Rb. Midden-Nederland - AWB - 19 1687
From GDPRhub
| Rb. Midden-Nederland - AWB - 19 _ 1687 | |
|---|---|
 | |
| Court: | Rechtbank Midden-Nederland |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 16 GDPR Article 24 GDPR |
| Decided: | 29.05.2020 |
| Published: | 19.06.2020 |
| Parties: | |
| National Case Number/Name: | AWB - 19 _ 1687 |
| European Case Law Identifier: | ECLI:NL:RBMNE:2020:2226 |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | de Rechtspraak (in Dutch) |
| Initial Contributor: | n/a |
The District Court of Midden-Nederland (Rb. Midden-Nederland) ruled that the right to rectification of inaccuracies contained in a medical report cannot be fulfilled by issuing additional report without actually rectifying them in the original document.
English Summary
Facts
The plaintiff complained about factual inaccuracies in reports on his medical situation and possibilities for performing work in the context of granting a work benefit. He requested rectification of data in these reports. The defendant claimed it corrected the inaccuracies by issuing a new report but the plaintiff found this not sufficient since the inaccuracies remain in the initial reports and alleged violation of his right to rectification.
Dispute
The Court had to assess the way in which the rectification should be carried out by the defendant considering also its technical capacity.
Holding
The District Court invoked Article 24 and Recital 78 GDPR and concluded that data controllers must take appropriate technical and organisational measures that are necessary to ensure that the requirements of GDPR are met. It found that an additional report cannot be considered sufficient to fulfill the right to rectification. THe controller must use its best efforts to ensure that policies and systems are in line with the GDPR including transparent and clearly recognisable rectification of inaccuracies other than merely adding a document in a medical file.
The Court ordered the controller to investigate the possibilities of complying with the right to rectification within six weeks and notify the Court if it will make use of this opportunity within two weeks.
Comment
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
Authority
Court of the Central Netherlands
Date of pronunciation
29-05-2020
Date of publication
19-06-2020
Case number
AWB - 19 _ 1687
Jurisdictions
Social security law
Special features
First instance - multiple
Content indication
Interjection. It is insufficiently plausible that the method of rectification is in line with the right of rectification of Article 16 of the AVG.
Sites
Rechtspraak.nl
Enriched pronunciation
Ruling
CENTRAL COURT
Sitting place Utrecht
Administrative law
Case number: UTR 19/1687-T
interlocutory judgment of the multiple chamber of 29 May 2020 in the case between
[plaintiff] , at [residence] , plaintiff
and
the Management Board of the Institute for Employee Insurance Schemes, defendant
(Agent: Mr M.E. Butter).
Process sequence
By decision of 14 April 2014 (the primary decision), the defendant partially rejected the plaintiff's requests pursuant to Section 36(1) of the Personal Data Protection Act (Wbp).
By decision of 13 May 2016, the defendant declared the claimant's objection to this unfounded.
By decision of 6 March 2017, the District Court dismissed the claimant's appeal against this decision as unfounded.1
By decision of 25 July 2018 the Administrative Jurisdiction Division of the Council of State (ABRvS) upheld the appeal lodged by the plaintiff and partially annulled the decision of 13 May 2016.2
By decision of 15 March 2019 (the contested decision), the defendant again decided on the claimant's objection and upheld that objection.
The plaintiff lodged an appeal against the contested decision.
The defendant submitted a defence.
The hearing took place on 15 January 2020. The plaintiff has appeared. The defendant was represented by his agent.
Recitals
The legal framework is set out in an annex which forms part of this judgment.
What is this procedure about?
1. In the context of the granting of a WIA benefit (a benefit as referred to in the Work and Income according to Labour Capacity Act), investigations have taken place into the claimant's medical situation and possibilities for performing work. Reports and reports have been drawn up of this. A number of documents mention factual inaccuracies. For this reason, on 9 September 2013 and on 14 October 2013 the claimant requested the correction, addition and deletion of data in a medical report dated 9 February 2012 and in a medical report dated 22 August 2013. The defendant partially rejected the requests. As follows from the course of the proceedings, the ABRvS ultimately ruled on 25 July 2018 that the defendant must again decide on the objection, after which the defendant took the contested decision now before it. In summary, the plaintiff takes the position that also in that decision the defendant did not correctly apply its rights to information, access, opposition and correction.
