Rb. Zeeland-West-Brabant - AWB- 20 5411

Rb. Zeeland-West-Brabant - AWB- 20_5411

Court:	Rb. Zeeland-West-Brabant (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:	Article 6 GDPR Article 17 GDPR Article 82 GDPR
Decided:	22.04.2021
Published:	06.05.2021
Parties:	Mr. N.G.A. Voorbach The Executive of the Municipality of Etten-Leur ('het college van burgemeester en wethouders van de gemeente Etten-Leur')
National Case Number/Name:	AWB- 20_5411
European Case Law Identifier:	ECLI:NL:RBZWB:2021:2046
Appeal from:
Appeal to:	Not appealed
Original Language(s):	Dutch
Original Source:	de Rechtspraak (in Dutch)
Initial Contributor:	n/a

In progress.

English Summary

Facts

In progress.

Dispute

Holding

In progress.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

Authority
District Court of Zeeland-West-Brabant
Date of judgment
22-04-2021

Date of publication

06-05-2021

Case number

AWB- 20_5411

Jurisdictions

Administrative law

Special characteristics

First instance - multiple

Content indication

GDPR

Locations

Rechtspraak.nl

Enriched pronunciation

Share pronunciation

Print
Save as PDF
Copy link

Statement

COURT ZEELAND-WEST-BRABANT Meeting place Breda Administrative law case number: BRE 20/5411 GDPR Judgment of the multi-judge chamber of 22 April 2021 in the case between
[name of plaintiff], at [place name], plaintiff's attorney: mr. N.G.A. Voorbach, and The Board of Mayor and Aldermen of the Municipality of Etten-Leur, defendant. In February 2020 (contested decision), the Board declared the plaintiff's objection against the primary decision inadmissible and, in the alternative, unfounded. The plaintiff lodged an appeal against the contested decision. The Board lodged a statement of defense. The appeal was discussed at the hearing of the court on March 11, 2021. Plaintiff was not present, but he was represented by his attorney, who participated via video calling. [Name of representative vwr] was present on behalf of the Board. Considerations 1. Facts The court assumes the following facts and circumstances: On 17 July 2019, the plaintiff submitted a request to the Commission under the General Data Protection Regulation (GDPR). The request pertains to: 1. Removal of the plaintiff's personal data on the forum of the Association of Dutch Municipalities (VNG). Plaintiff states that it has become apparent to him that the defendant's organization has processed data from him through publication on the VNG forum. The overview of processed personal data that the plaintiff received from the VNG shows that the Board stated his name and shared it with a large group of administrative bodies. With due observance of Article 17, paragraph 1, of the GDPR, the plaintiff requests that his personal data be deleted, insofar as they relate to the aforementioned form of data processing. 2) Compensation for damages because the Board has stated the data on the VNG forum. Plaintiff does not consider the data processing in accordance with the principles of proportionality and subsidiarity and refers to a judgment of the Overijssel court for this purpose. Plaintiff argues that the Board has compromised its privacy and that it should not have shared the personal data with a large group of other administrative bodies without permission. According to the claimant, there is no basis for data processing as referred to in Article 6 of the GDPR and the data processing is therefore unlawful. Plaintiff is seeking damages under Article 82 of the GDPR. In view of the nature and seriousness of the infringement, the plaintiff considers compensation of € 2,500 to be appropriate. In the primary decision, the Board rejected the plaintiff's request to delete personal data. To this end, the Commission states that it has heard from the VNG, which is the administrator of the forum, that the data had already been removed from the forum in 2017. Plaintiff was informed of this by the VNG at the time. It is not possible to delete already deleted data. The Commission notes in this connection that the terms of use for the forum with regard to the posting of personal data on the forum were tightened in 2017 and that the VNG supervises compliance. The Commission also rejects the request for compensation. To this end, the Commission states that without further information it is not possible to assess whether a request is made to compensate material or, conversely, immaterial damage. According to the Commission, it is also not possible to assess the causal relationship between the claimed damage and the actions that the Commission would have performed, nor whether they are factual or correct in administrative nature. In addition, with reference to case law2, the Board asks for substantiation of the amount claimed. The plaintiff has objected to the primary decision. On 6 February 2020, the committee for objections of the municipality of Etten-Leur (the committee) issued an opinion to In the contested decision, the Board declared the plaintiff's objections, in accordance with the Committee's advice, primarily inadmissible and, in the alternative, unfounded. 