Rb. Gelderland - AWB - 19/3510

Rb. Gelderland - AWB 19/3510
Court:	Rb. Gelderland (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:	Article 57 GDPR
Decided:	04.02.2020
Published:	05.02.2020
Parties:	Autoriteit Persoonsgegevens (Dutch DPA)
National Case Number/Name:	AWB 19/3510
European Case Law Identifier:	ECLI:NL:RBGEL:2020:622
Appeal from:
Appeal to:
Original Language(s):	Dutch
Original Source:	(in Dutch)
Initial Contributor:	n/a

The complainant filed a complaint against the Dutch DPA in the Gelderland Court of first instance for the perceived inaction regarding issues raised in a complaint against Dutch Railways.

English Summary

Facts

The complainant wanted the Dutch DPA to open an investigation concerning (1) identification issues when handing in an anonymous chip card and being reimbursed the sum; (2) a perceived attempt to mislead the complainant as a customer that identification would be mandatory when purchasing tickets at the station counter for all international train journeys within the EU; and (3) charging service costs when topping up an anonymous public transport chip card using cash.

Dispute

The dispute in front of the court was whether the decision to reject the investigation for the three issues was sufficiently grounded. The court assessed each of the three issues seperately.

Holding

The first issue was whether the DPA sufficiently investigated whether the costumer was identified on reimbursement of the balance of a non-registered OV chip card.

The court highlighted that the Dutch DPA showed in the investigation that it was not a policy of the Dutch Railways to record personal data, and that the issue of privacy was brought to the attention of employees during courses and training. In addition, Dutch Railways explained that their computer system did not allow personal data to be recorded when a non-registered public transport chip card was returned. Based on this, the Dutch DPA was able to conclude that the Dutch Railways acted sufficiently adequate with their policy and did not record any personal details of the identification shown. As such, the Court found the issue to be sufficiently investigated.

The second issue was whether the DPA sufficiently investigated the procedure for purchasing an international train ticket.

The court highlighted that according to the employee handbook, a customer buying an international ticket is not required to give up personal data. The complainant highlighted that the employee in fact asked for personal data when the complainant bought a ticket. However, as noted by the DPA, a deviation from the handbook by one of the employees was not sufficient to launch an investigation in light of the prioritisation policy. Furthermore, the complainant could buy a ticket in the end. The court agreed with this assessment.

Finally, the complainant stated that the OV chip card was not anonymous, and that even if it was, it was unreasonably onerous when the card could only be charged from a ticket machine at the local station, as well as paying a higher price.

The court highlighted that even with a restricted number of access points for charging the card with cash, it did not necessarily lead to a breach of the GDPR. Since there was no breach, it was not necessary for the DPA to further investigate the issue.

The court declared the appeal unfounded.

Comment

Share your comment here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the Dutch original for more details.

Statement
GELDERLAND COURT

Arnhem seat

Administrative law

case number: AWB 19/3510
judgment of the multiple chamber of 4 February 2020

in the case between
[Name A], in [domicile A], claimant,

and
the Dutch Data Protection Authority, defendant.

(Agents: JMA Koster and W. van Steenbergen, LL.M.).
The third party that participated in the proceedings was: NS Groep NV, in Utrecht.

(authorized representative: mr. A. Nijhoff)
Process course

By decision of 12 November 2018, the defendant refused a request from the plaintiff to take enforcement action against the Dutch Railways.

By decision of 12 June 2019 (the contested decision), the defendant rejected the claimant's objection as unfounded.

The claimant appealed against the contested decision.

Defendant has submitted a statement of defense.

Third party has given a written explanation.

The investigation at the hearing took place on December 16, 2019. Plaintiff has appeared. Defendant is represented by its agents. Third party is represented by its authorized representative and [Name B].
Considerations

Why does the court not honor the claimant's request to stay the case?

1. The claimant has requested that his case be stayed pending the answer to the questions referred for a preliminary ruling by the Constitutional Court of Belgium and pending the decision on the appeal to the Administrative Law Division of the Council of State (the Division) in a similar case previously conducted by him.
1.1.

The court sees no reason for this. In its judgment of 17 October 2019 (judgment no. 135/2019), the Constitutional Court of Belgium referred questions to the Court of Justice of the European Union for a preliminary ruling. These questions relate to the national (Belgian) law of 25 December 2016 on the processing of passenger data. Under this law, Directives (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016, 2004/82 / EC of the Council of 29 April 2004 and 2010/65 / EU of the European Parliament and of the Council of October 20, transposed into (national) legislation. The purpose of Directive 2004/82 / EC is to improve border controls and to combat illegal immigration, and it concerns the professional transport of persons by air. The purpose of Directive 2010/65 is to simplify and harmonize the administrative procedures applicable to maritime transport. Directive 2016/681 lays down rules on the transfer by airlines of Passenger Name Record PNR (Passenger Name Record PNR) flights for the purpose of preventing, detecting, investigating and prosecuting terrorist offenses and serious crime.

