RvS - 202001629/2/A3: Difference between revisions

From GDPRhub
(Created page with "{{COURTdecisionBOX <!--Information about the Court--> |Jurisdiction=Netherlands |Court-BG-Color=background-color:#ffffff; |Courtlogo=courtsNL.png |Court_Abbrevation=RvS |Cour...")
 
No edit summary
Line 9: Line 9:


<!--Information about the decision-->
<!--Information about the decision-->
|Case_Number_Name=201901006/1/A2
|Case_Number_Name=202001629/2/A3
|ECLI=ECLI:NL:RVS:2020:898
|ECLI=ECLI:NL:RVS:2020:1379


|Original_Source_Name_1=de Rechtspraak
|Original_Source_Name_1=de Rechtspraak
|Original_Source_Link_1=https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RVS:2020:898&showbutton=true&keyword=avg
|Original_Source_Link_1=https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RVS:2020:1379&showbutton=true&keyword=avg
|Original_Source_Language_1=Dutch
|Original_Source_Language_1=Dutch
|Original_Source_Language_Code_1=NL
|Original_Source_Language_Code_1=NL
Line 22: Line 22:
|Original_Source_Language_Code_2=
|Original_Source_Language_Code_2=


|Date_Decided=1.4.2020
|Date_Decided=12.6.2020
|Date_Published=1.4.2020
|Date_Published=17.7.2020
|Year=2020
|Year=2020


<!--Information about the applied law-->
<!--Information about the applied law-->
|GDPR_Article_1=Article 79 GDPR
|GDPR_Article_1=  
|GDPR_Article_Link_1=Article 79 GDPR
|GDPR_Article_Link_1=  
|GDPR_Article_2=Article 82 GDPR
|GDPR_Article_2=  
|GDPR_Article_Link_2=Article 82 GDPR
|GDPR_Article_Link_2=
|GDPR_Article_3=
|GDPR_Article_3=
|GDPR_Article_Link_3=
|GDPR_Article_Link_3=
Line 150: Line 150:
|National_Law_Link_20=
|National_Law_Link_20=


|Party_Name_1=Anonymous
|Party_Name_1=Autoriteit Persoonsgegevens
|Party_Link_1=
|Party_Link_1=https://autoriteitpersoonsgegevens.nl/en
|Party_Name_2=Minister for Legal Protection
|Party_Name_2=
|Party_Link_2=
|Party_Link_2=
|Party_Name_3=
|Party_Name_3=
Line 162: Line 162:


<!--Information about a possible appeal-->
<!--Information about a possible appeal-->
|Appeal_From_Body=Rb. Gelderland (Netherlands)
|Appeal_From_Body=
|Appeal_From_Case_Number_Name=18/3073
|Appeal_From_Case_Number_Name=
|Appeal_From_Status=Unknown
|Appeal_From_Status=Unknown
|Appeal_From_Link=
|Appeal_From_Link=
Line 174: Line 174:


<!--Here the main article starts-->
<!--Here the main article starts-->
The Council of State awarded appellant with 500 EUR compensation for the unlawful sharing of his sensitive personal data. The amount was raised from 300 EUR to 500 EUR. Sensitive data in question contained strictly confidential medical information which was shared between forensic psychiatric observation clinic Pieter Baan Centrum and Regional Disciplinary Board for Healthcare in Zwolle.
The preliminary relief judge of Council of State declared unfounded the applicant’s request to urgently force Autoriteit Persoonsgegevens (Dutch DPA) to investigate the abolishing by the European travel companies of the so-called ATB ticketing system. Applicant finds that it should be possible to buy international train tickets without having to provide personal data.


==English Summary==
==English Summary==
===Facts===
===Facts===
Appellant’s strictly confidential medical data was shared by a forensic psychiatric observation clinic with the Regional Disciplinary Board for Healthcare. The appellant was not informed about this. His subsequent objection and request for compensation was rejected by the Minister for Legal Protection on the basis that the Appellant’s honor or reputation has not been affected, nor has he suffered otherwise. The Court of Gelderland, which heard the dispute, ruled that sensitive personal data has indeed been shared unlawfully and awarded 300 EUR in damages to the Appellant.  
On 12 November 2018 Autoriteit Persoonsgegevens (Dutch DPA) rejected the applicant’s request for enforcement. On 12 June 2019 the DPA declared applicant’s objection invalid. On 4 February 2020 the court dismissed the applicant’s appeal. Applicant is now appealing this Court decision before the preliminary relief judge of the Council of State.


===Dispute===
===Dispute===
The Appellant claims that he is entitled to a higher compensation. The State Council had to assess whether that is the case.
Applicant is asking the preliminary relief judge to urgently order DPA to:
a) Notify relevant transportation companies in the European Union that they can start an investigation into the decommissioning of the ATB system and request these companies to continue supporting the system;
b) Investigate the historical and current facts behind the decommissioning;
c) Prevent further decommissioning if the investigation shows that the ATB system is being dismantled;
d) Report the outcome of the investigation for the Court to use in the main proceedings.
 
Dutch DPA is of the opinion that NS (Dutch public transportation company the applicant complained about) did not violate GDPR, so the enforcement is rejected. Moreover, according to the DPA, the applicant’s enforcement request only concerns cases where NS acts as a controller, which means it only applies to situations where NS sells its own tickets and not international tickets of other companies.


===Holding===
===Holding===
The State Council agreed with the Court of Gelderland that the appellant was intitled to compensation of non-material damage according to the Dutch Civil Code and increased the amount awarded to 500 EUR. In deciding this, the Council considered the nature, duration and seriousness of the breach:
The preliminary relief judge cannot order DPA to investigate the decommissioning of the ATB system because the judge cannot be sure that the DPA will get the same order as the result of the main proceedings.
• Nature: sensitive data was processed without consent or any other applicable legal basis;
 
• Seriousness: sensitive data was shared with a small group of professionals and members of the Board have a duty of confidentiality by virtue of their position;
The judge founds it important that the ATB system stayed in use until the end of 2019, so it was possible to buy such ticket at the time of the applicant’s objection to the DPA. Also, Dutch DPA’s enforcement powers regarding foreign transportation companies would need to be considered separately as NS is indeed acting as a processor to those companies.
• Duration: the breach occurred on the 15th of January 2018. On 22nd of January the Board confirmed that they would disregard the information.
 
