RvS - 201902925/1/A3
From GDPRhub
| RvS - 201902925/1/A3 | |
|---|---|
 | |
| Court: | RvS (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 5(1)(b) GDPR Article 6(4) GDPR Article 17(3)(e) GDPR |
| Decided: | 30.09.2020 |
| Published: | 30.09.2020 |
| Parties: | Het college van burgemeester en wethouders van Bladel |
| National Case Number/Name: | 201902925/1/A3 |
| European Case Law Identifier: | ECLI:NL:RVS:2020:2316 |
| Appeal from: | Rechtbank Oost-Brabant 18/2806 |
| Appeal to: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | De Rechtspraak (in Dutch) |
| Initial Contributor: | n/a |
The Council of State (RvS ) upheld the appeal against the decisions of the Court of First Instance and the local authorities of Bladel regarding a complainant's request for erasure. The authorities of Bladel did not have a legal basis for processing appellant's data; in particular, they failed to demonstrate compatibility of purposes under Article 6(4) GDPR.
English Summary
Facts
Appellant's personal data was shared in a document that was available to several Dutch animal protection authorities in the context of a nation-wide action day against rouge dog trafficking. The authorities of Bladel rejected her request for erasure. The Appellant went to court, arguing, among other, that the authorities had no legal basis for processing her data. The Court of First Instance of Eastern Brabant ruled that the local authority of Bladel was allowed to keep processing appellant's data under Article 17(3)(e) GDPR because of the ongoing legal proceedings. According to the Court, it was irrelevant whether it could be regarded that data was processed unlawfully.
Dispute
Apellant argues that her personal data is processed by the local authorities unlawfully. The authority of Bladel asserts that it had used the data for compatible purposes under Article 6(4) GDPR, which means the appellant's appeal must be rejected.
Holding
The Council ruled that the Court of First Instance was entitled to assess whether the exception of Article 17(3)(e) GDPR took place without having to first assess the lawfulness of the processing. However, the Council noted that the authority of Bladen has changed their reason for rejected the appellant's request from Article 17(3)(e) to Article 6(4) GDPR without properly documenting or demonstrating how purpose compatibility criteria in GDPR are met. The nation-wide enforcement day for which the data had initially been collected, took place n 2016; the fact that appellant initiated legal proceedings against the municipality in connection with that event does not mean that the purposes of processing are compatible.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
Authority
Council of State
Date of pronunciation
30-09-2020
Date of publication
30-09-2020
Case number
201902925/1/A3
Areas of law
Administrative law
Special features
Appeals
Content indication
By decision of 18 April 2018, the College of Mayor and Aldermen of Bladel rejected the request of [applicant] and [appellant] to remove their personal data. In 2013, as part of the integral approach to rogue dog trafficking by the Police National Unit Animal Welfare Expertise Centre, a so-called pre-emptive document has been drawn up. This document contains data of dog handlers for which sufficient indicators have been deemed to be present to justify a further investigation. The dog handlers listed in the pre-road document are included in the general roadmap 'Canitas project' that has been drawn up for a national enforcement action day, and which in section 1.4 contains a diagram with data from dog handlers. The data of [petitioner] and [appellant] are included in this schedule.
Sites
Rechtspraak.nl
Enriched pronunciation
Pronunciation
201902925/1/A3.
Date of pronouncement: 30 September 2020
SECTION
ADMINISTRATIVE LAW
Ruling on the appeal of:
[appellante], living at [residence],
against the judgment of the District Court of Oost-Brabant of 25 March 2019 in case no. 18/2806 in the case between:
[applicant] and [appellant]
and
the College of Mayor and Aldermen of Bladel.
Process sequence
By decision of 18 April 2018, the College rejected the request of [the applicant] and [the appellant] for the removal (hereinafter: deletion) of their personal data.
By decision of 16 October 2018, the Municipal Executive declared the objection made by [the applicant] and [the appellant] to that decision to be unfounded.
By judgment of 25 March 2019, the Court upheld the appeals brought by [the applicant] and [the appellant], annulled the contested decision in so far as it concerns the personal data of [the applicant], ordered the College to rectify the data of [the applicant] and ordered that the judgment replace the contested decision in so far as it has been annulled. This judgment is attached hereto.
[Appellant] has lodged an appeal against this judgment.
The college has given a written explanation.
[appellant] has submitted a further piece.
