Rb. Overijssel - AK 20 2097
From GDPRhub
| Rb. Overijssel - AK_20_2097 | |
|---|---|
 | |
| Court: | Rb. Overijssel (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 15 GDPR Article 17(1) GDPR Article 21(1) GDPR Article 82(1) GDPR |
| Decided: | 11.08.2021 |
| Published: | 12.08.2021 |
| Parties: | Joint Tax office Lococensus Tricijn |
| National Case Number/Name: | AK_20_2097 |
| European Case Law Identifier: | ECLI:NL:RBOVE:2021:3168 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Dutch |
| Original Source: | Rechtspraak.nl (in Dutch) |
| Initial Contributor: | n/a |
The District Court held that a mere breach of the AVG without prejudice to the integrity of a person does not necessarily lead to compensation under Art. 82 GDPR . The Court rejected the damages for material and immaterial damage as the applicant had not sufficiently demonstrated the adverse effects that the disclosure of the data had on him. The court emphasises that there are no indications that the data have been misused.
English Summary
Facts
In June 2019, the defendant, the Dutch Tax Office ('Gemeenschappelijke belastingkantoor Lococensus-Tricijn', 'GBLT'), addressed a letter to the claimant. However, the destination of the letter was the claimant's old residential address. The claimant sent an email to the defendant, drawing attention to this error and emphasising that, as a result, his personal data had reached a third party. The claimant requested that the defendant rectify this, and demonstrate that the data has been destroyed. In its response, the defendant apologised, and proposed that the appropriate action would be to ask the third party to delete the relevant data and confirm this. The claimant indicated they were unable to respond to this proposal until certain ambiguities were resolved regarding the content of the leaked data.
In August 2019, the claimant sent an email to the defendant, in which he stated that it appeared
the claimant requested more information relating to the specific processing of the defendant's customer research. Specifically, the claimant asked to what extent it has given its consent to share its data with third parties to carry out this processing. The Respondent considers this processing to be part of its statutory duties and therefore it does not consider it necessary to rely on the consent of the data subjects. The Respondent emphasises that only the email address is processed and considers the writing to be a right of objection, so the email address is deleted for this purpose.
Several months later, on 16 February 2020, the claimant asked for more information about the initial data breach. It is not clear to him to which documents the data leak refers. The claimant also put the defendant in default as the deadline for responding to the June 2019 request is well past. I need to add here the customer research, and the not responding in time.
On 28 February 2020, by primary decision, the defendant granted the claimant access to the disclosure of personal data relating to him by the defendant to third parties. The defendant indicated which personal data had been transmitted to which recipients and for which processing purposes. The defendant also confirmed that the claimant's email address had bee processed by third parties for customer research, and indicated that the email address would be deleted in relation to such a purpose. Finally, the Defendant states that it does not owe the claimant a penalty payment for failing to respond in time.
In addition, the respondent has informed the claimant that his e-mail address has been removed for the purpose of conducting customer research. Furthermore, in the primary decision, the defendant established that it does not owe the plaintiff a penalty for failing to make a timely decision on the request.
The claimant objected to the primary decision on 2 April 2020. On 17 April, the defendant acknowledged receipt of the objection and adjourned the decision on the objection for six weeks because a physical hearing is not possible due to the corona measures. On 1 July 2020, the claimant notified the defendant of its failure to decide on the objection in time.
On 18 August 2020, a hearing took place, at which an audio recording was made. At the end and after the hearing, the defendant was requested by the claimant to provide him with the audio recording. On 26 August 2020, the Chairperson of the Hearing Committee informed the claimant that the sound recording, after a written record of the hearing had been made, had been destroyed. The Defendant confirms the contested decision and reiterates its views with regard to the personal data processed, processing for customer surveys and the penalty payment.
The claimant brings the case before the court as he is convinced that he was not given full access to the documents and the correct use of the audio recording. The claimant also expresses his objection to the processing of his email address for customer research purposes. Lastly, the claimant seeks compensation for the failure to act in a timely manner and for the unlawful disclosure of personal data to third parties.
Documents were missing from the request for inspection
Processed the email for customer research purposes
Failure to comply with request in timely manner (not GDPR).
The provision of his personal data to third parties through the letter of 25 June 2019
The provision of his email address to KCM.
Holding
With regard to the completeness of the data provided, the correct use of the audio recording and the processing of the e-mail address for the customer survey, the court considered that there is no reason to doubt the fefendant's position. Regarding the hearing, the legal requirements and agreements were followed.
The court is of the opinion that the claimant has not made it likely that documents would be missing from the request for inspection. The mere existence of a suspicion is not sufficient in this context. The court refers to a judgment of the ABRvS of 31 March 2021 (ECLI:NL:RVS:2021:675). According to the Court, the Defendant also acted in accordance with Articles 17(1) and 21(1) of the GDPR when processing the e-mail address for customer research purposes and when complying with the claimant's request.
