RvS - 201902604/1/A3

RvS - 201902604/1/A3
Court:	RvS (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:	Article 4(7) GDPR Article 15 GDPR
Decided:	22. 01. 2019
Published:	22. 01. 2019
Parties:	GGD Flevoland
National Case Number:	201902604/1/A3
European Case Law Identifier:	ECLI:NL:RVS:2019:3848
Appeal from:	Rb. Midden-Nederland (District Court of First Instance)
Language:	Dutch
Original Source:	de Rechtspraak (in NL)

The Dutch State Council (Raad Van Staten) decided on the equal treatment by joint controllers of a data subject's access request.

English Summary

Facts

The claimant’s son applied for social support at home. Following the application, the City Public Health Department investigated and addressed a recommendation on whether the social support should be granted to the City Council. The City Council decided to not grant the social support. Then, the claimant requested a copy of the files processed during the application process, including the son's personal data related to his medical files. The City Council refused to grant the access.

Dispute

Who is the relevant controller?

Holding

The Court first considered that all public entities involved in the application process and not only the City Council were joint controllers. Thus, the access request regarding the personal data could have been sent to the City Public Health Department as well. Then, the Court considered that the access to the personal data should have been granted by the City Council under the data protection law. However, the City Council already destroyed the personal data after it refused to grant the social support. Therefore, the Court considered that the refusal was legitimate.

Comment

Share your comment here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the Dutch original for more details.

DECISION

201901832/1/A3

Date of judgment: 13 November 2019

SECTION
ADMINISTRATIVE LAW

Ruling on the appeal of:
[Appellant A] and [Appellant B], both residing at [residence],
against the judgment of the District Court of Midden-Nederland of 31 January 2019 in Case No 18/1037 in the proceedings between:
[appellants]
and
the day-to-day management of the GGD Flevoland.
Process sequence
By decision of 10 August 2017, the Executive Board rejected the request of [appellants] for access to and a copy of their personal data contained in [person's] file.
By decision of 30 January 2018, the Executive Board declared the objection made by [appellants] unfounded.
By interlocutory judgment of 27 July 2018, the District Court gave the Executive Board the opportunity to rectify the established defect in the decision of 30 January 2018 within six weeks after the interlocutory judgment was sent.
The Executive Board took this opportunity and declared the objection inadmissible by decision of 9 August 2018. In doing so, the Executive Board annulled the decision of 30 January 2018.

By decision of 31 January 2019, the District Court upheld the appeal lodged by [appellants] against the decision of 9 August 2018 and annulled that decision insofar as it relates to the application under the Personal Data Protection Act (Wbp). It declared the objection lodged against the decision of 10 August 2017 to be well-founded and rejected the request for inspection. In doing so, it determined that its decision will replace the decision of 9 August 2018 insofar as it has been annulled. Finally, she rejected the claim for damages. This judgment is attached.

[Appellants] have lodged an appeal against this decision.
The Executive Board has given a written explanation.
[Appellants] have submitted further documents.
The Division heard the case on 30 October 2019, where [appellants] and the Executive Board, represented by P.D.J. Vegter, appeared.

Considerations
1.    The legal framework, including the relevant provisions of Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter the APC), is set out in an Annex. This annex is part of the judgment.

Introduction
2.    [person] is the adult son of [appellants]. He applied to the municipality of Almere in 2017 for an indication 'Protected Living' under the Social Support Act 2015 (hereinafter: Wmo 2015). He made this application without the knowledge of his parents. In the context of this application, GGD Flevoland carried out the research referred to in Article 2.3.2 of the Wmo 2015 and on 1 June 2017 issued an advisory report to the Municipal Executive of Almere (hereinafter also referred to as: Municipal Executive). This advice is based on a file which includes medical details of [person] and a report of an interview between employees of GGD Flevoland and [person] about protected housing.

2.1.    On 31 July 2017, [appellants] asked the Executive Board for access to and a copy of the personal data relating to them that were processed as part of the investigation carried out by GGD Flevoland in connection with their son's application. By decision of 10 August 2017, the Executive Board rejected that request because [person's] file is a medical file and he did not grant permission to inspect it. By decision on the objection of 30 January 2018, the Executive Board declared the objection of [appellants] unfounded.

The interim and final verdict of the court
3.    In its interlocutory judgment of 27 July 2018, the Court rejected the argument of [appellants] that only the Municipal Executive of Almere is responsible within the meaning of Section 1(d) of the Wbp. It further established that, contrary to what the Executive Board had assumed, the request of [appellants] of 31 July 2017 was based on the Wbp. In its decision on objection of 30 January 2018, the Executive Board therefore wrongly did not (also) assess the request for inspection on the basis of the Wbp. The District Court then gave the Executive Board the opportunity to rectify this shortcoming. In order to rectify the defect, the Executive Board had to decide on [appellants'] request for inspection in accordance with Section 35 of the Wbp, according to the District Court.

