Rb. Amsterdam - 22/4916

Rb. Amsterdam - 22/4916
Court:	Rb. Amsterdam (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:	Article 15 GDPR Article 15(3) GDPR Article 39(i) WJSG
Decided:	20.09.2023
Published:	19.12.2023
Parties:
National Case Number/Name:	22/4916
European Case Law Identifier:	ECLI:NL:RBAMS:2023:5815
Appeal from:
Appeal to:
Original Language(s):	Dutch
Original Source:	rechtspraak.nl (in Dutch)
Initial Contributor:	co

A Dutch Court held that the board of the Public Prosecutor's office had fulfilled a generic access request under Article 15 GDPR by providing a general overview of the data being processed. The controller is obliged to provide a copy under Article 15(3) GDPR only insofar as the data subject shows that the copy is necessary to exercise their rights.

English Summary

Facts

A data subject had submitted an access request to the Board of Public Prosecutor’s office seeking to obtain information about any personal data about him being processed by the Board. The Board, as a defendant, treated his request as a general access request under Article 15 GDPR and Article 39(i) Judicial and Criminal Records Act (Wet justitiële en strafvorderlijke gegevens - WJSG). Under Article 39(i) of the WJSG, data subjects have the right to request the Board to obtain confirmation as to whether criminal records about them is being processed and, if so, to obtain information about the processing thereof.

On 31 August 2022, the Board thus provided the data subject with two separate documents, one regarding the criminal records about him that were being processed under the WJSG and the other containing all other personal data about him being processed under the GDPR. The data subject, the plaintiff claimed that the response was incomplete. The defendant thus asked him to substantiate his request and the data subject answered that he wished to receive all data concerning him that was being processed. The defendant then added additional personal data and criminal records of the plaintiff that were found in its database.

Still unsatisfied with the response, the plaintiff appealed against the judgment.

Holding

The court issued its final judgment on 20 September 2023 and held that, since the access request by the data subject was drafted in general terms and had a broad scope, the defendant correctly replied with a general overview of the personal data and criminal records about him being processed. The plaintiff objected to this response and the defendant asked him to specify his request in line with Recital 63 GDPR. As the plaintiff again answered in general terms, claiming he requested access to all his personal data, the court held that the defendant was right in replying in broad terms too. When the plaintiff substantiated his request at the appeal hearing, mentioning specific data he wished to have access to, the court held that it was too late and he should have mentioned this at the time of objection or submit a new request.

Further, upon hearing the defendant on its search operations, the court held that the defendant did carry out a sufficiently complete research when looking for the plaintiff’s personal data in its possession.

As regards the provision of copies of personal data of the plaintiff under Article 15(3) GDPR, making reference to CJEU C-487/21, the court specified that a right to obtain a copy of one’s personal data does not constitute an obligation for an administrative body to provide copies of documents entailing the data subject’s personal data. The latter can choose to provide an understandable reproduction of such data as long as a copy of the documents is not indispensable for the data subject to exercise his rights under the GDPR. The court held in this respect, that the plaintiff did not make it clear in his request that the data was indispensable for him to exercise his rights, hence the defendant was not bound to provide him with a copy of his personal data.

As regards the plaintiff’s criminal records, the court also held that he had no right to obtain a copy thereof under the WJSG.

In light of the above, the court declared the appeal to be unfounded as the defendant had answered in a complete and clear manner to the plaintiff’s access request.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

Authority
Court of Amsterdam
Judgment date
09/20/2023
Date of publication
19-12-2023
Case number
22/4916
Jurisdictions
Administrative law
Special characteristics
First instance - single
Content indication

"Unfounded. Avg and Wjsg. The plaintiff has not specified his request. In view of the general scope of the request, the scope of the personal data processed and recital 63 in the preamble to the Avg, the defendant may suffice with a general overview of the personal data processed of the plaintiff."
Locations
Rechtspraak.nl
Enriched pronunciation
Pronunciation
COURT OF AMSTERDAM

Administrative law

case number: AMS 22/4916
ruling of the single chamber of September 20, 2023 in the case between
[plaintiff], in Amsterdam, plaintiff,

and
Public Prosecution Service, Board of Attorneys General, defendant

(representative: Mr. T. Gillhaus).
Introduction

With a decision dated 1 February 2022 (the primary decision), the defendant decided on the claimant's request on the basis of the General Data Protection Regulation1 and the Criminal Procedure and Judicial Data Act2.

By a decision dated August 31, 2022 (the contested decision), the defendant declared the plaintiff's objection well-founded, insofar as it concerns the incompleteness of the overview.

The plaintiff has appealed against the contested decision. Defendant has filed a defense statement.

The hearing took place on August 2, 2023. The plaintiff appeared. Defendant was represented by his attorney, accompanied by
Mr. M.P. Ketting.The court closed the investigation at the hearing.

