RVS - 201907404/1/A3
From GDPRhub
| RVS - 201907404/1/A3 | |
|---|---|
 | |
| Court: | RVS (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 15(1) GDPR Article 23(1)(d) GDPR Article 23(1)(e) GDPR Article 23(1)(g) GDPR Article 23(1)(h) GDPR Article 23(1)(i) GDPR Art. 8 EVRM Art. 3 ICRC |
| Decided: | 27.07.2021 |
| Published: | 27.07.2021 |
| Parties: | Claimant Minister of Primary and Secondary Education and Media |
| National Case Number/Name: | 201907404/1/A3 |
| European Case Law Identifier: | ECLI:NL:RVS:2021:1613 |
| Appeal from: | Rb. Amsterdam AMS 19/181 |
| Appeal to: | |
| Original Language(s): | Dutch |
| Original Source: | Rechtspraak.nl (in Dutch) |
| Initial Contributor: | n/a |
The Dutch Council of State confirms the restrictions of Art. 23(1)(h) GDPR on the right of access (Art. 15 GDPR) after reasonable balancing the public interest against the individual interest of the data subject.
English Summary
Facts
Following alleged sexual abuse, the appellants requested the Inspection of Education to allow them to access documents and obtain a copy of all documentation concerning reports, announcements and/or questions made by, through or about the school community and submitted to (confidential) inspectors or staff members. More specifically, the appellants wish to obtain a copy of all documents known to the Inspection regarding the alleged sexual abuse. This request was rejected by the Minister through the decision of 21 November 2016 since (1) it was unclear to whose personal data the request was related, (2) the national law does not provide the right to obtain a copy but to access, and (3) the Dutch Education Supervision Act guarantees full confidentiality. By decision of 8 December 2017, the Minister provided a number of documents containing personal data of appellant A and his son in full and a number of documents in part. Insofar as more personal data of the appellants were held by the confidential inspector, the Minister refused access due to the above-mentioned confidentiality. By decision of 27 November 2018, the Minister dismissed the appellants' objection to the decision of 21 November 2016 as unfounded. The granting and partial refusal of the decision of 8 December 2017 were enforced in the appeal. The Amsterdam District Court declared in its decision of 29 August 2019 that the appeal lodged by the appellant was unfounded. With regard to the appellants' documents and other data, which are held by the confidential inspector and to which the above-mentioned confidentiality (Section 6(4) of the Dutch Education Supervision Act) applies, the District Court ruled that the Minister was entitled to refuse access to these documents, insofar as they are present and contain personal data of the appellants, on the grounds of this confidentiality. In this respect, the Court referred to the exceptions mentioned in the first paragraph of article 41 of the Dutch Personal Data Protection Regulation Implementing Act, more specifically article 41, paragraph 1, section h. The Minister was also entitled to refuse the other documents, insofar as they are present and contain personal data of the appellants, because of the general interest in the proper performance of the duties of the confidential adviser on the grounds of article 6, paragraph 6 of the Dutch Education Control Act. The appellants lodged an appeal against this judgment. According to the appellants, the court failed to recognise the lack of legal protection for children in situations where an educational institution does not comply with its obligation to report a reasonable suspicion of a moral offence. Furthermore, the appellants argue that in connection with the mental state of the children and their parents, who have already suffered from the situation, it is important that all information is made public and that there is clarity about the actions of the competent authority. The disclosure of all information serves a high public interest. Not disclosing all the information would constitute a violation of article 3 ICRC and articles 3 and 8 ECHR, because the signatory states are under a positive obligation to safeguard the physical and sexual integrity of a child. The appellants believe that this is not guaranteed by the current regulations. Judgement: With regard to the question of whether Article 6, 4th and 6th paragraphs of the Dutch Education Supervision Act and Article 41, 1st paragraph, opening words and under (h) of the Dutch General Data Regulation Implementing Act should have been left out of application in this case because of the violation of Articles 3 and 8 ECHR and Article 3 ICRC, or whether this should be referred to as a positive obligation to provide access to all processing of personal data requested, the question is answered negatively by the Division of the Council of State. The following considerations support the decision: There is no ground for the Minister taking the interests of the children of the