The Council took into account that the Appellant did not demonstrate any negative consequences of the breach.
Lastly, the preliminary relief judge did not agree that the dissemination of the ATB system would be irreversible. If at any point NS is found violating the GDPR by not offering an option to buy tickets without providing personal data, it will be the obligation of NS to provide a solution.


==Comment==
==Comment==
Line 199: Line 205:
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
<pre>
<pre>
Council of State
Date of pronunciation
    12-06-2020
Date of publication
    17-06-2020
Case number
    202001629/2/A3
Jurisdictions
    Administrative law
Special features
    Provisional provision
Content indication


201901006/1/A2.
    By decision of 12 November 2018, the Authority for Personal Data rejected a request by [the applicant] to maintain it. [applicant] considers that it should be possible to purchase a ticket for an international rail journey without having to provide any personal data. He states in his request for enforcement that this is very difficult in practice, because personal data - including at least the name - is requested by default when buying a ticket.
Sites
    Rechtspraak.nl
    Enriched pronunciation


Date of judgment: 1 April 2020
Ruling
 
202001629/2/A3.
 
Date of judgment: 12 June 2020


SECTION
SECTION
Line 208: Line 233:
ADMINISTRATIVE LAW
ADMINISTRATIVE LAW


Ruling on the appeal of:
A decision by the interim relief judge of the Administrative Jurisdiction Division of the Council of State on an application for interim relief (article 8:81 of the General Administrative Law Act) pending the appeal of the Council of State:


[appellant], residing at [residence],
[applicant], residing at [residence],


against the judgment of the District Court of Gelderland of 19 December 2018 in Case No 18/3073 in the proceedings between:
against the judgment of the District Court of Gelderland of 4 February 2020 in Case No 19/3510 in the proceedings between:


[appellant]
[applicant]


and
and


the Minister for Legal Protection.
the Personal Data Authority (hereinafter AP).


Process Process
Process flow


By decision of 13 March 2018, the Minister rejected a request for compensation from [the appellant].
By decision of 12 November 2018, the AP rejected an application by [the applicant] for maintenance.


By decision of 17 May 2018, the Minister dismissed [the appellant's] objection.
By decision of 12 June 2019, the AP dismissed [the applicant's] objection to that decision as unfounded.


On 6 June 2018, [the appellant] appealed against the decision of 17 May 2018 and asked the court to order the Minister to pay damages.
By decision of 4 February 2020, the District Court dismissed [the applicant's] appeal against that decision as unfounded.


By decision of 19 December 2018, the court upheld the appeal lodged by [the appellant] against the decision of 17 May 2018, annulled the decision of 17 May 2018, revoked the decision of 13 March 2018, ordered the Minister to pay damages of € 300 to [the appellant] and ordered that this decision replace the annulled decision. This decision is attached.
The applicant has lodged an appeal against this decision.


The [appellant] has lodged an appeal against this decision.
[the applicant] requested the Court in preliminary relief proceedings to make an interim injunction.


The Minister has given a written explanation.
The AP and NS Groep N.V. provided a written explanation.


The Division heard the case on 1 August 2019, where [the appellant] and the Minister, represented by F. Boone, appeared.
The applicant has submitted further documents.
 
The Division reopened the investigation pursuant to Section 8:68(1) of the General Administrative Law Act (Awb) and referred the case to a multiple chamber.
 
[Appellant] submitted a further document.
 
The Division heard the case on 15 January 2020, where [the appellant] and the Minister, represented by F. Boone, appeared.


Considerations
Considerations


    Introduction
1.    The judgment of the Court in preliminary relief proceedings is provisional in nature and is not binding in the proceedings on the merits.
 
1.    On January 15, 2018, the director of the Pieter Baan Centre submitted documents containing medical information about him to the Regional Health Care Disciplinary Board in Zwolle (hereinafter referred to as: the Disciplinary Board) in a complaint procedure against him, without [the appellant's] consent and without his knowledge. The draft versions of the psychological and psychiatric sections of Pro Justitia reports sent included strictly confidential personal details of [the appellant]. On 17 January 2018, [the Appellant] was informed by the Disciplinary Board of the disclosure of the sensitive personal data and was provided with copies of the reports. On 19 January 2018, [the appellant] asked the Disciplinary Board to disregard the documents when considering his complaint against the Director. On 22 January 2018, the Disciplinary Board informed [the appellant] that his personal details would be disregarded in the complaints procedure.
 
At the end of this decision (under 39), the Section briefly set out what this decision means in more general terms and what is to be decided in this case.
 
    Decision-making
 
2.    By letter dated 4 February 2018, [the appellant] objected to the Minister's submission of the reports and applied for compensation. In the proceedings that led to the court's ruling, the Minister stated that the Disciplinary Board was contacted immediately after the sensitive personal data were sent with a request to destroy the documents as soon as they were received. The Minister also took the position that the reports were not provided deliberately in order to influence the Disciplinary Board or to damage [the appellant]. In the decision of 17 May 2018, the Minister referred to the opinion of the Disciplinary Board of 9 March 2018 that the reports should not have been provided:
 
"In the opinion of the Board, the appendices, which evidently contain medical information, were indeed wrongly provided without the complainant's consent and without his knowledge. The appendices have no relevance for the present case and (therefore) do not serve to defend the defendant. The circumstances invoked by the defendant that a clerical error has been made, or that the lawyer of the RPP, after sending the documents - and therefore too late - advised not to send the annexes, should remain at the defendant's expense. The part of the complaint is well-founded'.
 
The Division is of the opinion that it should be held that the Minister took the position that the processing of [appellant's] personal data was unlawful. In addition, the Minister stated that he saw no grounds for compensation because [the appellant] had not been harmed in his honour or reputation or otherwise in his person.
 
    Court ruling
 
3.    The court found in the judgment that the transmission of the personal data was unlawful. [the appellant] rightly objected to the disclosure, on the grounds that he did not consent to the forwarding of his personal data as referred to in Article 8, opening words and under a, of the Personal Data Protection Act (Wet bescherming persoonsgegevens, Wbp). According to the court, [the appellant] is entitled to damages to be determined on a fair basis. With regard to the amount of the damages to be determined, the court considered it important that the privacy-sensitive personal data ended up with a small group of professionals, i.e. employees and members of the Disciplinary Board, and that they were bound by a duty of confidentiality by virtue of their duties. According to the District Court, this does not detract from the fact that [the appellant's] privacy was violated and that this was understandably perceived by the appellant as harmful and harmful. The court therefore considered compensation of € 300 to be fair and ruled that the Minister should pay this amount to [the appellant].
 