With respect to the damages for failure to timely decide on the claimant's request, the Court finds that the defendant responded in a timely and correct manner based on the primary decision.
Finally, with respect to the damages for the harm suffered as a result of the unlawful disclosure of his personal data to third parties, the court states the following (emphasis added):
“The court is of the opinion that the claimant has not demonstrated that he suffered material or immaterial damage as a result of the provision of his personal data to third parties through the letter of 25 June 2019 or the provision of his e-mail address (for the first time) to KCM. . Plaintiff has not substantiated his claim that this is the case. In the opinion of the court, a situation does not arise in which the adverse consequences of the (alleged) violation of standards are obvious. It is not about seriously culpable behavior with consequences so serious that it must be qualified as an infringement of a fundamental right. In the opinion of the court, it is not the case that an infringement of the GDPR automatically implies an infringement of the integrity of a person and thus leads to compensable damage. Plaintiff has not made it clear why the provision of personal data concerning him in the mistakenly addressed letter or the provision of his e-mail address for customer research can be qualified as infringement of his person. Nor has he made plausible what adverse consequences the provision of this information had for him. There is no indication that the data has been misused. Therefore, the court will also reject the claim for damages insofar as it is related to the letter of June 25, 2019 and the provision of the plaintiffs e-mail address to KCM. It follows from this that it is not clear whether the provision of the e-mail address for customer research was lawful or not.”
Comment
In the above case, the court is of the opinion that no non-material damage has been suffered because the plaintiff does not substantiate his claim and it is of the opinion that there is no situation here in which the adverse consequences of the breach of the norm are obvious. The court finds that there are no indications that the data have been misused.
This is in contrast to a case before the District Court of Rotterdam on 12 July 2021, case number ROT 20/3286 (ECLI:NL:RBROT:2021:6822) and another Dutch case before the Council of State on 1 April 2020, case number 201901006/1/A2 (ECLI:NL:RVS:2020:898) in which the Council decided that, because of the unlawful processing of personal data, non-material damage had been suffered.
The court's reasoning here was that it was possible that the data had been misused.
Both cases are diametrically opposed to each other, since in the case discussed here the court ruled that misuse must be demonstrated, whereas in the other cases a possibility of misuse suffices for compensation of immaterial damage.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
Body
Court of Overijssel
Date of judgment
11-08-2021
Date of publication
12-08-2021
Case number
ak_20 _ 2097
Jurisdictions
Administrative law
Administrative procedural law
Special characteristics
First instance - single
Content indication
GDPR; permission to delete sound recording; audio recording of an interview cannot further be regarded as a dispute; authority hearing committee; the claimant has not made it plausible that more personal data has been provided; object to processing e-mail address for customer research; rejection of claim for compensation; appeal unfounded,
Locations
Rechtspraak.nl
Enhanced pronunciation
Share pronunciation
print
Save as PDF
Copy link
Pronunciation
COURT OVERIJSSEL
Seating place Zwolle
Administrative law
case number: AWB 20/2097
decision of the single chamber in the case between
[claimant] , at [place of residence] , claimant,
and
the day-to-day management of the joint tax office Lococensus-Tricijn (GBLT), defendant,
authorized representative: [name 1] .
Process sequence
By decision of 28 February 2020 (the primary decision), the respondent granted the claimant access to the provision of personal data concerning him by GBLT to third parties. In addition, the respondent has informed the claimant that his e-mail address has been removed for the purpose of conducting customer research. Furthermore, in the primary decision, the defendant established that it does not owe the plaintiff a penalty for failing to decide on the request in time.
By decision of September 16, 2020 (the contested decision), the defendant declared the objection of the plaintiff unfounded. In addition, the defendant has established in the contested decision that it does not owe the plaintiff a penalty for failing to make a timely decision on the objection.
Plaintiff appealed against the contested decision.
Defendant has filed a statement of defence.
The hearing took place on 1 July 2021. Plaintiff appeared. Defendant was represented by his attorney.
Considerations
Relevant facts and circumstances
1. On June 25, 2019, the respondent sent a letter addressed to the claimant to the claimant's old home address. By e-mail of July 10, 2019, Plaintiff pointed out to GBLT that it sent personal information to an incorrect address, as a result of which his personal and business data ended up with third parties. He has requested GBLT to rectify this and to ensure that this data is demonstrably destroyed.
As a result of this e-mail, an e-mail exchange took place between the claimant and [name 1], a privacy officer of GBLT ([name 1]). [name 1] acknowledges in this email exchange that the letter of 25 June 2019 was incorrectly addressed and was sent by mistake to the plaintiff's former home address. He apologizes for this on behalf of GBLT. He also indicates that in his opinion it would be an appropriate measure to ask the residents of the address what they have done with the letter and, if this has not already been done, to ask them to delete the letter and confirm this. (hereinafter: the proposal). Plaintiff indicates in the email exchange that he can only respond to the proposal if certain ambiguities and uncertainties have been sufficiently resolved for him.