comprehensive school insufficiently in the decision-making process. The Minister has explained that the disclosure of what has been entrusted to a confidential inspector in the performance of his duties by a student, the parents of a student or a person charged with tasks on behalf of an institution about a case of sexual abuse, will result in a lower willingness to report. It is therefore essential for the proper functioning of the inspector that communication in response to such reports takes place in the utmost confidentiality. The Minister has explained that parents and their children who attend schools benefit from this, because it allows cases of sexual abuse to come to light more quickly or to be prevented, as opposed to when the Inspector of is not subject to such confidentiality. In view of the above, the Council of State believes that the Minister took the interests of the children of the comprehensive school and of children in general very much into account in the decision-making. Article 6, 4th and 6th paragraphs, of the Dutch Education Supervision Act and Article 41, first paragraph, opening words and under h, of the Dutch General Data Protection Regulation Implementing Act provide for the interference of any public authority with the right to respect for private life when granted by law, as in Article 8, second paragraph, ECHR. The interference is also necessary to prevent the disclosure of communication that have been made in confidence. In view of the general interest of preventing and combating sexual abuse, it is of great importance that the Inspector can function properly and that communication with him about reports of sexual abuse remains confidential. By allowing the aforementioned general interest to prevail over the appellant's interest in gaining access to all the requested processing of personal data, a reasonable balancing of interests has taken place and the required 'fair balance' under Article 8 of the ECHR has been met. For that reason alone, there is no violation of Article 8 of the ECHR. The appeal was dismissed as unfounded.
Dispute
Holding
The Dutch Council of State deems restrictions on the right of access (Art. 15 GDPR) according to Art. 23 (1)(h) GDPR legitimate after reasonable balancing the public interest against the individual interest of the data subject.
In this particular case the confidentiality, provided by national law, of the Inspectors of school communities outweighed the specific interest of a data subject.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
Body
Council of State
Date of judgment
21-07-2021
Date of publication
21-07-2021
Case number
201907404/1/A3
Jurisdictions
Administrative law
Special characteristics
Appeal
Content indication
By decision of 21 November 2016, the Minister for Primary and Secondary Education and Media rejected the request of [appellant] and others for copies of documents under the Personal Data Protection Act. By decision of 8 December 2017, the Minister has provided a number of documents containing personal data of [appellant] and others in full, a number of documents containing their personal data partially and, insofar as these exist, a number of documents containing their personal data have not been provided. [appellant] and others requested the Education Inspectorate by letter dated 8 September 2016 on the basis of the Wbp to: "all documentation in your possession regarding reports and/or announcements and/or questions from, by, or about the Cheider comprehensive school that has been made or submitted to your (trust) inspectors or employees otherwise in the broadest sense of the word.
Locations
Rechtspraak.nl
Education Total 2021/1319
Enhanced pronunciation
Share pronunciation
print
Save as PDF
Copy link
Pronunciation
201907404/1/A3.Date of ruling: 21 July 2021
DEPARTMENT OF ADMINISTRATIVE JURISDICTION
Decision on the appeal of:
[appellant], residing at [residence], and others, residing at [residence],
appellants,
against the judgment of the Amsterdam District Court of 29 August 2019 in case no. 19/181 in the proceedings between:
[appellant] and others
and
the Minister for Primary and Secondary Education and the Media.
Process sequence
By decision of November 21, 2016, the Minister rejected the request from [appellant] and others for copies of documents on the basis of the
Personal Data Protection Act (hereinafter: Wbp) rejected.
By decision of 8 December 2017, the Minister has provided a number of documents containing personal data of [appellant] and others in full, a number of documents containing their personal data partially and, insofar as these exist, a number of documents containing their personal data have not been provided.
By decision of 27 November 2018, the Minister declared the objection lodged by [appellant] and others against these decisions unfounded.
By judgment of 29 August 2019, the court dismissed the appeal lodged by [appellant] and others against it as unfounded. This statement is attached.
