RvS - 201901006/1/A2: Difference between revisions

From GDPRhub
(Created page with "{{COURTdecisionBOX <!--Information about the Court--> |Jurisdiction=Netherlands |Court-BG-Color=background-color:#ffffff; |Courtlogo=courtsNL.png |Court_Abbrevation=RvS |Cour...")
 
No edit summary
 
(3 intermediate revisions by 2 users not shown)
Line 9: Line 9:


<!--Information about the decision-->
<!--Information about the decision-->
|Case_Number_Name=201903691/1/A3
|Case_Number_Name=201901006/1/A2
|ECLI=ECLI:NL:RVS:2020:594
|ECLI=ECLI:NL:RVS:2020:898


|Original_Source_Name_1=de Rechtspraak
|Original_Source_Name_1=de Rechtspraak
|Original_Source_Link_1=https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RVS:2020:594&showbutton=true&keyword=AVG
|Original_Source_Link_1=https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RVS:2020:898&showbutton=true&keyword=avg
|Original_Source_Language_1=Dutch
|Original_Source_Language_1=Dutch
|Original_Source_Language_Code_1=NL
|Original_Source_Language_Code_1=NL
Line 22: Line 22:
|Original_Source_Language_Code_2=
|Original_Source_Language_Code_2=


|Date_Decided=26. 2. 2020
|Date_Decided=1.4.2020
|Date_Published=26. 2. 2020
|Date_Published=1.4.2020
|Year=2020
|Year=2020


<!--Information about the applied law-->
<!--Information about the applied law-->
|GDPR_Article_1=
|GDPR_Article_1=Article 79 GDPR
|GDPR_Article_Link_1=
|GDPR_Article_Link_1=Article 79 GDPR
|GDPR_Article_2=
|GDPR_Article_2=Article 82 GDPR
|GDPR_Article_Link_2=
|GDPR_Article_Link_2=Article 82 GDPR
|GDPR_Article_3=
|GDPR_Article_3=
|GDPR_Article_Link_3=
|GDPR_Article_Link_3=
Line 152: Line 152:
|Party_Name_1=Anonymous
|Party_Name_1=Anonymous
|Party_Link_1=
|Party_Link_1=
|Party_Name_2=The AP
|Party_Name_2=Minister for Legal Protection
|Party_Link_2=
|Party_Link_2=
|Party_Name_3=
|Party_Name_3=
Line 162: Line 162:


<!--Information about a possible appeal-->
<!--Information about a possible appeal-->
|Appeal_From_Body=
|Appeal_From_Body=Rb. Gelderland (Netherlands)
|Appeal_From_Case_Number_Name=
|Appeal_From_Case_Number_Name=18/3073
|Appeal_From_Status=
|Appeal_From_Status=Unknown
|Appeal_From_Link=
|Appeal_From_Link=
|Appeal_To_Body=
|Appeal_To_Body=
Line 172: Line 172:
|
|
}}
}}
<!--Here the main article starts-->
The Council of State awarded appellant with 500 EUR compensation for the unlawful sharing of his sensitive personal data. The amount was raised from 300 EUR to 500 EUR. Sensitive data in question contained strictly confidential medical information which was shared between forensic psychiatric observation clinic Pieter Baan Centrum and Regional Disciplinary Board for Healthcare in Zwolle.
==English Summary==
==English Summary==
===Facts===
===Facts===
The Data protection authority (AP) dismissed the complainant’s request to issue a sanction against a business for the alleged unlawful recording of personal data with surveillance camera. Indeed, after having carried out on-site investigations, the surveillance camera position has been adjusted to be less visible for the public road. Thereafter, the area monitored corresponded to the plot boundary with the entrance gate and a section of the public road. In this regard, the AP found that the surveillance camera’s owners had legitimate interests in installing the camera, as it was used for security purposes and that one incident already took place. For that purpose, the AP found that a limited part of the public road must be filmed and that it cannot be achieved by another less restrictive mean. In addition, the AP pointed out that the data controllers had implemented sufficient safeguards to inform the passers-by about the installation of the aforementioned camera. The AP concluded that the complainant’s privacy interests did not outweigh those of the data controller.
Appellant’s strictly confidential medical data was shared by a forensic psychiatric observation clinic with the Regional Disciplinary Board for Healthcare. The appellant was not informed about this. His subsequent objection and request for compensation was rejected by the Minister for Legal Protection on the basis that the Appellant’s honor or reputation has not been affected, nor has he suffered otherwise. The Court of Gelderland, which heard the dispute, ruled that sensitive personal data has indeed been shared unlawfully and awarded 300 EUR in damages to the Appellant.  


The complainant challenged the AP’s decision before the District Court, which dismissed the appellant’s claims as well. As a consequence, the appellant lodged an appeal against the District Court's decision before the Council of State.
===Dispute===
===Dispute===
The appellant argued that the District Court disregarded that a large part of the public road was monitored by the camera and that the incident which took place did not justify surveillance camera as it only happened once and was not directed against the data controller. In addition, it argued that the AP infriged Dutch administrative law as the authority did not send its report on its on-site investigations.
The Appellant claims that he is entitled to a higher compensation. The State Council had to assess whether that is the case.


Therefore, the Council of State had to judge whether the District Court properly balanced the appellant's and the data controller's interests, and thus if the personal data were lawfully recorded by the camera. In addition, the Council of State had to rule on the violation of Dutch administrative law.
===Holding===
===Holding===
The Council of State ruled that the surveillance camera is filming the company’s entrance gate and a section of the public road. However, only the people who are close to the plot boundary are fully captured. In addition, the Court confirmed that the data controllers implemented sufficient safeguards, such as the deletion of the images after two weeks. Finally, the Council of State confirmed that the passers-by were properly informed of the use of the surveillance camera.
The State Council agreed with the Court of Gelderland that the appellant was intitled to compensation of non-material damage according to the Dutch Civil Code and increased the amount awarded to 500 EUR. In deciding this, the Council considered the nature, duration and seriousness of the breach:
• Nature: sensitive data was processed without consent or any other applicable legal basis;
• Seriousness: sensitive data was shared with a small group of professionals and members of the Board have a duty of confidentiality by virtue of their position;
• Duration: the breach occurred on the 15th of January 2018. On 22nd of January the Board confirmed that they would disregard the information.
The Council took into account that the Appellant did not demonstrate any negative consequences of the breach.


However, as the AP failed to send the appellant its report on its on-site investigations, the District court should have issued its decision with an order to pay the costs of the proceedings and a order compensation from the court registry. Thus, the district Court issued its judgement contrary to Section 6:22 of the General Administrative Law Act.
As a conclusion, the Council of State ruled that the appeal was well-founded and annulled the District Court judgement insofar there is no order for costs.
==Comment==
==Comment==
''Add your comment here!''
''Add your comment here!''
==Further Resources==
==Further Resources==
''Share blogs or news articles here!''
''Share blogs or news articles here!''
==English Machine Translation of the Decision==
==English Machine Translation of the Decision==
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.<pre>
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
<pre>


Ruling
201901006/1/A2.


201903691/1/A3.
Date of judgment: 1 April 2020
 
Date of judgment: 26 February 2020


SECTION
SECTION
Line 206: Line 210:
Ruling on the appeal of:
Ruling on the appeal of:


[appellant] and others, residing in Zegveld, Municipality of Woerden,
[appellant], residing at [residence],
 
appellants,


against the judgment of the District Court of Midden-Nederland of 12 March 2019 in Case No 18/2879 in the proceedings between:
against the judgment of the District Court of Gelderland of 19 December 2018 in Case No 18/3073 in the proceedings between:


[appellant]
[appellant]
Line 216: Line 218:
and
and


the Personal Data Authority (hereinafter AP).
the Minister for Legal Protection.
 
Process Process


Process flow
By decision of 13 March 2018, the Minister rejected a request for compensation from [the appellant].


By decision of 15 November 2017, the AP rejected a request by [the Appellant] to take enforcement action in connection with two security cameras at Meije 300 in Zegveld.
By decision of 17 May 2018, the Minister dismissed [the appellant's] objection.


By decision of 20 June 2018, the AP dismissed [the Appellant's] objection to this.
On 6 June 2018, [the appellant] appealed against the decision of 17 May 2018 and asked the court to order the Minister to pay damages.


