RvS - 201905087/1/A2
From GDPRhub
| RvS - 201905087/1/A2 | |
|---|---|
 | |
| Court: | RvS (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 6(1)(f) GDPR Article 82 GDPR |
| Decided: | 1. 4. 2020 |
| Published: | |
| Parties: | Unknown |
| National Case Number/Name: | 201905087/1/A2 |
| European Case Law Identifier: | ECLI:NL:RVS:2020:899 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Dutch |
| Original Source: | de Rechtspraak (in Dutch) |
| Initial Contributor: | n/a |
On 1 April 2020, the Council of State rejected the claim of the plaintiff asking for damages for violation of the GDPR by the local authorities considering the lack of prove of an actual damage caused by the lack of information under the GDPR. To be compensated, claimant must be able to prove that the damage is real and certain.
English Summary
Facts
The Dutch Council of State ruled on a claim for damages filed by a citizen whose data (name and address) were communicated via email between local authorities. This communication was intended to exchange data between municipalities to prevent abuse of the Public Administration Act when several requests for access to documents were made by the same applicant.
Dispute
The Council of State had to determine whether the processing of information by the local authorities had a legal ground under Article 6 of the GDPR, and whether such a violation would entitle the claimant to a compensation for moral damage.
Holding
The lower court already recognized that the communication of the residence of the applicant was violating the principle of data minimization.
However, regarding the claim for damages, the CoS notes that though Article 82(1) of the GDPR states that full compensation for actual non-material damage resulting from breaches of the GDPR must take place in a manner that does justice to the objectives of the Regulation, the GDPR does not specify how the non-material damage is to be determined and calculated. However, the Court of Justice has consistently held that the damage to be compensated must be real and certain.
In this case, the CoS considers that the appellant does not bring the prove of his/her actual damage caused by the violation.
The fact that an infringement of the AVG may result in material or immaterial damage and that a person concerned must receive full and actual compensation for the damage he has suffered does not mean that a breach of the AVG by definition results in damage and that damage must not have been 'real and certain'.
Comment
Add your comment here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
201905087/1/A2. Date of judgment: 1 April 2020 SECTION ADMINISTRATIVE LAW Ruling on the appeals of: 1. the Municipal Executive of Deventer, 2. [appellant sub 2] appellants, against the judgment of the District Court of Overijssel of 28 May 2019 in Case No 18/2047 in the proceedings between: [appellant under 2] and the college. Process flow By judgment of 28 May 2019, the court ordered the Municipal Executive to pay damages of € 500.00 to [appellant sub 2] pursuant to Section 8:88(1) of the General Administrative Law Act (Awb). The court also upheld [the appellant under 2]'s appeal against the decision of 26 September 2018 and annulled the decision, on the grounds that it did not award any compensation to [the appellant under 2]. This judgment is attached. The Board of Appeal has lodged an appeal against this decision. The Board of Appeal has lodged an appeal against this decision. [Appellant sub 2] gave a written explanation and lodged an incidental appeal. The Division heard the case on 15 January 2019, where the Board, represented by W.J.R. Krol and L. Schieving, and [appellant under 2], represented by [agent], appeared. Recitals 1. At the end of this judgment (under 41), the Division will indicate what this judgment means more generally and what will be decided in this case. Applicable law 2. On 25 May 2018, Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (the General Data Protection Regulation, hereinafter AVG) became applicable. The AVG is directly applicable in each Member State (Article 99(3) of the AVG). The Personal Data Protection Act (Wbp) was repealed on 25 May 2018. The AVG has immediate effect and does not contain any transitional law for the processing of a claim for compensation under Article 82 of the AVG. The transitional law set out in Section 48(10) of the AVG Implementation Act does not apply in this case. 3. The AVG applies to the claim for damages. On 26 October 2018, i.e. after the AVG came into effect, [appellant sub 2] requested the court to order the Municipal Executive to pay damages. 4. Article 82 of the AVG reads as follows: 1. Any person who has suffered material or non-material damage as a result of a breach of this Regulation shall be entitled to receive compensation from the controller or processor for the damage suffered. 