GHDHA - 200.290.360-01

GHDHA - 200.290.360-01
Court:	GHDHA (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:	Article 12(3) GDPR Article 13 GDPR Article 14 GDPR Article 15 GDPR Article 23(1)(i) GDPR Article 10a Lawyer's Act Article 11a Lawyer's Act
Decided:	14.12.2021
Published:	28.03.2022
Parties:	Nauta Dutilh
National Case Number/Name:	200.290.360-01
European Case Law Identifier:	ECLI:NL:GHDHA:2021:2793
Appeal from:	Rb. Den Haag (Netherlands) C/10/591473 / HA RK 20-144
Appeal to:	Unknown
Original Language(s):	Dutch
Original Source:	Rechtspraak.nl (in Dutch)
Initial Contributor:	Giel Ritzen

The Court of Appeal Den Haag held that a law firm could restrict the information provided to data subjects pursuant to Articles 13, 14, and 15 GDPR in order to comply with their professional confidentiality obligations.

English Summary

Facts

The controller is Nauta Dutilh, a law firm. The data subject is a former advisor of a government institution, the “House for Whistleblowers” (the House), which is a public organisation where whistleblowers can report “societal abuses” and which investigates the treatment of whistleblowers. Between September 2018 and May 2019, the data subject reported several suspicions of wrongdoings, concerning the general functioning of the House, and the appointment procedure of their chairman. On 2 May 2019, the data subject reported internal (confidential) suspicions of wrongdoings to two newly appointed board members of the House. On 21 May 2019, the data subject was suspended, after which he was formally fired on 26 July 2019.

The data subject suspected that the chairman and two board members which he contacted, had been advised by the law firm Nauta Dutilh, the controller in this case. On 25 July 2019, the data subject made an access request with the controller, and requested a copy of his personal data pursuant to Article 15 GDPR. The controller confirmed that they processed his personal data (name, last name, address, email-address, and picture), but also stated that they cannot provide all information due to professional confidentiality.

The data subject brought the case before Court, requesting the Court to order the controller to provide him and the Dutch DPA with a copy of all personal data relating to him and all processing thereof processed by Nauta, and all information listed in Articles 13, 14, and 15 GDPR. However, the Court considered that the controller’s professional confidentiality limits the data subject’s right of access pursuant to Article 23 GDPR, and did not find any violations. The data subject then filed an appeal.

Holding

The Court of Appeal rejected the appeal.

First, it confirmed the argumentation of the Court of first instance. The Court of first instance stated that the right of access can be restricted by a legislative measure pursuant to Article 23 GDPR. Moreover, it noted that the professional confidentiality of a lawyer, which is laid down in Articles 10a and 11a of the (Dutch) Laywer’s Act, is a legislative measure that serves one of the objectives listed in Article 23, namely Article 23(1)(i) GDPR. After all, the Court of first instance notes, “compliance with the obligation of secrecy by the legal profession is a basic condition for the functioning of the rule of law”. This secrecy even extends to the question whether someone has requested the services of a lawyer.

Second, it rejected the data subject’s grievance that Articles 10a and 11a Lawyer’s Act did not fulfil the requirements of Article 23 GDPR, in light of the EDPB’s ‘Guidelines 10/2020 on restrictions under Article 23’. Third, it reiterated that the restrictions respect the principles of necessity, proportionality, and subsidiarity, and referred (again) to the Court of First instance’s statement that “compliance with the obligation of secrecy by the legal profession is a basic condition for the functioning of the rule of law”.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

COURT OF THE HAGUE

Department of Civil Law

Case number : 200.290.360/01

Court case and case number: C/10/591473/ HA RK 20-144

(not published on Rechtspraak.nl)

decision of December 14, 2021

in the case of

[appellant],

residing at [residence],

the applicant on appeal,

hereinafter referred to as: [appellant],

appeared in person,

against

NAUTA DUTILH N.V.,

located in Rotterdam,

defendant on appeal,

hereinafter referred to as: Nauta,

lawyer: mr. R.L. Ubels in Amsterdam.