What was the opinion of the ABRvS in its judgment?
2. The ABRvS concludes that the right of correction in article 36 of the Wbp applies to the mention of "rheumatoid arthritis" and "pain in the hands", even where this is repeated in later reports. The defendant and the District Court had not recognised this with regard to the "pain in the hands". Furthermore, the ABRvS is of the opinion that the defendant is not obliged to remove these entries from the report of the insurance doctor [A] ([A] ) of 9 February 2012 (and subsequent reports), because the defendant has made it plausible that the personal data have been recorded on a data carrier to which no changes can be made. However, the fact that the defendant could not suffice with how it rectified, by adding the report of insurance doctor W. Ebbelaar (Ebbelaar) of 11 April 2016, which states that 'rheumatoid arthritis' is a factual inaccuracy, without examining, in accordance with Section 36(4) of the Wbp, whether, with a small technical effort, a provision can be made to point out that these data are inaccurate to the person consulting the report of [A] and subsequent reports in which the 'rheumatoid arthritis' and 'pain in the hands' have been copied. Nor did the defendant examine whether it is possible to change the filename of the PDF/A document of the report of [A] and subsequent reports with repetitions of the same inaccuracy in the sense that, for example, '(note inaccuracy - see report dated 11-4-16)' is added to it.
The ABRvS instructed the defendant to take a new decision on appeal in compliance with its judgment and the General Data Protection Regulation (Avg), which entered into force on 25 May 2018, because the Wbp had lapsed on that date.
What is the relevant legal framework for this case?
3. At the time of the earlier decision by the defendant and its assessment by the ABRvS, the provisions of the Wbp applied. Article 36(3) of the Wbp read:
"The responsible party shall ensure that a decision to rectify, supplement, remove or shield is implemented as soon as possible".
The fourth paragraph reads:
"If the personal data are recorded on a storage medium to which no alterations can be made, he shall take the necessary measures to inform the user of the data about the impossibility of rectification, supplementation, deletion or blocking despite the fact that there are grounds for rectification, supplementation, deletion or blocking pursuant to this Article'.
4. On 25 May 2018, Regulation 2016/679 (General Data Protection Ordinance, hereinafter: AVG) and the AVG Implementing Act became applicable and the Wbp lapsed. This means that the defendant, as also considered by the ABRvS, had to take the new decision on objection in compliance with the AVG. In this case, the court will assess the contested decision against the AVG.
5. The relevant Article 16 of the AVG on the right to rectification and erasure of data reads as follows:
"The data subject has the right to obtain from the controller without delay the rectification of inaccurate personal data concerning him/her. With due regard for the purposes of processing, the data subject has the right to obtain completion of incomplete personal data, inter alia, by providing a supplementary statement'.
The court also considers relevant recital 78, which precedes the provisions of the AVG:
"(78) In order to protect the rights and freedoms of natural persons with regard to the processing of personal data, appropriate technical and organisational measures are needed to ensure compliance with the requirements of this Regulation. In order to demonstrate compliance with this Regulation, the controller should adopt internal policies and implement measures which comply in particular with data protection principles by design and data protection by default settings. Such measures may include minimising the processing of personal data, pseudonymising personal data as soon as possible, transparency of the functions and processing of personal data, enabling the data subject to control the information processing and enabling the controller to create and improve security features. When developing, designing, choosing and using applications, services and products which are based on the processing of personal data, or which process personal data in the performance of their tasks, the producers of the products, services and applications should be encouraged to take into account the right to the protection of personal data when developing and designing such products, services and applications and, taking into account the state of the art, to ensure that controllers and processors are able to comply with their data protection obligations. The principles of data protection by design and data protection by default settings should also be taken into account in public procurement'.
6. The District Court considers that no exception has been made in the AVG for personal data recorded on a data carrier to which no changes can be made. This is therefore different from the then applicable fourth paragraph of Section 36 of the Wbp.