2. Scope of the dispute On the basis of the proceedings at the hearing, the court finds that - in addition to the request for compensation - the removal request also forms part of the dispute. Although the removal of the data from the forum already took place in 2017, the privacy officer of the VNG has informed the Commission that data from the archive of the VNG is still present, which is part of the VNG file in legal proceedings. For that reason, the VNG states that it cannot comply with the Commission 's request to remove the plaintiff's data from the archive. The information regarding the present proceedings is still available at the municipality of Etten-Leur. 3. Applicable law On 25 May 2018, Regulation 2016/679 of the European Parliament and of the Council of the European Union of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (the GDPR) has become applicable. The GDPR is directly applicable in every Member State (Article 99, paragraph 3 of the GDPR). The Personal Data Protection Act (Wbp) was withdrawn on 25 May 2018. The GDPR has immediate effect and does not contain any transitional law for the handling of a claim for compensation under Article 82 of the GDPR. The transitional law in Article 48, tenth paragraph, of the GDPR Implementation Act does not apply in this case. With regard to the request for compensation, the GDPR applies. On July 17, 2019, so after the entry into force of the GDPR, the plaintiff filed a request for compensation from the Commission. For the assessment of the unlawfulness of the actions, which in this case occurred before 25 May 2018, the old law applies, i.e. the Personal Data Protection Act (Wbp). The relevant provisions of the GDPR and the Wbp are , for the sake of readability, included in the appendix to this decision. 4. Content of the contested decision: primarily inadmissible 4.1 With the contested decision, the Commission has declared the plaintiff's objection to the refusal to remove his personal data from the VNG forum primarily inadmissible. The commission has based this on the fact that the VNG must be regarded as responsible for the forum, and not the council. Plaintiff should not have turned to the Board but to the VNG, according to the Board in the contested decision. 4.2 In the defense, the Commission states that it has taken note of the decision of the Administrative Jurisdiction Division of the Council of State (AbRS) of 23 January 20193, in which - in brief - it was considered that the posting of messages by municipal officials on a forum management at the VNG means that the council of the relevant municipality must be regarded as responsible within the meaning of the Personal Data Protection Act (Wbp) that was applicable at the time. According to the Commission, this means that the plaintiff wrongly declared inadmissible in the contested decision.4.3 Furthermore, in the contested decision, the Commission also declared the plaintiff's objection against the rejection of his request for compensation primarily inadmissible. The Commission has based this on the fact that the decision on a request for compensation for unlawful data processing is not a decision within the meaning of Article 1: 3 of the General Administrative Law Act (Awb). In the contested decision, the Commission considers that there is therefore no open objection and appeal against the rejection of a request for compensation on the basis of Article 82 of the GDPR. 4.4 In the defense, the Commission states that it has taken note of the decisions of the AbRS. of 1 April 20204, in which it was ruled that the administrative court is competent to assess a request for compensation for material or immaterial damage as a result of an act in violation of the GDPR by an administrative body on the basis of Article 8:88 of the Awb. According to the Commission, this means that in the contested decision the plaintiff wrongly declared inadmissible on this point as well. 4.5 In view of the foregoing, it must be held that the Commission wrongly declared the plaintiff's objection against the primary decision inadmissible. . The appeal duty has also been violated in objection. The appeal is well-founded, so that the contested decision qualifies for annulment. The court sees reason to provide for the case itself on the basis of Article 8:72, third paragraph, of the Awb and in the context of final dispute settlement, because it the Board has taken a substantive position in the alternative, and both parties have agreed to the option of the court to provide for the case itself. 55. Content of the contested decision: in the alternative, unfounded 5.1 In the alternative, the Commission declared the objections of the plaintiff against the refusal to remove his personal data from the VNG forum and the rejection of his request for compensation unfounded. The Commission has based this on the fact that the data processing is lawful. Therefore, the Commission is not obliged to delete the data concerned on the basis of Article 17, first paragraph, under d, of the GDPR. Because the processing of the personal data is not unlawful, there is also no claim for compensation on the basis of Article 82 of the GDPR, according to the Commission.5.2 The court refers to the rulings of the AbRS of 1 April 2020 (footnote 4). In those judgments, the AbRS ruled that mentioning someone's name on the VNG forum is not unlawful and that there is therefore no claim to compensation. The AbRS considers this as follows: “30. On the basis of the Wob, a request for disclosure and provision of information about an administrative matter may be submitted to the Board. The implementation