What the matter is about

Invoking the General Data Protection Regulation, the applicant, a former adviser to a government agency, wants the defendant, a law firm, to be ordered by the civil court to provide him, inter alia, with a copy of all personal data concerning him processed by the law firm, certain other information and to notify the Dutch Data Protection Authority and him of infringements. The law firm takes the position that the duty of confidentiality of lawyers stands in the way of granting the request.

The procedure on appeal

1.1

The course of the appeal procedure is apparent from the following documents:

†

the notice of appeal of 9 February 2021, with exhibits, in which [appellant] has lodged an appeal against the decision of the District Court of Rotterdam of 9 November 2020 given between the parties (hereinafter: the contested decision, or: the decision against which appeal);

†

the statement of defense;

†

the deed with specified and supplemented offer of evidence and response to defense NautaDutilh, with a production.

1.2

On September 21, 2021, the case was heard orally at the court hearing. An official report has been drawn up of the hearing and is enclosed with the documents. At the end of the hearing, the verdict is set for November 30, 2021.

1.3

The verdict has been determined as of today.

The facts

2.1

For a better understanding of the case, the court briefly summarizes the following facts alleged by [appellant]. With this statement of fact, the Court of Appeal apparently also meets ground 2 of the notice of appeal of [appellant]. Nauta disputes these facts and, invoking its duty of confidentiality, argues that it cannot respond to them substantively.

(a) [appellant] has been working as an advisor at the House for Whistleblowers (hereinafter: the House) since 1 July 2016.

(b) On 17 September 2018, [appellant] announced to the Secretary-General of the Ministry of the Interior and Kingdom Relations that he, together with another person, wanted to report suspected abuses in relation to the House. At about the same time, [appellant] informed the employees of the House of this.

(c) On December 18, 2018, the Secretary-General notified the Speaker of the House of the report, the subject matter of the report and, with the consent of [appellant], that [appellant] is one of the reporters.

(d) Outwardly, the subjects of the notification have been described as the general functioning of the House and the appointment procedure of the current Speaker of the House.

(e) On 2 May 2019, [appellant] made internal (confidential) reports of (new) suspicions of abuses to two new board members of the House.

(f) Effective May 21, 2019, the Speaker of the House suspended [appellant] and denied access to the House office and his workplace. On July 3, 2019, [appellant] was sent an intention to dismiss.

(g) The suspicion has arisen with [appellant] that the Speaker of the House has been advised by a lawyer of Nauta in connection with the suspension decision and the intended dismissal and that the board members also have themselves in connection with the handling of the internal reports. have been advised by a lawyer from Nauta. [appellant] is of the opinion that there is a conflict of interests between these two 'clusters of issues'.

(h) With an explanation of these two clusters of issues and this conflict of interest, [appellant] informed Nauta's data protection officer by letter dated 25 July 2019 pursuant to art. 15 paragraph 3 and art. 12 paragraph 3 of the General Data Protection Regulation (GDPR) requested him to provide him with a copy of all personal data concerning him processed by Nauta and to provide him with all data referred to in art. 13, art. 14 and art. 15 AVG to provide intended information.

(i) A dismissal decision was emailed to [appellant] on 26 July 2019.

(j) By letter dated August 8, 2019, the data protection officer of Nauta, in response to his request for information of July 25, 2019, informed [appellant] as follows:

I can hereby confirm that we process the following personal data about you:

 The personal data as stated in your information request: first name, last name, address, e-mail address and photo.

We process your personal data to handle your access request. †

In view of our professional secrecy, we cannot make any statements about the clusters of issues you have mentioned.”

(k) [appellant] subsequently made several renewed and additional requests for information to Nauta's data protection officer. In response thereto (the data protection officer of) Nauta informed [appellant] each time that the request did not give Nauta reason to revise its position.

The procedure at the court

3.1

[Buyer] initiated the proceedings with the court by filing a petition pursuant to art. 35 of the General Data Protection Regulation Implementing Act (UAvg). Briefly, he requested the court to order Nauta to provide him with a copy of all personal data concerning him processed by Nauta and all processing thereof, and also to provide him with other information as referred to in artt. 13, 14 and 15 Avg. Furthermore, [appellant] requested the court to notify the Dutch Data Protection Authority and himself of infringements in connection with personal data concerning him processed by Nauta, all this under penalty of forfeiting a penalty payment to him.

