Rb. Rotterdam - ROT 19/1395

Rb. Rotterdam - ROT 19/1393
Court:	Rb. Rotterdam (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:	Article 5(1)(c) GDPR Article 6(1)(e) GDPR Article 17(1)(d) GDPR
Decided:	18. 3. 2020
Published:	25. 3. 2020
Parties:	Anonymous vs. The Board of the Legal Aid Council
National Case Number:	ROT 19/1393
European Case Law Identifier:	ECLI:NL:RBROT:2020:2257
Appeal from:	n/a
Language:	Dutch
Original Source:	(in NL)

The Rotterdam district Court hold that the applications for legal aid aimed at challenging a first instance judgement do not require the attachment of the judgement itself, under Article 6(1)(e) GDPR. Thus, the deletion request concerning the judgement submitted in support of the application had to be granted, under Article 17(1)(d) GDPR. Lastly, the Court pointed out that the retention period of personal data must be kept to a minimum in accordance with the data minimisation principle.

English Summary

Facts

In October 2017, a citizen, the Applicant, submitted applications for legal aid aimed at lodging an appeal against a municipality. To support its application, the Applicant submitted additional judgements which include personal data about him. One of the document was the first instance judgement.

In May 2018, the Applicant asked to the Board of the Legal Aid Council, the Defendant, the deletion of the judgements attached to the applications.  

The Defendant claimed that they needed those judgments to assess whether they could grant the legal aid. They claimed that the processing was necessary for the performance of a task carried out in the public interest. They argued that the applicant should submit judgements linked to the proceeding concerned by the legal aid application, to have a satisfactory understanding of facts.

The Applicant claimed that the judgements have been attached to the application for attachment without his consent and there were unlawfully processed. He also claimed that information about the mental health status was included in those judgements and that it was not necessary for the Defendant to store them for ten years.

Dispute

Τhe Court had to assess whether the legal aid council was required to delete the information about the mental health status of the plaintiff according to Article 17(1)(d) GDPR.

Holding

The Court recalled that deletion request under Article 17(1)(d) must be granted if the personal data have been unlawfully processed. In the present situation, the Court issued that the personal data were processed for the performance of a task carrier out in the public interest, under Article 6(1)(e) GDPR. It stressed out that Article 6(1)(e), read in conjunction with 6(3), in the lights of Recital 41, the basis for the processing does not necessarily have to be laid down in a legislative act, but it must be” clear and precise and its application should be foreseeable to persons subject to it”. In this regard, the Court hold that the application for legal aid should include a “satisfactory description of the case” but does not prescribe any particular attachment. The Court made clear that only personal data that are necessary to have a satisfactory description of the case should be processed.

As the Controller did not rely on another legal basis, the Court issued that the Defendant unlawfully processed the personal data included in the judgement submitted within the application of the legal aid. As a consequence, the Court ruled that the Defendant should have granted the claimant’s request for deletion under Article 17(1)(d) GDPR.

In addition, the Court confirmed that the judgements include sensitive data and that the Defendant unsuccessfully demonstrated that the retention period of ten years complied with the data minimization principle, as foreseen in Article 5(1)(c) GDPR and Recital 39 GDPR.

Comment

Share your comment here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the Dutch original for more details.

Court of Rotterdam

Administrative law

Case number: ROT 19/1395

judgment of the multiple chamber of 18 March 2020 in the case between
[plaintiff] , at [residence of plaintiff] , plaintiff,

and
the Board of the Legal Aid Board, defendant,

Agent: Mr C. Wijnstra.
Litigation process

By decision of 23 August 2018 (the primary decision), the defendant rejected a claimant's request for erasure of personal data.

By decision of 4 February 2019 (the contested decision), the defendant dismissed the claimant's objection as unfounded.

The claimant lodged an appeal against the contested decision.

The defendant submitted a statement of defence.

The parties submitted further documents.

The examination at the hearing took place on 9 January 2020 at the same time as the examination of the case with case number ROT 19/1393. The plaintiff appeared. The defendant has been represented by his agent.

Considerations
1.1.