The appellant and others appealed against this decision.
The minister has given a written explanation.
The Division dealt with the case at the hearing on 7 December 2020, where [appellant] and others, represented by [authorized representative A] and [authorized representative B], and the minister, represented by mr. D.W. Mulder, have appeared.
After the hearing was closed, the Division reopened the investigation.
The Division has taken cognizance of the documents submitted by the Minister invoking Article 8:29 of the General Administrative Law Act (hereinafter: Awb), after [appellant] and others had given permission for this, as referred to in Article 8:29, fifth. member of the Awb.
The Division continued to deal with the case at the session of 17 June 2021, where [appellant] and others, represented by [Agent A] and [Agent B], and the Minister, represented by mr. D.W. Mulder and Y. Schouten, have appeared.
Considerations
Introduction
1. Appellant] and others requested the Education Inspectorate in a letter dated 8 September 2016 on the basis of the Wbp to:
"all documentation in your possession regarding reports and/or announcements and/or questions from, by, or about the Cheider school community that have been made or posed to your (trust) inspectors or employees otherwise in the broadest sense of the word. More in particular, clients wish to obtain a copy of all documents known to your Inspectorate regarding the alleged (sexual) abuse or abuse that would have been committed, whether or not by [name of person], or others, at the Cheider school community. in Amsterdam. In addition, my clients wish to obtain a copy and to obtain access to all contacts that your inspection has had, in particular whether and when information has been exchanged about the aforementioned abuse".
In the decision of 21 November 2016, the Minister rejected the request of [appellant] and others, because the request did not show whose personal data the request was related to, because the Wbp does not grant the right to copies but to inspection and because of the absolute confidentiality regime of Article 6(4) of the Education Supervision Act (hereinafter: Wot).
By decision of 8 December 2017, the minister provided a number of documents with personal data of [authorized representative A] and his son held by the confidential inspector in full and a number of documents in part. To the extent that more personal data of [applicant] and others would be in the custody of the confidential inspector, the minister refused access to them, referring to Article 6(4) of the Wot.
By decision of 27 November 2018, the Minister declared the objection lodged by [appellant] and others against the decision of 21 November 2016 unfounded. The provision and partial refusal from the decision of 8 December 2017 have been upheld in objection, albeit with reference to the General Data Processing Regulation (hereinafter: AVG) and the General Data Processing Regulation Implementing Act (hereinafter: Implementation Act) which replace the Wbp in have come into effect.
Attacked verdict
2. The court declared the appeal unfounded. For documents containing personal data of [appellant] and others and other data held by the confidential inspector and to which Article 6(4) of the Wot applies, the court has ruled that the minister can inspect these documents, insofar as they are present. and contain personal data of [appellant] and others, on the basis of the absolute confidentiality regime of Article 6(4) of the Wot. In this context, the court also refers to the exceptions referred to in the first paragraph of Article 41 of the Implementation Act, in particular the exception referred to in the first paragraph, preamble and under h. With regard to documents containing personal data of [appellant] and others and other data that are held by the confidential inspector and to which Article 6(4) of the Wot does not apply, the court has ruled that for the notification by the competent authority of the school community and the painted off parts of two e-mail messages provided to [appellant] and others, it applies that these do not contain [appellant] and others concerning personal data. Of the other documents, insofar as they are present and contain personal data of [applicant] and others, the minister was also allowed to refuse inspection on the grounds of the public interest in the proper performance of his duties by the confidential inspector, but then on the basis of Article 6(6) of the the Wot.
The court has ruled that the documents containing personal data and other data that are not held by the confidential inspector and to which Article 6(4) of the Wot do not apply, do not contain [applicant] and others relating to personal data.
Legislation
3. The relevant laws and regulations are included in the appendix to this ruling. This appendix is part of the ruling.
Appeal
4. [appellant] and others argue that the court erred in ruling that the appeal is unfounded.
