Rb. Rotterdam - C/10/611345 / KG ZA 21-29
From GDPRhub
| Rb. Rotterdam - C/10/611345 / KG ZA 21-29 | |
|---|---|
 | |
| Court: | Rb. Rotterdam (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 6(1)(f) GDPR Article 6(4) GDPR 6:162 BW |
| Decided: | 01.03.2021 |
| Published: | 30.04.2021 |
| Parties: | Anonymous KPN |
| National Case Number/Name: | C/10/611345 / KG ZA 21-29 |
| European Case Law Identifier: | ECLI:NL:RBROT:2021:1679 |
| Appeal from: | |
| Appeal to: | Not appealed |
| Original Language(s): | Dutch |
| Original Source: | De Rechtspraak (in Dutch) |
| Initial Contributor: | Gerard Ritsema van Eck |
The Rotterdam Court of First Instance held that an ISP does not need to disclose subscriber data to a claimant who fails to make it plausible that the data will help them in other proceedings to claim damages.
English Summary
Facts
Plaintiff was removed from the National Interpreters Registry after claims of fraud. The Tolk- en Vertaalcentrum Nederland (Dutch Interpreters and Translation centre), a intermediary company where plaintiff had an account, claims that plaintiff fraudulently put out, accepted, and then cancelled interpreting assignments, inducing the centre to pay him cancellation fees. As a result hereof, plaintiff was removed from both the centre and the national registry, and lost income.
Dispute
Plaintiff disputes that he put out the cancelled assignments, and claims that the Court should order KPN (an ISP provider) to hand over information on the users of the IP addresses from which the assignments were created. This would allow plaintiff to prove that others put out the assignments, and claim damages from them.
Holding
The Court considers that (in line with Dutch jurisprudence, see HR 25 november 2005, ECLI:NL:HR:2005:AU4019 (Lycos/Pessers)) under certain circumstances ISPs can be forced to hand over subscriber information to injured parties. This allows them to bring actions before civil courts. This is in line with article 6(1)f GDPR, as it necessary for the purposes of protecting the legitimate interests of a third party. However, in the present case, claimant fails to demonstrate that the 37 IP addresses logged by the intermediary company belong to one or more data subjects which have indeed fraudulently put out assignments. First of all, KPN only holds on to IP information for six months whereas all the assignments were put out in the period between 2017 and 2019. Secondly, the claimant received at least €3,000.00 in cancellation fees. It is not credible that the claimant simply did not notice these charges before he was removed from both the intermediary and the national registry. Therefore, it seems unlikely that receiving the subscriber information will help claimant in his disputes with both organisations. As the consequences for the subscribers involved (in the form of e.g. court cases) might be significant, they outweigh the interests of the claimant. Therefore, there is no obligation on KPN to disclose the data.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
Authority
Court of Rotterdam
Date of judgment
01-03-2021
Date of publication
04/30/2021
Case number
C / 10/611345 / KG ZA 21-29
Jurisdictions
Contract law
Special characteristics
Interim injunction
Content indication
KG. Is KPN obliged to provide the name and address details of a customer, holder of an IP address on the basis of art. 6: 162 BW? Application HR 25 November 2005 (ECLI: NL: HR: 2005: AU4019) and art. 6 GDPR.
Locations
Rechtspraak.nl
Enriched pronunciation
Share pronunciation
Print
Save as PDF
Copy link
Statement
verdict
COURT ROTTERDAM
Trade and port team
case number / cause list number: C / 10/611345 / KG ZA 21-29
Interim injunction of 1 March 2021
in the case of
[claimant]
,
residing in [residence],
plaintiff,
lawyer M. van Tessel in Drunen,
against
the private company with limited liability
KPN B.V.,
established in Rotterdam,
defendant,
lawyer mr. S.C. van Velze in Amsterdam.
The parties are hereinafter referred to as [claimant] and KPN.
1. The procedure
1.1.
The course of the procedure is evidenced by:
-
the writ of summons of January 27, 2021, with 5 exhibits;
-
the deed containing exhibits of KPN, with 6 exhibits;
-
the oral hearing on February 15, 2021;
-
KPN's advocacy note.
1.2.
Finally, verdict has been determined.
2. The facts
2.1.
