Rb. Midden-Nederland - AWB - 20 727
From GDPRhub
| Rb. Midden-Nederland - AWB - 20 _ 727 | |
|---|---|
 | |
| Court: | Rb. Midden-Nederland (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 15(1) GDPR |
| Decided: | 08.12.2020 |
| Published: | 29.09.2021 |
| Parties: | Minister of Agriculture, Nature and Food quality |
| National Case Number/Name: | AWB - 20 _ 727 |
| European Case Law Identifier: | ECLI:NL:RBMNE:2020:5275 |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | Rechtspraak.nl (in Dutch) |
| Initial Contributor: | Martijn Staal |
The District Court of Midden-Nederland held that to comply with an article 15(1) GDPR request a copy of documents did not need to be provided and that an overview was sufficient if the personal data processed was the data subject's name, address and contact details.
English Summary
Facts
Plaintiff regularly represents others in Open Government Act (Wet openbaarheid van bestuur) procedures against the Dutch Food and Consumer Product Safety Authority (hereafter: NVWA). Plaintiff requested access to the personal data processed by the NVWA with regards to these procedures, basing their claim on article 15(1) GDPR.
The NVWA partially granted the request and gave plaintiff an overview of the data processed by them with regards to the aforementioned procedures and who has access to this information. Plaintiff objected to the primary decision because - among other things - the overview was incomplete. Defendant ruled that the objection justified, revoked the primary decision gave a more complete overview.
Plaintiff appealed to the decision, and argues that an overview of the processed personal data is not enough. They argue that they need a copy of the specific documents in which their personal data is processed to assess the accuracy of the data in context of these documents.
Holding
The court held that to comply with an article 15(1) GDPR request, it is sufficient to provide an overview of what data is processed and in which documents, if the data in question is mostly name, address and contact information. A copy of the documents itself does not need to be provided.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
Body
Central Netherlands Court
Date of judgment
08-12-2020
Date of publication
29-09-2021
Case number
AWB - 20 _ 727
Jurisdictions
Administrative law
Special characteristics
First instance - single
Content indication
Right of access to Article 15 of the GDPR - not automatically entitled to a copy of documents, only to a copy of the personal data - overview has been complete - search is sufficient.
Locations
Rechtspraak.nl
Enhanced pronunciation
Share pronunciation
print
Save as PDF
Copy link
Pronunciation
CENTRAL NETHERLANDS COURT
Seating location Utrecht
Administrative law
case number: UTR 20/727
decision of the single chamber of 8 December 2020 in the case between
[claimant] at [place of residence] , claimant,
and
The Minister of Agriculture, Nature and Food Quality, defendant
(agents: mr. T. Gillhaus and mr. M. Looijs).
Process sequence
By decision of 28 November 2018 (the primary decision), the respondent decided on the request for access to and the provision of personal data of the claimant.
By decision of January 16, 2020 (the contested decision), the respondent upheld the claimant's objection, insofar as it concerns the incompleteness of the overview. Respondent thereby revoked the primary decision and provided more information to the claimant.
Plaintiff appealed against the contested decision.
Defendant has filed a statement of defence.
The hearing took place on September 30, 2020 via a Skype connection. Plaintiff appeared. Defendant was represented by his attorneys.
Considerations
Introduction
1. On 20 August 2018, the Claimant submitted a request to the Netherlands Food and Consumer Product Safety Authority (NVWA) to inspect his personal data, pursuant to Article 15, first paragraph, of the GDPR1. On August 27, 2018, the claimant further specified this request because, according to the respondent, it was formulated too generally. Plaintiff has requested information relating to the processing of his personal data in various Wob proceedings. This does not include mail that is addressed directly to him or that is his hand, nor does it include documents that have otherwise become known to him in the context of Wob proceedings. Plaintiff regularly acts as an authorized representative in Wob proceedings at the NVWA.
Defendant's position
2. In the primary decision, the respondent partially granted the claimant's request and indicated that his name, address, e-mail address, telephone number and place of residence are processed as personal data of the claimant. This data has been processed in order to be able to reach the claimant in the context of handling Wob requests in which he is involved, as well as in the context of the current request. The employees of the NVWA who are charged with processing the Wob requests, the external employees hired by the NVWA and the State Attorney have access to this personal data. In the contested decision, the respondent upheld the claimant's objection, insofar as it relates to the incompleteness of the overview. In this regard, the respondent has established that the information of the claimant is stated in more documents than indicated in the primary decision. In the contested decision, the defendant provided an overview with regard to the personal data, as processed by the NVWA. Defendant has also indicated in which documents this data is processed.
Judgment of the court
Documents that the claimant already possesses
3. The claimant has argued on appeal that the respondent wrongly did not classify the personal data from documents that the claimant already possesses as part of the claimant's request. Article 15, first paragraph, of the GDPR obliges the defendant to provide a complete overview of personal data, so that the claimant must be given access to all his personal data.
