Rb. Den Haag - AWB - 19 6782
| Rb. Den Haag - AWB - 19 _ 6782 | |
|---|---|
 | |
| Court: | Rb. Den Haag (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 15(1) GDPR Article 15(3) GDPR |
| Decided: | 05.10.2020 |
| Published: | 20.10.2020 |
| Parties: | Het college van burgemeester en wethouders van Den Haag |
| National Case Number/Name: | AWB - 19 _ 6782 |
| European Case Law Identifier: | ECLI:NL:RBDHA:2020:9590 |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | de Rechtspraak (in Dutch) |
| Initial Contributor: | n/a |
The District Court of The Hague ruled that Article 15 GDPR doesn’t apply to the claimant's information held by the municipality of the Hague: IP address (it doesn’t constitute personal data in this case), debit card payment (the data has been anonymized), emails exchanged with the claimant (the claimant already has them). Furthermore, the Court clarified that Article 15 GDPR does not entitle the claimant to receive a copy of the physical or digital documents which contain personal data because these documents themselves do not constitute personal data.
English Summary
Facts
On 27 December 2018, the claimant requested access to his personal data held by the municipality of The Hague. He requested access to, among others, the information relating to an IP address, serial numbers and details of bicycles towed by the municipality and email communication with the employees of the municipality. The municipality provided claimant with some information but decided against disclosing all requested personal data.
Dispute
The claimant insists that the list of personal data provided by the municipality is incomplete. He argues that IP address, email communication and debit card payment information for the towed bicycle should be included.
Holding
The Court ruled that, as follows from the case law of the Administrative Division of the Council of State, the person who claims that there should be more personal data, has to make it evident that this is indeed the case if they want to contest the administrative body’s investigation into the matter.
The municipality has stated that IP addresses are not stored or linked to persons, it also doesn’t have the means to link IP addresses to a specific person (additional information from an ISP would be necessary here). Lastly, it would take an impossible amount to time and resources for the municipality to trace and identify all people who communicate IP addresses to the municipality. The Court ruled that when a processing requires an excessive effort, resulting in identification being practically impossible, an IP address cannot be considered personal data.
Regarding the processing of the debit card payment data, the municipality indicated that that data is anonymized, which means it cannot be traced to the claimant.
Regarding the claimant’s email communication with the municipality, the Court found that the claimant already has the emails he sent himself and the municipality’s response. Moreover, the Court ruled that Article 15 GDPR does not entitle the claimant to receive a copy of the physical or digital documents which contain his personal data because these documents do not constitute personal data. The claimant has the right to a complete overview, in an understandable form, of his personal data in order to be able to check the accuracy of these data and assess whether they are processed in accordance with the GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
Authority Court of The Hague Date of pronouncement 05-10-2020 Date of publication 20-10-2020 Case number AWB - 19 _ 6782 Jurisdictions Environmental law Special features First instance - single Content indication Request for access to personal data in accordance with AVG. Appeal unfounded. Sites Rechtspraak.nl Enrichedpronunciation Ruling COURT IN THE HEDGE Administrative law Case number: SGR 19/6782 judgment of the single chamber of 5 October 2020 in the case between [plaintiff] , at [residence] , plaintiff and The Municipal Executive of The Hague; Administrative Service; Legal Affairs, defendant Process sequence By decision of 7 February 2009 (the primary decision), in response to a request from the claimant for information on his personal data under the General Data Protection Regulation (AVG), the defendant granted access to the personal data found in the documents referred to and annexed in the decision. By letter dated 13 March 2019, the plaintiff submitted a notice of objection against this. Further information was provided by letter dated 17 April 2019. A hearing took place on 24 June 2019 and the Advisory Committee on Objections issued an opinion on 25 October 2019. By decision of 30 September 2019 (the contested decision), the defendant, referring to the abovementioned opinion, dismissed the claimant's objection as unfounded. The plaintiff brought an action against the contested decision. The defendant lodged a statement of defence. Because of the outbreak of the coronavirus and the measures taken to prevent its further spread, the court asked the parties whether it was preferable to postpone the case or whether the case could be settled on the merits. Both parties have given their consent for the case to be judged on the merits. Subsequently, the court closed the investigation. Considerations 1. By letter dated 27 December 2018, the claimant submitted a request for information on his personal data under the General Data Protection Regulation. Requests included insight into the processing of plaintiffs' personal data by the municipality of The Hague, specifically requesting information about or linked to the IP address, serial numbers and characteristics of vehicles/bicycles removed by the municipality and communication with persons employed by the municipality. Subsequently, information was also requested about his membership of the polling station, the change of residence from The Hague, the specification of the school data, the e-learning he completed as a polling station member and how results of his online election exam were processed. 