[Claimant] was registered in the Register of Sworn Interpreters and Translators (hereinafter: the Register) as an interpreter Dutch-Arabic (Iraqi), Dutch-Arabic (Palestinian-Jordanian) and Dutch-Arabic (Syrian-Lebanese). He had an interpreting account at the Interpreting and Translation Center for the Netherlands (hereinafter: TVcN).
2.2.
TVcN uses an online system called TASnet to request, change, accept, refuse and cancel interpretation assignments. The system consists of a customer platform and an interpreter platform. Applicants for interpretation services, including the Legal Aid Board (hereinafter: RvR), can request, change and cancel services via their own customer account in TASnet. Interpreters can accept or refuse services requested through their own interpreting account. If the requested service is canceled less than 4 hours before the start of the service, the cancellation fee from the customer to TVcN is 100%. TVcN then pays the interpreter.
2.3.
On October 31, 2019 and November 22, 2019, TVcN and RvR respectively filed a complaint with the Office of the Sworn Interpreters and Translators Act (hereafter: Bureau Wbtv) with regard to [claimant]. [plaintiff] is accused of fraudulently turning off, accepting and canceling non-existing interpreting assignments, thus inducing TVcN to pay him cancellation fees for non-existing interpreting assignments, over several years and to considerable amounts.
2.4.
The complaint of TVcN and RvR has been submitted for advice to the Complaints Committee Wbtv (hereinafter: the committee). On March 23, 2020, the Committee advised Bureau Wbtv to “declare the complaint well-founded, both with regard to the tacit receipt and retention of the evidently wrongly paid cancellation fees, and with regard to the malpractice that led to those payments”.
2.5.
On 23 June 2020, Bureau Wbtv took the decision that the registrations of [claimant] as an interpreter will be canceled from the Register as of 1 July 2020 and that he will not receive a new request for registration as an interpreter and / or translator in the Register until 1 July 2025. Register can submit.
To this end, Bureau Wbtv has considered the following:
“(…)
I note that your core competence as an interpreter, namely integrity and interpreting attitude, is in jeopardy both with regard to the tacit receipt and retention of the evidently wrongly paid cancellation fees and with regard to the conduct that led to those payments. Came. The behaviors described and thereby the receipt and tacit retention of the cancellation fees that are evidently wrongly paid to you, constitute serious facts that concern the integrity of the sworn interpreter or translator, and are also in violation of Article 1.1 of the Code of Conduct of the btv, as this entails the trust is seriously harmed in the profession to which you belong.
Both elements, viewed together and separately, are, in my opinion, so contrary to the integrity and attitude that must be required of a sworn interpreter and which the Rbtv aims to guarantee that registration in the Rbtv is no longer justified in your case. .
The importance of the Rbtv that meets the objectives of the law is of decisive importance to me. This interest exceeds your personal interest in continuing your registrations in the Rbtv as an interpreter. The users of the Rbtv must be able to trust that the interpreter used meets the required legal competences.
(…) ”
2.6.
[Claimant] has filed an appeal against the decision of 23 June 2020.
By decision of November 12, 2020, his objection was declared unfounded and the decision of June 23, 2020 was upheld.
2.7.
[Claimant] has appealed against the decision on the objection of November 12, 2020. The appeal procedure is still ongoing.
2.8.
The fraud was committed from various IP addresses, including IP address [IP address]. As of June 2, 2020, [plaintiff], himself and through various lawyers, has requested KPN several times to provide him with the name and address details of the user of this IP address. In addition, [plaintiff] explained that he needs this information to trace the actual fraudster and to challenge the removal from the Register.
In an e-mail of November 2, 2020, KPN informed [claimant] that the connection with IP address [IP address] is not registered in the name of [claimant] and that the connection is active in Zaltbommel. For the rest, KPN refused to comply with [plaintiff] 's request.
3. The dispute
3.1.
[plaintiff] claims by judgment, enforceable provisionally, to order KPN to provide the following information to [plaintiff] within 48 hours after notification of the judgment to be given:
all data that the user or the users of the said IP address [IP address] has provided to KPN when applying for the service provided by KPN, including the user's name, address and place of residence and bank details;
an overview of all times at which the aforementioned IP address was logged in in the period 2017 to 2019;
This under penalty of forfeiture of a penalty of € 10,000.00 per day that expires after two days after the aforementioned notification has passed and KPN has not complied with this order, however with a maximum of € 500,000.00.