By decision of 12 March 2019, the court dismissed [the appellant's] appeal against the decision. This ruling is attached.
By decision of 19 December 2018, the court upheld the appeal lodged by [the appellant] against the decision of 17 May 2018, annulled the decision of 17 May 2018, revoked the decision of 13 March 2018, ordered the Minister to pay damages of € 300 to [the appellant] and ordered that this decision replace the annulled decision. This decision is attached.


The [appellant] has lodged an appeal against this decision.
The [appellant] has lodged an appeal against this decision.


The AP gave a written explanation.
The Minister has given a written explanation.
 
The Division heard the case on 1 August 2019, where [the appellant] and the Minister, represented by F. Boone, appeared.
 
The Division reopened the investigation pursuant to Section 8:68(1) of the General Administrative Law Act (Awb) and referred the case to a multiple chamber.
 
[Appellant] submitted a further document.
 
The Division heard the case on 15 January 2020, where [the appellant] and the Minister, represented by F. Boone, appeared.
 
Considerations
 
    Introduction
 
1.    On January 15, 2018, the director of the Pieter Baan Centre submitted documents containing medical information about him to the Regional Health Care Disciplinary Board in Zwolle (hereinafter referred to as: the Disciplinary Board) in a complaint procedure against him, without [the appellant's] consent and without his knowledge. The draft versions of the psychological and psychiatric sections of Pro Justitia reports sent included strictly confidential personal details of [the appellant]. On 17 January 2018, [the Appellant] was informed by the Disciplinary Board of the disclosure of the sensitive personal data and was provided with copies of the reports. On 19 January 2018, [the appellant] asked the Disciplinary Board to disregard the documents when considering his complaint against the Director. On 22 January 2018, the Disciplinary Board informed [the appellant] that his personal details would be disregarded in the complaints procedure.
 
At the end of this decision (under 39), the Section briefly set out what this decision means in more general terms and what is to be decided in this case.
 
    Decision-making
 
2.    By letter dated 4 February 2018, [the appellant] objected to the Minister's submission of the reports and applied for compensation. In the proceedings that led to the court's ruling, the Minister stated that the Disciplinary Board was contacted immediately after the sensitive personal data were sent with a request to destroy the documents as soon as they were received. The Minister also took the position that the reports were not provided deliberately in order to influence the Disciplinary Board or to damage [the appellant]. In the decision of 17 May 2018, the Minister referred to the opinion of the Disciplinary Board of 9 March 2018 that the reports should not have been provided:
 
"In the opinion of the Board, the appendices, which evidently contain medical information, were indeed wrongly provided without the complainant's consent and without his knowledge. The appendices have no relevance for the present case and (therefore) do not serve to defend the defendant. The circumstances invoked by the defendant that a clerical error has been made, or that the lawyer of the RPP, after sending the documents - and therefore too late - advised not to send the annexes, should remain at the defendant's expense. The part of the complaint is well-founded'.


Interested party A] and [appellant] submitted further documents.
The Division is of the opinion that it should be held that the Minister took the position that the processing of [appellant's] personal data was unlawful. In addition, the Minister stated that he saw no grounds for compensation because [the appellant] had not been harmed in his honour or reputation or otherwise in his person.


The Division considered the case at the session on 30 January 2020, at which [the appellant], assisted by [agent A], and the AP, represented by O.S. Nijveld and W. Steenbergen, appeared. In addition, [Interested party A] and [Interested party B], assisted by [Agent B], were heard at the hearing.
    Court ruling


Recitals
3.    The court found in the judgment that the transmission of the personal data was unlawful. [the appellant] rightly objected to the disclosure, on the grounds that he did not consent to the forwarding of his personal data as referred to in Article 8, opening words and under a, of the Personal Data Protection Act (Wet bescherming persoonsgegevens, Wbp). According to the court, [the appellant] is entitled to damages to be determined on a fair basis. With regard to the amount of the damages to be determined, the court considered it important that the privacy-sensitive personal data ended up with a small group of professionals, i.e. employees and members of the Disciplinary Board, and that they were bound by a duty of confidentiality by virtue of their duties. According to the District Court, this does not detract from the fact that [the appellant's] privacy was violated and that this was understandably perceived by the appellant as harmful and harmful. The court therefore considered compensation of € 300 to be fair and ruled that the Minister should pay this amount to [the appellant].


1.    The relevant provisions of the General Data Protection Regulation (hereinafter: AVG) and the General Administrative Law Act (hereinafter: Awb) are included in the appendix that forms part of this ruling.
    Dispute on appeal


2.    [Appellant] requested the AP to take enforcement action in connection with two security cameras at the address Meije 300 in Zegveld that are directed towards the public road.
4.    The Minister has not appealed the court's decision. In that ruling, the court ruled that the decision of 17 May 2018 was unlawful and annulled that decision, in so far as it did not award any compensation.


    On 10 April 2018, the AP conducted an on-site investigation. As a result of this investigation, the position of the cameras was adjusted so that they are less visible from the public road. In its request, the AP did not see any reason to proceed with enforcement. According to the AP, [interested party A] and [interested party B], as owners of Buitenplaats De Blauwe Meije at the address Meije 300 in Zegveld, have a justified interest in installing the cameras, as they can use them to secure their property and the goods and persons entrusted to their care. If necessary, they can also report incidents substantiated with camera images. In this context, the AP considered it important that at least one incident took place at the business premises of [interested party A] and [interested party B]. On the basis of the on-site investigation, the AP took the view that the invasion of [the appellant's] privacy when passing through the company residence and business premises of [Interested party A] and [Interested party B] was not disproportionate in relation to the purposes to be served by camera surveillance. It is necessary that the properties and persons that are located on the premises just in front of the fence are shown. For that purpose, at least the plot boundary and a limited part of the public road must be filmed. This cannot be achieved in any other less detrimental way. Passersby shall be screened as little as possible. The impact on privacy is limited to what is necessary to achieve the objectives. Stakeholder A] and [Stakeholder B] have put in place sufficient safeguards to prevent and limit undesirable consequences for data subjects. Passers-by on public roads are informed about camera surveillance by means of stickers and a sign. On this basis, the AP took the position that the privacy interests of [the appellant] did not outweigh those of [Interested party A] and [Interested party B].
5.   5. [Appellant] claims to be entitled to higher compensation than € 300.00.


3.    [the Appellant] argued that the court had misunderstood the fact that the failure to send him the report of the AP's on-site investigation was a defect that should have led to the annulment of the decision of 20 June 2018. This is contrary to Section 7:9 of the Awb. The District Court has wrongfully disregarded this defect pursuant to Section 6:22 of the General Administrative Law Act. Although he was able to respond to the report in appeal, he was obliged to lodge an appeal with the associated costs in order to be able to respond. According to [the appellant], his reaction could not be included in the decision on the objection.
    Ex officio judgement


3.1.    Failure to send the report of the on-site investigation is a defect as referred to in Article 7:9 of the General Administrative Law Act (Awb). The Court was allowed to pass over this defect pursuant to Section 6:22 of the General Administrative Law Act, because [the appellant] was not disadvantaged by it. He was still able to respond to the report on appeal. However, in the event that such defects are passed, it is reasonable to order an order to pay the costs of the proceedings and to order compensation from the court registry, unless there are special circumstances to waive this. The court has failed to do so, while no special circumstances have emerged to waive it.
6.    The District Court did not acknowledge that with the introduction of Title 8.4 in the Awb on the basis of Article 8:4, paragraph 1, opening words and under f of the Awb, the possibility to appeal against a decision regarding compensation for loss on account of unlawful management actions has lapsed. It follows from this that the District Court has annulled the decision of 17 May 2018, although rightly so, but on incorrect grounds. The court should have declared the objection against the decision of 31 March 2018 inadmissible instead of revoking this decision. Pursuant to Section 8:88 of the General Administrative Law Act, the court should have assessed whether [the appellant] was entitled to compensation.


    The argument succeeds to that extent.
7.    The court's ruling qualifies for set aside, insofar as the court has revoked the 31 March 2018 decision, has determined that the Minister will pay damages of €300 to [the appellant] and has determined that this ruling will replace the annulled decision. The Division will declare the objection to this decision inadmissible after all.