The plaintiff challenged the examining judge with the email of August 4, 2023. The disqualification chamber rejected the disqualification request with its ruling of August 9, 2023. After this, the procedure continued in the state it was in at the time of the suspension due to the request for disqualification.
Considerations

What preceded this procedure
1.1.

On July 28, 2021, the plaintiff submitted a request for access to all personal data that the defendant processes about him, including personal data in reports, changes,
emails, apps, text messages and audio and video recordings. The plaintiff refers to the GDPR and any other relevant (international) legislation and treaties, such as the Police Data Act, the Data Protection Treaty, the European Convention on Human Rights and the Charter of Fundamental Rights of the European Union.
1.2.

With the primary decision, the defendant has decided on the plaintiff's request. The defendant interpreted the plaintiff's request for access as a general request on the basis of Article 39i of the Wjsg and Article 15 of the GDPR. Defendant has provided two overviews. In the first overview, the defendant has stated the processed criminal data of the plaintiff on the basis of the Wjsg. In the second overview, the defendant has listed the plaintiff's personal data processed on the basis of the GDPR.
1.3.

The claimant has objected to the primary decision. The claimant stated, among other things, that the overview is incomplete. By letter dated March 30, 2022, the defendant requested the plaintiff to provide concrete substantiation of what information is missing from the overviews drawn up by the defendant, so that a further detailed assessment can be made based on that information.

search can be carried out. In the plaintiff's written response of June 28, 2022, he wrote that he wishes to inspect all personal data that the defendant processes.
1.4.

With the contested decision, the defendant has declared the plaintiff's objection well-founded, insofar as it concerns the incompleteness of the overview. The defendant has included an overview in the appendix with additional criminal data and personal data that the defendant has found in his systems.

The judgment of the court
2.1.

The court assesses the decision to grant partial access to the plaintiff's criminal and personal data. She does this on the basis of the plaintiff's grounds for appeal.
2.2.

The court concludes that the appeal is unfounded. Below, the court explains how it reaches this decision and what consequences this decision has.

The procedural order
3.1.

The plaintiff argues that the defendant acted contrary to due process by not submitting a defense statement until July 21, 2023. The court does not agree with the plaintiff in this regard.
3.2.

On October 14, 2022, the court gave the defendant the opportunity to submit a statement of defense within four weeks3. Defendant only submitted a statement of defense twelve days before the hearing, so far beyond the set period of four weeks. Although this is certainly not to the defendant's advantage, it depends on the circumstances of the case what consequences are attached to it4. The question in particular is whether the claimant was sufficiently able to respond to the defense no later than the hearing. At the hearing, the parties discussed whether the case can be dealt with in full. The court has not received any signal from the parties that the case should be adjourned for a further response period to the defense statement. Given the content of the defense statement, the court also sees no ex officio reason to assume that the plaintiff was unable to sufficiently argue his case at the hearing.

The generality of the overview
4.1.

The court is of the opinion that in the present case the defendant has complied with the request made by the plaintiff by providing a general overview of the processed criminal proceedings and personal data. The court considers this as follows.
4.2.

The court considers that the plaintiff's request is formulated generally and is therefore broad in scope. The defendant therefore requested on March 30, 2022 - in line with recital 63 in the preamble to the GDPR - for a specification of the data that the plaintiff wishes to receive. In the plaintiff's written response of June 28, 2022, he wrote that he wishes to inspect all personal data that the defendant processes. The plaintiff therefore did not respond to the defendant's request. Since the plaintiff has not done this, the defendant, given the general scope of the request, the scope of the personal data processed and recital 63 in the preamble to the GDPR, could suffice with a general overview of the plaintiff's processed personal data.
4.3.

Insofar as the claimant did specify his request at the appeal hearing, such as regarding an Interpol alert mentioned by him, this was too late. The defendant rightly pointed out that it was up to the plaintiff to specify the request already in the objection phase. In the opinion of the court, the defendant in these proceedings could therefore suffice with a general overview. If the claimant wishes to inspect the processed personal data of a specific subject on the list, he can submit a new request.

The secret pieces

5. It was further discussed at the hearing that the defendant did not submit the secret documents on which the general overview was based confidentially. The court agrees with the defendant that, due to the general nature of the overview, there is no added value for the court to have the underlying secret documents.

The (in)completeness of the search
6.1.

It follows from settled case law of the Administrative Jurisdiction Division of the Council of State (the Division) that when an administrative body states that after investigation it has become apparent that a specific document is not or no longer held by it and this communication does not seem implausible, it is in principle up to the person who requests information is to make it plausible that the document is nevertheless held by the administrative body.5 When assessing whether a statement by an administrative body does not seem unbelievable to the court, the manner in which the investigation was conducted will be taken into account. The administrative body must make it clear that sufficient careful research has been conducted. This also means that the administrative body must investigate whether the requested documents exist or should have been in its possession.6
6.2.