3.2.
KPN has put up a defense.
3.3.
The arguments of the parties are discussed below, insofar as they are relevant.
4. The assessment
4.1.
In so far as relevant, [claimant] argues that he has an urgent interest in his claims, because he needs the information requested to be able to demonstrate in the appeal procedure that he is not the person who committed the fraud. The urgent interest of [plaintiff] is thus sufficiently given, all the more so because KPN stated at the hearing that it only retains the IP data that go back up to six months. The circumstances put forward by KPN that [plaintiff] waited too long to institute these interim relief proceedings and that there is currently no question of a continuous unlawful situation, do not detract from the aforementioned urgency.
4.2.
A legal basis is required on the basis of which an internet service provider, such as KPN, can be obliged to provide customer data. Article 6: 162 of the Dutch Civil Code contains a legal basis on the basis of which KPN can be obliged to make this release (Supreme Court, 25 November 2005, ECLI: NL: HR: 2005: AU4019). Under certain circumstances, a refusal by an internet service provider to disclose a user's data to a third party may conflict with the due care that the service provider must exercise towards such a third party. In this case, the following circumstances are important:
Is it sufficiently plausible that the user of the IP address [IP address] has acted unlawfully towards [claimant]?
Does [claimant] have a real interest in obtaining the requested information?
Isn't there a less invasive way to find out the data?
Does balancing the interests involved mean that the interests of the third party concerned should prevail?
4.3.
In addition to article 6: 162 DCC, the General Data Protection Regulation of 27 April 2016 (EU 2016/679, hereinafter: GDPR) applies. The requested provision of data by KPN can be regarded as processing personal data as referred to in the GDPR. Article 6 (1) of the GDPR sets out which conditions form a ground for the lawful processing - in this case: provision - of personal data. Section f of this paragraph provides that processing is permitted if it is necessary for the defense of the legitimate interests of the controller or of a third party, except when the interests or fundamental rights and freedoms of the data subject are for the protection of personal data necessities, outweigh those interests. This provision is comparable to the circumstances formulated by the Supreme Court, since here, too, the legitimate interest, the necessity of the processing and a balancing of interests are the requirements. In addition, if the processing for a purpose other than that for which the personal data were collected, as at issue here, is not based on the consent of the data subject, in the context of the balancing of interests, the information referred to in Article 6 paragraph must also be taken into account. 4 GDPR, including the possible consequences of the intended further processing for the data subjects.
4.4.
[Plaintiff] argues that his interest in obtaining the claimed information lies in the fact that the information provides him with a point of departure for discovering the identity of the actual fraudster. This allows him to prove his innocence in the appeal proceedings and to bring the fraudster in court for an action for damages.
In the provisional opinion, [plaintiff] has insufficiently demonstrated that the fraud was (exclusively) committed by the user of the IP address in question. In the complaints procedure against [plaintiff], the RvR submitted an Excel file with an overview of the IP addresses and smartphones used during the fraudulent activities (Exhibit 4 of KPN). KPN argues that, according to that overview, the fraudulent acts were carried out from 37 different IP addresses and that the mere fact that the IP address of its customer was used - which IP address may also have been manipulated - does not mean that that customer also committed the wrongful act. [claimant] has insufficiently disputed this. Insofar as he argues that all IP addresses and devices were used by the same person, [claimant] has not substantiated that assertion. KPN then rightly argues that there is no additional evidence that its customer was involved in the fraud.
4.5.
KPN has also argued that it keeps the customer data associated with the IP addresses for six months. At the time of the oral hearing on February 15, 2021, she could only view the IP data from August 15, 2020. It cannot be checked whether the current user is the same as the one in the period from 2017-2019. [claimant] has not discussed this. What interest he has in the data that is still available, or accessible, is then - partly in the light of what is stated in 4.4. considered - insufficiently clear.
4.6.
According to [claimant] there are no other ways to retrieve the requested data. Although he has reported the fraud to the police, they do not give it priority and do not carry out any investigative actions. KPN disputes this. This is not substantiated and, moreover, fraud qualifies as a crime. In that case, the public prosecutor is pre-eminently the person who, in the context of a criminal investigation and with guarantees, can request a third party, such as KPN, to provide him with certain information.