According to [appellant] and others, the court failed to recognize the lack of legal protection for children in situations where an educational institution does not fulfill its obligation to report a crime in the event of a reasonable suspicion of a crime against morality. According to [appellant] and others, the confidential inspector has no effective means of coercion to bring about a report by the competent authority.
Furthermore, [appellant] and others argue that in connection with the mental state of the children and their parents, who have already suffered from the situation, it is important that all information is made public and that clarity is created about the action taken by the competent authority. According to [appellant] and others, making all information public also serves a great social interest. Failure to disclose all information violates Article 3 of the Convention on the Rights of the Child (hereinafter: CRC), and Articles 3 and 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms ( hereinafter: ECHR), because the Contracting States have a positive obligation to guarantee the physical and sexual integrity of a child. This is not guaranteed by the current regulations. As a result, according to [appellant] and others, there is no possibility of an "effective investigation" as referred to in Article 3 of the ECHR in conjunction with Article 3 of the CRC.
Finally, [appellant] and others argue that the minutes of the court hearing are incomplete and incorrect on a number of points.
Rating
5. The Division finds that the grounds on appeal do not focus on the parts of the decision of the District Court in which it assessed whether the Minister [appellant] and others were allowed to refuse access to the personal data concerning them on the basis of Article 6, fourth and sixth paragraphs of the Wot and the ground for refusal from Article 41, first paragraph, opening words and under h, of the Implementation Act. It is therefore no longer in dispute that the Minister has rightly refused access to certain personal data concerning them within the framework of Article 6(4) and (6) of the Wot and Article 41(1)(h) of the Implementation Act. [Applicant] and others have to do with the fact that this legislation offers the possibility to refuse access to certain processing of personal data in this case. According to [appellant] and others, the application of these provisions in the case at issue here conflicts with Article 3 of the CRC and Articles 3 and 8 of the ECHR.
6. The Division considers the following regarding the argument that there is no effective means of coercion to have the competent authority comply with the obligation to report. Article 4a, second paragraph, of the Primary Education Act (hereinafter: Wpo) and Article 3, second paragraph, of the Secondary Education Act (hereinafter: Wvo) provide that the competent authority of a school, after consultation with the confidential inspector, must report without delay if there is a reasonable suspicion of a sex crime. Pursuant to Article 164, first paragraph, of the Wpo and Article 104, first paragraph, of the Wvo, the minister can determine that the funding of the school will be withheld or suspended if the competent authority of a school acts contrary to the Wpo or the Wvo. . In view of this, the minister rightly takes the position that there are means to induce the competent authority to file a report. Insofar as the argument of [appellant] and others must be interpreted as a plea for an alternative to this funding sanction to be included in the law, this cannot be discussed in these proceedings. These appeal proceedings concern the Wbp request submitted by [appellant] and others. This argument is not related to the Wbp, the AVG, the Implementation Act and the decision-making on the Wbp request.
7. Insofar as [appellant] and others argue that the official report of the appeal hearing is incorrect and incomplete, the Division considers that an official report pursuant to Article 8:61(5) of the Awb contains a statement of what occurred at the hearing regarding the case. It does not contain a literal representation of everything that was said by those present (compare, for example, the judgment of the Department of 17 June 2015, ECLI:NL:RVS:2015:1896). In this argument of [appellant] and others, the Division sees no reason to conclude that the investigation at the hearing in the first instance was incomplete. This argument therefore does not lead to annulment of the judgment under appeal.
8. The Division is faced with the question of whether Article 6, paragraphs 4 and 6, of the Wot and Article 41, paragraph 1, opening words and under h, of the Implementation Act should have been disapplied in this case due to a violation of Article 3 and Article 8 of the ECHR and Article 3 of the CRC, or whether this is a positive obligation to provide access to all processing of personal data that has been requested. That question is answered in the negative. To this end, the following is considered.
8.1.