Furthermore, the Court concludes from recital 78 of the AVG that the aim is for data controllers to take appropriate technical and organisational measures that are necessary to ensure that the requirements of this Regulation are met. This responsibility is laid down in Article 24 of the AVG.
How did the defendant correct the errors in the contested decision?
7. Subsequently, the defendant explained in the contested decision that the Document Information Provision (DIV) Department examined the possibility of alerting the user of a report containing inaccuracies in the Electronic Archive (EA) and Electronic Dossier (ED) to a correction. The outcome of this investigation is that this is not possible in the short term. Because the defendant considers it desirable that a provision be made to draw the attention of the user of the EA/ED to corrections, this is included in an ongoing project of DIV. Furthermore, the title of a document cannot be changed in the EA/ED because the title is the unique identifier of a document.
Therefore, the defendant deems the method of correction of the inaccuracy "rheumatoid arthritis" by Ebbelaar's supplementary report of 11 April 2016 sufficient to comply with the legal obligations. Furthermore, the defendant corrected the "pain in the hands" by adding a medical report of 28 August 2018 of insurance doctor's objection and appeal W. Ebbelaar. In that report, the following was considered:
"(...) The Report of [A] dated 9 February 2012 therefore wrongly mentions 'pain in the hands' on pg. 2 of 5 under the heading "Data obtained during a supplementary medical examination by the objection insurance doctor". By means of this report, the aforementioned phrase is corrected. The above correction also applies to the reports dated 10 April 2014 and 14 April 2014 drawn up by L.L.J. Looij, insurance doctor. (…)”
The defendant upheld the objection.
Why does the plaintiff consider these corrections insufficient?
8. The plaintiff has argued that the defendant cannot suffice with the introduction of loose inserts that only partially correct. The inaccuracies still remain in the relevant reports and advices while the presence of these is not pointed out. In doing so, the defendant is eroding the right of correction. In addition, the defendant has not demonstrated and substantiated that it is not technically possible to give an adequate warning on the file. Finally, the plaintiff argued that the defendant provided an open ending to the realization of the technical solution. This is not in accordance with the Avg. The defendant must be able to prove that data can be removed and corrected in a reliable manner. The relevant processing procedures must enable the defendant to prove this, according to the plaintiff.
What is the court's opinion on the contested decision?
9. That the "rheumatoid arthritis" and "pain in the hands" are claimants concerning incorrect personal data, of which she is entitled to immediate rectification by the defendant pursuant to Article 16 of the AVG, is not in dispute. What is in dispute, however, is the way in which this rectification should be carried out by the defendant and whether the defendant's investigation into the technical possibilities mentioned by the ABRvS is in accordance with the ABRvS' instructions.
The court is of the opinion that the defendant did not arrive at the contested decision with sufficient care on these two points of dispute. The court explains this below.
The method of rectifying the incorrect diagnosis of rheumatoid arthritis
10. The District Court is of the opinion that the conclusion in Ebbelaar's report cannot bear the content of the report. As considered above, the defendant corrected the factually incorrect diagnosis of "rheumatoid arthritis" by adding Ebbelaar's additional report of 11 April 2016 to plaintiff's medical file. Herein, under "6. Reconsideration" states that the diagnosis "rheumatoid arthritis" does not appear in any medical report or letter from a practitioner and is factually incorrect. In the conclusion of the report, however, this correction does not appear, as the claimant also argued. After all, the conclusion only states that there is no reason to correct medical reports and that the vision that the plaintiff has put forward at several points in the course of the years and is therefore also contained in the medical file is sufficient and provides a clear picture of the medical facts complex.
11. Because the conclusion of the report of 11 April 2016 does not follow logically from the rectification of a medical fact included in the report, the contested decision was prepared carelessly. At the hearing, the defendant stated, upon request, that the conclusion still had to be rectified. This means that the defendant has already failed to comply with its duty as data processor to rectify without delay as referred to in Section 16 of the Data Protection Act. Pursuant to Section 16 of the Data Protection Act, the defendant should in any event have the conclusion adjusted, so that it is clear from this that the diagnosis 'rheumatoid arthritis' is factually incorrect. This careless preparation constitutes a violation of Article 3:2 of the General Administrative Law Act (Awb). At the end of this judgment, the court explains what must be the result of this.