3.2

The court rejected the request. To this end, the court has considered, briefly summarized, that the right of access under the AVG and the UAvg is not unlimited and that the confidentiality obligation of (the lawyers of) Nauta entails a limitation of the right of inspection within the meaning of art. 23 Avg, so that Nauta is not obliged to provide [appellant] with more information than she has done. In addition, the court considered that it cannot be established that infringements have taken place. The court has compensated the costs of the proceedings, in the sense that each party bears its own costs.

The appeal

4.1

On appeal, [appellant] wants – as the Court understands – that the contested decision be annulled. To that end, he puts forward eighteen grievances (objections).

4.2

On appeal, the Appellant requests the Court as follows:

"I. Order NautaDutilh to provide me by electronic means within one week after the date of your decision, at least within a period to be determined in good justice by your Court of Appeal, by electronic means:

A. a copy of all personal data concerning me processed by NautaDutilh and a copy of, or at least information about all processing of that personal data, in particular of all personal data concerning me that NautaDutilh has processed in relation to:

†

1. advising on the handling of my confidential information of the board members of the Advice Department and the Investigation Department of the House for Whistleblowers internal reports of suspected abuses of 18 March and 2 May 2019 and the related procedures,

2. the advice on the handling of my confidentially submitted to the board members of the Advice Department and the Investigation Department of the House for Whistleblowers of 25 July 2019 and the related procedures,

5. the advice on how to deal with my objection of 7 May 2019 submitted to the chairman of the House for Whistleblowers in relation to the letter of 3 April 2019, as well as my subsequent objections in relation to the letters of 12 February and 6 March 2019 and letter of 23 January 2019, and the related proceedings,

6. the advice of the Speaker of the House for Whistleblowers, which has resulted in the suspension and dismissal decisions and the related procedures,

7. handling my confidential information requests submitted to NautaDutilh from 25 July 2019 to 28 June 2020,

8. the present proceedings at first instance,

9. the investigation referred to in my information requests under A, and

10. the measures and care referred to in my information requests under B;

at least (if and to the extent that I.A cannot be assigned):

B. a copy of all personal data concerning me processed by NautaDutilh and a copy of, or at least information about all processing of those personal data, in particular of all personal data concerning me that NautaDutilh has processed from which it appears or can be deduced directly or indirectly that I am the reporter of the internal reports, in relation to:

[1, 2, 5 to 10 idem as under A above],

with regard to the copy of the personal data concerning me processed by NautaDutilh:

i. primarily in the form of (possibly partially blackened) copies of the documents in which my personal data and the processing thereof are included, and

if and insofar as I should not be entitled to it

ii. alternatively in the form of a complete overview, in comprehensible form;

II. Order NautaDutilh within one week after the date of Your decision, at least within a period to be determined in good justice by Your Court of Justice, with regard to all personal data referred to above and all processing thereof:

A. the in art. 5, art. 13, art. 14 and art. 15 para. 1 GDPR, in particular in relation to: [I.A, at least I.B above], and

B. to provide information regarding the identity and contact details of all lawyers who are or have been involved as controller in the processing of my personal data, in particular in relation to: [1, 2, 5 to 10 idem as under IA above];

III. Order NautaDutilh to make an explicit distinction in the copy to be provided pursuant to your order under I of the personal data concerning me processed by NautaDutilh and the processing of those personal data and in the information to be provided pursuant to your order under II, between: [1, 2, 5 to 10 idem as under IA above];

IV. Order NautaDutilh within one week of the date of Your decision, at least within a period to be determined by Your Court of Justice in good justice:

A. to notify the Dutch Data Protection Authority of all breaches in connection with personal data processed by NautaDutilh within the meaning of Art. 33 yo. art. 4 preamble and under 12 GDPR, which until the date of the decision of the District Court of Rotterdam of 9 November 2020, at least until the date of the Revised version of the application in first instance of 9 July 2020, at least until the date of my renewed information request of June 28, 2020, at least up to the date of my information request of July 25, 2019, and