As the Division previously ruled in its judgment of 1 April 2020, ECLI:NL:RVS:2020:922, Article 3 of the CRC has direct effect. This is so to the extent that the article aims that the best interests of the child concerned must be taken into account in all measures concerning children. With regard to the weight to be given to the best interests of a child in a specific case, Article 3(1) of the CRC does not contain, given its wording, a standard that is unconditional and sufficiently precise to be used in the national legal order without to be applied more as an objective law. In this context, the administrative court must, however, assess whether the administrative authority has taken sufficient account of the interests of the child and has therefore remained within the limits of the law when exercising its powers.
There is no basis for the opinion that the minister has not sufficiently taken into account the interests of the children of the Cheider school community in the decision-making process. To that end, it is considered that Article 6(4) and (6) of the Wot should be given a lot of weight precisely for the sake of safety for children in education. The minister explained that the disclosure of what has been entrusted to the confidential inspector in the performance of his duties by an educational participant, the parents of an educational participant or a person entrusted with tasks for an institution about a case of sexual abuse, a lower willingness to report. will cause them. In view of this, it is essential for the proper functioning of the confidential inspector that communication in response to such reports takes place in the utmost confidentiality. The minister explained that parents and their children in education benefit from this, because in this way cases of sexual abuse come to light or are prevented earlier than if there were no special confidentiality regime for the confidential inspector. Contrary to what [appellant] and others argue, this serves the purpose of Article 6(4) and (6) of the Wot. For the same reasons, by invoking the ground for refusal from Article 41, first paragraph, opening words and under h, of the Implementation Act, the Minister has served the interests of safety for children in education through protection against sexual abuse.
In view of the above, the Division is of the opinion that in the decision-making process the Minister has taken great account of the interests of the children of the Cheider comprehensive school and of children in general. In doing so, he was allowed to let the interest of their safety in education outweigh the interest of [appellant] and others in accessing all processing of personal data requested. The appeal to Article 3 of the CRC fails.
8.2.
Under Article 3 of the ECHR, no one shall be subjected to torture or to inhuman or degrading treatment or punishment. [appellant] and others have not substantiated that the refusal to provide access should be regarded as torture or inhuman or degrading treatment. The confidentiality on which the refusal is based is of great importance for the proper functioning of the Education Inspectorate in general and the confidential inspector in particular. Preventing sexual abuse, which can be regarded as inhuman or degrading treatment, benefits from this. The special secrecy regime of the Wot and the ground for refusal of the Implementation Act contain reasonable measures to protect against these inhuman or degrading treatment. In view of this, it has not been established that Article 3 of the ECHR has been violated. In this case, there is also no positive obligation under Article 3 of the ECHR to provide access to all processing of personal data that has been requested.
8.3.
Under Article 8(1) of the ECHR, everyone has the right to respect for his private life. Insofar as the refusal to provide access to all processing of personal data that has been requested constitutes an interference with this right, the Division is of the opinion that no violation thereof or a positive obligation to inspect all requested information can be assumed. Under Article 8, paragraph 2, of the ECHR, interference by any public authority with this right is permitted insofar as the interference is provided for by law and is necessary in a democratic society in the interests of the prevention of criminal offences, the protection of morality or for the protection of the rights and freedoms of others.
The interference is provided for by law in Article 6, paragraphs 4 and 6, of the Wot and Article 41, paragraph 1, opening words and under h of the Implementation Act. The interference is also necessary to prevent the dissemination of communications made confidentially. In view of the general interest in preventing and combating sexual abuse, it is of great importance that the confidential inspector can function properly and that communication with him about reports of sexual abuse remains confidential.
By allowing the aforementioned public interest to prevail over the interests of [appellant] and others in accessing all processing of personal data requested, a reasonable weighing of interests has taken place and the required 'fair balance' in the context of Article 8 of the the ECHR. For that reason alone, there is no conflict with Article 8 of the ECHR.
