Rb. Noord-Holland - AWB-20 4638
From GDPRhub
| Rb. Noord-Holland - AWB-20_4638 | |
|---|---|
 | |
| Court: | Rb. Noord-Holland (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 15(1) GDPR |
| Decided: | 18.06.2021 |
| Published: | 20.07.2021 |
| Parties: | Minister of Finance |
| National Case Number/Name: | AWB-20_4638 |
| European Case Law Identifier: | ECLI:NL:RBNHO:2021:6040 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Dutch Dutch |
| Original Source: | Rechtspraak.nl (in Dutch) Rechtspraak.nl (in Dutch) |
| Initial Contributor: | n/a |
The District Court of Northern Holland held that a data controller should always perform a search for most common personal data, such as name, address and national security number, in its most common data files and/or computer systems/applications.
English Summary
Facts
The claimant's request for access to his personal data was rejected by the Minister of Finance (the defendant). The Minister of Finance considered the request to be too general, comparing it to a 'fishing expedition', and reported that he processes a large amount of data on each data subject. The claimant was asked to specify his request. The defendant draws on recital 63 and case law. With regard to the statutory tasks of the tax authorities, the defendant argues that the claimant can largely view and change his personal data himself by logging in to 'my tax authority' or 'my benefits' (web portal). The claimant argues that the defendant is wrong to ask him to specify his request, because this would make it impossible for him to verify what personal data is being processed. According to the claimant, there is a possibility that personal data may be processed incorrectly, incompletely and/or unlawfully without the ability to verify and rectify.
Dispute
What is the minimum effort of companies that process a large amount of data on a data subject must make when they receive a request for access under Art. 15, 1 GDPR?
Holding
The court considers it reasonable to expect the data controller to search the most common databases and/or data information systems/applications when a data subject requests access (Art. 15 GDPR), even if it concerns a data controller with a large amount of data on the legal subject.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
Body
Court of North Holland
Date of judgment
18-06-2021
Date of publication
20-07-2021
Case number
AWB - 20 _ 4638
Jurisdictions
Administrative law
Special characteristics
First instance - single
Content indication
AVG - The Tax and Customs Administration has provided insufficient reasons that a search for the most common personal data is not possible without further specification.
Locations
Rechtspraak.nl
Viditax (FutD), 6/22/2021
FutD 2021-1970 with annotation from Fiscal up to Date
U-N Today 2021/1795
NLF 2021/1527
Enhanced pronunciation
Share pronunciation
print
Save as PDF
Copy link
Pronunciation
NORTH HOLLAND COURT
Seating location Haarlem
Administrative law
case number: HAA 20/4638
judgment of the single chamber of 18 June 2021 in the case between
[claimant] , at [place of residence] , claimant
(Agent: J.H.P.M. Raaijmakers),
and
the Minister of Finance, defendant
(Agents: J.L. Lam MSc LL.M. and I.H.H.L. Kolthof).
Process sequence
In the decision of 7 April 2020 (primary decision), the respondent rejected the request for access to his personal data on the basis of the General Data Protection Regulation (GDPR).
In the decision of 23 July 2020 (contested decision), the respondent upheld the claimant's objection against the primary decision, in so far as the application was completely rejected and the rest declared unfounded.
Plaintiff appealed against the contested decision.
Defendant has filed a statement of defence.
The examination at the hearing took place on 17 May 2021 using video bubbles. Plaintiff is represented by his authorized representative. Defendant was represented by his attorneys.
Considerations
1. In a letter dated January 23, 2020, the plaintiff submitted a request to the defendant for access to his personal data. The defendant rejected the request, referring the plaintiff to 'my tax authorities' and 'my allowances' for his personal data.
2. The defendant has declared the objection of the plaintiff well-founded in the sense that the request is not wholly rejected, but that the reference to 'my allowances' and 'my tax authorities' provides sufficient access to the personal data.
3. As discussed at the hearing, the core of the dispute between the parties is the answer to the question whether the defendant could have sufficed to refer to my tax authorities and my allowances and otherwise require the claimant to specify his request.
4. The defendant takes the position that the request for access by the plaintiff is so general that it has the character of a 'fishing expedition'. Where a controller processes a large amount of data about a data subject (such as a defendant), the data subject may be requested to specify in his request to which information or which processing activity the request relates. The defendant bases its position on recital 631 of the GDPR and the relevant case law. With regard to the statutory duties of the tax authorities (levying/collecting taxes, paying surcharges, supervising goods and detecting related offenses), the defendant states that the plaintiff can largely view his personal data and change it (or have it changed) by logging in to ' my tax authorities' or 'my allowances'.