3.1.    The Executive Board took this opportunity and again decided on [Appellants'] objection. By decision on the objection of 9 August 2018, the Executive Board revoked the earlier decision of 30 January 2018 and declared the objection inadmissible as yet. According to the Executive Board, the rejection of the request for access to and a copy of personal data, insofar as these relate to [person's] medical file, does not constitute a decision within the meaning of Article 1:3 of the General Administrative Law Act (hereinafter: Awb). With regard to the request for inspection pursuant to Section 35 of the Wbp, the Executive Board has not applied this provision because of the protection of the person concerned or of the rights and freedoms of others, as referred to in Section 43, opening words and under e, of the Wbp.

3.2.    In its final judgment of 31 January 2019, the District Court ruled that, insofar as the rejection of the application was based on Section 7:457 of the Dutch Civil Code, the objection was rightly declared inadmissible. In so far as the application is a matter of private law, according to the District Court. In so far as the rejection of the application is based on the Wbp, the Executive Board wrongly failed to recognize that the AGM had entered into force in the meantime. The decision of 9 August 2018 therefore contains a lack of reasoning. The District Court subsequently ruled that, contrary to the opinion of [the appellants], the AGM does not entitle [person] to actually obtain the file and the contents of the interview report between [person] and the employees of GGD Flevoland about the home situation. However, the Executive Board should have given access to the processing of [appellants'] personal data in the call report. To that extent, the Executive Board wrongly declared the objection inadmissible, according to the District Court. The District Court declared the objection of [appellants] well-founded. Since the file has been destroyed in the meantime, the District Court has reason to reject the request for inspection on the basis of the AGM. Finally, the District Court rejected the application for damages. For this purpose, it considered it important that although the decision of 9 August 2018 was unlawful, [the appellants] did not make it plausible that the alleged immaterial damage was the result of the unlawful decision of 9 August 2018.

The dispute on appeal

i.    Processing manager

4.    [appellants] first of all argue that the District Court has misunderstood that it is not GGD Flevoland that is responsible for processing, but the Municipal Executive of Almere. GGD Flevoland is only an advisor hired by the Municipal Executive and the Municipal Executive remains, in view of Article 5.1.1 of the Wmo 2015, fully competent and responsible for the processing of personal data in the context of the investigation referred to in Article 2.3.2 of the Wmo 2015, according to [Appellants].

4.1.    The controller within the meaning of Article 4(7) of the Avg is a natural or legal person, a public authority, a service or other body which, alone or jointly with others, determines the purpose and means of processing personal data. As rightly considered by the court, GGD Flevoland has control over the preparation and content of the advice it issues to the Municipal Executive in the context of Article 2.3.2 of the Wmo 2015. For the purpose of this independent advice, a file is created in which, among other things, the medical file and the report of the interview with [person] were located. Although this file forms the basis of the advice, the file itself, as confirmed once again by the Executive Board at the session of the Division, is not transferred to the College. The Board only has access to the advice. The fact that an opinion is issued to the Board does not make it, as the District Court rightly ruled, controller for the processing of the personal data included in the file on which the opinion is based. As the District Court also rightly ruled, the circumstance that the Municipal Executive is authorized pursuant to Section 5.1.1 of the Wmo 2015 to process personal data received in connection with the application for a Protected Living Indication does not lead to a different conclusion. This exclusively concerns the processing of personal data by the Municipal Executive. Moreover, the Avg does not rule out the possibility that several government bodies may be responsible for processing. Insofar as the Municipal Executive also processes personal data of [appellants], they are free to submit a request for inspection to the Municipal Executive, as also considered by the District Court.

The argument fails.

ii.    The annulment of the file

5.    [Appellants] further submit that they have doubts as to whether the file was actually destroyed because the Executive Board failed to provide evidence thereof. According to them, the Court wrongly saw no reason to request such documentary evidence. They further argue that the decision to destroy the file is a decision as referred to in Section 6:19 of the Awb, because the file is the subject of the dispute. This nullification is unlawful, because the Executive Board was not authorised to take a decision to nullify the file. According to [the appellants], this power rests exclusively with the Executive Board. For this reason the Executive Board performed acts and took decisions as referred to in Section 8:88(1)(a) and (b) of the General Administrative Law Act. According to [Appellants], contrary to the Court's judgment, the immaterial damage suffered is directly and exclusively related to the unlawful decision to destroy the file and the destruction itself.