4.    [Appellant] argued that the District Court had wrongly come to the conclusion that the AP did not need to proceed with enforcement. To this end, he argues that the fact that a large part of the public road is monitored by the cameras has been disregarded. The one incident that took place that was not reported does not justify camera surveillance. This was an incident that was directed against [Interested A] and [Interested B] personally and not against the company. There are no other incidents. The camera surveillance as it exists now is not necessary. It would have sufficed to film the company's own land and as small a part of the public road as possible, for example only the verge. This is also sufficient to substantiate a possible declaration. Now, when using the public road, which gives access to his home, he is always identified. Furthermore, the District Court wrongly concluded that there are safeguards that minimize the violation of privacy as much as possible. At the time of the on-site investigation, the AP identified a number of cases that were in conflict with the AVG. This means that there was a breach at the time of the enforcement request. The AP then made recommendations to remedy those inconsistencies, assuming that they had been followed up without any certainty, according to [the appellant].
8.    The Division will assess the application for damages below.


4.1.    Stakeholder A] and [Stakeholder B] placed the cameras to protect their property and the property and persons entrusted to their care. In the event of an incident, they can make a substantiated declaration with the camera images. It is not disputed that this is in itself a legitimate interest as referred to in Article 6, first paragraph, opening words and under f of the AVG. The fact that this interest is actually present is evident from the egg incident. The fact that this incident has not been reported and that it would not have been directed against the company is irrelevant in that context.
    Applicable law


    In response to the enforcement request, the AP investigated the actual situation on the spot. The documents contain prints of immobilised camera images dated 10 April 2018, the day on which the AP was at the scene. These photographs show the plot boundary with the entrance gate and a section of the public road. There is no reason not to assume the situation at the site as established by the AP on that day. The District Court has rightly considered that no more persons on the road are being portrayed than is necessary to achieve the purpose of camera surveillance. Damage may also be caused from outside the plot, which makes it necessary to also record a section outside the plot boundary on camera. Only people who are close to the plot boundary will be fully captured. If only the verge is captured, persons are not directly identifiable. As the District Court rightly considered, the AP was allowed to put the weighty interests of [interested party A] and [interested party B] in protecting their property outweigh the interests of passers-by on the public road, since they are captured as little as possible. In addition, [Stakeholder A] and [Stakeholder B] have taken measures to minimise the undesirable consequences of camera surveillance, such as deleting the images after two weeks, protecting the VCR with a password and keeping log files of log-in attempts on the app providing access to the images. Passers-by will also be informed about camera surveillance, as considered below under 5.1. The fact that the AP made further recommendations as a result of the on-site investigation does not mean that the AVG was breached. These recommendations were made in order to further optimise the protection of personal data. Interested party A] subsequently undertook by e-mail to implement the recommendations made.
9.    On 25 May 2018, Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (the General Data Protection Regulation, hereinafter AVG) became applicable. The AVG will be directly applicable in each Member State as of 25 May 2018 (Article 99(3) of the AVG). The Wbp was repealed on 25 May 2018. The AVG has immediate effect. The transitional law contained in Section 48(10) of the AVG Implementation Act does not apply in this case.


    The argument fails.
10.    The AVG applies to the claim for damages. On 4 June 2018, i.e. after the AVG came into effect, [the appellant] requested the court to order the Minister to pay damages.


5.    [appellant] argued that the court had failed to recognise that passers-by were not properly informed about camera surveillance. To this end, he argues that the stickers are not very conspicuous because several stickers and other things have been affixed to the window near the entrance door. Moreover, one of the stickers is only visible when the company is open, because the glass entrance doors to which the sticker is affixed are closed behind wooden doors outside opening hours. The other sticker is not visible when the weather is fine, because the doors are then open. Furthermore, the public parking spaces in front of the company location are filmed. There is no mention of camera surveillance here. People who park their cars there but do not visit Buitenplaats De Blauwe Meije are not warned about camera surveillance, according to [appellant].
11.    The old law, i.e. the Wbp, applies to the assessment of the unlawfulness of the act as it occurred prior to 25 May 2018. It is not disputed on appeal that the Minister acted contrary to Section 8(a) of the Wbp and that this would also be contrary to the AVG.


5.1.    The Court rightly considered that passers-by are informed about the camera surveillance by means of applied stickers. Stickers with an image of a camera have been stuck on the door of the company and on the door of the company residence. The fact that some stickers are still stuck on the door of the company premises does not mean that the sticker warning about camera surveillance is not visible. If the claim made by [appellant] is correct that one of the stickers is not visible in good weather and the other sticker is not visible outside opening hours, at least one sticker will still be visible. The AP has determined that the stickers are in themselves clearly visible from the public road. There is no reason not to assume that the AP has established this fact.
    Article 82 of the AVG


    The fact that the parking spaces are not warned for camera surveillance cannot be addressed in this procedure. As the District Court rightly considered, this concerns a third camera that falls outside the scope of the enforcement request.
12.   Article 82 of the AVG reads as follows:


    The argument fails.
1.    Any person who has suffered material or non-material damage as a result of a breach of this Regulation shall be entitled to receive compensation for the damage suffered from the controller or processor.


6.    The appeal is well-founded. The judgment under appeal should be set aside to the extent that the District Court has failed to issue a court order to pay the costs of the proceedings and a court clerk's ruling.
2.    Any controller involved in processing shall be liable for any damage caused by processing operations in breach of this Regulation. A processor shall be liable for damage caused by processing only where the processing does not comply with the obligations laid down in this Regulation specifically addressed to processors or was carried out outside or in breach of the lawful instructions of the controller.


7.    The AP must be ordered to pay the costs of the proceedings in the manner stated below.
13.    The Minister has not disputed the competence of the administrative courts and has also declared, on request, that he is in agreement with them. As also considered by the Division in today's judgments with numbers ECLI:NL:RVS:2020:899, ECLI:NL:RVS:2020:900 and ECLI:NL:RVS:2020:901, the Administrative Court is, in its opinion, competent to adjudicate an application for compensation for material or immaterial damage resulting from an act in violation of the AVG by an administrative body pursuant to Section 8:88 of the General Administrative Law Act. The Division derives arguments for this from the AVG and the AVG Implementation Act.


Decision
14.    The AVG is directly applicable in each Member State (Article 99(3) of the AVG). Claims for compensation in the event of acts contrary to the AVG derive directly from the AVG. Article 82(6) of the AVG provides that legal proceedings for the exercise of the right to compensation are to be conducted before the courts of the Member State referred to in Article 79(2). More generally, Article 79(1) lays down the right to an effective remedy.
 
15.    The AVG does not determine which courts within a Member State have jurisdiction to rule on the right to compensation. In the absence of procedural rules of Union law, it is settled case-law of the Court of Justice of the European Union (hereinafter 'the Court of Justice') that it is for the Member States to designate the competent courts and to apply their national procedural law in cases where Union law is enforced. However, such national rules must satisfy the conditions of equivalence and effectiveness (compare the judgment of 16 December 1976, C-33/76, Rewe, ECLI:EU:C:1976:188, and the judgment of 13 July 2006, C-295/04 - 298/04, Manfredi, ECLI:EU:C:2006:461, paragraph 62). These conditions require that a national procedural rule protecting the rights which individuals derive from Union law must not be less favourable than that governing similar domestic actions (principle of equivalence) and that a procedural rule must not render the exercise of rights conferred by the Union impossible or excessively difficult in practice (principle of effectiveness). A procedural rule must also comply with the principle of effective judicial protection, as currently enshrined in Article 47 of the Charter (judgments of the Court of Justice of 18 March 2010, C-317/08, C-318/08, C-319/08 and C-320/08, Alassini and others, ECLI:EU:C:2010:146).
 
This means that, under these conditions, national law must determine which court has jurisdiction to rule on applications for compensation.
 
16.    Pursuant to Section 8:88(1)(a) of the General Administrative Law Act in conjunction with Section 34 of the Implementing Act, the administrative court has the power to order an administrative body, at the request of an interested party, to pay compensation for damage that an interested party has suffered or will suffer in connection with a written decision as referred to in Section 34 of the Implementing Act. To this end, it is envisaged as follows.
 