The method of rectification of the incorrect statement "pain in the hands"
12. As regards the erroneous reference to 'pain in the hands' in Van der Broeke's report of February 2012 and repeated in subsequent reports, the defendant referred in the contested decision to Ebbelaar's supplementary report of 28 August 2018. It is stated in the heading of that document: Medical report in appeal proceedings. Furthermore, under the heading '3. Reconsideration / Consideration' the following is stated:
The report of [A] dated 9-2-2012 therefore wrongly mentions 'pain in the hands' on pg. 2 of 5 under the heading 'Data obtained during a supplementary medical examination by an objection insurance doctor'. By means of this report, the said phrase is corrected.
The above correction also applies to the reports dated 10-4-2014 and 14-4-2014 drawn up by L.L.J. Looij, insurance physician.
Also with regard to this rectification, the defendant takes the view that the investigation order of the ABRvS has been complied with and that the investigation has shown that it will not be possible in the short term, with a small technical effort, to make a provision alerting persons consulting the medical file to factual inaccuracies in earlier reports.
13. The District Court is of the opinion that the intended rectification in the supplementary report is clear. It is clear what is inaccurate, in which reports the inaccuracy is stated and what the conclusion is; in the reports mentioned, 'pain in the hands' was wrongly mentioned. However, the District Court follows plaintiff in its argument that although the intended rectification is clear when the supplementary report is consulted, it is questionable whether this is in accordance with the right of rectification guaranteed in Article 16 of the AVG. After all, when the plaintiff's medical file with the defendant is consulted, it is not immediately clear that there are (or have been) factual inaccuracies in reports. The additional report from which this may be apparent has been added to the file as one of the documents. It may therefore happen that (authorized persons) take note of the reports in which the factual inaccuracies are (still) mentioned, without being informed of any subsequent correction. In order to assess whether the method of rectification is in accordance with Article 16 of the AVG, the court will successively discuss the investigation carried out by the defendant, the value of the results of that investigation and their significance in the light of the right of rectification of Article 16 of the AVG.
The meaning of the investigation into the technical and organizational possibilities
13.1
Prior to the hearing, the defendant did not submit any documents relating to its investigation into the various possibilities for applying the right of rectification set out in Article 16 of the General Assembly. It appears from the presentation on the right of rectification3 submitted at the hearing (the presentation) that, following the ruling of the ABRvS, DIV carried out an investigation into the question of whether it is possible, in a technically relatively simple manner, to create a possibility in the digital archive to indicate that an original included in the EA has been corrected on the grounds of the right of those concerned to rectification.
DIV states that it has investigated the modification of the document title, adding a new status to a document, assigning a different classification, deleting an authorisation on a document, adding a cover page with the text 'erroneous report' to an existing document and modifying the document title of a document in the EA. All these options are not technically feasible according to DIV, with the exception of adding a header page. However, according to DIV, adding a cover page results in forgery of history, so that the possibility of correcting a document by the defendant is also excluded. DIV does, however, see a solution in the long term by developing such a functionality within the EA domain.
13.2
At the hearing, the defendant stated that, contrary to what was stated in the contested decision and suggested by DIV's presentation, this solution would not be found in the long term either, as it would entail excessive implementation costs. According to the defendant, it follows from the investigation that insurance doctor's reports can only be corrected by adding a sheet/report to the medical file, not to the inaccurate report in question. This is also the method of correction applied in the plaintiff's situation.
13.3
The District Court is of the opinion that by submitting the presentation, the defendant insufficiently substantiated what investigation was carried out and what that investigation consisted of. The presentation is a brief summary of the results of the investigation, but does not represent or provide an insight into the investigation itself. The defendant did not provide sufficient insight into the investigation into the technical possibilities to apply the right of rectification and, in the District Court's opinion, carried out the investigation too restrictively. This also applies to its assertion at the hearing that a solution to the problem identified by the plaintiff when correcting with an additional report will not be found in the long term, because the costs of implementation are too high.