    Dispute on appeal
 
4.    The Minister has not appealed the court's decision. In that ruling, the court ruled that the decision of 17 May 2018 was unlawful and annulled that decision, in so far as it did not award any compensation.
 
5.    5. [Appellant] claims to be entitled to higher compensation than € 300.00.
 
    Ex officio judgement
 
6.    The District Court did not acknowledge that with the introduction of Title 8.4 in the Awb on the basis of Article 8:4, paragraph 1, opening words and under f of the Awb, the possibility to appeal against a decision regarding compensation for loss on account of unlawful management actions has lapsed. It follows from this that the District Court has annulled the decision of 17 May 2018, although rightly so, but on incorrect grounds. The court should have declared the objection against the decision of 31 March 2018 inadmissible instead of revoking this decision. Pursuant to Section 8:88 of the General Administrative Law Act, the court should have assessed whether [the appellant] was entitled to compensation.
 
7.    The court's ruling qualifies for set aside, insofar as the court has revoked the 31 March 2018 decision, has determined that the Minister will pay damages of €300 to [the appellant] and has determined that this ruling will replace the annulled decision. The Division will declare the objection to this decision inadmissible after all.
 
8.    The Division will assess the application for damages below.
 
    Applicable law
 
9.    On 25 May 2018, Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (the General Data Protection Regulation, hereinafter AVG) became applicable. The AVG will be directly applicable in each Member State as of 25 May 2018 (Article 99(3) of the AVG). The Wbp was repealed on 25 May 2018. The AVG has immediate effect. The transitional law contained in Section 48(10) of the AVG Implementation Act does not apply in this case.
 
10.    The AVG applies to the claim for damages. On 4 June 2018, i.e. after the AVG came into effect, [the appellant] requested the court to order the Minister to pay damages.
 
11.    The old law, i.e. the Wbp, applies to the assessment of the unlawfulness of the act as it occurred prior to 25 May 2018. It is not disputed on appeal that the Minister acted contrary to Section 8(a) of the Wbp and that this would also be contrary to the AVG.
 
    Article 82 of the AVG


12.    Article 82 of the AVG reads as follows:
Omission of hearing


1.    Any person who has suffered material or non-material damage as a result of a breach of this Regulation shall be entitled to receive compensation for the damage suffered from the controller or processor.
2.    The parties had been summoned to a hearing of the Court in preliminary relief proceedings on 30 April 2020.


2.    Any controller involved in processing shall be liable for any damage caused by processing operations in breach of this Regulation. A processor shall be liable for damage caused by processing only where the processing does not comply with the obligations laid down in this Regulation specifically addressed to processors or was carried out outside or in breach of the lawful instructions of the controller.
    In a letter dated 7 April 2020, [the applicant] requested that, in view of the nature and urgency of his request, the hearing should take place, even if he could not attend, for example due to the measures and guidelines of the government to prevent the spread of the coronavirus. [applicant] has argued that the corona crisis gives his application an extra urgent character.


13.    The Minister has not disputed the competence of the administrative courts and has also declared, on request, that he is in agreement with them. As also considered by the Division in today's judgments with numbers ECLI:NL:RVS:2020:899, ECLI:NL:RVS:2020:900 and ECLI:NL:RVS:2020:901, the Administrative Court is, in its opinion, competent to adjudicate an application for compensation for material or immaterial damage resulting from an act in violation of the AVG by an administrative body pursuant to Section 8:88 of the General Administrative Law Act. The Division derives arguments for this from the AVG and the AVG Implementation Act.
    By letter of 18 April 2020, sent from Finland, [the applicant] stated that he was prevented from attending the hearing as a result of the corona crisis. He reiterated his preference for the hearing to take place.


14.    The AVG is directly applicable in each Member State (Article 99(3) of the AVG). Claims for compensation in the event of acts contrary to the AVG derive directly from the AVG. Article 82(6) of the AVG provides that legal proceedings for the exercise of the right to compensation are to be conducted before the courts of the Member State referred to in Article 79(2). More generally, Article 79(1) lays down the right to an effective remedy.
    Due to the measures taken to prevent the spread of the coronavirus, the hearing did not take place. The parties were informed accordingly. The Court in preliminary relief proceedings then gave the parties the opportunity to comment on the intention to rule on the request at the hearing without hearing. At the same time, NS was asked three factual questions. NS answered these questions and provided a written explanation. The General Court provided a written explanation in which it stated that it did not consider it necessary to adjudicate at the hearing. The [applicant] responded to the written explanations given by NS and the AP.


15.    The AVG does not determine which courts within a Member State have jurisdiction to rule on the right to compensation. In the absence of procedural rules of Union law, it is settled case-law of the Court of Justice of the European Union (hereinafter 'the Court of Justice') that it is for the Member States to designate the competent courts and to apply their national procedural law in cases where Union law is enforced. However, such national rules must satisfy the conditions of equivalence and effectiveness (compare the judgment of 16 December 1976, C-33/76, Rewe, ECLI:EU:C:1976:188, and the judgment of 13 July 2006, C-295/04 - 298/04, Manfredi, ECLI:EU:C:2006:461, paragraph 62). These conditions require that a national procedural rule protecting the rights which individuals derive from Union law must not be less favourable than that governing similar domestic actions (principle of equivalence) and that a procedural rule must not render the exercise of rights conferred by the Union impossible or excessively difficult in practice (principle of effectiveness). A procedural rule must also comply with the principle of effective judicial protection, as currently enshrined in Article 47 of the Charter (judgments of the Court of Justice of 18 March 2010, C-317/08, C-318/08, C-319/08 and C-320/08, Alassini and others, ECLI:EU:C:2010:146).
    On the basis of the documents available, the Court in preliminary relief proceedings considered itself sufficiently well informed to be able to rule on the application for interim relief. In view of the obstacles and delays that have arisen in the progress of the hearing schedule as a result of the coronary measures taken, and now that none of the parties has indicated that a hearing is necessary, while [the applicant] considers his application urgent and has stated that the application may also be dealt with without his presence, in the opinion of the Interim Injunction Judge the parties will not be harmed in their interests if the application is not dealt with at the hearing. Therefore, pursuant to Section 8:83(4) of the General Administrative Law Act, the Interim Injunction Judge will rule without a hearing.