In an e-mail message dated August 7, 2019, the claimant asked, among other things, from [name 1] that it appears that he has given permission for the disclosure of his e-mail address to third parties, from which it appears that KCM Survey BV (KCM) may use his data. use and in which other cases his data has been provided to third parties. In addition, he stated that GBLT should have set up its approach in a completely different way and that, due to GBLT's conduct, its e-mail address and contact details are with a third party.
By e-mail of September 5, 2019, [name 1] Plaintiff has informed that GBLT considers conducting customer due diligence as a necessary part of its statutory duties, in particular evaluating and increasing the quality of the implementation of the tax law. For this investigation, the party conducting the customer investigation was not provided with more information than necessary, namely only the plaintiff's e-mail address. Because it appears from the claimant's response that the claimant does not appreciate this, his e-mail address has been removed for this purpose.
By e-mail of October 4, 2019, [name 1] plaintiff informed that the plaintiff was not asked for permission to process his personal data in the context of the customer survey, because the invitation to participate in this customer survey is based on a legal basis .
By e-mail of 16 February 2020, the claimant requested the respondent to indicate whether the data breach relates to one or more documents. Plaintiff has indicated that he can only respond to the proposal if he has an answer to this question. In addition, the claimant gave the defendant notice of default and requested to respond to the request for information within two weeks. According to the claimant, this request is dated July 30, 2019.
In the primary decision, the defendant granted the plaintiff access to the provision of personal data concerning him by GBLT to third parties. Respondent has indicated which claimant concerning personal data has been provided to which recipients and with which processing purposes this has been done. This concerns personal data provided to the National Property WOZ, the Overijssel District Court and KCM. It also concerns the letter of 25 June 2019 that was sent by mistake to the address of a third party. In addition, with reference to the aforementioned e-mail messages of September 5, 2019 and October 4, 2019, the respondent has taken the position that KCM's customer survey is a necessary part of the tasks that GBLT performs. Defendant also informed plaintiff that his e-mail address was removed on August 23, 2019 for conducting customer research, as a result of which this personal data is no longer with KCM. Finally, the defendant established in the primary decision that it does not owe the plaintiff a penalty for failing to make a timely decision.
Plaintiff objected to the primary decision by letter dated April 2, 2020. By letter dated April 17, 2020, the defendant confirmed receipt of the notice of objection and adjourned the decision on the objection by six weeks, because due to the corona measures, a physical hearing cannot be held in the short term.
By letter dated July 1, 2020, received by the defendant on July 3, 2020, the plaintiff gave the defendant notice of default for failing to make a timely decision on the objection.
A hearing was held on August 18, 2020. An audio recording was made of this hearing. At the end of the hearing and after the hearing (by email of August 18, 2020), the Plaintiff requested the Defendant to provide him with the audio recording of the hearing. In a letter dated August 26, 2020, the chairman of the hearing committee informed the plaintiff that the audio recording had been destroyed after a written report of the hearing had been drawn up.
Contested decision
2. In the contested decision, the defendant upheld the primary decision. The defendant based this on the fact that GBLT did not provide more of the claimant regarding personal data to third parties than was already indicated in the primary decision. In addition, the respondent took the position that the processing of the claimants' personal data in the context of KCM's customer survey is lawful and that the claimant's consent was not required for this. Respondent argues that he does not owe the claimant a penalty for failing to make a timely decision on the request for inspection, because he decided on this request within two weeks of the notice of default. Furthermore, the defendant has established in the contested decision that it does not owe the plaintiff a penalty for failing to decide on the objection in time, because the notice of default was submitted before the extended decision period had expired.
Profession
3. Plaintiff cannot agree with the contested decision. The court will discuss what he has argued in this regard in the following.
Authority [name 1]
4. The court does not agree with the claimant that [name 1] is not authorized to represent the defendant in these appeal proceedings, because he has not been given a mandate to do so. [name 1] is authorized to act on behalf of the defendant, now that the defendant has authorized him to do so. This does not concern the power to take decisions in the name of the administrative body, so that no mandate is required for this. The fact that [name 1] took the primary decision on behalf of the respondent and was part of the committee that heard the claimant in the objection procedure, does not prevent him from representing the respondent in the appeal procedure. It is customary and in keeping with the role of representative that the person who explains and explains the decision-making at the hearing on behalf of the administrative body is someone who is familiar with its content and background. In this context, the court refers to a decision of the Administrative Jurisdiction Division of the Council of State (ABRvS) of 26 April 2016 (ECLI:NL:RVS:2016:1097).