13.4
In view of the available information, the District Court can imagine that in order to implement Article 16 of the AVG it must be possible to add a fixed 'header' to the claimant's medical file containing inaccuracies. By 'header' the court means a header on each page of the report concerned in which the reader is alerted to an inaccuracy therein.
Adding a cover page to the reports in which a factual inaccuracy is mentioned also seems to be a technically simple and inexpensive option. By a cover page, the court means a page that appears first when a report is opened and on which it is noted that and on which date the report was rectified. To the extent that the defendant believes that adding a cover page would lead to a forgery of history, the defendant should have explained and substantiated why it is not possible to make this possible forgery of history comprehensible so that it does not have the character of a forgery but of the rectification envisaged here.
13.5
In this respect, the District Court considers it important that, as was considered in legal consideration 3, an exception was included under Section 36(4) of the Personal Data Protection Act (Wbp) for the situation that personal data had been recorded on a data carrier to which no changes could be made. Article 16 of the Avg does not provide for such an exception. In other words, by no longer maintaining the aforementioned exception, there seems to be a heavier obligation on the defendant to make sure that technical possibilities are created in this case to comply with the AVG.
13.6
In addition, the Court considers the aforementioned recital 78 of the AVG, as elaborated in Article 24 of the AVG, to be important. It seems to follow from this that the defendant, as controller or processor, may, to a certain extent, require the producer referred to in recital 78 of the AVG to have applications in order to comply with its data protection obligations. In addition, the defendant must make policy and take measures to demonstrate compliance with the AVG. It follows from this that the defendant has an obligation to use his best efforts to ensure that policies and systems are in line with the requirements of the AVG, in the opinion of the court, which includes a transparent and clearly recognisable rectification of inaccuracies other than merely adding an additional document in a medical file.
13.7
The District Court concludes that it is insufficiently plausible that the method of rectification is in accordance with the right of rectification of Article 16 of the GCG in view of the intended responsibility of the defendant as controller or processor. The Respondent did not make the investigation sufficiently transparent, insufficiently substantiated and, in view of its responsibility, possibly carried out too limitedly. This ground for appeal by the claimant is successful. At the end of this judgment, the court will explain what this should lead to.
13.8
For the sake of completeness, the District Court notes that apart from what has been ruled in paragraphs 10 and 11, the above about the investigation into technical possibilities also applies to the rectification of the factually incorrect diagnosis of rheumatoid arthritis".
14. Finally, the District Court is of the opinion that the contested decision is partly incorrect because the defendant states in it that work is to be carried out on a system that will draw the attention of the user of EA and ED to rectifications, whereas the defendant stated at the hearing that no work will be carried out on this because it is too expensive.
What does this mean for the contested decision?
15. The court concludes that the contested decision is flawed. In view of the above, the District Court sees reason to apply Section 8:51a(1) of the General Administrative Law Act (Awb), in which the defendant is given the opportunity to rectify the defects identified in paragraphs 11 and 13 to 13.8 above. Such rectification can only take place by means of a new decision on objection, after or at the same time as revoking the contested decision.
In order to remedy the defect, the defendant must comply with this judgment:
- examine the possibilities of applying the right of rectification as described in Article 16 of the General Assembly;
- clarify the investigation it is carrying out in that regard;
- apply the outcome of the investigation to the defects found.
For the sake of completeness, the court notes that the plaintiff pointed out other factual inaccuracies in her notice of appeal in addition to the points discussed in this judgment. In view of the ABRvS' decision on the appeal against the earlier decision on objection, the District Court is of the opinion that these points no longer form part of these proceedings.
The District Court stipulates that the time limit for the defendant to rectify the defect is six weeks from the date of dispatch of this interlocutory judgment.
16. Pursuant to Section 8:51b(1) of the Awb and in order to avoid unnecessary delay, the defendant must inform the Court as soon as possible, but at the latest within two weeks, whether it will make use of the opportunity to repair the defect. If the respondent makes use of that opportunity, the court will give the plaintiff the opportunity to respond within six weeks to the respondent's attempt at rectification. In principle, even in the situation where the defendant allows the recovery period to expire unused, the court will rule on the appeal without a second hearing.