4. The court considers the following. Plaintiff specified his request for personal data on August 27, 2018. He has indicated that his request does not relate to documents that are addressed directly to him, or documents that have become known to him in the context of Wob proceedings. In view of the scope of the specified request, in the opinion of the court the respondent did not have to provide the claimant with personal data from documents that he already had in the context of other proceedings. The fact that the claimant took a different position on this on appeal than at the time of his request does not preclude this. The defendant was entitled to rely on what the plaintiff stated in his request. In addition, by providing personal data from documents that the claimant already has, the purpose of the right of access under Article 15, first paragraph, of the GDPR can no longer be served. Article 15, first paragraph, of the GDPR gives a data subject the right to obtain information about the personal data concerning him. The purpose of the right of access as referred to in Article 15, first paragraph of the GDPR is to be able to take cognizance of the personal data that are processed about him by the data subject and to be able to check these personal data for their accuracy and lawful processing. This aim can no longer be achieved if the request for access concerns personal data that are laid down in documents, which the claimant already has at his disposal. Plaintiff has already been able to check the correctness of this data and the lawful processing thereof.
Overview personal data
5. Plaintiff also argues that Defendant has not been able to suffice by providing an overview of the documents containing his personal data. Defendant should also have submitted copies of certain documents. After all, for a number of personal data, the context in which they are processed is important. Without this context, it is impossible for the claimant to verify the accuracy of the data and the lawfulness of the processing.
6. The court considers that Article 15 of the GDPR does not give the right to a copy of the physical or digital documents in which the personal data are processed. Article 15(3) of the GDPR only refers to a copy of the personal data itself and not to a copy of the document in which the personal data is filed. The right to inspect personal data therefore does not mean that the data subject has the right to inspect or make copies of the documents or files as such if they contain his personal data. There is a right to an overview, in comprehensible form, of all personal data. That is, in a form that enables the data subject to take cognizance of his data and to check whether they are correct and have been processed in accordance with the GDPR. The claimant cannot derive the right from the GDPR to obtain a copy of the original document or file containing the data, if the request for access can be met by means of another form of disclosure.2 In which material form the data must be is therefore dependent on the specific circumstances. Insofar as documents do not only contain name and address details, but also factual and valuation data about the characteristics or behavior of natural persons, such data are not suitable for inclusion in an overview. In that case, a data subject is in principle entitled to a copy of the documents in which that data is included, because this is the most effective way in which the obligation to provide information as complete and clear as possible, on the basis of which the lawfulness and correctness of the data can be checked.
7. The court considers that the defendant in particular processes name and address details of the plaintiff. In the opinion of the court, it is sufficient for this type of data to comply with a request for access under Article 15(1) of the GDPR to provide an overview of this personal data and to indicate in this overview in which documents the personal data are processed. In the context of the present request for access, the court does not see any information among the information provided by the defendant that would require a copy of the document containing this information. For example, it cannot be deduced from the respondent's overview that the respondent processes factual and evaluative data about the characteristics and behavior of the claimant. Respondent was therefore able to suffice with an overview of the processed personal data and did not have to provide copies of documents to the claimant.
Completeness of the overview
8. Plaintiff argues that Defendant has not provided all available personal data of Plaintiff. In addition, the claimant points out that the NVWA took a decision on 26 February 2018 to refuse the assistance or representation of a client by the claimant. According to the claimant, the NVWA must also be aware of various allegations, statements and conduct of his in this regard. Pursuant to Article 4(1) of the GDPR, these are also personal data. The defendant should therefore have provided him with this information. On the statement of the respondent that after a search it did not appear that this information is available, the claimant says that the respondent has not provided sufficient insight into this search. Plaintiff also cannot imagine that these personal data are not processed by Defendant. In particular, the claimant refers to the intention of the decision to refuse the claimant as an authorized representative of December 22, 2017, in which an allegation is presented by way of illustration that the claimant does not observe the usual and proper manners in social relations in contacts with administrative bodies. According to the claimant, this example mentioned in the aforementioned decision implies that there must have been several allegations, behavior and statements by the claimant that gave rise to this decision, and which are processed by the defendant as personal data.