5. The Claimant argues that the Respondent wrongly asks him to specify his request, because this prevents him from checking all his personal data. Such an obligation also does not follow from the GDPR (and/or recital 63). Plaintiff states that more information is available than is currently provided by the tax authorities. For example, the Tax and Customs Administration states that the claimant is the Ultimate Benificial Owner (UBO) of a number of foreign companies. According to the claimant, it is not an excessive effort for the tax authorities to obtain the personal data. By not being given full access, because a request should be specified, there is a chance that personal data may be incorrectly and/or incompletely and/or unlawfully processed without there being any possibility of checking and correction.
6. The court considers as follows.
7. In general, a controller may request clarification if it processes a large amount of data. However, this does not mean that a controller can in all cases demand clarification before performing a search. The more concrete a request is, the more effort may be expected from the controller, but in the opinion of the court, the controller may also be expected to perform a search for the most common personal data in the case of a generally formulated request (for example, on the basis of the Name and address details and BSN number) in the most common data files and/or computer systems/applications. This would only be different if the controller provides clear reasons that such a limited search also requires a disproportionate amount of effort.
8. It is not disputed that the Tax and Customs Administration processes a large amount of data. At the hearing, the defendant explained that to search the many systems in which the Tax and Customs Administration processes personal data, employees must log in separately and that only a limited number of employees are authorized for some systems, such as the Fraud Signaling Facility (FSV) system. In this explanation, however, the respondent has provided insufficient reasons that it would not be possible to perform a search for the most common personal data (name and address details and the citizen service number) in a number of the larger applications or systems. The circumstance that login is required per system or application or that not every tax employee has access to a system or application does not justify the conclusion without further motivation that this requires a disproportionate effort from the Tax and Customs Administration. The contested decision therefore lacks a proper statement of reasons and will therefore be annulled.
9. The court will therefore declare the appeal well-founded and annul the contested decision. The court itself does not provide in this case, because the defendant either has to provide further reasons that a search for the most common personal data is not possible, or will have to perform that search. Defendant will therefore have to make a new decision with due observance of this ruling.
10. The court will deny the claimant's request to impose a penalty on the defendant, because there is no reason to assume that the defendant will not comply with this decision.
11. Because the District Court declares the appeal well-founded, the District Court determines that the defendant reimburses the applicant for the court fee paid by him.
12. The court orders the defendant to pay the costs incurred by the plaintiff. Based on the Administrative Costs Decree, the court sets these costs for legal assistance provided professionally by a third party at €1,068 (1 point for submitting the notice of appeal, 1 point for appearing at the hearing, with a value per point of € 534 and weighting factor 1). Furthermore, the defendant must reimburse the court fee paid by the plaintiff.
Decision
The court:
- declares the appeal well-founded;
- annul the contested decision;
- instructs the defendant to take a new decision on the objection within six weeks of the date on which this decision was sent, taking into account the considerations in this decision;
- rejects the request to impose a penalty;
- orders the defendant to reimburse the plaintiff for the court fee paid of € 178;
- orders the defendant to pay the plaintiff's legal costs to an amount of € 1,068.
This statement was made by mr. M.P. de Valk, judge, in the presence of mr. J.H. Bosveld, clerk. The verdict was handed down in public on June 18, 2021.
clerk
Right
A copy of this ruling has been sent to the parties at:
Do you disagree with this statement?
If you do not agree with this ruling, you can send a letter to the Administrative Jurisdiction Division of the Council of State explaining why you do not agree with it. This is called an appeal. You must submit this notice of appeal within 6 weeks after the
day on which this statement was sent. You can see this date above.
Appendix
Recital 63:
“A data subject should have the right to access the personal data collected about them and to exercise that right easily and at reasonable intervals so that they can obtain information about the processing and verify its lawfulness . This also means that data subjects should have the right to access their personal data regarding their health, such as the data in their medical file, which contains information about, for example, diagnoses, research results, assessments by treating physicians and treatments or interventions performed. Each data subject must therefore have the right to know and be informed for what purposes the personal data are processed, if possible how long they are stored, who receives the personal data, what logic is underlying any automatic processing of the data. personal data and, at least where the processing is based on profiling, what the consequences of such processing are. If possible, the controller should be able to provide remote access to a secure system on which the data subject can directly view his personal data. That right should not affect the rights or freedoms of others, including business secrets or intellectual property and, in particular, the copyright protecting the software. However, those considerations should not lead to the data subject being withheld all information. Where the controller processes a large amount of data concerning the data subject, it should be able to request the data subject, prior to providing the information, to specify the information or processing activities to which the request relates.”
1
See annex for the text of recital 63