On 30 October 2017, mr. [name of lawyer] , attorney at law, on behalf of the plaintiff, submitted three requests for additions to the defendant in connection with civil appeal proceedings (to be conducted) against the municipality [name of municipality]. All three applications are accompanied by judgments of the Subdistrict Court of the District Court of Rotterdam. In each of these judgments it is stated - with the facts - that the plaintiff (in 2008) [state of mind] has been affected.
1.2.

By judgments of 12 January 2018 and 15 January 2018 the defendant granted the three additions.
1.3.

In a letter dated 31 May 2018, the plaintiff requested the defendant to erase from the defendant's systems the judgments attached to the applications for additions.

2. The defendant based the contested decision on the following grounds. The basis for the processing of personal data contained in the judgments can be found in Article 6(1)(e) of the General Data Protection Regulation (AVG): the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. For the assessment of applications for inclusion, the legal aid provider must provide the necessary information on behalf of the person seeking legal aid so that the application can be assessed in the light of the legal criteria. Pursuant to Section 24(3) of the Legal Aid Act (Wrb), the applicant must provide a satisfactory description of the case. The policy adopted by the defendant (published on https://kenniswijzer.rvr.org) states that, as far as possible, supporting documents must be attached to the application. This can be a judgment, especially if the requested legal aid is aimed at lodging an appeal against that judgment. Pursuant to the Basic Selection Document under the Dutch Archives Act a retention obligation of ten years applies.

3. The plaintiff has argued the following. The judgments have been attached to the applications for attachment without the consent of the plaintiff. There are no legal grounds for this. The judgments contain privacy-sensitive information, including information about the health of the plaintiff. The defendant did not need the judgments for the assessment of the applications for additions. The plaintiff does not agree that the judgments will be kept for ten years.

4. For the rules applicable in this case, reference is made to the Annex. It forms part of this judgment.
5.1.

It is not disputed that the judgments contain personal data as referred to in Article 4, opening words and under 1 of the AVG. The claimant's request must be regarded as a request for the deletion of personal data as referred to in Article 17(1) of the AVG.
5.2.

Pursuant to Article 17(1)(d) of the AVG, such a request must be granted if the personal data have been processed unlawfully. Pursuant to Article 6(1)(d) of the AVG, the processing of personal data is only lawful if and insofar as at least one of the conditions referred to in a-f is met. According to the defendant, condition e applies here: the processing is necessary for the performance of a task in the public interest or in the context of the exercise of public authority.
5.3.

According to Article 6(3) of the AVG, where personal data are processed in the performance of a task carried out in the public interest or in the exercise of official authority, the legal basis for the processing must be determined by Union law or national law applicable to the controller. That legal basis shall specify whether the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority. According to point 41 in the preamble to the AVG, the legal basis does not necessarily have to be laid down in a law in a formal sense, but it must be 'clear and precise and its application must be predictable for those to whom it applies'.
5.4.

According to the defendant, the fact that, in the event of an appeal, the judgment of the first instance has to be attached to the application for inclusion is a consequence of Article 24(3) of the Working Conditions Act. This provision prescribes, in short, that the application for inclusion must contain a satisfactory description of the case. The Court is of the opinion that this provision in itself, with respect to the processing of the personal data included in the judgments, does not constitute a sufficient legal basis as referred to above in 5.3. Indeed, the provision does not specifically prescribe that the judgment of the first instance has to be submitted.
5.5.

The defendant also referred to its policy published on https://kenniswijzer.rvr.org. According to the defendant, it follows that, as far as possible, substantiated documents should be attached to the application. Apart from the fact that the defendant did not explain where this rule can be found, this is not a sufficiently precise requirement. The defendant also referred to work instruction O012, but it does not appear from these work instructions either that the judgment of the first instance must be attached to the application for inclusion. Furthermore, the defendant referred to the 'work instruction laid down in Article 28 Bvr'. On the basis of these work instructions, if the procedure for which the addition has been granted has resulted in a judgment, that judgment must be submitted for the purposes of establishing the claim. This work instruction is therefore not about the presentation of the ruling of the first instance at the time of the application for addition. In the statement of defence, the defendant also referred to the Manual of Additions. In the District Court's opinion, however, it is insufficiently clear whether this is a current policy. On the website https://kenniswijzer.rvr.org, on the Laws and Regulations page, the Handbook Toedboek is listed under the heading "Archive of Manuals and Regulations". Behind it is mentioned between brackets: "Add current policy in work instructions on Knowledge Guide". The document itself is from the year 2007. In view of this, it has not been demonstrated that the defendant (currently) applies the policy that, in the event of an appeal, the decision of the first instance must be submitted with the application for inclusion. In so far as this is nevertheless the case, the court is of the opinion that this is insufficiently known to the outside world.
5.6.