The judgment of the European Court of Human Rights (hereinafter: Court) of 26 March 1985, ECLI:NL:XX:1985:AC8813 (X. and Y. t. Nederland) does not help [appellant] and others. In that case, the Court ruled that Article 8 of the ECHR had been infringed because of a gap in the Criminal Code. This gap resulted in the fact that no complaint could be filed against the perpetrator on behalf of an abused sixteen-year-old victim, because the victim was unable to do so due to a mental disability and could not be placed under guardianship due to her age. In this case, it was up to the Dutch state to take protective measures. The facts on the basis of which the Court of Appeal came to the conclusion that the Dutch State had to implement that positive obligation are essentially different from the facts in the present case. It cannot be concluded from the judgment that the positive obligation for the State to guarantee the rights under Article 8 of the ECHR also includes an obligation to provide access to confidential information about highly sensitive abuse cases.
In view of the above, the reliance on Article 8 of the ECHR does not succeed.
9. The arguments fail.
Conclusion
10. The appeal is unfounded. The impugned verdict must be affirmed.
11. The minister is not required to reimburse legal costs.
Decision
The Administrative Jurisdiction Division of the Council of State:
confirms the attacked statement.
Adopted by mr. J.A.W. Scholten-Hinloopen, chairman, and mr. J.J. van Eck and mr. J. Gundelach, members, in the presence of mr. A.M.E.A. Neuwahl, clerk.
The chairman is unable to sign the decision.
The clerk is unable to sign the decision.
Pronounced in public on July 21, 2021
280-898.
APPENDIX
Law for the protection of personal information
1. The data subject has the right to contact the controller freely and at reasonable intervals with a request to inform him or her whether personal data concerning him are being processed. The responsible party will inform the data subject in writing within four weeks whether personal data concerning him/her will be processed.
2 If such data are processed, the communication shall contain a complete overview in comprehensible form, a description of the purpose or purposes of the processing, the categories of data to which the processing relates and the recipients or categories of recipients, as well as the available information about the origin of the data.
[…]
Education Supervision Act
Article 6
[…]
4. In so far as it concerns a case of sexual abuse or sexual intimidation as referred to in the first paragraph, under a or b, the confidential inspector is obliged to observe secrecy with regard to what has been entrusted to him in the performance of his duties by an educational participant, the parents of a educational participant or a person entrusted with tasks on behalf of an institution.
[…]
6. The confidential inspector will not provide the data collected by him to third parties. Only abstracted data is included in the report on the state of education, as referred to in Article 8, second paragraph.
[…]
Primary Education Act
Article 4a Obligation to consult and report sexual offences
1. If the competent authority has become aware in any way that a person entrusted with tasks for the benefit of his school may be guilty or has committed an offense against morality as referred to in Title XIV of the Criminal Code against a pupil of the school, the competent authority will immediately consult with the confidential inspector, as referred to in Article 6 of the Education Supervision Act.
2. If it must be concluded from the consultation referred to in the first paragraph that there is a reasonable suspicion that the person concerned has committed an offense as referred to in the first paragraph against a student of the school, the the competent authority shall immediately report the matter to an investigating officer as referred to in Article 127 in conjunction with Article 141 of the Code of Criminal Procedure, and the competent authority shall immediately inform the confidential inspector thereof. Before the competent authority proceeds to make a report, it will inform the parents of the pupil concerned, or the relevant person charged with tasks on behalf of the school.
[…]
Article 164 Withholding funding
1. If the competent authority of a school or the partnership acts contrary to the provisions of or pursuant to this Act, which also includes failure to comply with an instruction as referred to in Section 163b, Our Minister may determine that the funding, advances including, is withheld or suspended in whole or in part.
[…]
Secondary Education Act
Article 3 Obligation to consult and report sexual offences
1. If the competent authority has become aware in any way that a person entrusted with tasks for the benefit of his school may be guilty or has committed a crime against morality as referred to in Title XIV of the Criminal Code against a minor pupil of the school, the competent authority will immediately consult with the confidential inspector, as referred to in Article 6 of the Education Supervision Act.
2. If it must be concluded from the consultation referred to in the first paragraph that there is a reasonable suspicion that the person concerned has committed an offense as referred to in the first paragraph against a minor pupil at the school, the competent authority shall immediately report the matter to an investigating officer as referred to in Article 127 in conjunction with Article 141 of the Code of Criminal Procedure, and the competent authority shall immediately inform the confidential inspector thereof. Before the competent authority proceeds to make a report, it will inform the parents of the pupil concerned, or the relevant person charged with tasks on behalf of the school.
