Hoge Raad - AVG 2023-09-21

Hoge Raad - AVG 2023-09-21
Court:	Hoge Raad (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:	Article 5(1)(a) GDPR Article 6(1)(e) GDPR
Decided:
Published:
Parties:
National Case Number/Name:	AVG 2023-09-21
European Case Law Identifier:	ECLI:NL:PHR:2023:823
Appeal from:
Appeal to:
Original Language(s):	Dutch
Original Source:	Hoge Raad (in Dutch)
Initial Contributor:	co

The supreme court of the NL held, with regards to the E-Archive that it complies with GDPR requirements, as long as data subjects are informed on whether their data is included in the E-Archive or not.

English Summary

Facts

The E-Archive is an internal database containing a selection of judgments, accessible only to judicial and court officials in their judicial activities. An individual (data subject) brought three separate complaints with the Procurator General of the Supreme Court, who is competent to deal with complaints regarding courts acting in their judicial capacity. The data subject directed his complaints against three different district courts of courts of Northern-Netherlands, Amsterdam and The Hague (each of them a controller) for unlawful processing activities of his personal data, including in his professional capacity as a legal representative. In particular, the complainant held that the Nord Holland District Court included the name of the complainant in a E-Archive judgment without his consent and without informing him about the appearance of his data in the E-Archive, which was then removed at his request. Secondly, with respect to processing by the Amsterdam District Court, the complainant asserts that the court lacked a legal basis to search for his name in the E-Archive and disclose this data to the opposing party at a subsequent hearing. He objected to the processing and asked the court to stop processing his personal data, but the court replied that these judgments were not included in the E-Archive and thus it could not comply with his request. Thirdly, as regards the Hague District Court, the data subject complained about the refusal of the Board of the court to comply with his request not to disseminate his personal data via (inter alia) the E-Archive, as he considered that he had not been duly informed about the inclusion of his personal data in the E-Archive. The Supreme Court of the Netherlands was thus called upon to investigating on the processing activities by the above mentioned district courts and it took the chance to rule on the compliance of the E-Archive with the GDPR.

Holding

First of all, the court assessed the compliance of the E-Archive with the GDPR and it concluded that the purposes it serves, namely that of guaranteeing quality of judicial decisions and promote legal unity and certainty are legitimate. Also, it considered the measures in place and those to be adopted to ensure an adequate level of protection of the personal data included in the E-Archive. The court further held that the processing activities by courts in using the E-Archive are lawfully based on both Article 6(1)(e) directly and on Article 6(4) GDPR too, thus concluding that it does comply with GDPR requirements. For dealing with the complaint brought by the data subject, the Supreme Court then assessed whether the GDPR was applicable to the case at hand and whether it had competence to deal with such complaints. It concluded that the GDPR does apply to courts acting in their judicial capacity under Article 2(2)(d) GDPR. Yet, under Article 55(3) GDPR and Recital (20) GDPR national Data Protection Authorities do not have competence to supervise processing activities of courts acting in their judicial capacity, and this task should be assigned to a special supervisor. According to Dutch Law, complaints relating to processing activities by courts in their judicial capacity shall be handled by the Procurator General of the Supreme Court. With respect to the single claims, the Supreme Court held the majority of them to be unfounded, as it hald that it cannot consider the substantive content of the judgments in which the name of the complainant appears. As regards two of the judgments that the data subject refers to, instead, the Supreme Court found these to be well-founded, since at the time of the recording of the data subject’s personal data, the existence of the E-Archive had not been mentioned nor was otherwise known to the complainant. For this reason, the Supreme Court held that in these cases, the principle of transparency of Article 5(1)(a) had been violated.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.