5.1.    In a letter dated 6 September 2018, the Executive Board informed the District Court that the file on which the advice on the indication Protected Living was based had been destroyed at the request of [person]. Like the District Court, the Division does not see any reason to doubt this notification, so the District Court was not obliged to collect any further evidence of this.

5.2.    The argument of [appellants] that the setting aside of [person's] file is a decision within the meaning of Section 6:19(1) of the Awb and therefore had to be included in the proceedings before the District Court was unsuccessful. Pursuant to Section 6:19(1) of the General Administrative Law Act, the appeal also relates by operation of law to a decision to revoke, amend or replace the contested decision, unless the parties have an insufficient interest in doing so. The subject matter of the dispute before the court was the decisions on objection of 30 January and 9 August 2018 regarding the rejection of the request for access to [appellants'] personal data in [person's] file. Although the dispute ultimately revolved around access to that file, the Executive Board did not revoke, amend or replace the decisions of 30 January and 9 August 2018 by annulling the file. The destruction of the file at the request of [person] is therefore, contrary to what [appellants] assume, not a decision within the meaning of Article 6:19 of the General Administrative Law Act.

5.3.    The Court has rightly seen no reason to include the annulment of [person's] file in the appeal procedure.

Final sum

6.    The appeal is unfounded. The judgment under appeal must be upheld insofar as it is under appeal.

7.    There are no grounds for an order to pay the costs of the proceedings.

Decision

The Administrative Jurisdiction Division of the Council of State:

confirms the decision of the court, if attacked.

Thus determined by Mr C.J. Borman, member of the single chamber, in the presence of Mr R. Grimbergen, Registrar.

w.g. Borman w.g. Grimbergen

member of the single chamber of the Registrar

Pronounced in public on 13 November 2019

581.

ANNEX
 
Social Support Act 2015

Article 2.3.2

1. If a need for social support is reported to the Municipal Executive, the Municipal Executive will carry out an investigation in accordance with the second to eighth paragraphs as soon as possible, but no later than within six weeks, in consultation with the person by or on behalf of whom the report was made and, where possible, with the informal carer or informal carers or his representative. The Municipal Executive will confirm receipt of the report.

[…].

Article 5.1.1

1. The Municipal Executive is authorised to process the client's personal data, including data concerning health which are necessary for the assessment of the client's need for support for his participation or self-reliance or shelter or protected living, as well as personal data of the client's spouse, parents, children living at home and other housemates which are necessary in order to determine what assistance they offer or can offer to the client, insofar as these have been obtained within the framework of the investigation referred to in Article 2.3.2 or by virtue of Article 2.3.8, 5.2.2, 5.2.3, 5.2.4 or 5.2.5 and necessary for the implementation of Article 2.1.4, 2.1.5, 2.3.2, 2.3.3, 2.3.5, 2.3.6, 2.3.9, 2.3.10, 2.4.1 or 2.4.3.

[…].

Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).

Article 4

For the purposes of this Regulation, the following definitions shall apply:

[…];

(7) 'controller' means a natural or legal person, a public authority, a service or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of such processing are laid down in Union or Member State law, it may specify the controller or the criteria for designating the controller;

[…].

Article 15

1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data relating to him or her are being processed and, if so, to obtain access to those personal data and to the following information:

(a) the purposes of the processing;

(b) the categories of personal data concerned;

(c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

(d) if possible, the period for which the personal data are to be stored or, if this is not possible, the criteria for determining it;

(e) that the data subject shall have the right to obtain from the controller the rectification, erasure or restriction of the processing of personal data relating to him or her and the right to object to such processing;

(f) the data subject shall have the right to lodge a complaint with a supervisory authority;

(g) where personal data are not collected from the data subject, any available information as to their source;

(h) the existence of automated decision making, including the profiling referred to in Article 22(1) and (4), and, at least in those cases, useful information on the underlying logic and the importance and likely impact of that processing on the data subject.

[…].

Implementing Act General Data Protection Regulation

Article 34

A written decision on a request as referred to in Articles 15 to 22 of the Regulation shall be taken within the time limits referred to in Article 12(3) of the Regulation and, insofar as it has been taken by an administrative body, shall be deemed to be a decision within the meaning of the General Administrative Law Act.

Book 7 of the Dutch Civil Code

Article 7:457

1. Without prejudice to the provisions of Article 448(3), second sentence, the counsellor shall ensure that no information relating to the patient or access to or copy of the documents referred to in Article 454 shall be given to anyone other than the patient without the patient's consent. If such information is provided, it shall only be provided in so far as this does not harm another person's privacy. Provision may be made without observing the restrictions referred to in the preceding sentences, if required by or pursuant to the law.