Rb. Midden-Nederland - UTR 19/2351

Rb. Midden-Nederland - UTR 19/2351
Court:	Rb. Midden-Nederland (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:	Article 17(1)(d) GDPR Article 82 GDPR Article 99 GDPR Dutch Data Protection Act
Decided:	15.11.2019
Published:	29.11.2019
Parties:	Municipal Executive of the Municipality of Almere
National Case Number/Name:	UTR 19/2351
European Case Law Identifier:	ECLI:NL:RBMNE:2019:5430
Appeal from:
Appeal to:
Original Language(s):	Dutch
Original Source:	de Rechtspraak (in Dutch)
Initial Contributor:	n/a

The Court of First Instance of the Central Netherlands (Rechtbank Midden-Nederland) ruled on when the Dutch Data Protection Act or the GDPR applies.

English Summary

Facts

The plaintiff had requested erasure of his personal data according to Article 17 GDPR claiming that the forwarding of data via e-mail to other municipalities and the publication on the VNG forum of his personal data constituted unlawful processing.

He also claimed compensation for damages occurred from the unlawful processing on the basis of Article 82 GDPR.

The defendant had rejected the request because the processing at stake was lawful and thus the requirement of Article 17(1)(d) GDPR was not fulfilled. According to the defendant, the lawfulness should be assessed on the basis of the Dutch Data Protection Act and not of the GDPR as the processing at stake took place before the GDPR came into force.

Dispute

Does the GDPR apply to events that happened before 25. 5. 2018?

Holding

The Court found that the GDPR also applies to legal consequences of events which occurred before it came into force. The Dutch transitional law lists cases where the Act would still apply after the enforcement of the GDPR, but the present case is not among them.

However, the lawfulness of the processing is based on a factual assessment and the facts took place before the GDPR. Hence, the facts should be examined in on the basis of the Act, while the legal consequences, such as the right to erasure and the right to compensation, on the basis of the GDPR.

The Court ruled that the processing at stake was compliant with the Act and thus lawful. Consequently, the defendant rightly rejected the request to erasure based on Article 17(1)(d) GDPR.

Finally, for the factual assessment of the right to compensation the plaintiff should apply before the civil and not the administrative courts according to the Dutch Data Protection Act (Wet bescherming persoonsgegevens - Wbp).

Comment

Share your comment here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the Dutch original for more details.

DECISION

COURT OF THE MIDDLE THE NETHERLANDS
By decision of 9 November 2018 (the primary decision), the defendant rejected the claimant's requests for the deletion of his personal data and for compensation for damages for unlawful data processing under the General Data Protection Regulation (AVG)1 .

By decision of 13 May 2019 (the contested decision), the defendant dismissed the claimant's objection as unfounded.

The plaintiff lodged an appeal against the contested decision.

The defendant lodged a statement of defence.

The hearing took place on 4 October 2019. The plaintiff appeared, assisted by his agent. The defendant was represented by his agent. Mr [A], employed by the defendant, also appeared.
Recitals

1. On 29 August 2018, plaintiff requested defendant's removal of his personal data from defendant's systems pursuant to Article 17 of the AVG. Plaintiff has stated that the forwarding of his personal data to other administrative bodies by e-mail and the publication of his data on the VNG Forum is unlawful. The claimant has also requested compensation for unlawful data processing pursuant to Article 82 of the AVG.

2. The defendant has confirmed that in 2013 it e-mailed data of the claimant to a number of other municipalities and in 2017 placed data of the claimant on the VNG Forum. The claimant's request for data erasure was rejected by the defendant because, according to him, one of the grounds stated in Article 17 of the AVG was not met. The defendant also rejected the claim for damages on the basis of Article 82 of the AVG because, in its opinion, the data processing operations in 2013 and 2017 are lawful. According to the defendant, this lawfulness should be assessed on the basis of the Personal Data Protection Act (Wbp). Although the Data Protection Act was repealed with effect from 25 May 2018 and the AVG entered into force, the data processing took place before that date, so that it is not the AVG but the Wbp that applies to it.

3. The plaintiff argues that it is not the Wbp, but the AVG that applies to the data processing. Because the defendant applied the Wbp, the contested decision was, according to the plaintiff, taken carelessly and not properly reasoned, so that it should be set aside. The plaintiff also disputes the lawfulness of the data processing operations in 2013 and 2017. According to the claimant, there is no legal basis for the processing of the data. In doing so, the data processing violates the principles of proportionality and subsidiarity, because the defendant could have anonymised the data of the claimant. Finally, the plaintiff takes the position that the broad definition of the concept of damage from the AVG should be adopted when assessing his application for compensation.

4. The court finds that the claimant's request consists of two parts: the request for data erasure under Article 17 of the AVG and the request for damages under Article 82 of the AVG. These requests are based on the processing of claimant's data by defendant in 2013 and 2017. The parties disagree on the law applicable to these data processing operations, on the lawfulness of the data processing operations and, related to this, on whether the defendant should delete the data and the claimant has a right to compensation.
Applicable law
5.1.

The AVG entered into force on 25 May 2018. On the same date, the AVG Implementation Act (UAVG) entered into force and Article 51 of that Act repealed the Wbp. The AVG has immediate effect. This main rule of transitional law means that the AVG also applies to the legal consequences of facts that occurred before it came into effect.2 The transitional law in Section 48(10) of the UAVG specifies cases in which the Wbp still applies after the AVG comes into effect. None of these cases occurs in this case.
5.2.