Completeness of submitted documents
5.1
The claimant takes the position that the respondent has not submitted all the documents in both the objection procedure and in this appeal procedure. Plaintiff referred in particular to documents concerning internal deliberations, archival documents and documents that are located behind the tabs “notes” and “subject relationship” of the defendant's computer system. According to the claimant, these are tabs for the processing of information and this information is important to his case. Plaintiff wants access to all tabs, to communications that have not yet been shared and to archived information. Plaintiff states that due to the lack of this information, he cannot independently check whether all facts have been included in the decision-making process
5.2
Respondent states that in the objection and appeal procedure he submitted all documents relating to the request for inspection, the objection procedure and the notices of default. Insofar as internal deliberations have taken place in response to the applicant's request for inspection, this has not been laid down in a document, according to the defendant. Defendant states that the tabs to which Plaintiff refers are tabs of a portal for GBLT employees. This portal contains an overview of all established tax assessments, tax obligations, payments, incoming documents and outgoing documents. According to the defendant, the portal and the archive contain more documents than only documents relating to this case. Defendant submitted screenshots of the tabs “notes” and “subject relationship” referred to by plaintiff to show that these tabs do not contain any documents related to the case.
5.3
In view of this ground of appeal, the court considers the following.
5.3.1
Pursuant to Article 7:4, second paragraph, of the General Administrative Law Act (Awb), the administrative authority makes the notice of objection and all other documents relating to the case available for inspection by interested parties for at least one week prior to the hearing. Pursuant to the fourth paragraph, interested parties may obtain copies of these documents for a fee not exceeding the costs.
Pursuant to Section 8:42(1) of the Awb, the administrative authority sends the documents relating to the case to the administrative court within four weeks of the date on which the grounds of the appeal were sent to the administrative authority.
5.3.2
This concerns all documents that may be relevant for the administrative court to reach a decision and that played a role in the decision-making of the administrative body. The court will hereinafter refer to these documents as the proceedings.
5.3.3
The court sees no reason to doubt the defendant's position that in the objection and appeal proceedings he provided all the legal documents to the plaintiff or to the court. In the opinion of the court, the claimant has not demonstrated that there are missing documents. Defendant has explained that there are more documents in the aforementioned tabs of the computer system and the archive that relate to the claimant, but that these documents do not relate to this case. The court finds this explanation plausible. The obligation to submit documents does not go so far as to require the respondent to submit all documents relating to the claimant from the computer system and the archive, so that the claimant can check for himself whether there are documents that may be relevant to this case. Plaintiff has not made it plausible that the computer system or the archive contains any other documents. It follows that this ground of appeal fails.
Sound recording hearing
6.1
Plaintiff takes the position that Defendant acted contrary to the principle of due care by making a sound recording of the hearing without notice and without consultation. During the hearing the claimant was completely taken by surprise by making the recording. He is of the opinion that the defendant has acted contrary to the requirements of predictability and transparency that the National Ombudsman sets for making sound recordings. He further argues that the tone of the hearing was imperative in nature and that the report of the hearing does not reflect reality. In addition, the plaintiff takes the position that the defendant acted negligently by destroying the audio recording after the hearing, while he asked for a copy of it. According to the claimant, the audio recording is a document related to the case. Plaintiff disputes that the audio recording is only used for the record of the hearing. Plaintiff doubts Defendant's assertion that it is not possible to recover the deleted sound recording. He requests the court to appoint an expert who can analyze the traceability of the sound recording.
6.2
Defendant disputes that care was taken with regard to the making and destruction of the sound recording. According to the respondent, it was clearly indicated prior to the hearing that the audio recording was solely intended for making a written record of the hearing and that it would be destroyed after reporting. Defendant argues that Plaintiff - just like the others present - has given free, unambiguous and well-informed permission to make a sound recording under these conditions. According to the defendant, the sound recording is not relevant to the case. It was only a tool for recording the hearing and has not been used for any other purpose. In accordance with the agreement, the sound recording was removed after the report was drawn up. According to the defendant, the report contains a very detailed and faithful account of what was discussed during the hearing. Therefore, the removal of this recording has not harmed the claimant's position in the proceedings.
6.3.1
In view of this ground of appeal, the court considers the following.
6.3.2
The report of the hearing states that prior to the hearing, all participants have agreed that the conversation will be recorded for the purpose of preparing the hearing report and that the recording will be deleted after the preparation of this report. It does not appear from the report that the claimant or any of the other participants in the interview later reneged on this permission. Plaintiff has not disputed that he gave this consent and he has not stated that he subsequently withdrew it.
6.3.3
The court is of the opinion that the defendant did not act negligently by making an audio recording of the hearing and destroying this audio recording after drafting the written report of the hearing. Plaintiff agreed to this method prior to making the sound recording. The fact that he asked for a copy of the recording at the end of the hearing and afterwards does not change this. It is important here that the other participants in the conversation also only consented to making a sound recording for the making of the hearing report, on the condition that the recording would be deleted after making this report.
6.3.4
In the opinion of the court, the audio recording of the interview cannot be regarded as a court document. A report is made of the hearing on the basis of Article 7:7 of the Awb. The history of the establishment of this provision (Parliamentary Papers II 1988/99, 21 221, no. 3, p. 151) shows that a report is a written report. The Awb has no obligation to make a sound recording of the hearing and to keep it. Partly in view of the agreements made, the sound recording only served as an aid for drawing up the written report.
