Rb. Rotterdam - ROT 22/2125

Rb. Rotterdam - ROT 22/2125
Court:	Rb. Rotterdam (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:	Article 13(4) GDPR Article 14(5)(a) GDPR Article 15(1) GDPR Article 23(1)(d) GDPR Article 23(1)(i) GDPR
Decided:	17.02.2023
Published:	20.02.2023
Parties:	Minister of Finance (Dutch Tax Administration)
National Case Number/Name:	ROT 22/2125
European Case Law Identifier:	ECLI:NL:RBROT:2023:1189
Appeal from:
Appeal to:	Unknown
Original Language(s):	Dutch
Original Source:	rechtspraak.nl (in Dutch)
Initial Contributor:	elsjegold

The District Court of Rotterdam held that the Dutch Tax Administration insufficiently answered a data subject's access request. The search conducted should go beyond the most general system, and the purpose, whom the data may have been shared with and the origin of the data should be specified.

English Summary

Facts

A data subject made an access request with the Dutch Tax Administration (the controller). The controller decided to deny the data subject's request. The data subject raised objections against this decision, but the controller declared it unfounded. The data subject appealed this decision on the objection to the court.

The Court declared the appeal well-founded and ordered the controller to take a new decision on the objection (thus, fulfilling the access request).

The controller 'fulfilled' the request with a general indication of the personal data it processes, why, for what purpose, (and other stuff you can find in a privacy policy) etc. It also provided the data subject with their most commonly processed personal data as it appeared in the controller's general system. Last, the controller generally referred to Article 13(4), Article 14(5) and Article 23 GDPR for possible non-disclosure.

The data subject, not satisfied with this answer, again appealed the decision to the court.

During the hearing, the controller explained that other systems were not searched because there were too many systems and this would therefore be disproportionately burdensome.

Holding

The District Court of Rotterdam held that searching a general system was not sufficient. The controller had not complied with the data subject's request. The Court found that the controller's view that there were too many systems was unsubstantiated, and insufficient reasoning to suffice with the limited search it conducted.

Regarding the existing documents containing personal data outside of the system searched, the Court held that the controller's general reference to grounds for exemption in the GDPR, without a reasoning specifically focussed on those documents, was insufficient. In addition, the controller could have brought those documents before the Court by relying on Article 8:29 of the General Administrative Law Act. That way, the Court would be able to examine whether the grounds for exceptions were rightly invoked. However, the controller did not.

Furthermore, the Court held that the controller should have specified the purpose, whom the data may have been shared with and the origin of the data. The mere listing of the personal data found, followed with a general explanation of how the Tax Administration handles personal data was not enough. The Court held that this did not allow the data subject to verify the lawfulness of processing under Article 15 GDPR.

The Court declared the appeal well-founded, annulled the contested decision and ordered the controller to make a new decision, taking this judgement into account.

Comment

The Dutch Tax Administration is a part of the Ministry of Finance. Therefore, when a decision of the Tax Administration is appealed, the party in the proceedings is the Minister of Finance.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.