17.    In paragraph 3.3. Legal Protection' of the AVG Implementation Act, Article 34 reads as follows:


The Administrative Jurisdiction Division of the Council of State:
Article 34. Applicability of the General Administrative Law Act by decision of administrative bodies


I. declares the appeal well-founded;
A written decision on a request as referred to in Articles 15 to 22 of the Regulation shall be taken within the time limits referred to in Article 12(3) of the Regulation and, insofar as it has been taken by an administrative body, shall be deemed to be a decision within the meaning of the General Administrative Law Act.


II. annuls the judgment of the District Court of Central Netherlands of 12 March 2019 in case no. 18/2879 in so far as no order for costs and court clerk's fees was pronounced;
18.   Articles 15 to 22 of the AVG offer interested parties, among other things, the right of access to personal data, the right to rectification or erasure of personal data, the right to limit the processing of personal data concerning them, as well as the right to object to the processing of personal data, the right to data portability and the right not to be subjected exclusively to automated data processing.


III. orders the Personal Data Authority to reimburse the costs of the proceedings incurred by [the appellant] and others in connection with the handling of the appeal and the appeal up to an amount of € 2,100.00 (in words: two thousand and one hundred euros), attributable in full to legal assistance provided by a third party on a professional basis, on the understanding that payment to one of them the Personal Data Authority has fulfilled its payment obligation;
19. These rights are inextricably linked to the control of the processing of personal data and enable interested parties to ascertain whether personal data have been processed lawfully and, inter alia, to seek compensation for unlawful processing.


IV. order that the Authority Personal Data shall reimburse to [the appellant] and others the court fee paid by them in the amount of € 429.00 (in words: four hundred and twenty-nine euros) for the handling of the appeal and the appeal, on the understanding that payment to one of them the Authority Personal Data has fulfilled its payment obligation.
20.   For the ways in which the right to compensation can be realised, the Explanatory Memorandum (Parliamentary Papers II 2017-2018, 34851 no. 3) to the AVG Implementation Act is included in the implementation table under Section 82, "Current Title 8.4 of the General Administrative Law Act or Civil Court". The Division deduces from this that it must be possible to bring a claim for compensation for damage resulting from an infringement of the AVG by an administrative body before both the administrative courts and the civil courts.


Thus determined by J. Hoekstra, chairman, and F.C.M.A. Michiels and E.J. Daalder, members, in the presence of S. Niane-van de Put, Registrar.
21.   The Section therefore concludes from Article 8:88 of the General Administrative Law Act in conjunction with Article 34 of the AVG Implementation Act that it is in line with the intention of the national legislator that the same court that adjudicates on, inter alia, decisions of administrative bodies at a request as referred to in Articles 15 to 22 of the AVG may also be requested to pay compensation for related damage. The Division considers this to be in the interests of the concentration of legal protection and thus also in the interests of effective and efficient legal protection (principle of effectiveness and Article 47 of the Charter of Fundamental Rights of the European Union). By way of comparison, the Section refers to the judgment of the Court of Justice of the European Union of 15 April 2008, C-268/06, EU:C:2008:223, paragraph 51 (Impact), from which it can be inferred that a concentration of legal protection is in line with the principle of effectiveness. In the view of the Division, the principle of equivalence is also satisfied because the opening up of the administrative procedure is not a procedural rule which treats claims under Union law less favourably than comparable claims under national law.


w.g. Hoekstra w.g. Niane-van de Put
22.   This means that a person who, on the basis of Article 82 of the AVG, claims compensation for damage resulting from the unlawful processing of personal data by an administrative body, has the freedom of choice, in accordance with Article 8:88 of the Awb, to submit his request to the administrative court in connection with a decision as referred to in Article 34 of the AVG Implementation Act, or to realise his claim for compensation through the civil law channels. Article 8:88 of the General Administrative Law Act is interpreted as meaning that the power of the administrative court is less strictly limited to the requirement of an unlawful decision, because although there must be a connection with a decision as referred to in Article 34 of the AVG Implementation Act, this decision, for example on a request for inspection, does not have to be unlawful as such. In such a case, therefore, the administrative court may, in the application procedure pursuant to Section 8:88 of the General Administrative Law Act, give an opinion on the unlawfulness of the processing of the data to which the decision on the request for information relates. The latter decision does not have to be unlawful for this purpose, nor does it have to contain an opinion on the lawfulness of the processing of the data. The Division notes that if the request exceeds € 25,000.00, the application of Section 8:88 of the General Administrative Law Act entails that the civil court has exclusive jurisdiction to hear such a request.


chairman of the court clerk
23.    The Division is of the opinion that in this transitional phase, in which a request was made after 25 May 2018 for compensation for damage in connection with acts that took place in whole or in part before that date and that were contrary to the Wbp and would now also be contrary to the AVG, and in which the substantive assessment framework was therefore already the same, the legal protection set out under 22 must also be offered. This is in line with the views of the parties.


Pronounced in public on 26 February 2020
    Rejection of request for a preliminary ruling


805.
24.    [Appellant] asked the Division to refer a preliminary question to the Court of Justice of the European Union with a view to clarifying the answer to the question whether, and if so to what extent, article 82 of the AVG constitutes an independent basis for the award of damages by the administrative courts.


25.    The Division rejects this request. Article 82 of the AVG has direct effect and makes it possible for interested parties to realise the claim for damages for unlawful processing in the national legal order. According to settled case law of the Court of Justice (see paragraph 15 above), the organisation of the judicial procedure and the manner of legal protection are in principle matters of national law, if the EU legal preconditions are met. To this end, the Division has ruled that, in addition to the civil court, the administrative court has jurisdiction to assess a claim for damages on the basis of Section 82 of the General Administrative Law Act (AVG) by applying Section 8:88 of the General Administrative Law Act (Awb). There is no reason to ask a preliminary question, because there can be no reasonable doubt as to the answer to the question (see the judgment of the Court of Justice of 6 October 1982, Cilfit, ECLI:EU:C:1982:335, points 13, 14 and 16).


ANNEX
    Assessment of the claim for damages


26.    26. [Appellant] submits that the Court erred in its application of Section 6:106 of the Civil Code, because the amount of compensation determined on an equitable basis was set too low. He claims that he is entitled to higher damages than €300.00.


AVG
27.    Although Article 82(1) of the AVG states that full compensation for actual non-material damage resulting from infringements of the AVG must take place in a manner that does justice to the objectives of the Regulation, the AVG does not stipulate how the non-material damage must be determined and calculated. The Court of Justice has consistently held that, in the absence of Community rules, it is for the domestic legal order of each Member State to determine the rules governing the exercise of the right to compensation, subject to compliance with the principles of equivalence and effectiveness (see Manfredi judgment, paragraph 64).


Article 5
    However, recital 146 in the preamble to the AVG must be taken into account when exercising the right to compensation laid down in Article 82 of the AVG. This states, inter alia, that the controller or processor must compensate any damage which a person may suffer as a result of a processing operation infringing this Regulation. The concept of damage should be interpreted broadly in the light of the case law of the Court of Justice of the European Union, in a way that fully meets the objectives of this Regulation. It is also stated that data subjects should receive full and effective compensation for any damage suffered by them.


Principles governing the processing of personal data
28.    The Court of Justice has not yet provided any explanation specifically on the concept of damages or on the compensable immaterial damages in case of unlawful processing of personal data, including under the (repealed) Privacy Directive (Directive 95/46/EC). However, the Court of Justice has consistently held that the damage to be compensated must be real and certain (see judgment of the Court of Justice of 4 April 2017, ECLI:EU:C:2017:256, paragraph 91, C- 337/15 P, European Ombudsman v. Staelen, ECLI:EU:C:2017:256, paragraph 91).


1. Personal data must be:
29.    In the light of the above case-law of the Court of Justice and of Article 146 in the preamble, national law is therefore relevant in determining whether the alleged damage is eligible for compensation.


[…]
30.    According to the settled case law of the Division (see, for example, ECLI:NL:RVS:2010:BN4952 of 25 August 2010), the assessment of an application for compensation for non-material damage is based on a connection with civil compensation law.