This means that, under these conditions, national law must determine which court has jurisdiction to rule on applications for compensation.
Enforcement request of [the applicant]


16.    Pursuant to Section 8:88(1)(a) of the General Administrative Law Act in conjunction with Section 34 of the Implementing Act, the administrative court has the power to order an administrative body, at the request of an interested party, to pay compensation for damage that an interested party has suffered or will suffer in connection with a written decision as referred to in Section 34 of the Implementing Act. To this end, it is envisaged as follows.
3.    By letter dated 9 July 2018, [applicant] submitted an application for enforcement to the AP. The introduction to this state:


17.    In paragraph 3.3. Legal Protection' of the AVG Implementation Act, Article 34 reads as follows:
"Partly with reference to my previous enforcement requests concerning privacy violations by NS [...] and partly with reference to Articles 6, 7, 15, 17, 18, 21, 25, 29, 51, 52, 57, 58, 77, 78 and 83 (in particular also point 2.e) of the latter Article) of the General Data Protection Regulation (AVG), I request you to investigate the following breaches of privacy by Nederlandse Spoorwegen (NS) that I have identified and to end them by means of enforcement measures:
 
Article 34. Applicability of the General Administrative Law Act by decision of administrative bodies
 
A written decision on a request as referred to in Articles 15 to 22 of the Regulation shall be taken within the time limits referred to in Article 12(3) of the Regulation and, insofar as it has been taken by an administrative body, shall be deemed to be a decision within the meaning of the General Administrative Law Act.
 
18.   Articles 15 to 22 of the AVG offer interested parties, among other things, the right of access to personal data, the right to rectification or erasure of personal data, the right to limit the processing of personal data concerning them, as well as the right to object to the processing of personal data, the right to data portability and the right not to be subjected exclusively to automated data processing.
 
19. These rights are inextricably linked to the control of the processing of personal data and enable interested parties to ascertain whether personal data have been processed lawfully and, inter alia, to seek compensation for unlawful processing.
 
20.    For the ways in which the right to compensation can be realised, the Explanatory Memorandum (Parliamentary Papers II 2017-2018, 34851 no. 3) to the AVG Implementation Act is included in the implementation table under Section 82, "Current Title 8.4 of the General Administrative Law Act or Civil Court". The Division deduces from this that it must be possible to bring a claim for compensation for damage resulting from an infringement of the AVG by an administrative body before both the administrative courts and the civil courts.
 
21.    The Section therefore concludes from Article 8:88 of the General Administrative Law Act in conjunction with Article 34 of the AVG Implementation Act that it is in line with the intention of the national legislator that the same court that adjudicates on, inter alia, decisions of administrative bodies at a request as referred to in Articles 15 to 22 of the AVG may also be requested to pay compensation for related damage. The Division considers this to be in the interests of the concentration of legal protection and thus also in the interests of effective and efficient legal protection (principle of effectiveness and Article 47 of the Charter of Fundamental Rights of the European Union). By way of comparison, the Section refers to the judgment of the Court of Justice of the European Union of 15 April 2008, C-268/06, EU:C:2008:223, paragraph 51 (Impact), from which it can be inferred that a concentration of legal protection is in line with the principle of effectiveness. In the view of the Division, the principle of equivalence is also satisfied because the opening up of the administrative procedure is not a procedural rule which treats claims under Union law less favourably than comparable claims under national law.
 
22.    This means that a person who, on the basis of Article 82 of the AVG, claims compensation for damage resulting from the unlawful processing of personal data by an administrative body, has the freedom of choice, in accordance with Article 8:88 of the Awb, to submit his request to the administrative court in connection with a decision as referred to in Article 34 of the AVG Implementation Act, or to realise his claim for compensation through the civil law channels. Article 8:88 of the General Administrative Law Act is interpreted as meaning that the power of the administrative court is less strictly limited to the requirement of an unlawful decision, because although there must be a connection with a decision as referred to in Article 34 of the AVG Implementation Act, this decision, for example on a request for inspection, does not have to be unlawful as such. In such a case, therefore, the administrative court may, in the application procedure pursuant to Section 8:88 of the General Administrative Law Act, give an opinion on the unlawfulness of the processing of the data to which the decision on the request for information relates. The latter decision does not have to be unlawful for this purpose, nor does it have to contain an opinion on the lawfulness of the processing of the data. The Division notes that if the request exceeds € 25,000.00, the application of Section 8:88 of the General Administrative Law Act entails that the civil court has exclusive jurisdiction to hear such a request.
 
23.    The Division is of the opinion that in this transitional phase, in which a request was made after 25 May 2018 for compensation for damage in connection with acts that took place in whole or in part before that date and that were contrary to the Wbp and would now also be contrary to the AVG, and in which the substantive assessment framework was therefore already the same, the legal protection set out under 22 must also be offered. This is in line with the views of the parties.
 
    Rejection of request for a preliminary ruling
 
24.    [Appellant] asked the Division to refer a preliminary question to the Court of Justice of the European Union with a view to clarifying the answer to the question whether, and if so to what extent, article 82 of the AVG constitutes an independent basis for the award of damages by the administrative courts.
 
25.    The Division rejects this request. Article 82 of the AVG has direct effect and makes it possible for interested parties to realise the claim for damages for unlawful processing in the national legal order. According to settled case law of the Court of Justice (see paragraph 15 above), the organisation of the judicial procedure and the manner of legal protection are in principle matters of national law, if the EU legal preconditions are met. To this end, the Division has ruled that, in addition to the civil court, the administrative court has jurisdiction to assess a claim for damages on the basis of Section 82 of the General Administrative Law Act (AVG) by applying Section 8:88 of the General Administrative Law Act (Awb). There is no reason to ask a preliminary question, because there can be no reasonable doubt as to the answer to the question (see the judgment of the Court of Justice of 6 October 1982, Cilfit, ECLI:EU:C:1982:335, points 13, 14 and 16).
 
