RvS - 201907720/1/A3
| RvS - 201907720/1/A3 | |
|---|---|
 | |
| Court: | RvS (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 35 Personal Data Protection Act |
| Decided: | 09.12.2020 |
| Published: | 09.12.2020 |
| Parties: | Council of Mayor and Aldermen of Heemskerk |
| National Case Number/Name: | 201907720/1/A3 |
| European Case Law Identifier: | ECLI:NL:RVS:2020:2833 |
| Appeal from: | District Court of Noord-Holland 18/817 |
| Appeal to: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | Rechtspraak.nl (in Dutch) |
| Initial Contributor: | n/a |
The Dutch Council of State (RvS) held that in certain instances where a data subject's identity is in dispute, such as when there is a mismatch in signature, a data controller is entitled to request further proof of identity before fulfilling an access request. The Council of State reaffirmed that such an additional request must not be so demanding so as to impede on the GDPR right.
In this decision, this was not considered to be the case. The data controller had valid reasons to have doubts as to the identity of the applicant, and was therefore entitled to ask for additional information or to impose additional requirements.
English Summary
Facts
The Council of Mayor and Aldermen of Heemskerk (which exercises the executive power of the municipal government) declined the request of the appellant to access his personal data. The data subject attached a copy of an expired passport to this request, but the Council of Mayor and Aldermen of Heemskerk announced that it was unable to establish the applicant's identity properly with an expired passport. It therefore requested the appellant to send a certified copy of a valid identity document (i.e. copy of an original document that has been authorised or stamped as being a true copy of the original, by a qualified individual) or to visit the town hall in person. The appellant then sent a copy of a valid passport, without further explanations.
The Council however decided not to consider the request. It took the view that it was not possible to properly establish the identity of the applicant with the information at its disposal. Although a copy of a valid passport had been submitted, it had emerged from the administration that the signature on the request and on the passport did not match the signature on previously submitted requests by a person with the same name who lives at the same address. According to the Council, it was therefore necessary to establish the identity of the applicant by means of one of the two options offered (certified copy or visit at the town hall).
Dispute
Is a data controller entitled to request the data subject to send a certified copy of an identity document or to visit its building in person to establish its identity, or are these two options so impeding that it affects the right of the data subject to freely request access to his data?
Holding
On appeal, the Council of Mayor and Aldermen took the view that the appellant misused his rights because he made the access request with a view not to take cognisance of the personal data processed concerning him, but merely to collect penalty payments and obtaining reimbursement of legal costs from the public authorities (financial motive only). The District Court of Noord-Holland and the Council of State however ruled that there was insufficient ground to reach this conclusion.
The District Court of Noord-Holland and the Council of State considered that the Council of Mayor and Aldermen of Heemskerk could reasonably take the view that the different signatures gave rise to doubts as to the identity of the applicant and that a copy of the passport alone was not sufficient in this case.
It could therefore reasonably ask the applicant to send a certified copy of an identity document or to visit the town hall in person, to guarantee a proper establishment of his identity. The two options given by the Council were not disproportionately onerous. Although the distance to the town hall was considerable for the appellant, the alternative of a certified copy did not involve such high costs that the right of the data subject to freely request access to his data was infringed.
The Council of Mayor and Aldermen was therefore entitled to disregard the access request.
Comment
On 25 May 2018, the General Data Protection Regulation became applicable. The decision from the Council is from before that date. Therefore, the Dutch Personal Data Act (Wet Bescherming Persoonsgegevens) still applied to this case.
