Hoge Raad - 22/03293
| Hoge Raad - 22/03293 | |
|---|---|
 | |
| Court: | Hoge Raad (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 15 GDPR Article 35 Uitvoeringswet Algemene Verordening Gegevensbescherming |
| Decided: | 15.09.2023 |
| Published: | 15.09.2023 |
| Parties: | |
| National Case Number/Name: | 22/03293 |
| European Case Law Identifier: | ECLI:NL:HR:2023:1216 |
| Appeal from: | GHAMS ECLI:NL:GHAMS:2019:3966 |
| Appeal to: | |
| Original Language(s): | Dutch |
| Original Source: | Hoge Raad (in Dutch) |
| Initial Contributor: | Enzo Marquet |
The Dutch High Court held that when a data subject seeks to have their access rights enforced, they can also request preliminary injunction, even though the legal deadline for such enforcement has officially passed. The High Court also noted that making additional access requests without new information does not mean those requests are automatically manifestly unfounded or excessive.
English Summary
Facts
The case concerned an action for cassation brought before the Dutch Supreme Court on 15 September 2023, following an appeal against the Amsterdam Court of Appeal's judgment of 5 November 2019.
The main question brought before the Court was whether it was possible to raise an objection to the procesing of personal data in summary proceedings following the six-week time limit set out by Article 35(2) of the UAVG (Uitvoeringswet Algemene Verordening Gegevensbescherming). The UAVG is the Dutch national transposition of the GDPR. Article 35 UAVG implements Article 79 GDPR, and provides:
"1. If the decision on a request as referred to in Article 34 has been taken by a body other than an administrative body, the interested party may apply to the court with a written request to order the controller to order the request referred to in Articles 15 to 22 of the Regulation.
2. The application shall be made within six weeks of receipt of the answer from the controller. If the controller has not replied within the time limits referred to in Article 12, paragraph 3 of the Regulation, the submission of the application shall not be subject to a period."
In the present case, the data subject had made an application after the six-week time limit laid down in Article 35(2) UAVG. The facts are as follows. The data subject had taken out a student loan in 2002, and consequently, the details of it were registered in the Dutch Central Credit Registration Office (BKR). This body keeps records of private parties that have taken out credit. In early 2018, the data subject had applied for a loan and was denied due to the financial records on their credit history kept by the BKR.
On 27 June 2018, the data subject submitted an objection to processing (Article 21 GDPR) to BKR. By a letter dated 23 July 2018, BKR responded in the negative, refusing to comply with the objection.
Holding
The High Court first held that making additional access requests under Article 15 to Article 22, even though that request includes no new information, does not automatically mean the request is manifestly unfounded of excessive.
The High Court clarified that article 35 of the Dutch UAVG specifies that the petition procedure should be used when a data subject asks the court to instruct the data controller to accept or reject a request based on Articles 15 to 22 of the GDPR. The High Court stated that the regular court cannot be used to challenge a decision of a controller for access request. However, the High Court did hold that for urgent needs, temporary relief can be requested through a preliminary injunction. On top of that missing the deadline under article 35 UAVG does not deprive a data subject of its right from seeking legal action through this preliminary injunction.
Lastly, the High Court held that when a controller denies an access request, it must motivate its decision. It comes to the controller to show why the request is manifestly unfounded or excessive.
As such, the High Court annuled the decision by the regular court.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