    Assessment of the claim for damages
 
26.    26. [Appellant] submits that the Court erred in its application of Section 6:106 of the Civil Code, because the amount of compensation determined on an equitable basis was set too low. He claims that he is entitled to higher damages than €300.00.
 
27.    Although Article 82(1) of the AVG states that full compensation for actual non-material damage resulting from infringements of the AVG must take place in a manner that does justice to the objectives of the Regulation, the AVG does not stipulate how the non-material damage must be determined and calculated. The Court of Justice has consistently held that, in the absence of Community rules, it is for the domestic legal order of each Member State to determine the rules governing the exercise of the right to compensation, subject to compliance with the principles of equivalence and effectiveness (see Manfredi judgment, paragraph 64).
 
    However, recital 146 in the preamble to the AVG must be taken into account when exercising the right to compensation laid down in Article 82 of the AVG. This states, inter alia, that the controller or processor must compensate any damage which a person may suffer as a result of a processing operation infringing this Regulation. The concept of damage should be interpreted broadly in the light of the case law of the Court of Justice of the European Union, in a way that fully meets the objectives of this Regulation. It is also stated that data subjects should receive full and effective compensation for any damage suffered by them.
 
28.    The Court of Justice has not yet provided any explanation specifically on the concept of damages or on the compensable immaterial damages in case of unlawful processing of personal data, including under the (repealed) Privacy Directive (Directive 95/46/EC). However, the Court of Justice has consistently held that the damage to be compensated must be real and certain (see judgment of the Court of Justice of 4 April 2017, ECLI:EU:C:2017:256, paragraph 91, C- 337/15 P, European Ombudsman v. Staelen, ECLI:EU:C:2017:256, paragraph 91).
 
29.    In the light of the above case-law of the Court of Justice and of Article 146 in the preamble, national law is therefore relevant in determining whether the alleged damage is eligible for compensation.
 
30.    According to the settled case law of the Division (see, for example, ECLI:NL:RVS:2010:BN4952 of 25 August 2010), the assessment of an application for compensation for non-material damage is based on a connection with civil compensation law.
 
31.    Article 6:106 of the Dutch Civil Code reads:
 
For damage that does not consist of pecuniary loss, the injured party is entitled to compensation to be determined in accordance with fairness:


[…]
[…]


b. if the injured party has suffered bodily injury, damage to his honour or good name or any other harm to his person;
2. Attempt to mislead me as a customer that identification would be required when purchasing tickets at the station desk for all international train journeys within the EU;


[…]"
[…]"


32.    The impairment referred to in Section 6:106(1)(b) of the Civil Code in person 'otherwise' shall in any case be deemed to have occurred if the injured party has suffered mental injury. The party who invokes this will have to provide sufficient concrete data from which it can be deduced that psychological damage has occurred in connection with the circumstances of the case. This requires that the existence of mental injury can be established according to objective standards. Even if the existence of mental injury in the aforementioned sense cannot be assumed, it cannot be excluded that the nature and seriousness of the breach of the standards and of the consequences thereof for the injured party will mean that the impairment referred to in Section 6:106, opening words and under b, of the Civil Code is present in his person 'in a different way'. In such a case, the party invoking this will have to substantiate the impairment in his person with concrete data. This will only be different if the nature and seriousness of the breach of the standards mean that the relevant adverse consequences for the injured party are so obvious that an impairment in the person can be assumed. An impairment in the person 'in any other way' as referred to in Section 6:106(b) of Book 6 of the Dutch Civil Code does not already exist in the case of the mere violation of a fundamental right. (See the judgments of the Supreme Court of 15 March 2019, ECLI:NL:HR:2019:376, paragraph 4.2.2, of 28 May 2019, ECLI:NL:HR:2019:793, paragraph 2.4.5, and of 19 July 2019, ECLI:NL:HR:2019:1278, paragraph 2.13.2).
4.    The [applicant] considers that it should be possible to purchase a ticket for an international rail journey without having to provide any personal data. He states in his request for enforcement that this is very difficult in practice, as personal data - including at least the name - are requested by default when buying a ticket.


33.    The Section is of the opinion that the framework outlined in section 32 can meet the requirements of the AVG and the case law of the Court of Justice as set out in section 27.
Decisions AP


34.    [appellant] did not argue that he suffered mental injury as a result of the Minister's unlawful conduct, which can be established on objective grounds.
5.    The AP took the position that NS did not violate the General Data Protection Regulation ('the AVG') when selling international tickets. The AP therefore rejected this part of the enforcement request. The AP did not take a position on NS's sale of tickets for transport to be performed by third parties. According to the AP, the enforcement request of [the applicant] only relates to cases in which NS is the controller and not to cases in which NS is the processor. In other words, according to the AP, the enforcement request only relates to cases in which NS sells its own tickets, not to cases in which NS sells tickets of foreign transport companies.


35.    (appellant) claims that he has been harmed in person. He claims that his privacy has been violated because the reports contain strictly confidential and sensitive personal data and he has not given permission for the data to be processed.
Application for interim relief


36.    The Division agrees with the court that [the appellant] is entitled to compensation for non-material damage. The Minister acted in violation of Section 16 of the Wbp) and thereby violated [the appellant's] right to respect for his privacy. An infringement of [the appellant's] privacy may be regarded as an infringement in the person referred to in Section 6:106(1) and (b) of the Dutch Civil Code which entitles him to compensation for immaterial damage.
6.    The reason for [the applicant] to submit a request for interim relief is that, since the end of 2019, it has no longer been possible to purchase so-called ATB tickets. These were international tickets printed on paper. An ATB ticket could be purchased at a service desk at the station without providing personal details. According to [applicant], there is no privacy-friendly alternative to ATB tickets. With its request for a provisional provision, it aims to prevent the ATB ticketing system (hereinafter: the ATB system) from being technically dismantled or further dismantled.