17. The proceedings as conducted after this interlocutory decision are in principle limited to the grounds of appeal as discussed in this interlocutory decision, because the introduction of new points of dispute is generally considered to be contrary to the proper procedural order. The District Court refers to the judgment of the ABRvS of 12 June 2013.4
18. The District Court reserves any further decision until the final decision on the appeal. The latter also means that it will not yet decide on the costs of the proceedings and the court registry.
Decision
The court:
- orders the defendant to inform the court within two weeks whether he makes use of the opportunity to repair the defects;
- gives the defendant the opportunity to rectify the defects within six weeks after this interlocutory judgment has been sent, taking into account the considerations and directions in this interlocutory judgment;
- reserves any further decision.
This judgment was rendered on 29 May 2020 by V.E. van der Does, chairman, and L.A. Banga and J.L.W. Broeksteeg, members, in the presence of L.M. Janssens-Kleijn, Registrar.
As a result of measures surrounding the Coronavirus, this judgment was not pronounced at a public verdict hearing. As soon as public pronouncement is possible again, this decision will, insofar as necessary, still be pronounced in public.
The chairman is prevented from pronouncing it in public.
interlocutory agreement to sign
registrar president
Copy sent to parties on:
Legal remedy
This interlocutory judgment is not yet subject to appeal. An appeal may be lodged against this interlocutory judgment at the same time as an appeal against the (possible) final judgment in this case.
Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
Article 4
For the purposes of this Regulation, the following definitions shall apply:
[…];
(7) 'controller' means a natural or legal person, a public authority, a service or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of such processing are laid down in Union or Member State law, it may specify the controller or the criteria for designating the controller;
Article 16 Right of rectification
The data subject shall have the right to obtain from the controller without delay the rectification of inaccurate personal data concerning him/her. With due regard for the purposes of processing, the data subject shall have the right to obtain completion of incomplete personal data, including by providing a supplementary statement.
Article 19 Obligation to notify rectification or erasure of personal data or processing restrictions
The controller shall inform any recipient to whom personal data have been disclosed of any rectification or erasure of personal data or restriction of processing in accordance with Articles 16, 17(1) and 18, unless this proves impossible or involves a disproportionate effort. The controller shall provide the data subject with information about those recipients if the data subject so requests.
Article 24 Responsibility of the controller
1. Having regard to the nature, extent, context and purpose of the processing operation and the varying degrees of likelihood and seriousness of the risks to the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and demonstrate that the processing is carried out in accordance with this Regulation. Those measures shall be reviewed and, where necessary, updated.
2. Where proportionate to the processing activities, the measures referred to in paragraph 1 shall include appropriate data protection policies implemented by the controller.
3. Alignment with approved codes of conduct referred to in Article 40 or approved certification mechanisms referred to in Article 42 may be used as an element to demonstrate compliance with the obligations of the controller.
Personal Data Protection Act, valid until 25 May 2018.
Article 36
1. The person to whom personal data relating to him or her have been disclosed in accordance with Article 35 may request the controller to correct, supplement, delete or block such personal data if they are factually inaccurate, incomplete or irrelevant for the purpose or purposes of the processing or are otherwise processed in breach of a legal requirement. The request shall contain the changes to be made.
2. The responsible party shall notify the applicant in writing within four weeks of receipt of the request whether or to what extent he complies with the request. A refusal shall state the reasons on which it is based.
3. The person responsible shall ensure that a decision to rectify, supplement, remove or block an application is implemented as soon as possible.
4. If the personal data have been recorded on a data carrier to which no alterations can be made, he shall take the necessary measures to inform the user of the data about the impossibility of rectification, supplementation, deletion or blocking, despite the fact that there are grounds for rectification, supplementation, deletion or blocking pursuant to this Article.
5. The provisions of the first to fourth paragraphs do not apply to public registers established by law, if a special procedure for correcting, supplementing, deleting or blocking data is provided for in that law.