B. to notify me as a data subject as required by the GDPR of all breaches in connection with personal data processed by NautaDutilh concerning me within the meaning of Art. 34 yo. art. 4 preamble and under 12 GDPR, which until the date of the decision of the District Court of Rotterdam of 9 November 2020, at least until the date of the Revised version of the application in first instance of 9 July 2020, at least until the date of my renewed information request of June 28, 2020, at least until the date of my information request of July 25, 2019;

V. all this on pain of a penalty of € 5,000 for each day or part thereof that NautaDutilh fails to comply in whole or in part with the execution of the order, with a maximum of € 100,000, at least on pain of a penalty to be determined by Your Court of Justice in good justice;

VI. order NautaDutilh to pay the costs of these proceedings; and

VII. Declare your decision provisionally enforceable to the extent possible.”

4.3

Nauta comes to the conclusion that the requests of [applicant] must be rejected – with which the defense on appeal seeks to confirm the decision of which appeal – and that [appellant] is ordered to pay the costs of these proceedings (the Court of Appeal understands: of this appeal).

The admissibility of the applicant in the appeal

5.1

From the first paragraph of art. 35 UAvg follows that [appellant] as an interested party could turn to the court with a written request to order Nauta as controller to comply with the request as referred to in artt. 15 to 22 AVG can still be assigned. The fourth paragraph of art. 35 UAvg provides that this application need not be filed by a lawyer. In the opinion of the Court of Appeal, this provision is a special statutory provision within the meaning of Art. 278 paragraph 3 DCCP which entails that in a procedure on the basis of art. 35 UAvg on appeal the notice of appeal does not have to be signed by a lawyer. With regard to art. 46 of the Personal Data Protection Act (Wbp) – a predecessor of art. 35 UAvg – was ruled in the same sense in the appeal case law.1 It is not apparent from the parliamentary history of the UAvg that under the current implementing act this should be judged differently. The fact that [appellant]'s notice of appeal was submitted by himself and was not signed (and filed) by a lawyer therefore does not preclude its admissibility on appeal.

The assessment of the appeal

6.1

The Court of Appeal finds that the amendments to his request made by [appellant] on appeal are not so much substantive but mainly textual and editorial in nature. As in the first instance, the request relates to the in artt. 13, 14 and 15 Avg and related obligations and rights, and on the information referred to in artt. 33 and 34 AVG referred to notices. Nauta has not objected to the amendment of the request. In the opinion of the Court of Appeal, the amendment does not conflict with the requirements of due process. The court will therefore do justice to the amended request.

6.2

As the most far-reaching defence, Nauta takes the position that the request should be rejected because [appellant] misuses his powers. To this end, Nauta argues that the information and access rights (in the GDPR) have been granted so that a data subject can ascertain whether his personal data are being processed correctly and lawfully and possibly to effect rectification, erasure or blocking, while [appellant] is not aware of this. to do. According to Nauta, [appellant] is only trying to obtain evidence with his request for the accusations he makes against the chairman and (former) employees of the House, and for his suspicion that Nauta (in the context of her alleged advice to the House) has acted unlawfully towards him. During the oral hearing on appeal, [appellant] confirmed that he may involve the information to be obtained in proceedings regarding the said allegations. In the opinion of the Court of Appeal, however, it has not become sufficiently plausible that this is the sole purpose for which [appellant] exercises his information and access rights. At the hearing of the Court of Appeal, [appellant] also noted that his aim is to find out which personal data about him has been processed by Nauta and whether this has been done lawfully, and that if it appears that Nauta acted unlawfully, he will review which AVG rights he can exercise to address that illegality. It cannot therefore be judged that [appellant] misused his authority by exercising it for a purpose other than that for which it was granted (as referred to in Section 3:13(2) of the Dutch Civil Code.