4.7.
In the context of the balancing of interests, the interest of KPN in the protection of the personal data and privacy of its customer (Articles 7 and 8 Charter and Article 8 ECHR) is offset by the interest of [claimant] to be able to defend itself against (possibly unjustified ) fraud allegations.
4.8.
As already considered above, [claimant], in view of the point in 4.4. aforementioned file, as yet insufficiently plausible that the user of the IP address is the actual fraudster. The data in itself is insufficient to serve as evidence. It is also important that in imposing the measure, Bureau Wbtv not only took into account that, in its view, it has been established that [plaintiff] is behind the fraud, but also that he has tacitly received and retained the cancellation fees. It has held that both elements, viewed together and separately, are in conflict with the required integrity and attitude of a sworn interpreter to such an extent that registration in the Register is no longer justified (see 2.5.). This means that, if it were already established in the appeal procedure that [plaintiff] is not the fraudster, the judgment that he has not acted with integrity in keeping the funds still stands.
The committee, whose advice has been adopted by Bureau Wbtv, has determined that the proceeds of the malpractice went exclusively to [plaintiff] (at least that he has not disputed this). Over the years 2017, 2018 and 2019, the cancellation fees paid to him amounted to a total of € 45,000.00. These reimbursements were relatively far outside the averages. For example, in 2019 cancellation fees accounted for an average of 7% of the total fees paid to interpreters, while for [claimant] this was 70%. In addition, it was considered that an interpreter would always receive notification of the cancellation by e-mail and via the app, which message the interpreter must actively confirm, according to the committee.
In these summary proceedings, [plaintiff] has made little concrete about all these findings and judgments, let alone substantiated anything. It appears that during the oral hearing he argued for the first time that the amount of € 45,000 is incorrect. According to him, this is a considerably lower amount (approximately € 11,000.00), whereby he states that Global Talk Netherlands BV, through which company he received his assignments and which company declares the assignments to TVcN, 2/3 of the invoiced amount and he only receives 1/3 part, even in the event of a cancellation. He did not notice the unjustified receipts, according to [claimant]. Apart from the fact that it is remarkable that it is not clear from the documents in the proceedings before the Bureau Wbtv that [plaintiff] raised this argument there, [plaintiff] has not substantiated this assertion in these proceedings (but perhaps that he can do so in the ongoing appeal).
This means that for the time being it has not become sufficiently plausible that the provision of the requested information will lead to the measure imposed on [claimant] being withdrawn or canceled.
4.9.
Furthermore, it is taken into account that the provision of the requested data has far-reaching consequences for the user of the IP address. In that context, KPN has argued that [plaintiff] will use the data to take legal action against the person concerned and to claim damages of approximately € 500,000.00. [claimant] has also filed a complaint. This means that the user of the IP address may be hanging over everything, while it is still unclear whether the user is actually the fraudster.
4.10.
In view of the foregoing, the interest of [claimant] in obtaining the requested data does not (yet) outweigh the interest of KPN in the protection of the personal data and privacy of its customer. For the time being, KPN's refusal to disclose the data is not in conflict with the unwritten standard of care contained in Article 6: 162 of the Dutch Civil Code, so that there is no obligation to provide such data. The claims are therefore dismissed.
4.11.
[Claimant] is ordered to pay the costs of the proceedings as the unsuccessful party. The costs on the part of KPN, in addition to the subsequent costs, are estimated at:
- court fee € 667.00
- lawyer salary € 1,016.00
Total € 1,683.00
5. The decision
The preliminary relief judge:
5.1.
rejects the claims;
5.2.
orders [plaintiff] to pay the costs of the proceedings, estimated on the part of KPN to date at € 1,683.00;
5.3.
orders [plaintiff] to pay the costs incurred after this judgment, estimated at € 163.00 in lawyer's salary, to be increased, on the condition that [plaintiff] has not complied with the judgment within 14 days after registration and that the judgment is subsequently served has taken place, with an amount of € 85.00 in attorney's salary and the costs of service of the judgment;
5.4.
declares this judgment provisionally enforceable with regard to the cost order.
This judgment was rendered by mr. P. de Bruin and pronounced in public on March 1, 2021.
2091/2009