of the Wob is a public task of the Commission. For the proper functioning of the Wob, it is important that an investigation is conducted into misuse of the Wob and that any misuse is established. By means of the VNG Forum, the VNG has set up a digital platform to enable municipalities to consult with each other about the method of approach and handling of the many Wob requests submitted for the purpose of collecting penalties. On 1 October 2016, the legislator abolished the penalty for Wob requests. In 2017, the VNG cleaned up the Wob / municipalities section of the VNG Forum by taking all discussions offline. Personal data placed before April 1, 2017 can no longer be traced (see, among other things, the decision of the Court of The Hague of 18 May 2017, ECLI: NL: RBDHA: 2017: 5404) .31. Mentioning the name of [appellant] at the VNG Forum at the request of another municipality was intended to ensure proper implementation of the Wob and to prevent the Wob from being abused to collect penalties if a decision on a request. This purpose is in accordance with Article 8, under e of the Wbp (and Article 6, first paragraph and under e, of the GDPR). Contrary to what [appellant] argues, there is no ground for the opinion that the data processing is not in accordance with the requirements of proportionality and subsidiarity. The purpose of the processing is proportional to the infringement of the privacy of [appellant] and could not be achieved with less drastic means. Stating the name of [appellant] was necessary, because only in this way could it be checked whether he had submitted Wob requests to several municipalities that may be aimed at collecting a penalty. Nor was it excessive to share this information on the VNG Forum. As the Commission explained at the hearing, for the Wob / municipalities section of the VNG Forum, only those who have a specific function related to the handling of Wob requests had access. There is no basis for the assertion of [appellant] that the entire administrative Netherlands was able to take note of his name. When asked, [appellant] also failed to provide insight into the concrete adverse consequences of his name being mentioned at the VNG Forum.32. Because the Commission has not acted unlawfully by mentioning the name of [appellant] at the VNG Forum, the request for compensation has already been rejected. ”5.3 The court sees no reason to deviate from the decision of the AbRS. The court understands the plaintiff's appeal as saying that he does not agree with the opinion of the AbRS that mentioning his name on the VNG forum was not unlawful. However, the court agrees with the AbRS that the purpose of this was to prevent possible abuse of the Wob. This goal is in accordance with article 8 under e of the Wbp. Furthermore, the court agrees with the AbRS that the processing of data was necessary for that purpose, and not contrary to the requirements of proportionality and subsidiarity. The court sees no reason to refer preliminary questions to the Court of Justice about the interpretation of the concept of damage in the GDPR. After all, the court ruled that there was no unlawful processing of the plaintiff's personal data and an infringement of the GDPR. For this reason alone, no damage can be compensated on the basis of Article 82 of the GDPR. 5.4 Given the above, the court follows the alternative position of the Commission that the plaintiff's objections must be declared unfounded and the request for compensation must be rejected. 6. Conclusion Given what has been considered under point 3.5 of this judgment, the appeal is well-founded. The court annuls the contested decision. The court itself will provide for the case and will declare the claimant's objection unfounded and will reject the claim for damages, as considered above. 7. Legal costs and court fees Because the court declares the appeal to be well-founded, the board must reimburse the plaintiff for the court fee paid by him. The court orders the board to pay the legal costs incurred by the plaintiff. The legal costs are calculated in accordance with the Administrative Law Costs of Proceedings Decree. The college is ordered to reimburse the costs of legal aid. The court sets these costs at € 1,068.00 (1 point for submitting the notice of appeal and 1 point for appearing at the hearing, with a value per point of € 534.00 and a weighting factor of 1). declares the appeal well-founded; - annuls the contested decision; - determines that the objection against the primary decision is unfounded and rejects the request for compensation; - orders the Board to reimburse the plaintiff the paid court fee of € 178.00; - orders the Board to pay the costs of the proceedings of the plaintiff to an amount of € 1,068.00. This judgment was made by mr. JEC Vriends, chairman, and mr. V.M. Schotanus and mr. I.M. Josten, members, in the presence of mr. M.A. de Rooij, on 22 April 2021 and made public by anonymous publication on www.rechtspraak.nl.griffier chairman Copy sent to parties at: What can you do if you do not agree with this decision? day of dispatch thereof, an appeal may be lodged with the Administrative Jurisdiction Division of the Council of State. ANNEX REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC ( General Data Protection Regulation) Article 17: Right to erasure ('right to be forgotten') 1. The data