6.3

As a second 'preliminary' defence, Nauta argues that [appellant] is inadmissible in a number of his requests, or at least that those requests must be rejected, namely insofar as they relate to artt. 5, 13 and 14 Avg and insofar as [appellant] requests Nauta to report to the Dutch Data Protection Authority and to himself on the basis of artt. 33 and 34 Avg. In an assessment of this defense – which in law cannot be regarded as preliminary (or principal), which will be the reason why Nauta uses quotation marks – Nauta has no interest because the Court of Appeal is of the opinion on other grounds that the request of [appellant] must be dismissed. These grounds include the following.

6.4

The court sees reason to first apply Art. 23 GDPR and art. 41 UAvg to quote. Nauta is the controller within the meaning of these provisions. art. 23 Avg, entitled 'Restrictions', reads, in so far as relevant here, as follows:

‘1. The scope of the obligations and rights referred to in Articles 12 to 22 and Article 34, as well as in Article 5 may, insofar as the provisions of those Articles correspond to the rights and obligations referred to in Articles 12 to 20 , are limited by provisions of Union or Member State law to which the controller or processor is subject, provided that such limitation does not affect the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to ensure from:

†

(e) other important objectives of general interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and fiscal matters, public health and social security;

†

(i) the protection of the data subject or of the rights and freedoms of others;'

art. 41 UAvg, with the heading 'Exceptions to the rights of the data subject and the obligations of the controller', reads, insofar as relevant here, as follows:

The controller may disapply the obligations and rights referred to in Articles 12 to 21 and Article 34 of the Regulation insofar as this is necessary and proportionate to ensure:

†

e. other important objectives of general interest of the European Union or of the Netherlands, in particular an important economic or financial interest of the European Union or of the Netherlands, including monetary, budgetary and tax matters, public health and social security;

†

i. the protection of the data subject or of the rights and freedoms of others;'

6.5

Insofar as it is further relevant here, artt. 10a and 11a of the Lawyers Act the following in:

‘1. In the interest of proper administration of justice, the lawyer ensures the legal protection of his client. To this end, in the exercise of his profession, the lawyer is:

†

e. confidential counselor and observes confidentiality within the limits set by law and law',

respectively

‘1. Insofar as not provided otherwise by law, the advocate is obliged to observe secrecy with regard to everything he becomes aware of in the course of his professional practice. The same obligation applies to employees and staff of the lawyer, as well as other persons involved in the practice of the profession.'

6.6

In rejecting the application of the applicant, the court in the decision against which appeal considered and ruled the following:

"3.5. It is rightly not in dispute between the parties that the right of inspection is not unlimited. In the GDPR and UAVG, this is expressed in exceptions to the obligations to provide certain information. Those exceptions include what ensues from the duty of confidentiality of lawyers. This is related to the function of the legal profession in a constitutional state such as the Netherlands. The far-reaching duty of confidentiality of lawyers is essential so that the legal profession can adequately fulfill its proper function in a constitutional state.

3.6.

The position of [appellant] that Article 23 GDPR does not apply to the

duty of confidentiality cannot be followed. (…) [follows an abbreviated version of art. 23 paragraph 1, opening words and under i, AVG, art. 41 paragraph 1, opening words and under i, UAvg, art. 10a paragraph 1, opening words and under e, and art. 11a Lawyers Act; court] Nauta's duty of confidentiality constitutes a limitation that applies to the controller or processor, Nauta, as referred to in Article 23 GDPR. After all, observing the duty of confidentiality by the legal profession is a basic condition for the rule of law to function. A person who turns to a lawyer about a dispute with a third party must be able to rely on the fact that he/she can do so in freedom and that that lawyer will observe secrecy with regard to what is entrusted to him/her. In principle, this secrecy also extends to the question of whether someone has approached a particular lawyer and, if so, about what. This means that Nauta was not obliged to provide more information to [appellant] than she had done. The applicant's requests for further information must therefore be rejected.

3.7.

With regard to [appellant's] request to order Nauta the Authority

Notifying personal data of breaches is relevant in that it cannot be established that breaches have occurred. This request will therefore be rejected. The request of [appellant] to order Nauta to notify him of infringements cannot be granted for the same reason.'