In view of the circumstances of this case, including the nature, duration and seriousness of the infringement, the Division will fairly determine this damage at € 500. To this end, the Division will take into account the special sensitivity of the nature of the personal data processed in this case without the consent of [the appellant]. For the processing of special (sensitive) personal data as referred to in Article 9 of the AVG, a higher level of protection has been laid down in the AVG than for ordinary personal data. The adverse consequences of the provision of the sensitive personal data are obvious. It is also important to note that the data were submitted by the director as part of a complaint procedure against him, without there being any justification as referred to in Article 9(2) of the AVG. With regard to the seriousness of the breach, the Division considers that the privacy-sensitive personal data ended up with a small group of professionals and that the members of the Disciplinary Board who have a duty of confidentiality by virtue of their position. With regard to the duration of the breach, it is important to note that the Pieter Baan Centre took action to undo the provision of the sensitive data following the submission of the data on 15 January 2018. Subsequently, in a letter dated 22 January 2018, the Disciplinary Board indicated that it would disregard the reports sent and not add them to the file. To the extent that [the appellant] disputes that this was done, in view of the questions put to the director during the hearing at the Disciplinary Board, it is important that [the appellant], if asked at the hearing, did not make it plausible that this had led to adverse consequences.
    The [applicant] requested the Court in preliminary relief proceedings to give the AP four orders:


    Conclusion
(i) Inform all relevant transport undertakings in the European Union that the PPC may start an investigation into the admissibility of decommissioning the ATB system in the near future and urge those transport undertakings not to technically dismantle or further dismantle the ATB system before a decision has been taken to start an investigation by the PPC;


37.    In doing what the court should do, the Division will still decide on the application for damages. In so doing, the Division will determine that the Minister will pay [the appellant] damages of € 500.
(ii) Investigate the historical and current facts regarding the abolition, decommissioning and technical dismantling of the ATB system;


38.    The Minister must be ordered to pay the costs of the proceedings (travel costs of public transport) on appeal and appeal in a manner to be reported.
(iii) If the AP's investigation shows that there is a risk at one or more of the transport companies that the ATB system will be fully or partially dismantled in a non-reversible or difficult way prior to the Division's decision in the proceedings on the merits, take enforcement measures to prevent such dismantling;


    What does this judgment entail in brief?
(iv) report the results of the investigation to the Division so that a response can be given to this in the proceedings on the merits.


39.    In these and three other judgments today, the Division discusses the possibilities of claiming compensation for damages before the administrative courts if someone claims that an administrative body has processed personal data in violation of the applicable privacy legislation (since 25 May 2018 the General Data Protection Regulation (AVG) and the AVG Implementation Act). Before the AVG and the AVG Implementation Act entered into force, the case law of the Division offered fewer possibilities, which meant that the citizen was then directed to the civil courts. This route remains open, but in a larger number of cases it is now also possible to approach the administrative courts for requests for compensation up to € 25,000. For the answer to the question as to when this is possible, see in particular above under 22. This is therefore a procedural question of legal protection, i.e. when, in the event of unlawful processing of personal data, the administrative court can be approached.
Assessment of request


    In terms of content, the Division then decides that in order to be eligible for compensation, the requirements of Section 6:106 of the Dutch Civil Code must be met. For these cases, this means that the honour or good name of the person concerned must be affected, or that the person must be affected in some other way. In this respect, the Division is in line with the case law of the Supreme Court. In this case, the Division decided that [the appellant] may claim damages of € 500; the court awarded € 300 in the first instance. In doing so, the Division takes into account, on the one hand, the unlawful processing of personal data with a special sensitivity and, on the other hand, the fact that these data only ended up with a small group of professionals (see above under 36).
7.    So far, the AP has not investigated the decommissioning of the ATB system in these proceedings. Nor has the AP conducted any investigation into the sale by NS of international tickets of foreign transport companies, in which NS is the processor of personal data. In that light, it is far-reaching, as [the applicant] requests, to have the AP conduct an investigation into the decommissioning of the ATB system by both NS and foreign transport companies pending the appeal. There is only reason to make this far-reaching provision if the Court in preliminary relief proceedings is convinced in advance that the outcome of the proceedings on the merits will be that the General Court has wrongfully failed to investigate these cases. The Court in preliminary relief proceedings does not have this conviction. To this end it is important to note that, as is not in dispute, the ATB system was only decommissioned at the end of 2019. However, the decision on the objection had already been taken earlier, i.e. on 12 June 2019. At the time of that decision it was therefore possible to purchase an ATB ticket. The fact that [the applicant] lodged an objection that, according to a desk clerk, the ATB system was going to disappear and that, he assumes, the decommissioning of the ATB system might already have been prepared at the time of the decision of 12 June 2019, is insufficient to consider in advance that it will be ruled in the proceedings on the merits that the AP should have investigated the decommissioning of the ATB system at the time the decision on the objection was taken. It is also important to note that the request for enforcement by [the applicant] and the events described therein with respect to the purchase of international transport tickets do not give cause to consider in advance beyond doubt that the request for enforcement, contrary to what the court has considered, also relates to NS's actions as processor on behalf of foreign transport companies. If it were to be ruled that the request for enforcement should nevertheless have been interpreted more broadly, it would then still have to be assessed to what extent the AP's enforcement powers extend to the foreign transport companies involved. This requires further investigation, for which this provisional provision procedure does not lend itself.


Decision
8.    In addition, the Court in preliminary relief proceedings did not follow [the applicant] in its assertion that an irreversible situation would arise if the ATB system were to be dismantled further. If, at any point in time, it were to be ruled that NS is acting in violation of the AVG by not offering the possibility to purchase international tickets without providing personal data, NS would be obliged to ensure that this possibility would still be offered. The fact that this may require more drastic changes to the systems and larger associated investments if the ATB system is largely or entirely dismantled is at NS's risk. However, it does not ensure that this possibility can no longer be realised after the ATB system has been dismantled. In this respect, the Division takes into account that NS has stated that, even if the ATB system is not dismantled, substantial investments must be made in order to be able to continue using this system.


The Administrative Jurisdiction Division of the Council of State:
Conclusion


I. declares the appeal well-founded;
9.   In view of this, the request for interim relief should be rejected.


II. annuls the decision of the District Court of Gelderland of 19 December 2018 in case no. 18/3073; in so far as it revoked the decision of 13 March 2018, it is stipulated that the Minister for Legal Protection will pay compensation and it is stipulated that this decision will replace the decision of 17 May 2018;
10.   There are no grounds for an order as to costs.