This decision should be compared to: https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RVS:2020:2915&showbutton=true&keyword=AVG
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
201907720/1/A3. Date of judgment: 9 December 2020 SECTION ADMINISTRATIVE LAW Judgment on the appeals of: 1. [appellant under 1], residing at [place of residence], 2. the Municipal Executive of Heemskerk, appellants, against the judgment of the District Court of North Holland of 12 September 2019 in Case No 18/817 in the interlocutory proceedings: [appellant under 1] and the college. Process sequence By decision of 19 September 2017, the Board rejected the request by [appellant under 1] for access to his personal data. By decision of 18 January 2018, the Board dismissed [appellant sub 1]'s objection to that request as unfounded. By decision of 13 February 2018, the Board decided that no penalty payment had been forfeited on account of the failure to decide on the objection in good time. By decision of 12 September 2019, the Court declared the appeal lodged by [appellant sub 1] against the decision of 18 January 2018 unfounded and upheld the appeal lodged against the decision of 13 February 2018, annulled that decision and set the penalty payment forfeited by the Board at € 520. This judgment is attached. The [appellant under 1] has lodged an appeal against that decision. The Board made a written statement and lodged an incidental appeal. The Division heard the case on 3 August 2020, where [the appellant sub 1], assisted by [the agent], legal aid provider, and the Board of Appeal, represented by C.N. van der Sluis, attorney at law in Rotterdam, appeared. Recitals Applicable law 1. On 25 May 2018, the General Data Protection Regulation became applicable. The decision on objections is from before that date. Therefore, the Wbp still applies to this case. For the text of the relevant provisions of the Wbp and the General Administrative Law Act (hereinafter: the Awb), reference is made to the annex, which forms part of the decision. Decision-making 2. On 30 July 2017 [appellant sub 1] requested access to the processing of his personal data as referred to in article 35 of the Wbp. According to [Appellant under 1], his personal data were processed in connection with, among other things, a request submitted previously under the Government Information (Public Access) Act (hereinafter: the Wob). He has also requested that, insofar as the Board has processed his personal data by posting messages on the forum of the Association of Netherlands Municipalities (hereinafter: VNG), the content of these messages be included in the overview. He attached a copy of an expired passport to this request. 2.1. On 7 August 2017, the Municipal Executive announced that it was unable to establish the applicant's identity properly with an expired passport. It requested [the appellant under 1] to send a certified or authorised copy of a valid identity document or to visit the town hall in person. [appellant sub 1] then sent a copy of a valid passport, without further explanation. 2.2. By decision of 19 September 2017, the Municipal Executive decided not to consider the request. Pursuant to Section 37(2) of the Wbp, it is required to properly establish the identity of the applicant in the case of an application. The Municipal Executive took the view that this was not possible with the information at its disposal. Although a copy of a valid passport had been submitted, it had emerged from the administration that a person with the same name as [appellant under 1] had previously sent letters to the Board, but that the signature on those letters did not match the signature on the application for inspection. In view of this, it was necessary, in the opinion of the Board, to establish the identity by means of one of the two options offered. In its appeal, the College maintained the decision. Ruling attacked 3. On appeal, the College took the view that [the appellant under 1] was misusing his rights, because [the appellant under 1] made the request for inspection with the aim of collecting periodic penalty payments and obtaining reimbursement of legal costs. The court ruled that there is insufficient ground for the conclusion that [appellant sub 1] submitted the request for inspection under the Wbp for a purpose other than that for which it was granted. The court also ruled that the Board could reasonably ask for a certified or authorised copy of an identity document to be sent or for an appointment to be made at the town hall. Now that [the appellant under 1] has failed to do so, the court ruled that the Municipal Executive could disregard its request. Appeal by the College 4. The incidental appeal of the Board is the most far-reaching. That is why it will be the first to be assessed. The College submits that the Court erred in finding that [appellant under 1] did not commit an abuse of rights. There are several aspects which, viewed in conjunction, must lead to a finding that there is an abuse of rights. For example, the conduct of [the appellant under 1] and [the agent] is established. In the past, [appellant sub 1] has submitted Wob requests in almost all municipalities. There have been many proceedings on this subject, which has ultimately led to decisions by the Division in which it is ruled that [appellant sub 1] has abused his rights with these requests. Now [appellant sub 1] has submitted a Wbp request to almost all municipalities. In addition, various aspects show that [appellant sub 1] and [authorised representative] have a financial motive. For example, in a similar case, [the agent] approached the Municipal Executive to buy off proceedings, a request for compensation for breach of a reasonable period of time was made on appeal and the notice of appeal is an almost literal repetition of the notice of appeal, which indicates a minimum effort. Failure to appear at a hearing also indicates this. In addition, the financial interests of [appellant under 1] and [agent] are apparent from [person's] no-cure-no-pay practice. Finally, there is another way for [appellant under 1] to obtain the personal data processed on the VNG forum. He had in fact initiated proceedings against the VNG in order to access those data and could have continued those proceedings. There was also the possibility of filing a new Wbp application, according to the College. 4.1. In its decision of 23 January 2019, ECLI:NL:RVS:2019:184, the Division ruled that the Wob and the Wbp relate to different matters. This means that the judgment that there has been an abuse of rights with regard to the Wob does not automatically mean that there has also been an abuse of rights with regard to the Wbp. The purpose of the Wbp is, among other things, to give citizens access to the way in which administrative bodies, among others, process their personal data. In its decision of 21 August 2019, ECLI:NL:RVS:2019:2797, which concerns a similar case of [appellant sub 1], the Division ruled that there were insufficient grounds for the opinion that [appellant sub 1] had made an abuse of rights by submitting the request for inspection and using legal remedies. The circumstance that the representative of [appellant sub 1] was declared inadmissible earlier in the context of Wob proceedings, that [appellant sub 1] had submitted requests for inspection to various municipalities, and that many proceedings were in progress about this, the fact that [the appellant under 1] is keeping a close eye on the time-limit for taking a decision and, if that time-limit is exceeded, requests the imposition of periodic penalty payments following formal notice and damages, was not considered sufficient for it to be concluded that [the appellant under 1] did not intend to take cognisance of the personal data processed concerning him, but merely attempted to collect sums of money from the public authorities. 