6.7

The court unites with these considerations and judgments and makes them its own. In doing so, the Court of Appeal understands the consideration that the right of inspection is not unlimited (para. 3.5) as meaning that the District Court does not only have the in art. 15 AVG has in mind, but also the in artt. 13 and 14 GDPR laid down obligations and rights. The by [appellant] against para. Complaints formulated in 3.5-3.7 are already inconsistent with this. In addition to this, the court also considers the following.

6.8

To the extent that [appellant's] request relates to the provisions referred to in art. 13 Avg, Nauta has argued that it has already provided this information to [appellant] (by means of her letter of 8 August 2019). [Appellant] has not disputed this. The court followed Nauta in this regard by stating in para. 3.4 of the contested decision to consider that Nauta takes the position that the provisions referred to in art. 13 AVG has already been provided to [appellant] (and that Nauta's professional secrecy precludes it from having to provide the information referred to in Articles 14 and 15 AVG), and in para. 4.6 to rule that Nauta was not obliged to provide more information to [appellant] than it had done. The appellant has not lodged a complaint against this, so that the appeal must be based on the correctness of this judgment.

6.9

Insofar as the request of [appellant] relates to the in art. 14 paragraphs 1 to 3 GDPR, Nauta has pointed out that art. 14, paragraph 5, opening words and under d, GDPR provides that paragraphs 1 to 4 of this provision do not apply 'if and insofar as the personal data must remain confidential on the basis of professional secrecy under Union or Member State law, including a statutory duty of confidentiality'. Art. 10a and 11a Advocatenwet entail such a (member state) statutory (statutory) duty of confidentiality for the advocate with regard to everything he becomes aware of in the course of his professional practice (and for employees and staff of the advocate as well as other persons involved in professional practice). The request is therefore inadmissible in that regard as well.

6.10

Insofar as the request of [appellant] relates to the matters referred to in art. 15 paragraph 1 of the AVG regulated right of inspection, Nauta has rightly argued that the duty of confidentiality for the lawyer also prevents this inspection via the provisions of paragraph 4 of art. 15 GDPR (“The right to obtain a copy referred to in paragraph 3 does not affect the rights and freedoms of others”). In this regard, Nauta argued (uncontested) that having to provide access would prejudice both its rights and freedoms to be able to practice its profession as a law firm and effectively safeguard the interests of its clients, as well as the rights and freedoms of the law firm. House (if the House were indeed a client of Nauta) to be able to freely turn to a lawyer and to be able to correspond with that lawyer and exchange information without a counterparty or a third party being able to see it.

6.11

It follows from the foregoing that artt. 14 and 15 Avg themselves contain limitations and that these limitations also lead to the rejection of [appellant]'s request, insofar as the request relates to the in artt. 14 and 15 AVG referred to obligations and rights.

6.12

With ground of ground 1, [appellant] takes the position that Nauta cannot successfully invoke its derived right of nondisclosure or derived duty of confidentiality if and insofar as the 'concerning secret holders' - the Court of Appeal understands: the lawyers referred to in ground 3 - do not have expressed themselves about their right of nondisclosure or confidentiality. This point of view, however, ignores that Nauta for the application of artt. 14, 15 and 23 GDPR and art. 41 UAvg must be equated with the lawyers working for it as a law firm responsible for the processing insofar as Nauta itself has an (own) duty of confidentiality. Ground 1 therefore fails.

6.13

Grounds 3 to 13 are suitable for joint handling. In essence, these complaints argue that Nauta is not entitled to a derived right of nondisclosure or a derived duty of confidentiality (cf. the conclusion in the notice of appeal, last paragraph under P, pp. 23-24). They therefore already fail what has been considered above with regard to ground 1. In addition, these complaints are based on the assumption (the presumption) that some lawyers working at Nauta have wrongly not treated documents on certain issues and procedures confidentially and that they have wrongly become known to other lawyers working at Nauta. Assuming that this assumption is correct – which is contradicted by Nauta – it does not entail that Nauta (or the lawyers and employees working for Nauta mentioned by [appellant]) cannot (can) not appeal in these proceedings to reject the request. ) comply with its (their) duty of confidentiality. That there is therefore no question of taking cognizance 'by virtue of his professional practice as such' within the meaning of Art. 11a Lawyers Act, is not readily apparent. The rules of conduct cited by [appellant] do not change this. Finally, his assertion that lawyers' right of nondisclosure relates solely to the confidentiality of communication between client and lawyer in the context of the right of defense in proceedings that may lead to the imposition of a sanction cannot help [appellant] either. because a right of nondisclosure (of Nauta) is not at issue here (but the duty of confidentiality) and because this statement is not supported by the law.