It follows from the above that the conditions mentioned above in 5.3 for processing personal data on the grounds of the performance of a task in the public interest or in the exercise of public authority have not been met.
5.7.

Now that the defendant has not indicated any other legal ground mentioned in Article 6.1 of the AVG, nor has the Court found that any of these other legal grounds apply, it must be ruled that the processing of the personal data included in the judgments is unlawful. In this respect, the Court notes that, in so far as it must be assumed that the plaintiff has given permission for the inclusion of the judgments in the applications for inclusion (which the plaintiff has disputed), the claimant's request for data erasure states that she has withdrawn that permission. Pursuant to Article 7(3) of the AVG, she was entitled to do so.
5.8.

It has neither been asserted nor turned out that one of the situations referred to in Article 17, third paragraph, of the AVG occurs in which the right to erasure of data does not apply. Nor has it been stated or appeared that the right to erroneous data has been restricted in this case on the basis of the General Data Protection Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming (UAVG)).
5.9.

It already follows from the above that the defendant should have granted the claimant's request for erasure of data on the basis of Article 17 of the AVG.
5.10.

The District Court further considered the following. The judgments also contain special personal data within the meaning of Article 9 of the AVG. In the judgments it is stated (among other things) that the plaintiff was a [state of mind]. This is information about the health of the plaintiff. Pursuant to Article 9(1) of the AVG, processing of special personal data is prohibited unless one or more of the conditions referred to in the second paragraph under a-j have been met. According to the defendant, condition a (consent) applies here, because the plaintiff (through her lawyer) provided the judgments herself. Again, however, in so far as it must be assumed that the plaintiff has given her consent, the claimant's request for data erasure contains the decision that she has withdrawn that consent (see also above in 5.7). At the hearing, the court asked whether there is another basis in the GC or the UAVG for processing the special personal data, but the defendant was not able to point this out. Nor did the Court find this to be the case. It must therefore be ruled that the processing of the special personal data included in the judgments is unlawful (also for this reason).
5.11.

Needless to say, the District Court also notes the following. With respect to the retention period of ten years, the defendant invoked the retention obligation pursuant to the Archives Act. However, this is not a sufficient basis for the retention period of ten years, because the retention obligation under the Archives Act is only met if data are processed in accordance with the AVG. (Compare the judgment of the Administrative Jurisdiction Division of the Council of State of 23 August 2017, ECLI:NL:RVS:2017:2232). Under the AVG, the storage period of personal data must be kept to a minimum (see Article 5(1)(c) of the AVG and recital 39 of the preamble). In the opinion of the court, the defendant has not demonstrated that he complies with this requirement with regard to the storage of the judgments.

6. The conclusion is that the appeal is well-founded. The Court will set aside the contested decision. The court cannot definitively settle the dispute by providing for the case itself: although it follows from the foregoing that the plaintiff's request will still have to be granted, the court cannot itself remove the judgments from the defendant's systems. The court will therefore suffice with an order to the defendant to take a new decision on the objection within two weeks. In doing so, the defendant will have to take into account the considerations and directions in this judgment.

7. Because the court declares the appeal to be well-founded, the court will determine that the defendant reimburses the plaintiff for the court fee she has paid.

8. There is no reason for a procedural award, since there are no costs eligible for reimbursement.
Decision

The court:

- declares the appeal well-founded;

- set aside the contested decision;

- orders the defendant to take a new decision on appeal within two weeks after this judgment has been sent, taking into account what has been considered in this judgment;

- provides that the defendant shall reimburse to the plaintiff the court fee of € 174.

This judgment has been rendered by Mr. S. Veling, chairman, and Mr. M.G.L. de Vette and Mr. A.S. Flikweert, members, in the presence of Mr. C.H.I. Zwaneveld-Butter, registrar. The judgment was rendered in public on 18 March 2020.