(b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes; further processing for archiving in the public interest, scientific or historical research or statistical purposes shall not be considered incompatible with the original purposes pursuant to Article 89(1) ('purpose limitation');
31.    Article 6:106 of the Dutch Civil Code reads:


(c) adequate, relevant and limited to what is necessary for the purposes for which they are processed ('minimal data processing');
For damage that does not consist of pecuniary loss, the injured party is entitled to compensation to be determined in accordance with fairness:


[…]
[…]


(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods in so far as the personal data are processed solely for archiving purposes in the public interest or for scientific or historical research or statistical purposes in accordance with Article 89(1), provided that the appropriate technical and organisational measures are taken to safeguard the rights and freedoms of the data subject as required by this Regulation ('storage restrictions');
b. if the injured party has suffered bodily injury, damage to his honour or good name or any other harm to his person;


[…]
[…]"


Article 6
32.    The impairment referred to in Section 6:106(1)(b) of the Civil Code in person 'otherwise' shall in any case be deemed to have occurred if the injured party has suffered mental injury. The party who invokes this will have to provide sufficient concrete data from which it can be deduced that psychological damage has occurred in connection with the circumstances of the case. This requires that the existence of mental injury can be established according to objective standards. Even if the existence of mental injury in the aforementioned sense cannot be assumed, it cannot be excluded that the nature and seriousness of the breach of the standards and of the consequences thereof for the injured party will mean that the impairment referred to in Section 6:106, opening words and under b, of the Civil Code is present in his person 'in a different way'. In such a case, the party invoking this will have to substantiate the impairment in his person with concrete data. This will only be different if the nature and seriousness of the breach of the standards mean that the relevant adverse consequences for the injured party are so obvious that an impairment in the person can be assumed. An impairment in the person 'in any other way' as referred to in Section 6:106(b) of Book 6 of the Dutch Civil Code does not already exist in the case of the mere violation of a fundamental right. (See the judgments of the Supreme Court of 15 March 2019, ECLI:NL:HR:2019:376, paragraph 4.2.2, of 28 May 2019, ECLI:NL:HR:2019:793, paragraph 2.4.5, and of 19 July 2019, ECLI:NL:HR:2019:1278, paragraph 2.13.2).


Lawfulness of processing
33.    The Section is of the opinion that the framework outlined in section 32 can meet the requirements of the AVG and the case law of the Court of Justice as set out in section 27.


1. Processing is lawful only if and insofar as at least one of the following conditions is met:
34.   [appellant] did not argue that he suffered mental injury as a result of the Minister's unlawful conduct, which can be established on objective grounds.


[…]
35.    (appellant) claims that he has been harmed in person. He claims that his privacy has been violated because the reports contain strictly confidential and sensitive personal data and he has not given permission for the data to be processed.


(f) processing is necessary for the purposes of pursuing the legitimate interests of the controller or of a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
36.    The Division agrees with the court that [the appellant] is entitled to compensation for non-material damage. The Minister acted in violation of Section 16 of the Wbp) and thereby violated [the appellant's] right to respect for his privacy. An infringement of [the appellant's] privacy may be regarded as an infringement in the person referred to in Section 6:106(1) and (b) of the Dutch Civil Code which entitles him to compensation for immaterial damage.


[…]
In view of the circumstances of this case, including the nature, duration and seriousness of the infringement, the Division will fairly determine this damage at € 500. To this end, the Division will take into account the special sensitivity of the nature of the personal data processed in this case without the consent of [the appellant]. For the processing of special (sensitive) personal data as referred to in Article 9 of the AVG, a higher level of protection has been laid down in the AVG than for ordinary personal data. The adverse consequences of the provision of the sensitive personal data are obvious. It is also important to note that the data were submitted by the director as part of a complaint procedure against him, without there being any justification as referred to in Article 9(2) of the AVG. With regard to the seriousness of the breach, the Division considers that the privacy-sensitive personal data ended up with a small group of professionals and that the members of the Disciplinary Board who have a duty of confidentiality by virtue of their position. With regard to the duration of the breach, it is important to note that the Pieter Baan Centre took action to undo the provision of the sensitive data following the submission of the data on 15 January 2018. Subsequently, in a letter dated 22 January 2018, the Disciplinary Board indicated that it would disregard the reports sent and not add them to the file. To the extent that [the appellant] disputes that this was done, in view of the questions put to the director during the hearing at the Disciplinary Board, it is important that [the appellant], if asked at the hearing, did not make it plausible that this had led to adverse consequences.


Article 14
    Conclusion


Information to be provided where the personal data have not been obtained from the data subject
37.    In doing what the court should do, the Division will still decide on the application for damages. In so doing, the Division will determine that the Minister will pay [the appellant] damages of € 500.


1. Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:
38.   The Minister must be ordered to pay the costs of the proceedings (travel costs of public transport) on appeal and appeal in a manner to be reported.


(a) the identity and contact details of the controller and, where appropriate, of the controller's representative;
    What does this judgment entail in brief?


(b) where appropriate, the contact details of the data protection officer;
39.    In these and three other judgments today, the Division discusses the possibilities of claiming compensation for damages before the administrative courts if someone claims that an administrative body has processed personal data in violation of the applicable privacy legislation (since 25 May 2018 the General Data Protection Regulation (AVG) and the AVG Implementation Act). Before the AVG and the AVG Implementation Act entered into force, the case law of the Division offered fewer possibilities, which meant that the citizen was then directed to the civil courts. This route remains open, but in a larger number of cases it is now also possible to approach the administrative courts for requests for compensation up to € 25,000. For the answer to the question as to when this is possible, see in particular above under 22. This is therefore a procedural question of legal protection, i.e. when, in the event of unlawful processing of personal data, the administrative court can be approached.


(c) the purposes of the processing for which the personal data are intended and the legal basis for the processing;
    In terms of content, the Division then decides that in order to be eligible for compensation, the requirements of Section 6:106 of the Dutch Civil Code must be met. For these cases, this means that the honour or good name of the person concerned must be affected, or that the person must be affected in some other way. In this respect, the Division is in line with the case law of the Supreme Court. In this case, the Division decided that [the appellant] may claim damages of € 500; the court awarded € 300 in the first instance. In doing so, the Division takes into account, on the one hand, the unlawful processing of personal data with a special sensitivity and, on the other hand, the fact that these data only ended up with a small group of professionals (see above under 36).


(d) the categories of personal data concerned;
Decision


(e) where applicable, the recipients or categories of recipients of the personal data;
The Administrative Jurisdiction Division of the Council of State:


(f) where applicable, that the controller intends to transfer the personal data to a recipient in a third country or to an international organisation; whether or not an adequacy decision of the Commission exists; or, in the case of transfers referred to in Article 46, Article 47 or the second subparagraph of Article 49(1), what are the appropriate or appropriate safeguards, how a copy can be obtained or where it can be accessed.
I. declares the appeal well-founded;
 
II. annuls the decision of the District Court of Gelderland of 19 December 2018 in case no. 18/3073; in so far as it revoked the decision of 13 March 2018, it is stipulated that the Minister for Legal Protection will pay compensation and it is stipulated that this decision will replace the decision of 17 May 2018;
 
III. declares the objection lodged by [the appellant] against the decision of 17 May 2018 inadmissible in so far as it decides on the application for compensation made by [the appellant];


[…]
IV. orders the Minister for Legal Protection to pay [the appellant] compensation of € 500.00 (in words: five hundred euros);


Awb
V. orders the Minister for Legal Protection to pay the costs of the proceedings incurred by [the appellant] in connection with the hearing of the appeal and the appeal up to an amount of € 46.71 (in words: forty-six euros and seventy-one cents).


Article 6:22
Thus determined by J.E.M. Polak, chairman, and E.A. Minderhoud and E.J. Daalder, members, in the presence of M.A.E. Planken, registrar.


A decision against which an objection or appeal has been lodged may, notwithstanding any violation of a written or unwritten rule of law or general principle of law, be upheld by the body deciding on the objection or appeal if it is plausible that the interested parties have not been adversely affected thereby.
The chairman is prevented from signing the decision.  


Article 7:9
The Registrar is prevented from signing the decision.


If, after the administrative body has been heard, facts or circumstances come to light which could be of substantial importance for the decision to be taken on the objection or appeal, this shall be communicated to the interested parties and they shall be given the opportunity to be heard on the matter.
Pronounced in public on 1 April 2020


299.