The District Court ruled that the question whether the data processing operations in 2013 and 2017 are lawful or unlawful must be assessed on the basis of the Personal Data Protection Act (Wbp), because this Act was applicable at the time when those data processing operations took place. In the District Court's opinion, the immediate effect of the AVG does not mean that facts that took place before the AVG entered into force, in this case the data processing, must also be assessed on the basis of the AVG.3 If it concerns the legal consequences of those facts after the entry into force of the AVG, such as the right to erasure of personal data or the right to compensation, the AVG will apply.

Lawfulness of data processing and data erasure requests
6.1.

On 28 August 2018, the plaintiff requested the removal of his personal data from the defendant's systems on the grounds that his data had been unlawfully processed. His request is therefore based on Article 17(1)(d) of the AVG. On the basis of Article 34 UAVG, a decision on such a request is a decision within the meaning of Article 1:3 of the General Administrative Law Act (Algemene wet bestuursrecht (Awb)), so that it can be appealed to the administrative courts. The AVG applies to the application because it was submitted after the AVG came into effect.
6.2.

The defendant takes the position that the data processing operations are lawful because they were necessary in order to be able to deal with requests under the Public Administration Act (Wob) in a timely manner. This in the light of misuse of the Wob in combination with the Penalty Payments and Appeals Act in the event of late decisions. At the time, the defendant claimed to have had strong indications that the plaintiff was guilty of such abuse. Sharing the plaintiff's details with other municipalities served to exchange experiences about possible Wob abusers. According to the defendant, there was no other or better method to achieve this goal.
6.3.

As judged above under 6.2, the question whether or not the defendant's data processing was unlawful must be assessed under the Wbp and not under the AVG. The processing of personal data may only take place on the basis of one of the processing principles listed in Article 8 of the Wbp. Moreover, pursuant to Article 7 of the Wbp, data may only be collected for specific, explicit and justified purposes.
6.4.

The District Court considered that the implementation of the Wbp is a public law duty of the defendant. For the proper functioning of the Wob, it is important that an investigation is conducted into abuse of the Wob and that any abuse is established.4 The purpose of the defendant's data processing in 2013 and 2017 was to ensure proper implementation of the Wob and to prevent abuse of the Wob in order to collect periodic penalty payments in the event of late decisions. The District Court is of the opinion that this purpose is in accordance with Sections 7 and 8(e) of the Wbp. The District Court also ruled that the data processing is in accordance with the principles of proportionality and subsidiarity, because the defendant only processed the name, gender, address and domicile of the plaintiff. The court does not consider it plausible that the defendant could have achieved the same purpose with the processing by anonymizing these data. Moreover, in the opinion of the District Court it was not excessive to share these data. Therefore, the District Court concluded that the data processing operations in 2013 and 2017 were lawful.
6.5

Because the data processing operations were lawful in 2013 and 2017, the defendant is not obliged to delete the data concerned pursuant to Section 17(1)(d) of the AVG and the defendant could reject plaintiffs' requests in this respect.

Claim for damages
7.1.

The claimant's claim for compensation relates to the damage he would have suffered as a result of the data processing operations in 2013 and 2017. The request does not cover the defendant's refusal to delete his personal data. The request was made after the AVG entered into force, so Article 82 of the AVG applies to the request. The court ruled that the data processing operations were lawful. In view of this, it is obvious that the request cannot be granted.
7.2.

However, the Court did not reject the application for compensation. The reason for this is that the decision on a request for compensation for unlawful data processing is not a decision in the sense of Section 1:3 of the Awb. The damage alleged by the claimant was caused by the data processing. These are factual acts that are not intended to have legal effect. The data processing is therefore not a decision. A decision on a claim for compensation for unlawful data processing is therefore also not a decision, because there is no connection with a decision in the sense of Article 1:3 of the Awb. Nor does the UAVG contain a provision in which such a decision is equated with a decision. There is therefore no appeal to the administrative courts against the rejection of a claim for compensation on the basis of Article 82 of the AVG. The claimant will have to submit his application to the civil court.

Conclusion
8. Since the rejection of a claim for damages for unlawful data processing does not constitute a decision, the defendant erred in declaring the objection admissible on this point and in assessing its substance. The appeal is therefore well founded, albeit for a different reason than that put forward by the claimant. The Court annulled the contested decision on that point. Pursuant to Section 8:72(3) of the Awb, the District Court itself provides for the case by declaring the objection inadmissible in so far as it relates to the rejection of the application for compensation.

9. Because the court declares the appeal to be well-founded, the court stipulates that the defendant shall reimburse the plaintiff for the court fee he has paid.

10. The court orders the defendant to pay the costs of the proceedings incurred by the claimant in the appeal. Pursuant to the Decree on Administrative Law Costs (Besluit proceskosten bestuursrecht), the court sets these costs at € 1,024 (1 point for the submission of the appeal, 1 point for the appearance at the hearing, with a value per point of € 512 and a weighting factor of 1). In addition, the claimant has applied for reimbursement of his travel and departure expenses. The court sets the travel expenses at € 51,- on the basis of public transport, second class. The court sets the lost time costs at € 52.24.
Decision

The court:
- declares the appeal well-founded;
- Annuls the contested decision in so far as it dismisses the objection to the rejection of

the claim for damages of 9 November 2018 was declared unfounded;

- dismisses as inadmissible the objection to the rejection of the application for damages

- provides that that judgment is to replace the annulled part of the contested decision;

- orders the defendant to pay to the plaintiff the court fee of € 174;

- orders the defendant to pay to the plaintiff the costs of the proceedings up to an amount of € 1,127.24.

This decision was made by J.J. Catsburg, judge, in the presence of L.E. Mollerus, registrar. The decision was pronounced in public on 15 November 2019.