Defendant further explained the search at the hearing. The defendant has two systems, one for criminal data and one for other data, including personal data that are not criminal proceedings. The defendant searched these systems for the plaintiff's name, the plaintiff's social security number and the plaintiff's criminal justice system number. The people who search in the search systems have access to the entire database within the search system. There are no shielded parts that are not accessible to them. Based on indications from the general search system, the privacy officers of the specific public prosecutor's offices are questioned. Each public prosecutor's office has a privacy officer for any further investigation. The court is of the opinion that the search carried out by the defendant adequately covers the general request of the plaintiff. The court therefore considers it not implausible that the defendant does not hold more personal data than that which already falls within the scope of this general search. A further search can take place in the event of a new specific request. In view of the foregoing, the court sees no reason to request underlying documents, such as proof that the defendant asked the specific public prosecutor's office for information.
6.3.

The claimant has stated that it is implausible that the general overview is complete because of all the incidents he has experienced. The plaintiff draws the conclusion from this that the government (including the defendant) cannot be trusted with regard to the disclosure of personal data. The court does not follow the plaintiff in this. In this case it is a general request. Defendant was able to suffice with a general search and a general overview. For that reason alone, the claimant's claim does not hold.
6.4.

Since the court does not doubt the completeness of the overview, the court sees no reason to have an expert conduct a search of the defendant, as the plaintiff has requested.

The provision of copies

Personal data under the GDPR
7.1.

The plaintiff argues that the defendant should have provided copies of his personal data. The plaintiff argues that the defendant has not recognized that he is entitled to unvarnished copies under Article 15(3) of the GDPR.
7.2.

Article 15(3)(1) of the GDPR stipulates that the controller must provide the data subject with a copy of the personal data being processed. In the judgment of May 4, 2023, F.F. v Österreichische Datenschutzbehörde, C-487/217, the Court of Justice of the European Union ruled that Article 15(3), first sentence, of the GDPR must be interpreted as follows. The right to obtain a copy of personal data means that the data subject must be provided with a faithful and intelligible reproduction of all such data. This right includes the right to obtain a copy of extracts from documents or even of complete documents or database extracts containing that data, where this is indispensable to enable the data subject to exercise effectively the rights conferred on him by this Regulation.
7.3.

The obligation to provide a copy of the personal data pursuant to Article 15(3) of the GDPR does not therefore mean that an administrative body is obliged to provide copies of the documents in which those personal data appear. An administrative body may do this, but it may also choose another form in which the copy of the personal data is provided if this provides a faithful and understandable reproduction of all these data. But if copies are indispensable to actually exercise the rights granted by the GDPR, an administrative body is obliged to provide copies of documents.
7.4.

The court agrees with the defendant that, given the general nature of the overview alone, it has not been shown that it is indispensable for the plaintiff to receive copies of all underlying documents to which the defendant's overview refers.

Criminal proceedings data on the basis of the Wjsg

8. The court also sees no grounds for the conclusion that the defendant was obliged to provide the plaintiff with copies of the criminal data. After all, it follows from settled case law of the Division8 that Article 39i of the Wjsg does not give the right to a copy of the data in question. The article concerns the notification of which criminal data have been processed and not whether or not a copy of that data is obtained.
Conclusion

9. In view of the above considerations, the appeal is unfounded. This means that the decision on the plaintiff's objection remains upheld. The plaintiff will therefore not receive the court fee back. He will also not be reimbursed for his legal costs.
Decision

The court declares the appeal unfounded.

This statement was made by Mr. T.L. Fernig-Rocour, judge, in the presence of
Mr. N.J.A. van Eck, clerk. The decision was pronounced publicly on
September 20, 2023.

clerk judge

Copy sent to parties on:
Remedy

A party that does not agree with this ruling can send an appeal to the Administrative Jurisdiction Division of the Council of State explaining why this party does not agree with this ruling. The appeal must be submitted within six weeks of the day on which this decision was sent. If the petitioner cannot await the hearing of the appeal because the case is urgent, the petitioner can ask the preliminary relief judge of the Administrative Jurisdiction Division of the Council of State to take a provisional measure (a temporary measure).

1 Hereafter: Avg.

2 Hereafter: Wjsg.

3 This concerns a request pursuant to Article 8:42, first paragraph, of the General Administrative Law Act (GALA).

4 It follows from settled case law of the Division that the law does not attach any consequences to failure to submit a statement of defense within this period. See, for example, the ruling of the Administrative Jurisdiction Division of the Council of State of 19 March 2014, ECLI:NL:RVS:2014:989.

5 See, for example, the ruling of the Division of 4 August 2021, ECLI:NL:RVS:2021:1743.

6 See the ruling of the Division of October 14, 2020, ECLI:NL:RVS:2020:2437.

7 CJEU 4 May 2023, ECLI:EU:C:2023:369.

8 See, for example, the ruling of January 18, 2017, ECLI:NL:RVS:2017:128