The Division heard the case on 23 September 2019, where [appellant], represented by [applicant], and the College, represented by S.T.P. Joosten, attorney at law in Eindhoven, appeared.
After closing the investigation in session, the Department reopened the investigation. [Appellant] and the College have submitted further documents upon request.
None of the parties has declared within the set period of time that they wish to make use of the right to be heard again at the hearing, after which the Division concluded the investigation with application of article 8:57, third paragraph, read in conjunction with article 8:108, first paragraph, of the General Administrative Law Act.
Considerations
In advance
1. In view of the exceptional situation created in the Netherlands by the outbreak of the coronavirus and the related measures taken by the Dutch government to prevent the spread of this virus, the planned second session of 14 April 2020 could not take place. The department has informed the parties that, after thorough examination of the file, it does not consider it necessary to hold a second session to decide on the contentious issues. The parties have been given the opportunity to indicate that they nevertheless wish to exercise the right to be heard at a hearing. None of the parties has done so. The Division has therefore decided to settle the case without further hearing.
Introduction
2. In 2013, as part of the integrated approach to rogue dog trafficking by the Police National Unit Expertise Center Animal Welfare, a so-called pre-emptive document has been drawn up. In this document, data from dog handlers are included in which sufficient indicators are deemed to be present to justify a further investigation. The dog handlers listed in the pre-road document are included in the general roadmap 'Canitas project' (hereinafter: the roadmap) that has been drawn up for a national enforcement action day, and that in section 1.4 contains a diagram with data from dog handlers. The data of [applicant] and [appellant] are included in this diagram. The project was carried out in cooperation with, among others, the National Animal Protection Inspectorate and the Dutch Food and Consumer Product Safety Authority (hereafter: NVWA). Within the framework of integral enforcement, the plan was shared with the administrative bodies affiliated with the Regional Information and Expertise Centre for East Brabant (hereinafter: RIEC Oost-Brabant), including the Municipal Executive. The investigation in which the data were exchanged within the RIEC framework ultimately resulted in an enforcement action on 11 April 2016, in which each partner exercised supervision in accordance with its own statutory duties, powers and possibilities.
3. Pursuant to the Personal Data Protection Act (hereinafter: Wbp), [applicant] and [appellant] have requested the deletion of their data from the pre-weighed document and the schedule in paragraph 1.4 of the roadmap. The Board of Appeal took the position that the data of [appellant] in the roadmap will not be processed unlawfully. In addition, the right to forgetting Article 17 of the General Data Protection Regulation (hereafter: GTC) is not intended to correct or delete opinions with which the applicants disagree. Furthermore, in connection with the processing of their data, [the applicant] and [the appellant] have also instituted civil damages proceedings against the municipality of Bladel. In that context, the data are necessary for the substantiation of a legal action, so that the exception of article 17, third paragraph, of the AVG is applicable, according to the Municipal Executive.
The ruling of the court
4. The court's decision annulled the decision on objection in so far as it relates to the data of [the applicant], because the Board no longer objected to the deletion of those data from the pre-weighed document and the roadmap. The appeals of [applicant] and [appellant] were therefore upheld. However, the District Court ruled that the Municipal Executive was right to reject the request for erasure insofar as it related to the data of [the appellant]. To this end, the District Court has considered that the Municipal Executive has taken the position that article 17, third paragraph, of the GCG applies on good grounds. This means that [appellant] is not entitled to have its data deleted from the documents because of the ongoing civil proceedings. It is irrelevant here whether the processing of the personal data in the documents can be regarded as unlawful. It is also irrelevant whether or not the processing of the personal data in the documents is unlawful. According to the court, it is also irrelevant whether or not a judgment was rendered by the court in the civil proceedings on 15 May 2019, because an appeal has been lodged against this judgment.
What is the scope of the appeal?
5. Although the notice of appeal has been signed by [applicant] and [appellant], it became clear at the hearing that [applicant] is acting as agent of [appellant]. In appeal proceedings, grounds have only been formulated against the attacked decision insofar as the decision on the erasure of [appellant's] data has been adjudicated. The Division will therefore assume in the following that the appeal was only lodged by [appellant].
Assessment Framework
6. On May 25, 2018, the AVG became applicable and the Wbp was repealed. The AVG is applicable to these proceedings, because the decision on objection dates from after May 25, 2018.
7. The relevant laws and regulations are listed in the appendix. This appendix is attached to the judgment and is part of it.