III. declares the objection lodged by [the appellant] against the decision of 17 May 2018 inadmissible in so far as it decides on the application for compensation made by [the appellant];
Decision


IV. orders the Minister for Legal Protection to pay [the appellant] compensation of € 500.00 (in words: five hundred euros);
The Interim Injunction Judge of the Administrative Jurisdiction Division of the Council of State:


V. orders the Minister for Legal Protection to pay the costs of the proceedings incurred by [the appellant] in connection with the hearing of the appeal and the appeal up to an amount of € 46.71 (in words: forty-six euros and seventy-one cents).
Dismisses the application.


Thus determined by J.E.M. Polak, chairman, and E.A. Minderhoud and E.J. Daalder, members, in the presence of M.A.E. Planken, registrar.
Thus determined by J.A.W. Scholten-Hinloopen, judge in preliminary relief proceedings, in the presence of H. Herweijer, registrar.


The chairman is prevented from signing the decision.   
The judge in preliminary relief proceedings is prevented from signing the decision.   


The Registrar is prevented from signing the decision.
w.g. Herweijer


Pronounced in public on 1 April 2020
court clerk


299.
Pronounced in public on 12 June 2020


Annex
640.
</pre>
</pre>

Revision as of 13:01, 26 June 2020

RvS - 202001629/2/A3
CourtsNL.png
Court: RvS (Netherlands)
Jurisdiction: Netherlands
Relevant Law:
Decided: 12.6.2020
Published: 17.7.2020
Parties: Autoriteit Persoonsgegevens
National Case Number/Name: 202001629/2/A3
European Case Law Identifier: ECLI:NL:RVS:2020:1379
Appeal from:
Appeal to:
Original Language(s): Dutch
Original Source: de Rechtspraak (in Dutch)
Initial Contributor: n/a

The preliminary relief judge of Council of State declared unfounded the applicant’s request to urgently force Autoriteit Persoonsgegevens (Dutch DPA) to investigate the abolishing by the European travel companies of the so-called ATB ticketing system. Applicant finds that it should be possible to buy international train tickets without having to provide personal data.

English Summary

Facts

On 12 November 2018 Autoriteit Persoonsgegevens (Dutch DPA) rejected the applicant’s request for enforcement. On 12 June 2019 the DPA declared applicant’s objection invalid. On 4 February 2020 the court dismissed the applicant’s appeal. Applicant is now appealing this Court decision before the preliminary relief judge of the Council of State.

Dispute

Applicant is asking the preliminary relief judge to urgently order DPA to: a) Notify relevant transportation companies in the European Union that they can start an investigation into the decommissioning of the ATB system and request these companies to continue supporting the system; b) Investigate the historical and current facts behind the decommissioning; c) Prevent further decommissioning if the investigation shows that the ATB system is being dismantled; d) Report the outcome of the investigation for the Court to use in the main proceedings.

Dutch DPA is of the opinion that NS (Dutch public transportation company the applicant complained about) did not violate GDPR, so the enforcement is rejected. Moreover, according to the DPA, the applicant’s enforcement request only concerns cases where NS acts as a controller, which means it only applies to situations where NS sells its own tickets and not international tickets of other companies.

Holding

The preliminary relief judge cannot order DPA to investigate the decommissioning of the ATB system because the judge cannot be sure that the DPA will get the same order as the result of the main proceedings.

The judge founds it important that the ATB system stayed in use until the end of 2019, so it was possible to buy such ticket at the time of the applicant’s objection to the DPA. Also, Dutch DPA’s enforcement powers regarding foreign transportation companies would need to be considered separately as NS is indeed acting as a processor to those companies.

Lastly, the preliminary relief judge did not agree that the dissemination of the ATB system would be irreversible. If at any point NS is found violating the GDPR by not offering an option to buy tickets without providing personal data, it will be the obligation of NS to provide a solution.

Comment

Add your comment here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

Council of State
Date of pronunciation
    12-06-2020
Date of publication
    17-06-2020 
Case number
    202001629/2/A3
Jurisdictions
    Administrative law
Special features
    Provisional provision
Content indication

    By decision of 12 November 2018, the Authority for Personal Data rejected a request by [the applicant] to maintain it. [applicant] considers that it should be possible to purchase a ticket for an international rail journey without having to provide any personal data. He states in his request for enforcement that this is very difficult in practice, because personal data - including at least the name - is requested by default when buying a ticket.
Sites
    Rechtspraak.nl
    Enriched pronunciation 

Ruling

202001629/2/A3.

Date of judgment: 12 June 2020

SECTION

ADMINISTRATIVE LAW

A decision by the interim relief judge of the Administrative Jurisdiction Division of the Council of State on an application for interim relief (article 8:81 of the General Administrative Law Act) pending the appeal of the Council of State:

[applicant], residing at [residence],

against the judgment of the District Court of Gelderland of 4 February 2020 in Case No 19/3510 in the proceedings between:

[applicant]

and

the Personal Data Authority (hereinafter AP).

Process flow

By decision of 12 November 2018, the AP rejected an application by [the applicant] for maintenance.

By decision of 12 June 2019, the AP dismissed [the applicant's] objection to that decision as unfounded.

By decision of 4 February 2020, the District Court dismissed [the applicant's] appeal against that decision as unfounded.

The applicant has lodged an appeal against this decision.

[the applicant] requested the Court in preliminary relief proceedings to make an interim injunction.

The AP and NS Groep N.V. provided a written explanation.

The applicant has submitted further documents.

Considerations

1.    The judgment of the Court in preliminary relief proceedings is provisional in nature and is not binding in the proceedings on the merits.

Omission of hearing

2.    The parties had been summoned to a hearing of the Court in preliminary relief proceedings on 30 April 2020.

    In a letter dated 7 April 2020, [the applicant] requested that, in view of the nature and urgency of his request, the hearing should take place, even if he could not attend, for example due to the measures and guidelines of the government to prevent the spread of the coronavirus. [applicant] has argued that the corona crisis gives his application an extra urgent character.

    By letter of 18 April 2020, sent from Finland, [the applicant] stated that he was prevented from attending the hearing as a result of the corona crisis. He reiterated his preference for the hearing to take place.

    Due to the measures taken to prevent the spread of the coronavirus, the hearing did not take place. The parties were informed accordingly. The Court in preliminary relief proceedings then gave the parties the opportunity to comment on the intention to rule on the request at the hearing without hearing. At the same time, NS was asked three factual questions. NS answered these questions and provided a written explanation. The General Court provided a written explanation in which it stated that it did not consider it necessary to adjudicate at the hearing. The [applicant] responded to the written explanations given by NS and the AP.