Annex
</pre>
</pre>

Latest revision as of 07:10, 7 April 2020

RvS - 201901006/1/A2
CourtsNL.png
Court: RvS (Netherlands)
Jurisdiction: Netherlands
Relevant Law: Article 79 GDPR
Article 82 GDPR
Decided: 1.4.2020
Published: 1.4.2020
Parties: Anonymous
Minister for Legal Protection
National Case Number/Name: 201901006/1/A2
European Case Law Identifier: ECLI:NL:RVS:2020:898
Appeal from: Rb. Gelderland (Netherlands)
18/3073
Appeal to:
Original Language(s): Dutch
Original Source: de Rechtspraak (in Dutch)
Initial Contributor: n/a

The Council of State awarded appellant with 500 EUR compensation for the unlawful sharing of his sensitive personal data. The amount was raised from 300 EUR to 500 EUR. Sensitive data in question contained strictly confidential medical information which was shared between forensic psychiatric observation clinic Pieter Baan Centrum and Regional Disciplinary Board for Healthcare in Zwolle.

English Summary

Facts

Appellant’s strictly confidential medical data was shared by a forensic psychiatric observation clinic with the Regional Disciplinary Board for Healthcare. The appellant was not informed about this. His subsequent objection and request for compensation was rejected by the Minister for Legal Protection on the basis that the Appellant’s honor or reputation has not been affected, nor has he suffered otherwise. The Court of Gelderland, which heard the dispute, ruled that sensitive personal data has indeed been shared unlawfully and awarded 300 EUR in damages to the Appellant.

Dispute

The Appellant claims that he is entitled to a higher compensation. The State Council had to assess whether that is the case.

Holding

The State Council agreed with the Court of Gelderland that the appellant was intitled to compensation of non-material damage according to the Dutch Civil Code and increased the amount awarded to 500 EUR. In deciding this, the Council considered the nature, duration and seriousness of the breach: • Nature: sensitive data was processed without consent or any other applicable legal basis; • Seriousness: sensitive data was shared with a small group of professionals and members of the Board have a duty of confidentiality by virtue of their position; • Duration: the breach occurred on the 15th of January 2018. On 22nd of January the Board confirmed that they would disregard the information. The Council took into account that the Appellant did not demonstrate any negative consequences of the breach.

Comment

Add your comment here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details. 


201901006/1/A2.

Date of judgment: 1 April 2020

SECTION

ADMINISTRATIVE LAW

Ruling on the appeal of:

[appellant], residing at [residence],

against the judgment of the District Court of Gelderland of 19 December 2018 in Case No 18/3073 in the proceedings between:

[appellant]

and

the Minister for Legal Protection.

Process Process

By decision of 13 March 2018, the Minister rejected a request for compensation from [the appellant].

By decision of 17 May 2018, the Minister dismissed [the appellant's] objection.

On 6 June 2018, [the appellant] appealed against the decision of 17 May 2018 and asked the court to order the Minister to pay damages.

By decision of 19 December 2018, the court upheld the appeal lodged by [the appellant] against the decision of 17 May 2018, annulled the decision of 17 May 2018, revoked the decision of 13 March 2018, ordered the Minister to pay damages of € 300 to [the appellant] and ordered that this decision replace the annulled decision. This decision is attached.

The [appellant] has lodged an appeal against this decision.

The Minister has given a written explanation.

The Division heard the case on 1 August 2019, where [the appellant] and the Minister, represented by F. Boone, appeared.

The Division reopened the investigation pursuant to Section 8:68(1) of the General Administrative Law Act (Awb) and referred the case to a multiple chamber.

[Appellant] submitted a further document.

The Division heard the case on 15 January 2020, where [the appellant] and the Minister, represented by F. Boone, appeared.

Considerations

    Introduction

1.    On January 15, 2018, the director of the Pieter Baan Centre submitted documents containing medical information about him to the Regional Health Care Disciplinary Board in Zwolle (hereinafter referred to as: the Disciplinary Board) in a complaint procedure against him, without [the appellant's] consent and without his knowledge. The draft versions of the psychological and psychiatric sections of Pro Justitia reports sent included strictly confidential personal details of [the appellant]. On 17 January 2018, [the Appellant] was informed by the Disciplinary Board of the disclosure of the sensitive personal data and was provided with copies of the reports. On 19 January 2018, [the appellant] asked the Disciplinary Board to disregard the documents when considering his complaint against the Director. On 22 January 2018, the Disciplinary Board informed [the appellant] that his personal details would be disregarded in the complaints procedure.

At the end of this decision (under 39), the Section briefly set out what this decision means in more general terms and what is to be decided in this case.

    Decision-making

2.    By letter dated 4 February 2018, [the appellant] objected to the Minister's submission of the reports and applied for compensation. In the proceedings that led to the court's ruling, the Minister stated that the Disciplinary Board was contacted immediately after the sensitive personal data were sent with a request to destroy the documents as soon as they were received. The Minister also took the position that the reports were not provided deliberately in order to influence the Disciplinary Board or to damage [the appellant]. In the decision of 17 May 2018, the Minister referred to the opinion of the Disciplinary Board of 9 March 2018 that the reports should not have been provided:

"In the opinion of the Board, the appendices, which evidently contain medical information, were indeed wrongly provided without the complainant's consent and without his knowledge. The appendices have no relevance for the present case and (therefore) do not serve to defend the defendant. The circumstances invoked by the defendant that a clerical error has been made, or that the lawyer of the RPP, after sending the documents - and therefore too late - advised not to send the annexes, should remain at the defendant's expense. The part of the complaint is well-founded'.

The Division is of the opinion that it should be held that the Minister took the position that the processing of [appellant's] personal data was unlawful. In addition, the Minister stated that he saw no grounds for compensation because [the appellant] had not been harmed in his honour or reputation or otherwise in his person.

    Court ruling

3.    The court found in the judgment that the transmission of the personal data was unlawful. [the appellant] rightly objected to the disclosure, on the grounds that he did not consent to the forwarding of his personal data as referred to in Article 8, opening words and under a, of the Personal Data Protection Act (Wet bescherming persoonsgegevens, Wbp). According to the court, [the appellant] is entitled to damages to be determined on a fair basis. With regard to the amount of the damages to be determined, the court considered it important that the privacy-sensitive personal data ended up with a small group of professionals, i.e. employees and members of the Disciplinary Board, and that they were bound by a duty of confidentiality by virtue of their duties. According to the District Court, this does not detract from the fact that [the appellant's] privacy was violated and that this was understandably perceived by the appellant as harmful and harmful. The court therefore considered compensation of € 300 to be fair and ruled that the Minister should pay this amount to [the appellant].

    Dispute on appeal

4.    The Minister has not appealed the court's decision. In that ruling, the court ruled that the decision of 17 May 2018 was unlawful and annulled that decision, in so far as it did not award any compensation.

5.    5. [Appellant] claims to be entitled to higher compensation than € 300.00.

    Ex officio judgement

6.    The District Court did not acknowledge that with the introduction of Title 8.4 in the Awb on the basis of Article 8:4, paragraph 1, opening words and under f of the Awb, the possibility to appeal against a decision regarding compensation for loss on account of unlawful management actions has lapsed. It follows from this that the District Court has annulled the decision of 17 May 2018, although rightly so, but on incorrect grounds. The court should have declared the objection against the decision of 31 March 2018 inadmissible instead of revoking this decision. Pursuant to Section 8:88 of the General Administrative Law Act, the court should have assessed whether [the appellant] was entitled to compensation.

7.    The court's ruling qualifies for set aside, insofar as the court has revoked the 31 March 2018 decision, has determined that the Minister will pay damages of €300 to [the appellant] and has determined that this ruling will replace the annulled decision. The Division will declare the objection to this decision inadmissible after all.

8.    The Division will assess the application for damages below.

    Applicable law

9.    On 25 May 2018, Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (the General Data Protection Regulation, hereinafter AVG) became applicable. The AVG will be directly applicable in each Member State as of 25 May 2018 (Article 99(3) of the AVG). The Wbp was repealed on 25 May 2018. The AVG has immediate effect. The transitional law contained in Section 48(10) of the AVG Implementation Act does not apply in this case.

10.    The AVG applies to the claim for damages. On 4 June 2018, i.e. after the AVG came into effect, [the appellant] requested the court to order the Minister to pay damages.

11.    The old law, i.e. the Wbp, applies to the assessment of the unlawfulness of the act as it occurred prior to 25 May 2018. It is not disputed on appeal that the Minister acted contrary to Section 8(a) of the Wbp and that this would also be contrary to the AVG.