subject has the right to obtain from the controller the erasure of personal data concerning him without unreasonable delay and the controller is obliged to erase personal data without unreasonable delay where one of the following applies: a. (a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; (b) the data subject withdraws the consent to which the processing was carried out in accordance with point (a) of Article 6 (1) or point (a) of Article 9 (2) , is based in, and there is no other legal basis for the processing; (c) the data subject objects to the processing in accordance with Article 21 (1), and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing in accordance with Article 21 (2); (d) the personal data have been unlawfully processed; (e) the personal data must be erased in order to comply with a legal obligation imposed on the controller by Union or Member State law; (f) the personal data are collected in connection with an offer of information society services as referred to in Article 8, paragraph 1.2. Where the controller has disclosed the personal data and is required to erase the personal data in accordance with paragraph 1, it shall take reasonable steps, including technical measures, to inform controllers processing the personal data, taking into account the available technology and the costs of implementation. state that the data subject has requested the controllers to erase any link to, or copy or reproduction of such personal data. 3. Paragraphs 1 and 2 do not apply insofar as processing is necessary: a. (a) for the exercise of the right to freedom of expression and information; (b) for the fulfillment of a legal processing obligation imposed on the controller by Union or Member State law, or for the performance of a task carried out in the public interest or exercise of official authority vested in the controller; (c) for reasons of public interest in the field of public health in accordance with points (h) and (i) of Article 9 (2) and Article 9 (3); (d) with the for archiving in the public interest, scientific or historical research or statistical purposes in accordance with Article 89 (1), to the extent that the right referred to in paragraph 1 is likely to render impossible or seriously jeopardize the achievement of the purposes of that processing e) for the establishment, exercise or defense of legal claims Article 82: Right to compensation and liability 1. Anyone who has suffered material or non-material damage as a result of an infringement of this Regulation has the right to receive compensation from the controller or processor for the damage suffered. 2. Any controller involved in processing is liable for damage caused by processing in breach of this Regulation. A processor is only liable for the damage caused by processing if the processing does not fulfill the obligations specifically addressed to processors under this Regulation or acts outside or in violation of the lawful instructions of the controller. 3. A controller or processor shall be exempted from liability under paragraph 2 if it proves that it is in no way responsible for the event causing the damage. 4. Where several controllers or processors are involved in the same processing, and are responsible for damage caused by processing in accordance with paragraphs 2 and 3, each controller or processor shall be held liable for the entire damage in order to ensure that the data subject is actually compensated. . Where a controller or processor has made full compensation for the damage in accordance with paragraph 4, that controller or processor may recover from other controllers or processors involved in the processing the part of the compensation corresponding to their share of liability for the damage, in accordance with the conditions set out in paragraph 2. 6. Legal proceedings for exercising the right to compensation are conducted before the courts with jurisdiction under Article 79 (2). Personal Data Protection Act Article 8 Personal data may only be processed if: the data subject has given his unambiguous consent for the processing; the data processing is necessary is for the performance of a contract to which the data subject is a party, or for taking pre-contractual measures in response to a request from the data subject and which are necessary for the conclusion of a contract; the data processing is necessary to comply with a legal obligation to which the controller is subject; e data processing is necessary to safeguard a vital interest of the data subject; the data processing is necessary for the proper performance of a public-law task by the relevant administrative body or administrative body w to which the data are provided, whether the data processing is necessary for the defense of the legitimate interest of the controller or of a third party to whom the data are disclosed, unless the interest or fundamental rights and freedoms of the data subject, in particular the right to protection of privacy prevails. 1 Court of Overijssel 18 July 2018, ECLI: NL: RBOVE: 2018: 2496.2 AbRS 21 February 2018, ECLI: NL: RVS: 2018: 593 and HR 15 March 2019, ECLI: NL: HR: 2019: 376.3 ECLI: NL: RVS: 2019: 181.4 ECLI: NL: RVS: 2020: 898, ECLI: NL: RVS: 2020: 899, ECLI: NL: RVS: 2020: 900 and ECLI: NL: RVS: 2020: 901.5 See the decision of the AbRS of 2 February 2011, ECLI: NL: RVS: 2011: BP2842.