6.3.5
In view of the foregoing, in the opinion of the court, the defendant was authorized to make a sound recording and to destroy it after completing the written record of the hearing. That is why the court does not consider it important to know whether the deleted sound recording can still be retrieved. She therefore sees no reason to appoint a forensic expert and rejects the applicant's request to do so. This leads the court to conclude that this ground of appeal fails.
6.3.6
The court considers superfluously that it has not been shown that the plaintiff's interests have been harmed by the destruction of the sound recording. The claimant has admitted that the report is not an accurate representation of reality, but he has not made this concrete - even after he was asked to do so at the hearing. Therefore, the court sees no reason to doubt the contents of the report.
Authority hearing committee
7.1
Plaintiff takes the position that the hearing was conducted by unauthorized persons and that the decision not to provide him with a copy of the audio recording was made without authorization. To that end, he argues that the defendant has not issued a mandate to the members of the hearing committee. According to the claimant, this is particularly important for [name 2], because he operates a company, it does not appear that he is employed by or has a legal relationship with GBLT and he has made the decision about the sound recording. Furthermore, the claimant argues that [name 1] was also involved in the primary decision.
7.2
According to the respondent, the hearing took place in accordance with Article 7:5, first paragraph, of the Awb. Respondent points out that [name 2] and the other members of the hearing committee are authorized to perform all actions on his behalf that form part of the proceedings, such as hearing, preparing decisions, submitting documents and representing at the oral hearing of the objection. Therefore, they were authorized to hear the claimant. According to the defendant, the (employment) relationship between [name 2] and GBLT does not affect the lawfulness of the decisions taken.
7.3
In view of this ground of appeal, the court considers the following.
7.3.1
Article 7:5, first paragraph, of the Awb provides that, unless the hearing is conducted by or partly by the administrative body itself or the chairman or a member thereof, the hearing is to be conducted by: a. of the contested decision, or b. more than one person, the majority of whom, including the person conducting the hearing, was not involved in the preparation of the decision.
7.3.2
Plaintiff was heard by three persons, namely [name 2] , as chairman, [name 3] and [name 1] . Since none of these persons is part of the day-to-day management of GBLT, the hearing was not partly conducted by (the chairman or a member of) the administrative body. Of the persons mentioned, only [name 1] was involved in the preparation of the primary decision. Article 7:5, first paragraph, preamble and under b, of the Awb does not require that the persons who are part of the hearing committee are employed by or have a legal relationship with the legal person to which the administrative body belongs. It follows that the hearing was conducted in accordance with this provision. The defendant authorized the members of the hearing committee to hear the plaintiff. The hearing does not include the power to take decisions in the name of the administrative body, so no mandate is required. The contested decision was taken by the defendant itself.
Furthermore, the Awb does not preclude a primary decision and a decision on objection being prepared by the same civil servant. In this context, the court refers to the decision of the ABRvS of 4 November 2015 (ECLI:NL:RVS:2015:3362).
7.3.3
The court is of the opinion that the decision not to provide the applicant with the audio recording of the interview cannot be regarded as a decision, so that no mandate is required for this either. Pursuant to Article 1:3, first paragraph, of the Awb, a decision is understood to mean: a written decision by an administrative authority, containing a legal act under public law. This is not the case with the decision to destroy the recording, in accordance with the agreements made, and therefore not to provide it to the claimant.
No draft hearing report and pre-announcement decision on objection
8. The court does not follow the claimant's argument that he was wrongly not sent a draft of the hearing report and no advance notice of the decision on the objection. There is no legal obligation for an administrative body, before taking a decision, to send a draft report of the hearing to those involved for approval and then adopt this report. In this context, the court refers to a decision of the ABRvS of 6 March 2019 (ECLI:NL:RVS:2019:698). An administrative body is also not obliged to send the data subjects a prior notice of the decision on the objection. The fact that the applicant has requested this does not change this. Contrary to what the claimant believes, the fact that the defendant has not complied with these requests does not mean that no adversarial procedure has been applied, nor that the defendant has done insufficient to try to prevent an appeal. During the objection phase, the claimant was given sufficient opportunity to put forward his point of view, both in writing and during the hearing.
Access to processed personal data
9.1
The Plaintiff argues that the Defendant did not provide him with full access to the personal data concerning him that were provided to third parties in the primary decision. Plaintiff argues that it is not clear to him on the basis of the information provided by Defendant which information concerning him has ended up with which third parties and also not how often and in what way this happened.
9.2
The defendant takes the position that it has provided all information that it has provided pursuant to Article 15 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (GDPR). According to the Defendant, all of the Plaintiff's personal data provided to third parties are listed in the primary decision.
9.3.1
In view of this ground of appeal, the court considers the following.
