RvS - 202107090/1/A3: Difference between revisions

From GDPRhub
(Created page with "{{COURTdecisionBOX |Jurisdiction=Netherlands |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=RvS |Court_Original_Name=Raad van State |Court_English_Name=Council of State |Court_With_Country=RvS (Netherlands) |Case_Number_Name=202107090/1/A3 |ECLI=ECLI:NL:RVS:2023:2681 |Original_Source_Name_1=Raad van State |Original_Source_Link_1=https://uitspraken.rechtspraak.nl/#!/details?id=ECLI:NL:RVS:2023:2681&showbutton=true&keyword=AVG&idx=6 |Original_Source_Lan...")
 
No edit summary
Line 69: Line 69:


=== Facts ===
=== Facts ===
The data subject requested a controller, the Employee Insurance Agency (a governmental organisation), to delete her phone number because she no longer wanted to be contacted  by them. She also requested that her phone number was deleted from two messages which were stored in the digital 'mailbox' of the controller.  
The data subject requested a controller, the Employee Insurance Agency (a governmental organisation), to delete her phone number because she no longer wanted to be contacted  by them. She also requested the erasure of her phone number from two messages which were stored in the digital 'mailbox' of the controller.  


The controller deleted her number for contacting purposes, but would not delete her number from its documents, such as the digital mailbox. These documents are part of their files on social security and must be stored based on the condition as set out in the Archiefwet (Archive Law). The right of erasure was not yet applicable as set out in [[article 17 GDPR#3b|Article 17(3)(b)]], the controller had to comply with a legal obligation in the exercise of official authority vested in the controller.
The controller deleted her number for contacting purposes, but refused to delete her number from the digital mailbox. It argued that these documents were part of their social security files and must be stored on the basis of a legal obligation arising from the Archiefwet (Archive Law).


This last holding was followed by the Court of Noord-Holland (case 20/4820), the controller was not obligated to delete the phone number from their files. The Archiefwet obligated the controller to keep the archive in good, orderly and accessible condition. Following on case ECLI:NL:RVS:2017:620, the Archiefwet must also be interpreted that files must be kept in their original state.  
This last holding was followed by the Court of Noord-Holland (case 20/4820), the controller was not obligated to delete the phone number from their files. The Archiefwet obligated the controller to keep the archive in good, orderly and accessible condition. Following on case ECLI:NL:RVS:2017:620, the Archiefwet must also be interpreted that files must be kept in their original state.  

Revision as of 12:52, 17 July 2023

RvS - 202107090/1/A3
Courts logo1.png
Court: RvS (Netherlands)
Jurisdiction: Netherlands
Relevant Law: Article 17(3)(b) GDPR
Archiefwet
Decided: 12.07.2023
Published: 12.07.2023
Parties: Uitvoeringsinstituut Werknemersverzekeringen
National Case Number/Name: 202107090/1/A3
European Case Law Identifier: ECLI:NL:RVS:2023:2681
Appeal from: RBNHO
20/4820
Appeal to:
Original Language(s): Dutch
Original Source: Raad van State (in Dutch)
Initial Contributor: Enzo Marquet

The Dutch Council of State reaffirmed that if there is a legal obligation to retain files in the exercise of official authority vested in the controller, then the right to erasure under Article 17 is not applicable as long as the retention period runs, as stated in Article 17(3)(b).

English Summary

Facts

The data subject requested a controller, the Employee Insurance Agency (a governmental organisation), to delete her phone number because she no longer wanted to be contacted by them. She also requested the erasure of her phone number from two messages which were stored in the digital 'mailbox' of the controller.

The controller deleted her number for contacting purposes, but refused to delete her number from the digital mailbox. It argued that these documents were part of their social security files and must be stored on the basis of a legal obligation arising from the Archiefwet (Archive Law).

This last holding was followed by the Court of Noord-Holland (case 20/4820), the controller was not obligated to delete the phone number from their files. The Archiefwet obligated the controller to keep the archive in good, orderly and accessible condition. Following on case ECLI:NL:RVS:2017:620, the Archiefwet must also be interpreted that files must be kept in their original state.

The data subject appealed this decision. She claimed that the controller unlawfully processed her data and that it was not necessary to store the personal data. In her view, the Archiefwet does not offer a legal basis for processing and it breached the principles of minimisation, lawfulness and necessity.

Holding

The Dutch Council of State dismissed the claim as they were a repetition of the arguments made in first instance. The CoS held that the Court of Noord-Holland adequately motivated its decision. The CoS also referred to case ECLI:NL:RVS:2022:2065, where the court came to the same conclusion as in this case. The CoS repeated that if there is a legal obligation to store files in the exercise of official authority vested in the controller, then the right to erasure under Article 17 is not applicable as long as the retention period runs, as stated in Article 17(3)(b). Archiving as such does not breach the GDPR.

The CoS declared the appeal unfounded.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.