One of the questions asked by the Constitutional Court of Belgium is whether Article 23 of the AVG applies to (this) national legislation. For the rest, the questions relate to Directive (EU) 2016/681.

In the opinion of the Court, the European Court's answers to the questions asked do not affect the claimant's appeal in this case. The aforementioned directives are not applicable and the AVG has been applied directly in this case and not through national legislation.
1.2.

There is also no reason to await the decision of the Division in the claimant's appeal against the decision of this court of 5 September 2019 in cases AWB 18/546 and 18/1487 1 . The enforcement request that is being dealt with in this case largely concerns subjects other than those covered by the judgment of 5 September 2019.

What is this statement about?

2. In this judgment, the court assesses the defendant's refusal to take enforcement action against NS on the basis of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (General Data Protection Regulation; AVG ). This concerns 3 alleged violations of the Dutch Railways:

I. mandatory identification / identification when handing in anonymous chip card for payment of the balance thereon;

II. attempt to mislead plaintiff as a customer that identification would be mandatory when purchasing tickets at the station counter for all international train journeys within the EU;

III. charging service costs when charging / topping up an anonymous public transport chip card using cash.
2.1.

The court refers to the appendix for the relevant laws and regulations. This appendix is ​​part of the ruling.

How does the court assess the defendant's decision?

3. The claimant has submitted a request on the basis of Article 58 of the AVG . Pursuant to this article, the defendant may - prior to taking enforcement action - initiate an investigation into the manner in which the AVG is applied with regard to data processing. The defendant has also done so in this case.

Defendant has policy rules for such investigations, which are described in the 'Policy rules for prioritizing complaints investigation AP'. 2 Article 2 of these policy rules states that the respondent first assesses on the basis of the content of the complaint whether it concerns the processing of personal data concerning the complainant and whether or not there has been a violation of the AVG . If the initial assessment shows that there has been no violation, the respondent rejects the request for enforcement or terminates the handling of the complaint, according to the explanation. The claimant's request was rejected after the initial assessment, with reference to these policy rules.

In the court's opinion, this policy is not unreasonable. Furthermore, the defendant has correctly assessed the request against these policy rules. The policy rules do not provide for transitional law and therefore have immediate effect. It is therefore irrelevant that the claimant has submitted his request for the policy rules to enter into force.

The court assesses whether the respondent has been able to conclude on the basis of this investigation that the NS does not violate the AVG . If that is not the case, then the respondent is not authorized to take enforcement action against the Dutch Railways.

Has the respondent sufficiently investigated the identification on payment of the balance of a non-registered OV chip card?

4. The claimant argues that the respondent did not adequately investigate the way NS works when paying the balance on an anonymous public transport chip card. The Dutch Railways requires people who submit an anonymous OV chip card to identify themselves. According to NS policy, no personal data is processed in this regard, but the defendant has not investigated whether NS actually adheres to this policy. If there were stolen anonymous cards, this would indicate that personal data would still be processed. Because without personal data, the Dutch Railways cannot check whether the card has been stolen. According to the claimant, reading the Chip ID on the card is also not necessary.

The defendant also refuses to check the contractual provisions of the Dutch Railways against the AVG . Plaintiff has not concluded a contract with Trans Link Systems (TLS). The claimant wants the defendant to be instructed to investigate the actual objectives and actual actions, including technical (IT) systems of the Dutch Railways.
4.1.

Respondent has asked questions to NS from the claimant's complaint. It follows from the letter from the Dutch Railways (NS) of 26 September 2018 that NS does not process any personal data from the identity documents of customers who hand in a non-registered public transport chip card. The NS referred to the handbook for its employees, in which the following is stated under “Balance on the OV chip card”:

“A customer with an OV chip card with a maximum amount of € 30.00 can receive a refund under the following conditions:

    -

    There is no refund for another OV chip card ordered in the same order;
    -

    After a refund, the card balance is always zero. Only the entire balance can be refunded. The customer must identify himself (passport, ID or driver's license). It is not permitted to record personal data of this customer. " 

4.2.

The defendant did not reasonably need to see any reason to conduct further investigation. After all, the investigation conducted by the defendant shows that it is not a policy of the Dutch Railways to record personal data. The handbook for employees regularly brings NS to the attention of employees during courses and training. Employees have recently received an e-mail about this, according to the NS at the hearing. In addition, the Dutch Railways explained that their computer system does not allow personal data to be recorded when a non-registered public transport chip card is returned. Based on this, the defendant has been able to conclude that the NS acts sufficiently adequately with this policy and does not record any personal details of the identification shown. The claimant has not further substantiated his claim that the employees of the Dutch Railways were instructed to act differently.