9.3.2
Pursuant to Article 15, paragraph 1, of the GDPR, the data subject has the right to obtain confirmation from the controller as to whether or not personal data concerning him/her is processed and, where this is the case, to obtain access to those personal data and of (among other things) the processing purposes and the recipients to whom the personal data has been provided.
9.3.3
The court is of the opinion that the statement of the defendant that GBLT did not provide more claimant regarding personal data to third parties than he already indicated in the primary decision is not implausible. It is therefore up to the claimant to demonstrate that more personal data has been provided. In this context, the court refers to a decision of the ABRvS of 31 March 2021 (ECLI:NL:RVS:2021:675). The court finds that the plaintiff failed to do so. The mere suspicion that possibly more often (or more) personal data has been provided to third parties is insufficient in this context. Plaintiff referred to a letter dated May 6, 2019, which - just like the letter dated June 25, 2019 - was addressed to his old home address. Defendant has explained that this concerns a hearing report, that this report does indeed contain Plaintiff's old address, but that this report was only sent to Plaintiff by e-mail and not by post. According to the defendant, this is also apparent from the overview of written documents sent. Plaintiff has not substantiated the contrary and the Court sees no reason to doubt these statements by Defendant. It follows from this that it is plausible that the letter of 6 May 2019 was not sent to third parties and was therefore rightly not mentioned in the primary decision. The grounds of appeal fail.
Objection to processing e-mail address for customer survey
10.1
Plaintiff argues that the processing of his e-mail address by KCM for customer research is unlawful, because he did not give permission for this and the defendant was therefore not authorized to use the e-mail address for this purpose.
10.2
The defendant takes the position that this processing is lawful. According to the defendant, this processing was necessary for the performance of a task in the exercise of public authority entrusted to GBLT. Therefore no permission was required.
10.3.1
In view of this ground of appeal, the court considers the following.
10.3.2
Pursuant to Article 17, first paragraph, preamble and under c and d, of the GDPR, the data subject has the right to obtain from the controller without undue delay the erasure of personal data concerning him and the controller is obliged to delete personal data without undue delay where the data subject objects to the processing in accordance with Article 21(1) and there are no overriding compelling legitimate grounds for the processing or the personal data have been unlawfully processed.
Pursuant to Article 21(1) of the GDPR, the data subject has the right to object at any time, on grounds relating to his particular situation, to the processing of personal data concerning him/her on the basis of Article 6(1)(e) or f. The controller shall cease processing the personal data unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or which are related to the establishment, exercise or defense of legal claims.
10.3.3
The defendant based the processing of the plaintiff's e-mail address for the customer survey by KCM on the basis of Article 6, first paragraph, under e, of the GDPR. That is why there was an objection to it. The court deduced from the documents that, following the invitation to the customer survey, the plaintiff objected to the processing of his e-mail address for this purpose. In its correspondence with the claimant and in its decisions, the defendant does not explicitly mention an objection to this processing. Nevertheless, as a result of this objection, the defendant has deleted the e-mail address used by KCM with regard to the processing purpose of customer research and has discontinued the processing of the e-mail address for this purpose. In the opinion of the court, the defendant has thereby complied with its obligations under Article 17(1) and 21(1) of the GDPR. The fact that the defendant takes the position that this processing is not unlawful does not alter the fact that the defendant has deleted the e-mail address for this purpose and has ceased processing it, whatever this position may be. It follows that this ground of appeal fails.
10.3.4
For the sake of completeness, the court considers the following. It appears from the letter from GBLT submitted by the claimant on 12 November 2020 that in October 2020 (and thus after the contested decision) he was again invited by or on behalf of GBLT for a customer survey and that an e-mail address of the claimant was again processed. . It appears from this letter that it concerns a different e-mail address than the one that has been deleted for this purpose as a result of the claimant's objection and the processing of which has been discontinued for this purpose. It appears from the letter of 12 November 2020 that this is not the result of a conscious choice on the part of the defendant, but that this was caused by the way in which the customer research process is set up. After the plaintiff had pointed out to the defendant that this second e-mail address had been processed, the defendant took measures and ensured that this e-mail address is also no longer used for customer research in the future. The court understands from this that the second e-mail address has now also been deleted for this purpose and its processing for this purpose has ceased. This course of events – which, as stated, took place after the contested decision – does not affect the lawfulness of the decision contested in these proceedings.
Penalty for not making a timely decision on the request
11.1
The claimant takes the position that the respondent owes him a penalty because the respondent did not decide in time on his request for inspection. Plaintiff argues that Defendant did not announce the primary decision within two weeks of the notice of default in accordance with the legal requirements, since Defendant did not send the decision to him by post.
11.2
Respondent takes the position that he does not owe the claimant a penalty payment, because he decided on the request within fourteen days of receipt of the claimant's e-mail of 16 February 2020 and this decision was properly announced. According to the defendant, the decision could be sent electronically, because the plaintiff indicated that he was sufficiently accessible by electronic means.