2. By the contested decision, the defendant, in accordance with the opinion of the Advisory Committee on Objections, declared the plaintiff's objections unfounded. 3. The plaintiff disagrees with the contested decision. According to the plaintiff, the list of personal data provided by the defendant is incomplete. The plaintiff has argued that his IP address has been processed and that this processing falls under the AVG, as a result of which he must be given access. The defendant should also allow access to the e-mail communication that took place between the plaintiff and the defendant. Furthermore, no information about the collection of a towed bicycle at Fietsdepot Haaglanden, where a debit card payment has been made, has been provided and a notice of objection submitted by the claimant on behalf of someone else in another objection procedure will not be included in the documents provided. 4. The court will make the following assessment. 5. The right of inspection in article 15 of the AVG is elaborated as follows: 1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data relating to him or her are being processed and, if so, to obtain access to those personal data and to the following information: a. the processing purposes; b. the categories of personal data concerned; c. the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; (…) 3. The controller shall provide the data subject with a copy of the personal data being processed. If the data subject requests additional copies, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes his or her request electronically and does not request any other arrangement, the information shall be provided in a common electronic form. 6. The Court sees no ground for the conclusion that the processing overview of the defendant is incomplete, or that the search carried out by the defendant was insufficient. As follows from the case law of the Administrative Jurisdiction Division of the Council of State, the person who claims that there should be more personal data, after the administrative body has investigated those personal data and has not credibly stated that there are no more personal data, must make it plausible that there should be more personal data. 7. In the District Court's opinion, the defendant has demonstrated that within the municipality of The Hague no IP addresses are recorded, stored and linked to persons. Therefore, there is no direct or indirect traceability to persons. To that end, it is important that the defendant has explained that IP addresses can be indirectly traceable to a person, but that means must be used to establish this. The defendant has indicated that it is impossible in terms of time and manpower to trace the identification of all citizens with whom communication is made by means of an IP address. It is important in this connection that the municipality itself does not have the data to make a link between an IP address and a citizen, but that data is needed from an Internet Service Provider. At a time when processing requires an excessive effort on the part of the defendant, with the result that the risk of identification is in practice insignificant, the IP address cannot be regarded as personal data. 8. With regard to the data on the collection of the bicycle at Fietsdepot Haaglanden, it is important that the defendant has indicated that these data have been anonymised in the Perfect View system. As a result, they can no longer be traced back to the plaintiff. With this, the defendant has made it plausible that the claimant's data are no longer being processed at the bicycle depot. In addition, the defendant has indicated that the pin transaction cited by the claimant can no longer be traced. 9. As regards the plaintiff's communication with the municipality, it is important that the plaintiff already has the e-mails he sent himself and the defendant's response to them. Furthermore, Article 15 of the AVG does not entitle the claimant to receive a copy of the physical or digital documents in which the personal data are processed. Documents as such are not personal data and nowhere in the GCG is there any reference to the provision of a copy of the documents in which the personal data are processed. Therefore, the right to access personal data does not mean that the person concerned has the right to access or make copies of the documents or files as such if they contain his or her personal data. There is, however, a right to a complete overview, in comprehensible form, of all personal data. That is to say, in a form that enables the person concerned to take note of his or her data and to check whether they are correct and have been processed in accordance with the GCG. Furthermore, the defendant has demonstrated that there is no registration within the municipality of The Hague with which the municipality communicates. If a process requires an email to be saved, it is archived in the Data Management System. 10. With regard to a notice of objection lodged by a claimant on behalf of another person, it is important that a summary of the objection procedure was sent to the claimant by e-mail dated 10 July 2019, which resulted in the claimant's request being granted and his ground of appeal failing. 11. In these circumstances, the court considers that the defendant's communication that there are no more personal data is credible. 12. The appeal is unfounded. 13. There are no grounds for an order to pay costs. Decision The court declares the appeal unfounded. This decision was made by Mr M.M. Meijers, judge, in the presence of Mr Tijsma, Registrar. registrar judge Copy sent to parties on: Legal remedy An appeal may be lodged with the Administrative Jurisdiction Division of the Council of State against this decision within six weeks of the day it was sent. If an appeal has been lodged, a request may be made to the Interim Injunction Judge of the Higher Appeal Court for a preliminary injunction or for the annulment or modification of a preliminary injunction made by this decision.