Personal data will be processed when repaying the balance of a non-registered OV chip card above a maximum of € 30.00. In addition, the processing controller is not the NS but the TLS. As no enforcement request has been filed with the defendant for TLS, reimbursements by TLS are not relevant in this case. The claimant's claim that the amount of € 30.00 was chosen at random does not change this. This professional ground does not succeed.

Has the defendant sufficiently investigated the procedure for purchasing an international train ticket?

5. The claimant argues that employees of the NS service desk structurally ask for personal data when purchasing an international train ticket. According to the claimant, the NS did not deny this either. It is up to the defendant to investigate violations that deviate from the paper policy. This also applies to violations by the NS call center.
At the hearing the plaintiff explained that his request for enforcement on this point applies to all international journeys that the NS sells at the station counter, not only the tickets for which the NS can be considered as controller, but also the tickets where the NS only acts as a processor acts for a foreign company.
5.1.

The court considers the latter part of the request to be undetermined and insufficiently concrete. A request for enforcement (complaint) on the basis of the AVG can only be submitted if there is processing of personal data from the claimant himself as a person concerned within the meaning of the AVG and as an interested party within the meaning of the General Administrative Law Act (Awb). This is not the case with regard to NS as a processor for a foreign company, because the claimant did not purchase an international train ticket for a journey in which the NS acted as a processor. The claimant did, however, buy an international train ticket for a trip to a location in Germany that he mentioned, whereby the NS is the controller. That is why the respondent was right to limit the request to NS as the controller for this train ticket purchased by the claimant; The defendant did not have to interpret the enforcement request more broadly.
5.2

If a traveler buys an international train ticket at an NS service counter for which the NS is responsible for processing, he is not obliged to provide personal data. This is evident from the handbook cited in the letter from the Dutch Railways dated 26 September 2018. It states: "Desk staff informs (potential) customers about the possibility of receiving service messages in the event of, for example, delays, changes, strikes or calamities" and: "The customer can therefore optionally provide his personal data to the NS solely for service messages with the aforementioned character "and:" It is also important to emphasize that this is an additional option for the customer, in other words it is still possible to purchase an international ticket by a (potential) customer without having to receive service messages from NS and therefore provide personal data to NS. "

The defendant was able to deduce from this letter that the NS did not act contrary to the AVG when selling international train tickets. The claimant was able to purchase an international train ticket without providing his personal details. The fact that, according to the plaintiff, a desk clerk might not have acted in full in accordance with the NS Handbook, does not mean that the defendant should have seen it necessary, in view of his prioritization policy, to conduct further investigation.
The claimant's claim that the call center has processed personal data from him has not supported the claimant. This professional ground does not succeed.

Has the defendant adequately investigated the service costs for charging non-registered OV chip card with cash?

6. The claimant states that the anonymous OV chip card is not anonymous. Even if the anonymous OV chip card were anonymous, then a privacy-friendly use would be unreasonably onerous because a resident of Arnhem can only charge at a ticket machine with cash at Arnhem Central station. That is only one location and you can only pay with coins. Charging at the service counter with paper money costs € 0.50 extra. Travelers who want to travel anonymously must pay higher costs than travelers who lose their privacy. The extra service costs are discriminatory.
6.1

As the court considered in its aforementioned judgment of 5 September 2019, travel data are processed in the case of a non-registered public transport chip card on the basis of the unique pass number of the card, but when purchasing cash or charging a ticket with cash OV chip card no payment details known that can be linked to the user of the card. In that judgment, the court also considered it not disproportionately burdensome to save money for this, or to pay a slightly higher price (€ 0.50) with a banknote balance at an NS counter. In addition, charging for service costs does not lead to discrimination for travelers who want to travel with a non-registered OV chip card, because the NS staff members must perform extra actions and these service costs are also charged when charging a personal OV chip card. be charged. Although the number of machines where cash can be charged is limited, it does not lead to the conclusion that there is a possible violation of the AVG . The defendant therefore did not have to conduct any further investigation into this. This professional ground does not succeed.

Other professional grounds. Conclusion

7. The claimant has put forward more grounds for appeal. The plaintiff's fears in particular show that there will increasingly be a society in which the privacy of the citizen is coming under pressure. However, those grounds do not directly relate to the contested decision and therefore cannot affect its legality. The other grounds for appeal do not alter this either.

8. Because the grounds for appeal do not succeed, the appeal is unfounded. There is no reason for a costs order.
Decision

The court declares the appeal unfounded.