The appeal of [appellante]
8. [appellant] argues that the schedule in the script is based on inaccurate and uncontrolled data. The processing is unlawful because the plan was drawn up in a careless manner and because no careful balance of interests was made before the data was processed in the context of the cooperation in RIEC Oost-Brabant. According to [Appellant], the processing of her data is therefore not in accordance with Article 5, first paragraph, opening words and under a, c and d of the AVG. The lawfulness of the processing should not have been left out of the court's consideration and should have been the first to assess the College's appeal against the exception of Section 17(3) of the GCG.
The further point of view of the college
9. The Board states that the data of [appellant] included in the script were processed on the basis of Article 6, first paragraph, opening words and under e, of the AVG. Because the municipality would participate in an action day in the field of integral enforcement as part of the cooperation within RIEC Oost-Brabant, the processing was necessary for the fulfilment of the municipality's public task. The Municipal Executive further argues with reference to Article 5.1(b) of the AVG that under certain conditions personal data may also be processed for purposes other than the original purpose. This is called "secondary use" and according to the Municipal Executive this is the case here. This secondary use is permitted if the other purpose is compatible with the purpose for which the personal data was originally collected. To determine what is "compatible" in a specific case, the Municipal Executive has referred to the criteria as formulated in article 6, fourth paragraph, of the GCG. Furthermore, the College argues that the data of [appellant] are still being processed in connection with the pending civil proceedings and some administrative proceedings. Within the framework of these proceedings it is important that the Municipal Executive has access to the original documents. This further processing as referred to in article 6, fourth paragraph, of the AVG is compatible with the original processing purpose. Therefore, no separate legal basis is required, according to the Municipal Executive.
Can Article 17(3) of the AVG be applied?
10. Article 17 of the AVG reads:
"The data subject shall have the right to obtain from the data controller the erasure of personal data relating to him without unreasonable delay and the data controller shall be obliged to erase personal data without unreasonable delay where one of the following applies:
a. up to and including c. [...];
d. the personal data has been processed unlawfully;
e. and f. [...].
2. […]
3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:
a. up to and including d. [...];
e. for the institution, exercise or substantiation of a legal claim.
10.1. The argument of [appellant] about the order of judgement does not succeed. In view of the systematics and the text of article 17 of the AVG, the Court was entitled to assess whether the exception of article 17(3)(e) of the AVG occurred and was not obliged to first assess the lawfulness of the processing. However, pending appeal - after the reopening of the investigation - the Municipal Executive based the decision on objection on a different basis. The Division deduces from this that Article 17, third paragraph, of the AVG has thus been abandoned as a basis. In the further document of 20 December 2019, the Board stated that the basis of the processing is further processing that is compatible with the original purpose of processing, as referred to in article 6, fourth paragraph, of the AVG. For this reason, the rejection of [appellant's] application must be upheld according to the Municipal Executive.
[Appellant's] appeal is well-founded for this reason, and the judgment under appeal will be set aside to the extent that its appeal has been dismissed as unfounded. In doing what the District Court should do, the Division will annul the decision on objection of 16 October 2018 insofar as it declared [appellant's] objection unfounded. In the following it will be examined whether the legal consequences of the decision can be upheld to the extent that they can be maintained on the basis of lawful further processing as referred to in article 6, fourth paragraph, of the GCG.
Is the further processing of [appellant's] personal data compatible with the original purpose?
11. The college initially processed the data of [appellant] in connection with the college's participation in the national day of action to combat illegal animal trafficking. From the Board's argument, the Division understands that the purpose for which [appellant's] personal data were initially processed was no longer relevant at the time the decision on the objection was taken. After all, the national action day for integral enforcement, for which the data had been processed, had already taken place in 2016. The question is then whether this further processing was permitted. Pursuant to Article 6, fourth paragraph, of the AVG, further processing is permitted if the purpose is compatible with the purpose for which the personal data were originally collected. In doing so, the factors mentioned in article 6, fourth paragraph, under a to e, of the AVG must be taken into account. These factors relate to the relationship between the purposes for which the personal data were originally collected and the purposes of the intended further processing, the framework in which the personal data were collected, the nature of the personal data, the possible consequences of the intended further processing for the data subjects and the existence of appropriate safeguards. Article 6, fourth paragraph of the GTC thus formulates an exception to the so-called purpose limitation principle and must therefore be interpreted strictly.