11.3
In view of this ground of appeal, the court considers the following.
11.3.1
Under Section 4:17(1) of the Awb, if a decision on application is not made in time, the administrative authority forfeits a penalty payment to the applicant for each day that it is in default, but for a maximum of 42 days. Pursuant to the third paragraph, the first day on which the penalty payment is due is the day on which two weeks have elapsed after the day on which the term for making the decision has expired and the administrative authority has received a written notice of default from the applicant.
11.3.2
Plaintiff has given Defendant notice of default by e-mail message dated February 16, 2020. Defendant made the primary decision on February 28, 2020. This is within two weeks of the notice of default. The defendant did not send the decision to the plaintiff by post, but only by e-mail. The dispute focuses on the question of whether the defendant has correctly announced the decision.
11.3.3
Pursuant to Section 3:41(1) of the Awb, decisions addressed to one or more interested parties are announced by sending or issuing them, including the applicant.
Pursuant to Section 2:14(1) of the Awb, an administrative body may electronically send a message addressed to one or more addressees, insofar as the addressee has indicated that he or she can be reached sufficiently in this way.
11.3.4
The court is of the opinion that the plaintiff implicitly indicated to the defendant that he was sufficiently accessible by electronic means. There was an established e-mail practice between the plaintiff and the defendant. The claimant sent his request and the notice of default to the defendant exclusively by e-mail and he also mainly communicated with the defendant in this matter via e-mail messages. In view of this, the defendant was entitled to assume that communication with the plaintiff, regardless of the type of message, could be done electronically. In this context, the court refers to a decision of the ABRvS of 17 October 2018 (ECLI:NL:RVS:2018:3392). It follows from this that the respondent announced the primary decision in accordance with Articles 3:41(1) and 2:14(1) of the General Administrative Law Act by sending it to the claimant by e-mail.
11.3.5
This leads the court to the conclusion that the defendant does not owe the plaintiff a penalty, because the primary decision was taken and announced within two weeks of the notice of default. This means that this ground of appeal fails.
Penalty for failure to make a timely decision on the objection
12.1
The claimant takes the position that the respondent owes him a penalty because the respondent did not decide on the objection in time. Plaintiff disputes that there is a just and correct postponement of the decision period. Therefore, according to the claimant, the notice of default was not submitted prematurely. Insofar as this should be the case, according to the claimant, there is still a valid notice of default by operation of law from the moment that the decision period has expired.
12.2
Respondent takes the position that he does not owe the claimant any penalty, now that the notice of default was submitted before the end of the decision period. According to the defendant, it does not follow from the General Administrative Law Act that he had to give the plaintiff the opportunity to rectify this omission.
12.3
In view of this ground of appeal, the court considers the following.
12.3.1
As the court has considered under 11.3.1 above, the administrative authority forfeits a penalty payment to the applicant for each day that it is in default. The first day on which the penalty payment is due is the day on which two weeks have passed after the day on which the term for making the decision has expired and the administrative authority has received a written notice of default from the applicant.
Pursuant to Article 7:10(1) of the Awb, the administrative authority makes a decision within six weeks, calculated from the day after the date on which the period for submitting the notice of objection has expired. Pursuant to the third paragraph, the administrative authority may adjourn the decision for a maximum period of six weeks.
12.3.2
Plaintiff objected to the primary decision by letter dated April 2, 2020. The objection period ran until April 10, 2020. It follows that the decision period of six weeks ran until May 22, 2020. In a letter dated April 17, 2020, the claimant was informed that the decision on the notice of objection had been adjourned for six weeks. In the opinion of the court, this postponement of the decision period is lawful. An adjournment pursuant to Article 7:10(3) of the General Administrative Law Act does not need to be motivated. In addition, it is not contrary to this provision that a decision is made to postpone the decision shortly after the start of the decision period. In this context, the court refers to a decision of the Central Appeals Board (CRvB) of 15 April 2014 (ECLI:NL:CRVB:2014:1459).
12.3.3
It follows from the foregoing that the defendant had to make a decision on the objection by 3 July 2020 at the latest. Plaintiff has given the defendant notice of default by letter dated July 1, 2020. This letter was received by the defendant on July 3, 2020 and therefore before the end of the (extended) decision period. Plaintiff has not put forward any circumstances on the basis of which it must be held that the notice of default is nevertheless valid.
12.3.4
Now that there is no valid notice of default, this notice of default no longer has any meaning for the remainder of the procedure. Plaintiff's alternative position that there is by operation of law a valid notice of default from the moment that the decision period has expired is therefore incorrect. Since the claimant has not given the defendant further notice of default after the expiry of the decision period, the defendant has rightly taken the position that no penalty payment is due. The court refers again to the aforementioned judgment of the CRvB of 15 April 2014. It follows that this ground of appeal also fails.