2. Any controller involved in processing shall be liable for any damage caused by processing operations in breach of this Regulation. A processor shall be liable for damage caused by processing only where the processing operations fail to comply with the obligations of this Regulation addressed specifically to processors or were carried out outside or in breach of the lawful instructions of the controller. History 5. On 27 July 2017, pursuant to Section 35 of the Personal Data Protection Act, [Appellant sub 2] requested the Board to provide him with an understandable and complete overview of his personal data processed, including a description of the purpose(s) of the processing and a list of all recipients. 6. By decision of 24 August 2017, the Municipal Executive provided an overview of personal data processed in the postal registration system of the municipality of Deventer. The Municipal Executive also stated that it had placed no personal data on the forum of the Association of Netherlands Municipalities (VNG) and to that extent had not processed any personal data. 7. In its objection, [the appellant under 2] argued that the Board had not complied in full with the request for inspection. To this end, he stated that, on 20 August 2013, an official of the municipal council had sent an e-mail to other municipal councils containing personal data belonging to [the appellant, sub 2] in response to requests made by [the appellant, sub 2]. This e-mail was not part of the summary of personal data processed provided to him. 8. By decision of 19 January 2018, the Board declared the objection unfounded. 9. In its decision of 18 July 2018, the court ruled that the e-mail dated 20 August 2013 contained personal details of [appellant sub 2] (name and place of residence). The court ruled in its ruling of 18 July 2018 that the e-mail of 20 August 2013 [appellant under 2] (name and place of residence) contained the personal details of [the appellant under 2] (name and place of residence), and that [the appellant under 2] did not consent to the forwarding of his personal details as referred to in Article 8(a) of the Wbp. The Board did not substantiate that the data processing was necessary for the proper performance of a duty under public law. According to the District Court, the Board could have informed the other administrative bodies without mentioning the name and place of residence of [appellant under 2]. With the forwarding of the personal data, the Municipal Executive violated the principles of proportionality and subsidiarity, according to the District Court. The District Court upheld the appeal, annulled the decision of 19 January 2018 and instructed the Board to take a new decision on the appeal. In doing so, the Board must consider the question to what extent there are grounds [appellant sub 2] to award damages. 10. By decision of 26 September 2018, the Board upheld the objection to the decision of 24 August 2017 and revoked the decision. The Board rejected [the appellant's application for compensation under 2]. Judgment of the District Court of 28 May 2019 11. The court considered that the decision of 19 January 2018 was set aside on grounds of unlawfulness in the judgment of 18 July 2018. The Municipal Executive has not lodged an appeal against that decision, so that this judgment is legally certain. The dispute on appeal is limited to the question whether [appellant sub 2] can claim immaterial damages, according to the court. 12. In the opinion of the District Court, the application of article 82 of the AVG does not affect the fact that, in order to be awarded damages, a connection may and must be sought with the Dutch legal system. Title 8.4 of the General Administrative Law Act (Awb) and the case law of the highest Dutch administrative courts - based on civil compensation law - provide a sufficient basis for the administrative court to decide on the request for compensation from [appellant under 2]. 13. In the opinion of the court, [appellant sub 2] has been affected by the unlawful decision in his person, because he has lost control of his personal data. According to the District Court, [appellant sub 2] is entitled to damages to be determined on the basis of Article 82 of the AVG in conjunction with Article 6:106 of the BW. In determining the amount of this compensation, the court considered it important that the unlawful decision did not provide any justification for the processing of [appellant sub 2]'s personal data. The court also referred to recitals 75, 85 and 146 of the preamble to the AVG. 14. The court ordered the College to pay compensation of € 500.00 to [appellant sub 2] as non-material damage. Appeals of the Municipal Executive 15. The Municipal Executive argued on appeal that the Court had failed to recognise that there was no causal link between the unlawful decision of 19 January 2018 and the alleged damage. The loss of control over his personal data alleged by [the appellant under 2] was due to the dispatch of the e-mail dated 20 August 2013 and not to the decision of 19 January 2018, which did not fully comply with [the appellant under 2]'s request to provide a summary of the personal data he had processed. The sending of the e-mail is a factual act and should be distinguished from the wrongful failure to report its transmission. In view of Section 8:88 of the General Administrative Law Act (Awb), the administrative court has no jurisdiction to adjudicate on damages resulting from actual acts. In this respect, the Municipal Executive refers to the judgment of the District Court of Rotterdam of 27 May 2019, ECLI:NL:RBROT:2019:4265, and a judgment of the District Court of Central Netherlands of 15 November 2019, ECLI:NL:RBMNE:2019:5430. 