11.1. Although the Municipal Executive, on appeal, takes the position that the criteria of Article 6, fourth paragraph, of the GCG must be met, it does not explain its position at all on the basis of these criteria. After all, the mere fact that [the applicant] and [the appellant], as a result of the initial data processing, instituted civil proceedings for damages against, inter alia, the municipality does not yet mean that the purpose of the further processing of these data for the purposes of these damages proceedings is therefore already compatible with the purpose for which the personal data were initially collected. The same applies to the further processing of these data for the purpose of certain administrative proceedings. Insofar as the Municipal Executive is of the opinion that there is secondary use as referred to in Article 5, clause 1, sub b, of the GCG, this position too lacks a concrete explanation on the basis of the criteria mentioned in this paragraph.
11.2. The conclusion is that the Board has insufficiently substantiated that the further processing has a sound basis. In view of this, there is no reason to maintain the legal consequences of the decision on objection.
Final considerations
12. The appeal of [appellant] is well founded. The decision of the court, if attacked, should be set aside. In doing what the Court should do, the Division will annul the decision of 16 October 2018 insofar as it relates to [appellant's] personal data.
13. With a view to an efficient settlement of the dispute, the Division sees reason to stipulate, pursuant to Section 8:113(2) of the Awb, that the new decision to be taken by the Municipal Executive in respect of [the appellant's] objection can only be appealed to it.
14. There is no evidence of litigation costs eligible for reimbursement.
Decision
The Administrative Jurisdiction Division of the Council of State:
I. declares the appeal well-founded;
II. nullifies the judgment of the District Court of Oost-Brabant of 25 March 2019 in case no. 18/2806, insofar as it does not nullify the decision on objection in respect of [appellant's] personal data;
III. annuls the decision of the College of Mayor and Aldermen of Bladel of 16 October 2018, reference 18h.04912, insofar as it relates to the data of [appellant];
IV. provides that the new decision to be taken by the Municipal Executive of Bladel in respect of [the appellant's] objection can only be appealed to the Division;
V. orders that the Municipal Executive of Bladel shall reimburse to [the appellant] the court fee paid by it in the amount of € 259.00 (in words: two hundred and fifty-nine euros) for the handling of the appeal.
Thus established by C.H.M. van Altena, chairman, and C.M. Wissels and C.C.W. Lange, members, in the presence of M.H. Kuggeleijn-Jansen, registrar.
The chairman is prevented from signing the ruling.
The Registrar is prevented from signing the judgment.
Pronounced in public on 30 September 2020
545.
ANNEX
AVG
Article 5
1. Personal data must be:
(a) processed in a manner that is lawful, adequate and transparent as regards the data subject ('lawfulness, adequacy and transparency');
(b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes; further processing for the purposes of public interest archiving, scientific or historical research or statistical purposes shall not be considered incompatible with the original purposes pursuant to Article 89(1) ('purpose limitation');
(c) adequate, relevant and limited to what is necessary for the purposes for which they are processed ('minimal data processing');
(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data which are inaccurate, having regard to the purposes for which they are processed, are promptly erased or rectified ('accuracy');
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods in so far as the personal data are processed solely for archiving purposes in the public interest or for scientific or historical research or statistical purposes in accordance with Article 89(1), provided that appropriate technical and organisational measures are taken to safeguard the rights and freedoms of the data subject as required by this Regulation ('storage restrictions');
(f) are processed by taking appropriate technical or organisational measures in such a way as to ensure their security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage ('integrity and confidentiality').
Article 6
1. Processing is lawful only if and insofar as at least one of the following conditions is met:
[...]
e. the processing is necessary for the performance of a task carried out in the public interest or in the exercise of public authority vested in the controller;
[…]
4. Where processing for a purpose other than that for which the personal data were collected is not based on the data subject's consent or on a provision of Union law or a provision of national law which constitutes a necessary and proportionate measure in a democratic society to safeguard the purposes referred to in Article 23(1), the controller shall take into account, inter alia, when assessing whether processing for a purpose other than that for which the personal data were originally collected is compatible with the purpose for which the personal data were collected:
a. any connection between the purposes for which the personal data have been collected and the purposes of the intended further processing;
b. the framework in which the personal data have been collected, in particular with regard to the relationship between the data subjects and the controller;
c. the nature of personal data, in particular whether special categories of personal data are processed, in accordance with article 9, and whether personal data on criminal convictions and offences are processed, in accordance with article 10;
d. the possible consequences of the intended further processing for the data subjects;
e. the existence of appropriate safeguards, which may include encryption or pseudonymisation.
