Rb. Rotterdam - ROT 22/2125: Difference between revisions
No edit summary |
No edit summary |
||
| Line 79: | Line 79: | ||
The Court declared the appeal well-founded and ordered the controller to take a new decision on the objection (thus, fulfilling the access request). | The Court declared the appeal well-founded and ordered the controller to take a new decision on the objection (thus, fulfilling the access request). | ||
The controller 'fulfilled' the request with a general indication of the personal data it processes, why, for what purpose, (and other stuff you can find in a privacy policy) etc. It also provided the data subject with their most commonly processed personal data as it appeared in the controller's general system. Last, the controller generally referred to Article 13(4), Article 14(5) and [[Article 23 GDPR|Article 23 GDPR]] for possible non-disclosure. | The controller 'fulfilled' the request with a general indication of the personal data it processes, why, for what purpose, (and other stuff you can find in a privacy policy) etc. It also provided the data subject with their most commonly processed personal data as it appeared in the controller's general system. Last, the controller generally referred to [[Article 13 GDPR#4|Article 13(4)]], [[Article 14 GDPR#5|Article 14(5)]] and [[Article 23 GDPR|Article 23 GDPR]] for possible non-disclosure. | ||
The data subject, not satisfied with this answer, again appealed the decision to the court. | The data subject, not satisfied with this answer, again appealed the decision to the court. | ||
| Line 88: | Line 88: | ||
The District Court of Rotterdam held that searching a general system was not sufficient. The controller had not complied with the data subject's request. The Court found that the controller's view that there were too many systems was unsubstantiated, and insufficient reasoning to suffice with the limited search it conducted. | The District Court of Rotterdam held that searching a general system was not sufficient. The controller had not complied with the data subject's request. The Court found that the controller's view that there were too many systems was unsubstantiated, and insufficient reasoning to suffice with the limited search it conducted. | ||
Regarding the existing documents containing personal data outside of the system searched, the Court held that the controller's general reference to grounds for exemption in the GDPR, without a reasoning specifically focussed on those documents, was insufficient. In addition, the controller could have brought those documents before the Court by relying on Article 8:29 of the General Administrative Law Act. That way, the Court would be able to examine whether the grounds for exceptions were rightly invoked. However, the controller did not. | |||
Regarding the existing documents containing personal data outside of the system searched, the Court held that the controller's general reference to grounds for exemption in the GDPR, without a reasoning specifically focussed on those documents, was insufficient. In addition, the controller could have brought those documents before the Court by relying on Article 8:29 of the General Administrative Law Act. That way, the Court would be able to examine whether the grounds for exceptions were rightly invoked. However, the controller did not. | |||
Furthermore, the Court held that the controller should have specified the purpose, whom the data may have been shared with and the origin of the data. The mere listing of the personal data found, followed with a general explanation of how the Tax Administration handles personal data was not enough. The Court held that this did not allow the data subject to verify the lawfulness of processing under [[Article 15 GDPR|Article 15 GDPR]]. | Furthermore, the Court held that the controller should have specified the purpose, whom the data may have been shared with and the origin of the data. The mere listing of the personal data found, followed with a general explanation of how the Tax Administration handles personal data was not enough. The Court held that this did not allow the data subject to verify the lawfulness of processing under [[Article 15 GDPR|Article 15 GDPR]]. | ||
Revision as of 08:22, 14 March 2023
| Rb. Rotterdam - ROT 22/2125 | |
|---|---|
 | |
| Court: | Rb. Rotterdam (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 13(4) GDPR Article 14(5)(a) GDPR Article 15(1) GDPR Article 23(1)(d) GDPR Article 23(1)(i) GDPR |
| Decided: | 17.02.2023 |
| Published: | 20.02.2023 |
| Parties: | Minister of Finance (Dutch Tax Administration |
| National Case Number/Name: | ROT 22/2125 |
| European Case Law Identifier: | ECLI:NL:RBROT:2023:1189 |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | rechtspraak.nl (in Dutch) |
| Initial Contributor: | elsjegold |
The District Court of Rotterdam held that the Dutch Tax Administration insufficiently answered a data subject's access request. The search conducted should go beyond the most general system, and the purpose, whom the data may have been shared with and the origin of the data should be specified.
English Summary
Facts
A data subject made an access request with the Dutch Tax Administration (the controller). The controller decided to deny the data subject's request. The data subject raised objections against this decision, but the controller declared it unfounded. The data subject appealed this decision on the objection to the court.
The Court declared the appeal well-founded and ordered the controller to take a new decision on the objection (thus, fulfilling the access request).
The controller 'fulfilled' the request with a general indication of the personal data it processes, why, for what purpose, (and other stuff you can find in a privacy policy) etc. It also provided the data subject with their most commonly processed personal data as it appeared in the controller's general system. Last, the controller generally referred to Article 13(4), Article 14(5) and Article 23 GDPR for possible non-disclosure.
The data subject, not satisfied with this answer, again appealed the decision to the court.
During the hearing, the controller explained that other systems were not searched because there were too many systems and this would therefore be disproportionately burdensome.
Holding
The District Court of Rotterdam held that searching a general system was not sufficient. The controller had not complied with the data subject's request. The Court found that the controller's view that there were too many systems was unsubstantiated, and insufficient reasoning to suffice with the limited search it conducted.
Regarding the existing documents containing personal data outside of the system searched, the Court held that the controller's general reference to grounds for exemption in the GDPR, without a reasoning specifically focussed on those documents, was insufficient. In addition, the controller could have brought those documents before the Court by relying on Article 8:29 of the General Administrative Law Act. That way, the Court would be able to examine whether the grounds for exceptions were rightly invoked. However, the controller did not.
Furthermore, the Court held that the controller should have specified the purpose, whom the data may have been shared with and the origin of the data. The mere listing of the personal data found, followed with a general explanation of how the Tax Administration handles personal data was not enough. The Court held that this did not allow the data subject to verify the lawfulness of processing under Article 15 GDPR.
The Court declared the appeal well-founded, annulled the contested decision and ordered the controller to make a new decision, taking this judgement into account.
Comment
The Dutch Tax Administration is a part of the Ministry of Finance. Therefore, when a decision of the Tax Administration is appealed, the party in the proceedings is the Minister of Finance.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