16. The Municipal Executive further argued that, in the event that the Division did consider the District Court competent to rule on the application for damages, the District Court had incorrectly applied Section 6:106 of the Dutch Civil Code (BW). In this respect, the Board refers to the judgment of the Supreme Court of 19 July 2019, ECLI:NL:HR:2019:376, from which it follows that the person who invokes impairment must substantiate this with concrete data. In the e-mail dated 20 August 2013, only the name of [appellant under 2] and his place of residence were mentioned, and 44 officials were informed of the fact that [appellant under 2] had submitted two Wob applications to the municipality of Deventer. The e-mail of 20 August 2013 did not specify the substance of these requests and merely described how these requests had been dealt with internally. According to the Municipal Executive, [the appellant under 2] did not make it plausible that the adverse consequences of these requests were so obvious that they could be assumed to have an adverse effect on the person concerned. Occasional appeal by [appellant sub 2] 17. 17. [Appellant under 2] argued on appeal that the compensation of € 500 awarded by the court did not do sufficient justice to the wording and purport of the AVG. The Board shared his personal details (name and place of residence) without permission or basis in the e-mail of 20 August 2013. By doing so, the Municipal Executive has declared his personal data 'outlawed'. Contrary to what the court has considered, the damages under these circumstances are insufficiently fair. [Appellant under 2] considered the €7,500 award reasonable, given the broad definition of damage under the AVG. Compensation of € 500.00 is not a sufficient deterrent for an administrative body not to proceed with unlawful data processing. The judgment of the Supreme Court of 15 March 2019, ECLI:NL:HR:2019:37, to which the Supreme Court refers in its judgment of 19 July 2019, has only limited significance for this case. It is true that in this judgment the Supreme Court interprets Section 6:106 of the Dutch Civil Code, but this judgment does not contain any reference to the AVG, according to [appellant sub 2]. Judgment of the Division Article 8:88 Awb 18. The Board has not lodged an appeal against the court's decision of 18 July 2018. In that decision, the District Court ruled that the decision of 19 January 2018 was unlawful and annulled it. To this end, the court considered that the Board [appellant sub 2] provided incomplete information about the provision of his personal data in the e-mail of 20 August 2013. In addition, the court expressly ruled, without reservation, that the provision of personal data was unlawful. Since the court's ruling of 18 July 2018 has acquired authority of res judicata, that ruling can no longer be called into question in these proceedings. As a result, the unlawfulness of the decision of 19 January 2018 must be assumed. Contrary to the opinion of the Municipal Executive, this also means that, for this reason alone, the District Court had jurisdiction to rule on the application for damages made by [appellant sub 2] pursuant to Section 8:88(1) and (a) of the General Administrative Law Act. 19. In addition, as considered by the Division in today's judgments with numbers ECLI:NL:RVS:2020:898, ECLI:NL:RVS:2020:900 and ECLI:NL:RVS:2020:901, the administrative court is competent to rule on a claim for damages pursuant to Section 8:88 of the General Administrative Law Act in cases where the alleged loss is related to a decision as referred to in Section 34 of the AVG Implementation Act. Ex officio opinion 20. In his notice of appeal and the accompanying supplementary information, [appellant sub 2] requested the court to order the Board to pay damages for wrongful acts. On the basis of Article 8:88 of the General Administrative Law Act, the court assessed whether [the appellant under 2] was entitled to compensation. However, the Court did not acknowledge that with the introduction of Title 8.4 in the Awb on the grounds of Article 8:4(1)(f) of the Awb, the possibility to appeal against a decision regarding compensation for loss as a result of wrongful acts of management has lapsed. It follows from this that the District Court wrongly annulled the decision of 26 September 2018 in so far as the Board [appellant under 2] did not award any compensation. To that extent, the District Court's decision qualifies