[…]
Article 104 Withholding funding
1. If the competent authority of a school or the partnership acts contrary to the provisions of or pursuant to this Act, which also includes failure to comply with an instruction as referred to in Article 103g, Our Minister may determine that the funding, advances including, is withheld or suspended in whole or in part.
[…]
Convention on the Rights of the Child
Article 3
1. In all measures concerning children, whether taken by public or private social welfare institutions or by courts, administrative authorities or legislative bodies, the best interests of the child shall be a primary consideration.
[…]
Convention for the Protection of Human Rights and Fundamental Freedoms
Article 8 Right to respect for private and family life
1. Everyone has the right to respect for his private and family life, his home and his correspondence.
2. No interference by any public authority is permitted in the exercise of this right, except to the extent provided for by law and necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country , the prevention of disorder and crime, the protection of health or morals or the protection of the rights and freedoms of others.
General Data Protection Regulation
Article 15 Right of access of the data subject
1. The data subject has the right to obtain confirmation from the controller as to whether or not personal data concerning him/her is processed and, where that is the case, to obtain access to those personal data and to the following information:
a. a) the processing purposes;
b) the categories of personal data concerned;
(c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
d) if possible, the period for which the personal data are expected to be stored, or if that is not possible, the criteria for determining that period;
e) that the data subject has the right to request from the controller that personal data be rectified or erased, or that the processing of personal data concerning him/her be restricted, as well as the right to object to such processing;
f) that the data subject has the right to lodge a complaint with a supervisory authority;
g) where the personal data are not collected from the data subject, any available information about the source of that data;
(h) the existence of automated decision-making, including the profiling referred to in Article 22(1) and (4), and, at least in those cases, useful information about the underlying logic as well as the importance and
expected consequences of that processing for the data subject.
[…]
3. The controller shall provide the data subject with a copy of the personal data being processed. If the data subject requests additional copies, the controller may charge a reasonable fee based on the administrative costs. Where the data subject submits his request electronically, and does not request another arrangement, the information shall be provided in a commonly used electronic format.
[…]
Article 23 Restrictions
1. The scope of the obligations and rights referred to in Articles 12 to 22 and Article 34, as well as in Article 5 may, insofar as the provisions of those Articles correspond to the rights and obligations referred to in Articles 12 to 20 , are limited by provisions of Union or Member State law to which the controller or processor is subject, provided that such limitation does not affect the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to ensure by:
[…]
d. the prevention, investigation, detection and prosecution of criminal offenses or the execution of criminal penalties, including protection against and prevention of threats to public security;
e. other important objectives of general interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and fiscal matters, public health and social security;
[…]
g. the prevention, investigation, detection and prosecution of violations of professional codes for regulated professions;
h. any supervisory, inspection or regulatory function related, even occasionally, to the exercise of official authority in the cases referred to in points (a), to (e) and (g);
i. the protection of the data subject or the rights and freedoms of others;
[…]
Implementation Act General Data Protection Regulation
Article 41 Exceptions to data subject rights and obligations of controller
1. The controller may waive the obligations and rights referred to in Articles 12 to 21 and Article 34 of the Regulation insofar as this is necessary and proportionate to ensure:
[…]
d. the prevention, investigation, detection and prosecution of criminal offenses or the execution of criminal penalties, including protection against and prevention of threats to public security;
e. other important objectives of general interest of the European Union or of the Netherlands, in particular an important economic or financial interest of the European Union or of the Netherlands, including monetary, budgetary and tax matters, public health and social security;
[…]
g. the prevention, investigation, detection and prosecution of violations of professional codes for regulated professions;
h. a task in the field of supervision, inspection or regulation that is related, even occasionally, to the exercise of public authority in the cases referred to in subparagraphs a, b, c, d, e and g;
i. the protection of the data subject or the rights and freedoms of others; or
[…]