    Article 82 of the AVG

12.    Article 82 of the AVG reads as follows:

1.    Any person who has suffered material or non-material damage as a result of a breach of this Regulation shall be entitled to receive compensation for the damage suffered from the controller or processor.

2.    Any controller involved in processing shall be liable for any damage caused by processing operations in breach of this Regulation. A processor shall be liable for damage caused by processing only where the processing does not comply with the obligations laid down in this Regulation specifically addressed to processors or was carried out outside or in breach of the lawful instructions of the controller.

13.    The Minister has not disputed the competence of the administrative courts and has also declared, on request, that he is in agreement with them. As also considered by the Division in today's judgments with numbers ECLI:NL:RVS:2020:899, ECLI:NL:RVS:2020:900 and ECLI:NL:RVS:2020:901, the Administrative Court is, in its opinion, competent to adjudicate an application for compensation for material or immaterial damage resulting from an act in violation of the AVG by an administrative body pursuant to Section 8:88 of the General Administrative Law Act. The Division derives arguments for this from the AVG and the AVG Implementation Act.

14.    The AVG is directly applicable in each Member State (Article 99(3) of the AVG). Claims for compensation in the event of acts contrary to the AVG derive directly from the AVG. Article 82(6) of the AVG provides that legal proceedings for the exercise of the right to compensation are to be conducted before the courts of the Member State referred to in Article 79(2). More generally, Article 79(1) lays down the right to an effective remedy.

15.    The AVG does not determine which courts within a Member State have jurisdiction to rule on the right to compensation. In the absence of procedural rules of Union law, it is settled case-law of the Court of Justice of the European Union (hereinafter 'the Court of Justice') that it is for the Member States to designate the competent courts and to apply their national procedural law in cases where Union law is enforced. However, such national rules must satisfy the conditions of equivalence and effectiveness (compare the judgment of 16 December 1976, C-33/76, Rewe, ECLI:EU:C:1976:188, and the judgment of 13 July 2006, C-295/04 - 298/04, Manfredi, ECLI:EU:C:2006:461, paragraph 62). These conditions require that a national procedural rule protecting the rights which individuals derive from Union law must not be less favourable than that governing similar domestic actions (principle of equivalence) and that a procedural rule must not render the exercise of rights conferred by the Union impossible or excessively difficult in practice (principle of effectiveness). A procedural rule must also comply with the principle of effective judicial protection, as currently enshrined in Article 47 of the Charter (judgments of the Court of Justice of 18 March 2010, C-317/08, C-318/08, C-319/08 and C-320/08, Alassini and others, ECLI:EU:C:2010:146).

This means that, under these conditions, national law must determine which court has jurisdiction to rule on applications for compensation.

16.    Pursuant to Section 8:88(1)(a) of the General Administrative Law Act in conjunction with Section 34 of the Implementing Act, the administrative court has the power to order an administrative body, at the request of an interested party, to pay compensation for damage that an interested party has suffered or will suffer in connection with a written decision as referred to in Section 34 of the Implementing Act. To this end, it is envisaged as follows.

17.    In paragraph 3.3. Legal Protection' of the AVG Implementation Act, Article 34 reads as follows:

Article 34. Applicability of the General Administrative Law Act by decision of administrative bodies

A written decision on a request as referred to in Articles 15 to 22 of the Regulation shall be taken within the time limits referred to in Article 12(3) of the Regulation and, insofar as it has been taken by an administrative body, shall be deemed to be a decision within the meaning of the General Administrative Law Act.

18.    Articles 15 to 22 of the AVG offer interested parties, among other things, the right of access to personal data, the right to rectification or erasure of personal data, the right to limit the processing of personal data concerning them, as well as the right to object to the processing of personal data, the right to data portability and the right not to be subjected exclusively to automated data processing.

19. These rights are inextricably linked to the control of the processing of personal data and enable interested parties to ascertain whether personal data have been processed lawfully and, inter alia, to seek compensation for unlawful processing.

20.    For the ways in which the right to compensation can be realised, the Explanatory Memorandum (Parliamentary Papers II 2017-2018, 34851 no. 3) to the AVG Implementation Act is included in the implementation table under Section 82, "Current Title 8.4 of the General Administrative Law Act or Civil Court". The Division deduces from this that it must be possible to bring a claim for compensation for damage resulting from an infringement of the AVG by an administrative body before both the administrative courts and the civil courts.

21.    The Section therefore concludes from Article 8:88 of the General Administrative Law Act in conjunction with Article 34 of the AVG Implementation Act that it is in line with the intention of the national legislator that the same court that adjudicates on, inter alia, decisions of administrative bodies at a request as referred to in Articles 15 to 22 of the AVG may also be requested to pay compensation for related damage. The Division considers this to be in the interests of the concentration of legal protection and thus also in the interests of effective and efficient legal protection (principle of effectiveness and Article 47 of the Charter of Fundamental Rights of the European Union). By way of comparison, the Section refers to the judgment of the Court of Justice of the European Union of 15 April 2008, C-268/06, EU:C:2008:223, paragraph 51 (Impact), from which it can be inferred that a concentration of legal protection is in line with the principle of effectiveness. In the view of the Division, the principle of equivalence is also satisfied because the opening up of the administrative procedure is not a procedural rule which treats claims under Union law less favourably than comparable claims under national law.

22.    This means that a person who, on the basis of Article 82 of the AVG, claims compensation for damage resulting from the unlawful processing of personal data by an administrative body, has the freedom of choice, in accordance with Article 8:88 of the Awb, to submit his request to the administrative court in connection with a decision as referred to in Article 34 of the AVG Implementation Act, or to realise his claim for compensation through the civil law channels. Article 8:88 of the General Administrative Law Act is interpreted as meaning that the power of the administrative court is less strictly limited to the requirement of an unlawful decision, because although there must be a connection with a decision as referred to in Article 34 of the AVG Implementation Act, this decision, for example on a request for inspection, does not have to be unlawful as such. In such a case, therefore, the administrative court may, in the application procedure pursuant to Section 8:88 of the General Administrative Law Act, give an opinion on the unlawfulness of the processing of the data to which the decision on the request for information relates. The latter decision does not have to be unlawful for this purpose, nor does it have to contain an opinion on the lawfulness of the processing of the data. The Division notes that if the request exceeds € 25,000.00, the application of Section 8:88 of the General Administrative Law Act entails that the civil court has exclusive jurisdiction to hear such a request.

23.    The Division is of the opinion that in this transitional phase, in which a request was made after 25 May 2018 for compensation for damage in connection with acts that took place in whole or in part before that date and that were contrary to the Wbp and would now also be contrary to the AVG, and in which the substantive assessment framework was therefore already the same, the legal protection set out under 22 must also be offered. This is in line with the views of the parties.

    Rejection of request for a preliminary ruling

24.    [Appellant] asked the Division to refer a preliminary question to the Court of Justice of the European Union with a view to clarifying the answer to the question whether, and if so to what extent, article 82 of the AVG constitutes an independent basis for the award of damages by the administrative courts.

25.    The Division rejects this request. Article 82 of the AVG has direct effect and makes it possible for interested parties to realise the claim for damages for unlawful processing in the national legal order. According to settled case law of the Court of Justice (see paragraph 15 above), the organisation of the judicial procedure and the manner of legal protection are in principle matters of national law, if the EU legal preconditions are met. To this end, the Division has ruled that, in addition to the civil court, the administrative court has jurisdiction to assess a claim for damages on the basis of Section 82 of the General Administrative Law Act (AVG) by applying Section 8:88 of the General Administrative Law Act (Awb). There is no reason to ask a preliminary question, because there can be no reasonable doubt as to the answer to the question (see the judgment of the Court of Justice of 6 October 1982, Cilfit, ECLI:EU:C:1982:335, points 13, 14 and 16).

    Assessment of the claim for damages

26.    26. [Appellant] submits that the Court erred in its application of Section 6:106 of the Civil Code, because the amount of compensation determined on an equitable basis was set too low. He claims that he is entitled to higher damages than €300.00.