for annulment. The District Court should have regarded the appeal lodged with it as a request addressed to it to order the Board to pay damages. Assessment of application of Section 6:106 of the Civil Code by the District Court 21. Although Article 82(1) of the AVG provides that full compensation for actual non-material damage resulting from infringements of the AVG must be made in a manner that does justice to the objectives of the Regulation, the AVG does not specify how the non-material damage is to be determined and calculated. The Court of Justice has consistently held that, in the absence of Community rules, it is for the domestic legal order of each Member State to determine the rules governing the exercise of the right to compensation, subject to compliance with the principles of equivalence and effectiveness (see Manfredi judgment, paragraph 64). However, recital 146 in the preamble to the AVG must be taken into account when exercising the right to compensation laid down in Article 82 of the AVG. This states, inter alia, that the controller or processor must compensate any damage which a person may suffer as a result of a processing operation infringing this Regulation. The concept of damage should be interpreted broadly in the light of the case law of the Court of Justice of the European Union, in a way that fully meets the objectives of this Regulation. It is also stated that data subjects should receive full and effective compensation for any damage suffered by them. 22. The Court of Justice has not yet provided any explanation specifically on the concept of damages or on the compensable immaterial damages in case of unlawful processing of personal data, including under the (repealed) Privacy Directive (Directive 95/46/EC). However, the Court of Justice has consistently held that the damage to be compensated must be real and certain (see judgment of the Court of Justice of 4 April 2017, ECLI:EU:C:2017:256, paragraph 91, C- 337/15 P, European Ombudsman v. Staelen, ECLI:EU:C:2017:256, paragraph 91). 23. In the light of the abovementioned case-law of the Court of Justice and Article 146 in the preamble, national law is therefore relevant in determining whether the alleged damage is eligible for compensation. 24. According to the settled case law of the Division (see, for example, ECLI:NL:RVS:2010:BN4952 of 25 August 2010), the assessment of an application for compensation for non-material damage is based on a connection with civil compensation law. 25. Article 6:106 of the Dutch Civil Code reads: For damage that does not consist of pecuniary loss, the injured party is entitled to compensation to be determined in accordance with fairness: […] b. if the injured party has suffered bodily injury, damage to his honour or good name or any other harm to his person; […]" 26. The impairment referred to in Section 6:106(1)(b) of the Civil Code in person 'otherwise' shall in any case be deemed to have occurred if the injured party has suffered mental injury. The party who invokes this will have to provide sufficient concrete data from which it can be deduced that psychological damage has occurred in connection with the circumstances of the case. This requires that the existence of mental injury can be established according to objective standards. Even if the existence of mental injury in the aforementioned sense cannot be assumed, it cannot be excluded that the nature and seriousness of the breach of the standards and of the consequences thereof for the injured party will mean that the impairment referred to in Section 6:106, opening words and under b, of the Civil Code is present in his person 'in a different way'. In such a case, the party invoking this will have to substantiate the impairment in his person with concrete data. This will only be different if the nature and seriousness of the breach of the standards imply that the relevant adverse consequences for the injured party are so obvious that an impairment in the person can be assumed. An impairment in the person 'in any other way' as referred to in Section 6:106, opening words and under b, of the Civil Code does not already exist in the case of the mere violation of a fundamental right. (See the judgments of the Supreme Court of 15 March 2019, ECLI:NL:HR:2019:376, paragraph 4.2.2, of 28 May 2019, ECLI:NL:HR:2019:793, paragraph 2.4.5, and of 19 July 2019, ECLI:NL:HR:2019:1278, paragraph 2.13.2). 27. The Section is of the opinion that the framework outlined under 26 can meet the requirements of the AVG and the case law of the Court of Justice as outlined under 21. 28. 28. [appellant sub 2] did not state that he suffered mental injury as a result of the unlawful conduct of the Municipal Executive, which can be established on objective grounds. 29. According to [appellant sub 2], the immaterial damage consists of the infringement of the law as such, which must be regarded as affecting the person within the meaning of Section 6:106(1)(b) of the Civil Code. He argues that he therefore claims damages to be determined on an equitable basis. 