Request for compensation for providing personal data
13.1
The claimant has requested the court to order the respondent to pay compensation for the damage he suffered as a result of the unlawful provision of his personal data to third parties. At the hearing, the claimant explained that this concerns the letters of May 6, 2019 and June 25, 2019, which were addressed to his old home address, and the provision of his e-mail address to third parties for customer research.
13.2
Respondent takes the position that only with regard to the letter of 25 June 2019 there is unlawful processing. According to the respondent, the claimant has not substantiated that he suffered damage as a result and this has not been proved.
13.3
In response to this request, the court considers the following.
13.3.1
Pursuant to Article 82(1) of the GDPR, anyone who has suffered material or non-material damage as a result of an infringement of this Regulation has the right to receive compensation from the controller or processor. Pursuant to the second paragraph, any controller involved in processing is liable for damage caused by processing that infringes this Regulation.
13.3.2
According to settled case law of the ABRvS (for example, the judgment of 1 April 2020, ECLI:NL:RVS:2020:899, ground 19), the administrative court is authorized under Article 8:88 of the Awb to rule on a request for compensation on the basis of Article 8:88 of the Awb. pursuant to Article 82 of the GDPR in cases where the alleged damage is related to a written decision on a request as referred to in Articles 15 to 22 of the GDPR, insofar as it has been taken by an administrative authority. Plaintiff's claim for damages is related to defendant's decisions on plaintiff's request for access and his objection to the processing of his e-mail address for the purpose of customer research. It follows that the court has jurisdiction to assess the plaintiff's claim for damages.
13.3.3
It follows from consideration 9.3.3 that the court assumes that the incorrectly addressed hearing report of 6 May 2019 was not sent by post and that in this context no personal data of the claimant was therefore provided to third parties. Therefore, the court will deny the claim for damages insofar as it relates to this letter.
13.3.4
It follows from 10.3.4 that the defendant provided an e-mail address of the plaintiff to a third party around October 2020 (for the second time) for the purpose of conducting customer research. This processing of the claimants' personal data took place after the contested decision. For this reason alone, the court will reject the claim for damages insofar as it is related to this processing of the plaintiff's e-mail address.
13.3.5
The court is of the opinion that the claimant has not demonstrated that he suffered material or immaterial damage as a result of the provision of his personal data to third parties through the letter of 25 June 2019 or the provision of his e-mail address (for the first time) to KCM. . Plaintiff has not substantiated his claim that this is the case. In the opinion of the court, a situation does not arise in which the adverse consequences of the (alleged) violation of standards are obvious. It is not about seriously culpable behavior with consequences so serious that it must be qualified as an infringement of a fundamental right. In the opinion of the court, it is not the case that an infringement of the GDPR automatically implies an infringement of the integrity of a person and thus leads to compensable damage. Plaintiff has not made it clear why the provision of personal data concerning him in the mistakenly addressed letter or the provision of his e-mail address for customer research can be qualified as infringement of his person. Nor has he made plausible what adverse consequences the provision of this information had for him. There is no indication that the data has been misused. Therefore, the court will also reject the claim for damages insofar as it is related to the letter of June 25, 2019 and the provision of the plaintiffs e-mail address to KCM. It follows from this that it is not clear whether the provision of the e-mail address for customer research was lawful or not.
Claim for damages for breach of reasonable time
14. The plaintiff has requested the court to order the defendant to pay non-material compensation for (imminent) violation of the reasonable time limit referred to in Article 6 of the Convention for the Protection of Human Rights and Fundamental Freedoms. The court will deny this request. It is settled case law of the ABRvS (for example the judgment of 8 January 2020, ECLI:NL:RVS:2020:27) that the reasonable term has been exceeded if the duration of the total procedure is too long. In cases with a prior objection procedure, the term starts at the moment of receipt of the objection by the administrative authority. The term ends when the judge makes a decision. The starting point for the adjudication of a case in first instance is that it will not take place within a reasonable period of time if the court of first instance does not rule within two years after that period has commenced. This period includes the duration of any objection procedure. In this case, the respondent received the notice of objection on April 6, 2020. Since that date, two years have not yet passed at the time this decision is made, so that there has been no violation of the reasonable term.
Closing Considerations
15. The foregoing leads the court to the conclusion that the appeal is unfounded.
16. There is no reason for an order to pay costs.
Decision
The court:
-
declares the appeal unfounded;
-
rejects the claims for compensation.
This decision was made by mr. E. Hoekstra, judge, in the presence of mr. F.F. van Emst, as clerk, on
The verdict will be made public on the next Thursday after this date.
the clerk is unable to judge
to sign the judgment
Copy sent to parties on:
Remedy
An appeal can be lodged against this decision with the Administrative Jurisdiction Division of the Council of State within six weeks of the date on which it was sent. If an appeal has been lodged, a request may be made to the preliminary relief judge of the appeal court to make a provisional injunction or to cancel or amend a provisional injunction made by this decision.