4.2. Contrary to the decision of 21 August 2019, the Division sees no reason to consider that [appellant sub 1] has misused the authority to submit requests for inspection. Finding out which municipalities have posted the applicant's personal data on the VNG forum is in line with the purpose of the Wbp. As [appellant sub 1] explained at the session, the VNG has removed everything from him from the forum. A request to the VNG for inspection therefore makes no sense. He hopes that the Board has made screenshots of the forum or can find out in some other way what was posted on the forum. If the Board has unlawfully processed his personal data, he will request compensation. Under the AVG there is the possibility to do so. The fact that this is the underlying purpose of this request, and also of the other requests for inspection that he has submitted, does not mean that the purpose of the request is no longer in line with the purpose of the Wbp. Nor does the Division see any reason to reach a different conclusion in what has otherwise been argued. In fact, the arguments put forward are very similar to those put forward in the case that led to the judgment of 21 August 2019. 4.3. The argument fails. Appeal by [appellant under 1] 5. [appellant under 1] submits that the court erred in finding that the College was entitled to ask him to send a certified or authorised copy of an identity document or to visit the town hall. The copy of his identity document enabled the Municipal Executive to establish his identity properly. The signature on the request corresponds to the signature in the passport. The request for inspection was submitted from the address on which he is registered in the basic registration of persons, which is an important factor in establishing his identity, according to [appellant sub 1]. 5.1. It follows from the lack of specific points of reference in the Wbp that, in principle, the Municipal Executive has room for manoeuvre with regard to the manner in which it wishes to establish the identity of the applicant. That scope is also determined, on the one hand, by the principle that the determination of identity must be sound. On the other hand, the fact that the determination of identity may not be so impeding that it affects the right of the person concerned to apply freely to the College with a request for inspection. 5.2. It is not considered unreasonable to ask for a copy of an identity document in the case of a request for inspection. This will guarantee a proper determination of the identity without prejudice to the right of the persons concerned to apply freely to the Board. In this case, the College noted that the signature on the request and on the passport did not correspond to the signature on previously submitted Wob requests of a person with the same name who lives at the same address. It could therefore reasonably take the view that this gave rise to doubts as to the identity of the applicant and that a copy of the passport alone was not sufficient in this case. The fact that, according to [appellant sub 1], the request for inspection had been submitted from the address with which he is registered in the basic registration of persons and that the overview could be sent to that address, could not have been considered sufficient by the Board to establish the identity properly. The Board was entitled to request additional information to establish the identity of [appellant under 1]. The Court correctly ruled that the two options given by the Municipal Executive [appellant sub 1], the submission of a certified or authorised copy of a valid identity document or the personal visit to the town hall, were not disproportionately onerous in this case. Although the distance to the town hall is considerable for [appellant sub 1], the alternative of a certified or authorised copy does not involve such high costs that the right to freely request inspection is infringed. 5.3. The argument fails. 5.4. 5.4. [appellant under 1] has also requested compensation for exceeding the reasonable period of time. He withdrew that request at the hearing and will therefore not be assessed. Final sum 6. The appeals brought by [appellant under 1] and by the College are unfounded. The decision of the court must be upheld in so far as it has been attacked. 7. The Board must be ordered to reimburse the costs of the proceedings in a manner to be reported. The fact that [appellant sub 1] is more often objected to the fact that he has misused his right to submit requests for inspection does not, contrary to what he has argued, give cause to apply a heavier weighting factor. Decision The Administrative Jurisdiction Division of the Council of State: I. confirms the decision of the court, in so far as attacked; II. orders the Municipal Executive of Heemskerk to compensate [appellant sub 1] for legal costs incurred by [appellant sub 1] in connection with the hearing of the appeal up to an amount of € 1,184.53 (in words: eleven hundred and eighty-four euros and fifty-three cents). Thus established by Mr C.J. Borman, Chairman, and Mr S.F.M. Wortmann and Mr J. Gundelach, Members, in the presence of Mr P. Klein, Registrar. The chairman is prevented from signing the decision. w.g. Klein Registrar Pronounced in public on 9 December 2020 176-851. Annex Personal Data Protection Act Article 35 1. The data subject shall have the right to address himself/herself freely and at reasonable intervals to the data controller with a request to inform him/her whether personal data relating to him/her are being processed. The data controller shall inform the data subject in writing within four weeks whether or not personal data relating to him or her are being processed. […]. Article 37 1. […]. 2. The person responsible shall ensure that the identity of the applicant is properly established. […]. General Administrative Law Act Article 4:5 1. The administrative body may decide not to consider the application if: a. the applicant has not complied with any legal requirement for the application to be considered, or b. the application has been refused, in whole or in part, on the grounds of Article 2:15, or c. the information and documents provided are inadequate for the evaluation of the application or the preparation of the decision, provided that the applicant has had the opportunity to complete the application within a period set by the administrative authority. […].