6.14

Ground 14 apparently builds on grounds of appeal 3 through 13 and must therefore share its fate.

6.15

In ground 15, [appellant] argues on various grounds that Art. 41 UAVg, art. 10 a paragraph 1, opening words and under e, and art. 11a Lawyers Act – partly in light of the Guidelines 10/2020 on restrictions under Article 23 GDPR – do not meet the requirements of art. 23 Avg lays down regulations under member state law with which the in artt. obligations and rights referred to in 12 to 22, 34 and 5 Avg are limited. The principle of the primacy of EU law means that these national legal provisions must therefore be disapplied, according to [appellant]. In the opinion of the Court of Appeal, however, it does not follow from the grounds put forward by [appellant] – which essentially entail his own interpretation of [appellant] – that these legal provisions (by the Dutch court) are not in accordance with the requirements of EU law (art. . 23 Avg) can be explained. The Court considers that one of the requirements of art. 23 Avg corresponding interpretation of these provisions (here) is possible. Ground 15 fails on this.

6.16

[appellant] further argues, stated briefly and succinctly, that the limitation of the AVG rights underlying his information requests and the request in these proceedings is not necessary in the circumstances outlined by him, or at least does not meet the requirements of proportionality and subsidiarity. The Court does not agree with [appellant] in this regard. After all, the District Court has considered (in ground 3.6) – with which the Court of Appeal has agreed – that observance of the duty of confidentiality by the legal profession is a basic condition for the functioning of the rule of law, that the person involved in a dispute turns to a lawyer with a third party, must be able to rely on the fact that he can do so in freedom and that that lawyer will observe secrecy with regard to what is entrusted to him/her. to a certain lawyer and, if so, about what, and all this entails that Nauta was not obliged to provide [appellant] with more information than she had done. This implies that in the circumstances of this case there is no violation of the requirements of necessity, proportionality and subsidiarity. Grounds 16 and 17 therefore fail.

6.17

Ground 18 also fails on the basis of what the District Court has ruled and with which the Court of Appeal has agreed. in row. After all, the court has ruled that the request to notify the Dutch Data Protection Authority and/or to [appellant] of infringements must be rejected because it cannot be established that infringements have taken place. That any breach of personal data as referred to in artt. 33 and 34 Avg cannot be established, it follows from the circumstance that Nauta's duty of confidentiality stands in the way of that determination.

conclusion

6.18

It follows from the foregoing that the appeal is without purpose. The contested decision will be ratified. As the party to be found in the wrong, [appellant] will be ordered to pay the costs of the appeal proceedings. The salary of Nauta's lawyer will be estimated at €2,228 (two points, rate II (€1,114 per point)). Nauta has not requested a provisional declaration of enforceability (of the order to pay costs).

The decision

The Council:

ratifies the decision of the Rotterdam District Court of 9 November 2020 given between the parties;

orders [appellant] to pay the costs of the appeal proceedings, estimated on the part of Nauta to date at €772 in disbursements (court fees) and €2,228 in lawyer's salary.

This decision was made by Mrs. H.J. van Kooten, R.S. van Coevorden and R.W. Polak, and was pronounced in open court on 14 December 2021 in the presence of the Registrar.

1 i.a. Court of 's-Hertogenbosch 1 February 2018, ECLI:NL:GHSHE:2018:363, Court of The Hague 1 September 2015, ECLI:NL:GHDHA:2015:2332, and Hof Amsterdam 5 July 2011, ECLI:NL:GHAMS:2011 :BR3020.