processing of personal data
1. Personal data must:
(a) processed in a manner that is lawful, fair and transparent towards the data subject ("lawfulness, fairness and transparency");
(b) collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research or statistical purposes shall not be considered incompatible with the original purposes in accordance with Article 89(1) ("purpose limitation");
(c) adequate, relevant and limited to what is necessary for the purposes for which they are processed ('minimum data processing');
d) are accurate and updated if necessary; all reasonable steps must be taken to delete or rectify without undue delay any personal data that are inaccurate in view of the purposes for which they are processed ("accuracy");
e) be kept in a form that makes it possible to identify data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods to the extent that the personal data are processed solely for the purpose of archiving in the public interest, scientific or historical research or statistical purposes in accordance with Article 89(1), provided that the appropriate technical and organizational measures required by this Regulation are applied. taken to protect the rights and freedoms of the data subject ("storage restriction");
f) processed by appropriate technical or organizational measures in such a way as to ensure appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage ("integrity and confidentiality ").
2. The controller is responsible for and can demonstrate compliance with paragraph 1 ("accountability").
Article 6 Lawfulness of the processing
1. Processing is only lawful if and insofar as at least one of the following conditions is met:
a) the data subject has consented to the processing of his/her personal data for one or more specific purposes;
b) the processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract;
c) the processing is necessary for compliance with a legal obligation to which the controller is responsible;
d) the processing is necessary to protect the vital interests of the data subject or of another natural person;
e) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority conferred on the controller;
f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where the interests or fundamental rights and freedoms of the data subject which require the protection of personal data outweigh those interests, in particular when the person concerned is a child.
Point (f) of the first subparagraph shall not apply to processing by public authorities in the performance of their duties.
2. Member States may maintain or introduce more specific provisions to adapt the way in which the rules of this Regulation with regard to processing for the purposes of compliance with paragraph 1(c) and (e) are applied; to this end, they may further specify specific processing rules and other measures to ensure lawful and proper processing, including for other specific processing situations as referred to in Chapter IX.
3. The legal basis for the processing referred to in points (c) and (e) of paragraph 1 shall be determined by:
a) Union law; or
b) Member State law applicable to the controller.
The purpose of the processing shall be determined in that legal basis or, in relation to the processing referred to in point (e) of paragraph 1, it is necessary for the performance of a task carried out in the public interest or for the exercise of official authority conferred on the controller . That legal basis may contain specific provisions to adapt the application of the rules of this Regulation, including the general conditions on the lawfulness of processing by the controller; the types of data processed; The involved; the entities to which and the purposes for which the personal data may be provided; the target limitation; the storage periods; and the processing activities and procedures, including measures to ensure lawful and fair processing, such as those for other specific processing situations referred to in Chapter IX. Union or Member State law must meet an objective of public interest and must be proportionate to the legitimate aim pursued.
4. […].
awb
Article 5:34
1. The administrative authority that has imposed an order subject to a penalty may, at the request of the offender, cancel the order, suspend its duration for a specified period or reduce the penalty in the event of permanent or temporary total or partial impossibility for the offender to fulfill his obligations. comply.
2. The administrative authority that has imposed an order subject to a penalty may, at the request of the offender, lift the order if the order has been in force for a year without the penalty being forfeited.
Laws of environmental Conservation
Article 10.21
1. The municipal council and the mayor and aldermen, whether or not in collaboration with the municipal council and mayor and aldermen of other municipalities, shall ensure that at least once a week the household waste, with the exception of coarse household waste, is collected from each within its territory. site where such waste can regularly be generated.
2. In addition to the first paragraph, in the interest of efficient waste management, rules may be laid down by Order in Council on the responsibility of the municipal council and mayors and aldermen for the collection of waste materials to be designated in this regard that are of nature and composition are comparable to household waste and come from designated sources.
3. If the second paragraph has been applied, those waste materials are regarded as household waste.
4. The municipal council may decide to collect other components of household waste separately.