27.    Although Article 82(1) of the AVG states that full compensation for actual non-material damage resulting from infringements of the AVG must take place in a manner that does justice to the objectives of the Regulation, the AVG does not stipulate how the non-material damage must be determined and calculated. The Court of Justice has consistently held that, in the absence of Community rules, it is for the domestic legal order of each Member State to determine the rules governing the exercise of the right to compensation, subject to compliance with the principles of equivalence and effectiveness (see Manfredi judgment, paragraph 64).

     However, recital 146 in the preamble to the AVG must be taken into account when exercising the right to compensation laid down in Article 82 of the AVG. This states, inter alia, that the controller or processor must compensate any damage which a person may suffer as a result of a processing operation infringing this Regulation. The concept of damage should be interpreted broadly in the light of the case law of the Court of Justice of the European Union, in a way that fully meets the objectives of this Regulation. It is also stated that data subjects should receive full and effective compensation for any damage suffered by them.

28.    The Court of Justice has not yet provided any explanation specifically on the concept of damages or on the compensable immaterial damages in case of unlawful processing of personal data, including under the (repealed) Privacy Directive (Directive 95/46/EC). However, the Court of Justice has consistently held that the damage to be compensated must be real and certain (see judgment of the Court of Justice of 4 April 2017, ECLI:EU:C:2017:256, paragraph 91, C- 337/15 P, European Ombudsman v. Staelen, ECLI:EU:C:2017:256, paragraph 91).

29.    In the light of the above case-law of the Court of Justice and of Article 146 in the preamble, national law is therefore relevant in determining whether the alleged damage is eligible for compensation.

30.    According to the settled case law of the Division (see, for example, ECLI:NL:RVS:2010:BN4952 of 25 August 2010), the assessment of an application for compensation for non-material damage is based on a connection with civil compensation law.

31.    Article 6:106 of the Dutch Civil Code reads:

For damage that does not consist of pecuniary loss, the injured party is entitled to compensation to be determined in accordance with fairness:

[…]

b. if the injured party has suffered bodily injury, damage to his honour or good name or any other harm to his person;

[…]"

32.    The impairment referred to in Section 6:106(1)(b) of the Civil Code in person 'otherwise' shall in any case be deemed to have occurred if the injured party has suffered mental injury. The party who invokes this will have to provide sufficient concrete data from which it can be deduced that psychological damage has occurred in connection with the circumstances of the case. This requires that the existence of mental injury can be established according to objective standards. Even if the existence of mental injury in the aforementioned sense cannot be assumed, it cannot be excluded that the nature and seriousness of the breach of the standards and of the consequences thereof for the injured party will mean that the impairment referred to in Section 6:106, opening words and under b, of the Civil Code is present in his person 'in a different way'. In such a case, the party invoking this will have to substantiate the impairment in his person with concrete data. This will only be different if the nature and seriousness of the breach of the standards mean that the relevant adverse consequences for the injured party are so obvious that an impairment in the person can be assumed. An impairment in the person 'in any other way' as referred to in Section 6:106(b) of Book 6 of the Dutch Civil Code does not already exist in the case of the mere violation of a fundamental right. (See the judgments of the Supreme Court of 15 March 2019, ECLI:NL:HR:2019:376, paragraph 4.2.2, of 28 May 2019, ECLI:NL:HR:2019:793, paragraph 2.4.5, and of 19 July 2019, ECLI:NL:HR:2019:1278, paragraph 2.13.2).

33.    The Section is of the opinion that the framework outlined in section 32 can meet the requirements of the AVG and the case law of the Court of Justice as set out in section 27.

34.    [appellant] did not argue that he suffered mental injury as a result of the Minister's unlawful conduct, which can be established on objective grounds.

35.    (appellant) claims that he has been harmed in person. He claims that his privacy has been violated because the reports contain strictly confidential and sensitive personal data and he has not given permission for the data to be processed.

36.    The Division agrees with the court that [the appellant] is entitled to compensation for non-material damage. The Minister acted in violation of Section 16 of the Wbp) and thereby violated [the appellant's] right to respect for his privacy. An infringement of [the appellant's] privacy may be regarded as an infringement in the person referred to in Section 6:106(1) and (b) of the Dutch Civil Code which entitles him to compensation for immaterial damage.

In view of the circumstances of this case, including the nature, duration and seriousness of the infringement, the Division will fairly determine this damage at € 500. To this end, the Division will take into account the special sensitivity of the nature of the personal data processed in this case without the consent of [the appellant]. For the processing of special (sensitive) personal data as referred to in Article 9 of the AVG, a higher level of protection has been laid down in the AVG than for ordinary personal data. The adverse consequences of the provision of the sensitive personal data are obvious. It is also important to note that the data were submitted by the director as part of a complaint procedure against him, without there being any justification as referred to in Article 9(2) of the AVG. With regard to the seriousness of the breach, the Division considers that the privacy-sensitive personal data ended up with a small group of professionals and that the members of the Disciplinary Board who have a duty of confidentiality by virtue of their position. With regard to the duration of the breach, it is important to note that the Pieter Baan Centre took action to undo the provision of the sensitive data following the submission of the data on 15 January 2018. Subsequently, in a letter dated 22 January 2018, the Disciplinary Board indicated that it would disregard the reports sent and not add them to the file. To the extent that [the appellant] disputes that this was done, in view of the questions put to the director during the hearing at the Disciplinary Board, it is important that [the appellant], if asked at the hearing, did not make it plausible that this had led to adverse consequences.

    Conclusion

37.    In doing what the court should do, the Division will still decide on the application for damages. In so doing, the Division will determine that the Minister will pay [the appellant] damages of € 500.

38.    The Minister must be ordered to pay the costs of the proceedings (travel costs of public transport) on appeal and appeal in a manner to be reported.

    What does this judgment entail in brief?

39.    In these and three other judgments today, the Division discusses the possibilities of claiming compensation for damages before the administrative courts if someone claims that an administrative body has processed personal data in violation of the applicable privacy legislation (since 25 May 2018 the General Data Protection Regulation (AVG) and the AVG Implementation Act). Before the AVG and the AVG Implementation Act entered into force, the case law of the Division offered fewer possibilities, which meant that the citizen was then directed to the civil courts. This route remains open, but in a larger number of cases it is now also possible to approach the administrative courts for requests for compensation up to € 25,000. For the answer to the question as to when this is possible, see in particular above under 22. This is therefore a procedural question of legal protection, i.e. when, in the event of unlawful processing of personal data, the administrative court can be approached. 

    In terms of content, the Division then decides that in order to be eligible for compensation, the requirements of Section 6:106 of the Dutch Civil Code must be met. For these cases, this means that the honour or good name of the person concerned must be affected, or that the person must be affected in some other way. In this respect, the Division is in line with the case law of the Supreme Court. In this case, the Division decided that [the appellant] may claim damages of € 500; the court awarded € 300 in the first instance. In doing so, the Division takes into account, on the one hand, the unlawful processing of personal data with a special sensitivity and, on the other hand, the fact that these data only ended up with a small group of professionals (see above under 36).

Decision

The Administrative Jurisdiction Division of the Council of State:

I. declares the appeal well-founded;

II. annuls the decision of the District Court of Gelderland of 19 December 2018 in case no. 18/3073; in so far as it revoked the decision of 13 March 2018, it is stipulated that the Minister for Legal Protection will pay compensation and it is stipulated that this decision will replace the decision of 17 May 2018;

III. declares the objection lodged by [the appellant] against the decision of 17 May 2018 inadmissible in so far as it decides on the application for compensation made by [the appellant];

IV. orders the Minister for Legal Protection to pay [the appellant] compensation of € 500.00 (in words: five hundred euros);

V. orders the Minister for Legal Protection to pay the costs of the proceedings incurred by [the appellant] in connection with the hearing of the appeal and the appeal up to an amount of € 46.71 (in words: forty-six euros and seventy-one cents).

Thus determined by J.E.M. Polak, chairman, and E.A. Minderhoud and E.J. Daalder, members, in the presence of M.A.E. Planken, registrar.

The chairman is prevented from signing the decision.   

The Registrar is prevented from signing the decision.

Pronounced in public on 1 April 2020

299.

Annex
Retrieved from "https://gdprhub.eu/index.php?title=RvS_-_201901006/1/A2&oldid=9840"
Creative Commons Attribution-NonCommercial-ShareAlike
Powered by MediaWiki