    On the basis of the documents available, the Court in preliminary relief proceedings considered itself sufficiently well informed to be able to rule on the application for interim relief. In view of the obstacles and delays that have arisen in the progress of the hearing schedule as a result of the coronary measures taken, and now that none of the parties has indicated that a hearing is necessary, while [the applicant] considers his application urgent and has stated that the application may also be dealt with without his presence, in the opinion of the Interim Injunction Judge the parties will not be harmed in their interests if the application is not dealt with at the hearing. Therefore, pursuant to Section 8:83(4) of the General Administrative Law Act, the Interim Injunction Judge will rule without a hearing.

Enforcement request of [the applicant]

3.    By letter dated 9 July 2018, [applicant] submitted an application for enforcement to the AP. The introduction to this state:

"Partly with reference to my previous enforcement requests concerning privacy violations by NS [...] and partly with reference to Articles 6, 7, 15, 17, 18, 21, 25, 29, 51, 52, 57, 58, 77, 78 and 83 (in particular also point 2.e) of the latter Article) of the General Data Protection Regulation (AVG), I request you to investigate the following breaches of privacy by Nederlandse Spoorwegen (NS) that I have identified and to end them by means of enforcement measures:

[…]

2. Attempt to mislead me as a customer that identification would be required when purchasing tickets at the station desk for all international train journeys within the EU;

[…]"

4.    The [applicant] considers that it should be possible to purchase a ticket for an international rail journey without having to provide any personal data. He states in his request for enforcement that this is very difficult in practice, as personal data - including at least the name - are requested by default when buying a ticket.

Decisions AP

5.    The AP took the position that NS did not violate the General Data Protection Regulation ('the AVG') when selling international tickets. The AP therefore rejected this part of the enforcement request. The AP did not take a position on NS's sale of tickets for transport to be performed by third parties. According to the AP, the enforcement request of [the applicant] only relates to cases in which NS is the controller and not to cases in which NS is the processor. In other words, according to the AP, the enforcement request only relates to cases in which NS sells its own tickets, not to cases in which NS sells tickets of foreign transport companies.

Application for interim relief

6.    The reason for [the applicant] to submit a request for interim relief is that, since the end of 2019, it has no longer been possible to purchase so-called ATB tickets. These were international tickets printed on paper. An ATB ticket could be purchased at a service desk at the station without providing personal details. According to [applicant], there is no privacy-friendly alternative to ATB tickets. With its request for a provisional provision, it aims to prevent the ATB ticketing system (hereinafter: the ATB system) from being technically dismantled or further dismantled.

    The [applicant] requested the Court in preliminary relief proceedings to give the AP four orders:

(i) Inform all relevant transport undertakings in the European Union that the PPC may start an investigation into the admissibility of decommissioning the ATB system in the near future and urge those transport undertakings not to technically dismantle or further dismantle the ATB system before a decision has been taken to start an investigation by the PPC;

(ii) Investigate the historical and current facts regarding the abolition, decommissioning and technical dismantling of the ATB system;

(iii) If the AP's investigation shows that there is a risk at one or more of the transport companies that the ATB system will be fully or partially dismantled in a non-reversible or difficult way prior to the Division's decision in the proceedings on the merits, take enforcement measures to prevent such dismantling;

(iv) report the results of the investigation to the Division so that a response can be given to this in the proceedings on the merits.

Assessment of request

7.    So far, the AP has not investigated the decommissioning of the ATB system in these proceedings. Nor has the AP conducted any investigation into the sale by NS of international tickets of foreign transport companies, in which NS is the processor of personal data. In that light, it is far-reaching, as [the applicant] requests, to have the AP conduct an investigation into the decommissioning of the ATB system by both NS and foreign transport companies pending the appeal. There is only reason to make this far-reaching provision if the Court in preliminary relief proceedings is convinced in advance that the outcome of the proceedings on the merits will be that the General Court has wrongfully failed to investigate these cases. The Court in preliminary relief proceedings does not have this conviction. To this end it is important to note that, as is not in dispute, the ATB system was only decommissioned at the end of 2019. However, the decision on the objection had already been taken earlier, i.e. on 12 June 2019. At the time of that decision it was therefore possible to purchase an ATB ticket. The fact that [the applicant] lodged an objection that, according to a desk clerk, the ATB system was going to disappear and that, he assumes, the decommissioning of the ATB system might already have been prepared at the time of the decision of 12 June 2019, is insufficient to consider in advance that it will be ruled in the proceedings on the merits that the AP should have investigated the decommissioning of the ATB system at the time the decision on the objection was taken. It is also important to note that the request for enforcement by [the applicant] and the events described therein with respect to the purchase of international transport tickets do not give cause to consider in advance beyond doubt that the request for enforcement, contrary to what the court has considered, also relates to NS's actions as processor on behalf of foreign transport companies. If it were to be ruled that the request for enforcement should nevertheless have been interpreted more broadly, it would then still have to be assessed to what extent the AP's enforcement powers extend to the foreign transport companies involved. This requires further investigation, for which this provisional provision procedure does not lend itself.

8.    In addition, the Court in preliminary relief proceedings did not follow [the applicant] in its assertion that an irreversible situation would arise if the ATB system were to be dismantled further. If, at any point in time, it were to be ruled that NS is acting in violation of the AVG by not offering the possibility to purchase international tickets without providing personal data, NS would be obliged to ensure that this possibility would still be offered. The fact that this may require more drastic changes to the systems and larger associated investments if the ATB system is largely or entirely dismantled is at NS's risk. However, it does not ensure that this possibility can no longer be realised after the ATB system has been dismantled. In this respect, the Division takes into account that NS has stated that, even if the ATB system is not dismantled, substantial investments must be made in order to be able to continue using this system.

Conclusion

9.    In view of this, the request for interim relief should be rejected.

10.    There are no grounds for an order as to costs.

Decision

The Interim Injunction Judge of the Administrative Jurisdiction Division of the Council of State:

Dismisses the application.

Thus determined by J.A.W. Scholten-Hinloopen, judge in preliminary relief proceedings, in the presence of H. Herweijer, registrar.

The judge in preliminary relief proceedings is prevented from signing the decision.   

w.g. Herweijer

court clerk

Pronounced in public on 12 June 2020

640.