Hoge Raad - AVG 2023-09-21: Difference between revisions
No edit summary |
mNo edit summary |
||
| Line 62: | Line 62: | ||
}} | }} | ||
The | The Supreme Court of the Netherlands (''Hoge Raad'') held, with regards to the E-Archive that it complies with GDPR requirements, as long as data subjects are informed on whether their data is included in the E-Archive or not. | ||
== English Summary == | == English Summary == | ||
| Line 68: | Line 68: | ||
=== Facts === | === Facts === | ||
The E-Archive is an internal database containing a selection of judgments, accessible only to judicial and court officials in their judicial activities. | The E-Archive is an internal database containing a selection of judgments, accessible only to judicial and court officials in their judicial activities. | ||
An individual (data subject) brought three separate complaints with the Procurator General of the Supreme Court, who is competent to deal with complaints regarding courts acting in their judicial capacity. The data subject directed his complaints against three different district courts of courts of Northern-Netherlands, Amsterdam and The Hague (each of them a controller) for unlawful processing activities of his personal data, including in his professional capacity as a legal representative. | An individual (data subject) brought three separate complaints with the Procurator General of the Supreme Court, who is competent to deal with complaints regarding courts acting in their judicial capacity. The data subject directed his complaints against three different district courts of courts of Northern-Netherlands, Amsterdam and The Hague (each of them a controller) for unlawful processing activities of his personal data, including in his professional capacity as a legal representative. | ||
In particular, the complainant held that the Nord Holland District Court included the name of the complainant in a E-Archive judgment without his consent and without informing him about the appearance of his data | |||
In particular, the complainant held that the Nord Holland District Court included the name of the complainant in a E-Archive judgment without his consent and without informing him about the appearance of his data therein, which was then removed at his request. | |||
Secondly, with respect to processing by the Amsterdam District Court, the complainant asserts that the court lacked a legal basis to search for his name in the E-Archive and disclose this data to the opposing party at a subsequent hearing. He objected to the processing and asked the court to stop processing his personal data, but the court replied that these judgments were not included in the E-Archive and thus it could not comply with his request. | Secondly, with respect to processing by the Amsterdam District Court, the complainant asserts that the court lacked a legal basis to search for his name in the E-Archive and disclose this data to the opposing party at a subsequent hearing. He objected to the processing and asked the court to stop processing his personal data, but the court replied that these judgments were not included in the E-Archive and thus it could not comply with his request. | ||
Thirdly, as regards the Hague District Court, the data subject complained about the refusal of the Board of the | Thirdly, as regards the Hague District Court, the data subject complained about the refusal of the Board of the Court to comply with his request not to disseminate his personal data via, inter alia, the E-Archive, as he considered that he had not been duly informed about the inclusion of his personal data in the E-Archive. | ||
The Supreme Court of the Netherlands was thus called upon to investigating on the processing activities by the above mentioned | |||
The Supreme Court of the Netherlands was thus called upon to investigating on the processing activities by the Boards of the above mentioned District Courts and it took the chance to rule on the compliance of the E-Archive with the GDPR. | |||
=== Holding === | === Holding === | ||
First of all, the | First of all, the Supreme Court assessed the compliance of the E-Archive with the GDPR and it held that the purposes it serves, namely that of guaranteeing quality of judicial decisions and promote legal unity and certainty are legitimate. Also, it considered the measures in place and those to be adopted to ensure an adequate level of protection of the personal data included in the E-Archive. The court further held that the processing activities by courts in using the E-Archive are lawfully based on both Article 6(1)(e) directly and on [[Article 6 GDPR#4|Article 6(4) GDPR]] too, thus concluding that the archive does comply with GDPR requirements. | ||
Then, in order to handle the complaint brought by the data subject, the Supreme Court assessed whether the GDPR was applicable to the case at hand and whether it had competence to deal with such complaints. It concluded that the GDPR does apply to courts acting in their judicial capacity under [[Article 2 GDPR#2d|Article 2(2)(d) GDPR]]. Also, under [[Article 55 GDPR#3|Article 55(3) GDPR]] and Recital (20) GDPR national Data Protection Authorities do not have competence to supervise processing activities of courts acting in their judicial capacity, and this task should be assigned to a special supervisor. According to Dutch Law, complaints relating to processing activities by courts in their judicial capacity shall be handled by the Procurator General of the Supreme Court. | |||