30. The Municipal Executive disputes that the nature and seriousness of the breach of the standards are such that immaterial damage has arisen as a result. According to the Municipal Executive, [appellant sub 2] did not substantiate this with concrete data either. Assessment 31. The loss of control over personal data is an attack on a right to personality. Everyone has the right to the protection and accurate and lawful processing of personal data concerning him or her (see, inter alia, Article 8(1), Charter of Fundamental Rights of the European Union). 32. As stated in Section 18 above, it follows from the Court's judgment of 18 July 2018, which has acquired authority of res judicata, that the provision of personal data of [the appellant under 2] by e-mail dated 20 August 2013 must be regarded as unlawful. 33. [appellant sub 2] cannot be followed in his argument that the Supreme Court's judgment of 15 March 2019 has no significance for the assessment of a request for compensation for non-material damage, because that judgment does not address the question of whether non-material damage qualifies for compensation under the AVG. The general principle that damage must be substantiated also applies here. There is no ground for the opinion that an infringement of the AVG simply implies an attack on the integrity of a person and therefore leads to compensable damage. Contrary to what [appellant sub 2] argues, this cannot be deduced from recitals 85 and 146 of the AVG. The fact that a breach of personal data can result in (im)material damage and that a data subject must receive full and actual compensation for the damage he has suffered does not mean that a breach of the standards by definition results in damage and that damage must not have been suffered in a real and certain manner. Compare ECJ EU 6 November 2012, C-199/11, ECLI:EU:C:2012:684, (Otis) and ECJ EU 4 April 2017, C-337/15, ECLI:EU:C:2017:256 (European Ombudsman). 34. In the present case, there is no situation where the adverse consequences of the breach of the standards are obvious. The mention of a name in response to a question from another municipality in the context of Wob requests is not comparable to the situation which led to the judgments of the Supreme Court of 18 March 2005, ECLI:NL:HR:2005:AR5213 (Baby Kelly) and of 9 July 2004, ECLI:NL:HR:2004:AO7721 (Groninger Oudejaarsrellen). This is not serious culpable behaviour with such serious consequences that it should be qualified as an infringement of a fundamental right. 35. In so far as [appellant sub 2] argues in support of his argument that compensation under the AVG is punitive in nature, it is important that this case concerns the possibility of obtaining compensation for (im)material damage as a result of incorrect culpable conduct. The purpose of compensation is to repair or offer compensation for an unlawful invasion of privacy. The imposition of a punitive sanction as a fine that must be distinguished from it is not at issue here and is intended to add suffering to the violator of the violated standard. Contrary to what [appellant sub 2] argues, recital 146 of the AVG does not state that compensation must be effective and 'sufficiently deterrent'. Recital 146 states that damages resulting from unlawful processing of personal data must be actually and fully compensated. It cannot be inferred from this that, in the event of an infringement of the AVG, there is an obligation to award damages that go beyond full compensation for the actual damage suffered (compare the judgment of the Court of Justice of 17 December 2015, ECLI:EU:C:2015:831). 36. The starting point is therefore that [the appellant under 2] must make a plausible case for the harm suffered by him and substantiate the damage alleged by him with concrete evidence. Prior to the hearing on appeal, the Division asked [appellant sub 2] to specify and substantiate the loss alleged by him. 37. The Board rightly argued that [the appellant under 2] had not submitted any concrete evidence in support of his claim for damages. He has not made it plausible that the infringement resulted in the impairment of the integrity of his person and that the consequences of the infringement directly affected him. The appellant did not explain why mentioning his name and place of residence in the notice that he had submitted two unspecified Wob requests in response to a request from another municipality could be regarded as an infringement of the person's integrity. Nor did he make it plausible what adverse consequences the naming of his name and place of residence would have for him. The mere assertion made by [appellant under 2] that mentioning his name had a stigmatising effect is insufficient. The same applies to his assertion that the entire administration of the Netherlands was able to take note of his personal data. The data was shared with municipal officials who, by virtue of their position, are involved in the processing of Wob requests. There are no indications that the data has been misused. Conclusion 38. The appeal by [appellant under 2] is unfounded. The Board's appeal is well-founded. The decision of the court, in which the court orders the Board to pay damages, is quashed. The Division will declare that the District Court still has no jurisdiction to hear the appeal against the decision of 26 September 2018, to the extent that a decision was made on the request for compensation made by [appellant sub 2]. 