With respect to the single claims, the Supreme Court held the majority of them to be unfounded, as it | With respect to the single claims, the Supreme Court held the majority of them to be unfounded, as it held that it cannot consider the substantive content of the judgments in which the name of the complainant appears. As regards two of the judgments that the data subject refers to, instead, the Supreme Court found these to be well-founded, since at the time of the recording of the data subject’s personal data, the existence of the E-Archive had not been mentioned nor was otherwise known to the complainant. For this reason, the Supreme Court held that in those cases, the principle of transparency of Article 5(1)(a) GDPR had been violated. | ||
== Comment == | == Comment == | ||
Revision as of 07:27, 27 September 2023
| Hoge Raad - AVG 2023-09-21 | |
|---|---|
 | |
| Court: | Hoge Raad (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 5(1)(a) GDPR Article 6(1)(e) GDPR |
| Decided: | |
| Published: | |
| Parties: | |
| National Case Number/Name: | AVG 2023-09-21 |
| European Case Law Identifier: | ECLI:NL:PHR:2023:823 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Dutch |
| Original Source: | Hoge Raad (in Dutch) |
| Initial Contributor: | co |
The Supreme Court of the Netherlands (Hoge Raad) held, with regards to the E-Archive that it complies with GDPR requirements, as long as data subjects are informed on whether their data is included in the E-Archive or not.
English Summary
Facts
The E-Archive is an internal database containing a selection of judgments, accessible only to judicial and court officials in their judicial activities. An individual (data subject) brought three separate complaints with the Procurator General of the Supreme Court, who is competent to deal with complaints regarding courts acting in their judicial capacity. The data subject directed his complaints against three different district courts of courts of Northern-Netherlands, Amsterdam and The Hague (each of them a controller) for unlawful processing activities of his personal data, including in his professional capacity as a legal representative.
In particular, the complainant held that the Nord Holland District Court included the name of the complainant in a E-Archive judgment without his consent and without informing him about the appearance of his data therein, which was then removed at his request.
Secondly, with respect to processing by the Amsterdam District Court, the complainant asserts that the court lacked a legal basis to search for his name in the E-Archive and disclose this data to the opposing party at a subsequent hearing. He objected to the processing and asked the court to stop processing his personal data, but the court replied that these judgments were not included in the E-Archive and thus it could not comply with his request.
Thirdly, as regards the Hague District Court, the data subject complained about the refusal of the Board of the Court to comply with his request not to disseminate his personal data via, inter alia, the E-Archive, as he considered that he had not been duly informed about the inclusion of his personal data in the E-Archive.
The Supreme Court of the Netherlands was thus called upon to investigating on the processing activities by the Boards of the above mentioned District Courts and it took the chance to rule on the compliance of the E-Archive with the GDPR.
Holding
First of all, the Supreme Court assessed the compliance of the E-Archive with the GDPR and it held that the purposes it serves, namely that of guaranteeing quality of judicial decisions and promote legal unity and certainty are legitimate. Also, it considered the measures in place and those to be adopted to ensure an adequate level of protection of the personal data included in the E-Archive. The court further held that the processing activities by courts in using the E-Archive are lawfully based on both Article 6(1)(e) directly and on Article 6(4) GDPR too, thus concluding that the archive does comply with GDPR requirements.
Then, in order to handle the complaint brought by the data subject, the Supreme Court assessed whether the GDPR was applicable to the case at hand and whether it had competence to deal with such complaints. It concluded that the GDPR does apply to courts acting in their judicial capacity under Article 2(2)(d) GDPR. Also, under Article 55(3) GDPR and Recital (20) GDPR national Data Protection Authorities do not have competence to supervise processing activities of courts acting in their judicial capacity, and this task should be assigned to a special supervisor. According to Dutch Law, complaints relating to processing activities by courts in their judicial capacity shall be handled by the Procurator General of the Supreme Court.
With respect to the single claims, the Supreme Court held the majority of them to be unfounded, as it held that it cannot consider the substantive content of the judgments in which the name of the complainant appears. As regards two of the judgments that the data subject refers to, instead, the Supreme Court found these to be well-founded, since at the time of the recording of the data subject’s personal data, the existence of the E-Archive had not been mentioned nor was otherwise known to the complainant. For this reason, the Supreme Court held that in those cases, the principle of transparency of Article 5(1)(a) GDPR had been violated.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