39. In doing what the court should do, the Division will reject [the appellant's application for compensation under 2]. 40. There are no grounds for an order to pay the costs of the proceedings. Briefly, what does this judgment entail? 41. In this judgment and more extensively in three other judgments delivered today, the Division discusses the possibilities of claiming compensation for damages before the administrative courts if someone claims that an administrative body has processed personal data in violation of the applicable privacy legislation (since 25 May 2018 the General Data Protection Regulation (AVG) and the AVG Implementation Act). Before the AVG and the AVG Implementation Act entered into force, the case law of the Division offered fewer possibilities, which meant that the citizen was then directed to the civil courts. This route remains open, but in a larger number of cases the administrative court can now also be approached for requests for compensation up to € 25,000, as is evident from the other three judgments. In this case, the power of the administrative court to decide on the application for damages has been explained in particular under 18. This concerns a procedural question of legal protection, i.e. when, in case of unlawful processing of personal data, the administrative court can be approached. In terms of content, the Division then decides that in order to be eligible for compensation, the requirements of Section 6:106 of the Civil Code must be met. For these cases, this means that the honour or good name of the person concerned must be affected, or that the person must be affected in some other way. In this respect, the Division is in line with the case law of the Supreme Court. In this case the Division decides, unlike the District Court, that [appellant sub 2] cannot claim compensation. The Division ruled that [the appellant under 2] did not demonstrate with concrete data that he had been adversely affected by the processing of personal data, which in this case must be regarded as unlawful, that the consequences of the infringement had directly affected him. Decision The Administrative Jurisdiction Division of the Council of State: I. dismisses [appellant sub 2]'s appeal as unfounded; II. declares the appeal of the Municipal Executive of Deventer well-founded; III. sets aside the judgment of the District Court of Overijssel of 28 May 2019 in case no. 18/2047; IV. declares that the District Court has no jurisdiction to hear the appeal against the decision of 26 September 2018, to the extent that a decision was made on the application for compensation made by [appellant under 2]; V. dismisses the claim for damages. Thus determined by J.E.M. Polak, chairman, and E.A. Minderhoud and E.J. Daalder, members, in the presence of M.A.E. Planken, registrar. The chairman is prevented from signing the decision. The Registrar is prevented from signing the decision. Pronounced in public on 1 April 2020 299. Annex Article 146 in the preamble to the AVG: The controller or processor must make good any damage which a person may suffer as a result of processing operations in breach of this Regulation. The controller or processor should be exempted from his liability if he proves that he is not responsible for the damage. The concept of 'damage' should be interpreted broadly in the light of the case-law of the Court of Justice in a manner which is fully in line with the objectives of this Regulation. This is without prejudice to any claims for damages for breach of other rules of Union or national law. Processing in breach of this Regulation should also include processing in breach of delegated and implementing acts adopted pursuant to this Regulation as well as Member State law specifying rules contained in this Regulation. Data subjects should receive full and effective compensation for any damage suffered by them. Where controllers or processors are involved in the same processing operation, they should each be held liable for the full damage suffered. However, where, in accordance with Member State law, they are joined in the same legal proceedings, each controller or processor may bear part of the compensation in accordance with his or her share of responsibility for the damage caused by the processing, provided that the data subject who has suffered damage is fully and effectively compensated. Any controller or processor who has paid the full compensation may subsequently bring an action for recourse against other controllers or processors involved in the same processing operation.