9. In what has been put forward by the claimant, the court sees no grounds for the conclusion that the processing overview of the respondent is incomplete, or that the search performed by the respondent was insufficient. With regard to the search, the court considers that the defendant has explained in the statement of defense that a careful investigation was carried out, in which relevant e-mails and (digital) files of cases in which the plaintiff was involved were searched. Following the explanation of the plaintiff in the objection that his request also relates to personal data that formed the basis of the decision to refuse him as an authorized representative, the defendant conducted another investigation. It was then specifically checked whether the internal relevant e-mails and files contain further substantive judgments about the claimant that were not already included in the decisions known to the claimant. Defendant has not encountered such 'value judgments' referred to by Plaintiff. In the opinion of the court, this investigation by the defendant was sufficient and it is not implausible that this information was not found. According to the case law of the Administrative Jurisdiction Division of the Council of State (ABRvS), after such an investigation by the administrative body, it is up to the claimant to demonstrate that there are more personal data.3 The court is of the opinion that the claimant has not done so. The court agrees with the claimant in the view that the data as outlined by him, statements and behavior of him, in principle fall under the definition of personal data as referred to in Article 4, first paragraph, of the GDPR. However, the claimant has not sufficiently demonstrated that the respondent would have this information. The circumstance that the intention of the decision not to admit the claimant as an authorized representative refers to an example, is not sufficient to deem it plausible that there must be more personal data about the claimant. Defendant explained that the decision was taken in accordance with the personal experiences of the official concerned, so that no personal data was processed. The only personal data that have been processed are contained in the intention, the decision and the procedural documents themselves. Plaintiff already possesses these documents, which means that this does not fall within the scope of the request. The court therefore concludes that the overview provided by the defendant is complete and that the search by the defendant has been sufficient.
Recipients of the personal data
10. Plaintiff further argues that Defendant has incorrectly provided insight into who has access to Plaintiff's personal data. Defendant has only mentioned categories but no names of the recipients. In addition, the claimant knows that his personal data has also been shared with others several times. Plaintiff hereby cites a letter to a third party dated December 22, 2017, in which personal data about him was shared. However, the defendant has not named that third party as a recipient in the decision. The claimant also states that the respondent has provided his personal data to third parties in a number of objection procedures. After all, these third parties have contacted the claimant about these cases and can only have received his personal data via the defendant.
11. The court considers that it follows from Article 15, first paragraph, under c, of the GDPR that the defendant does not always have to state the names of the persons to whom the personal data of the claimant has been provided, but may also state this in categories. In the contested decision, therefore, the defendant was allowed to suffice with naming the categories of recipients of the applicants' personal data.
12. The court considers as follows about the statement that the defendant has also provided information to third parties that are not mentioned in the decision. Plaintiff referred to a letter dated December 22, 2017, which was sent to a third party. The court notes that it appears from the letter referred to by the claimant that this third party is a client of the claimant, and that the letter was sent in proceedings in which the claimant assisted this client. As the defendant has rightly pointed out, the plaintiff has already had this letter at his disposal in the context of the proceedings in which he assisted his client. The claimant's request for inspection therefore does not relate to the personal data in this letter, so that the defendant did not have to provide the personal data from this letter. Furthermore, the court considers that it has not been shown that the defendant provided the plaintiffs with personal data to third parties. During the hearing, the defendant noted that in the event that third parties receive information in a certain procedure, the personal data of the parties will always be deleted. The Plaintiff has argued that it cannot be otherwise than that third parties have received his personal data from the Defendant in the context of proceedings that have been conducted. The court notes that the plaintiff has not further substantiated this position. It cannot be ruled out that third parties may have become aware of the claimant's involvement in objection procedures through other means than through the provision of the claimant's personal data by the defendant. As considered under 9, it has not been shown that the defendant's search was insufficient, as a result of which the court assumes that the defendant has not provided the applicant's personal data to third parties other than the categories of persons listed in the contested decision. Respondent has therefore provided a complete overview of the persons to whom the personal data of the claimant has been provided.
Hearing
13. Plaintiff also argues that he also wishes to receive recordings and/or reports of hearings at which he was present. According to the claimant, these are also personal data, now that his voice can be heard on the recordings. The claimant only concerns the parts in which he is speaking.
14. First of all, the court finds that the request can only relate to the claimant's own personal data, namely what he himself said during the hearings. The rights and freedoms of third parties stand in the way of providing an integral copy. Furthermore, the court finds that the defendant has offered the plaintiff to come and listen to the recordings of the hearings on location. During the hearing, the respondent explained that the claimant can indicate which parts of the recordings concern him and with which he may not agree. The court is of the opinion that the defendant has sufficiently complied with the request for inspection by the plaintiff with the aforementioned offer. It cannot be deduced from the GDPR that the defendant should submit a sound recording or a record of the hearing to the plaintiff. The fact that listening on location would mean that the claimant would have to go to the NVWA for several days does not change that. The court notes that this is a consequence of the applicant's broad request for personal data from hearings at which he was present.
Compensation for litigation costs in objection
15. Finally, the applicant submits that in the contested decision the defendant erred in not deciding on its application to reimburse its legal costs. According to the claimant, if the objection is upheld, these costs are eligible for reimbursement. The court agrees with the plaintiff in this position. In the contested decision, the defendant did not respond to this request of the plaintiff, while it should have made a decision on this under Article 7:15(3) of the General Administrative Law Act (Awb). The appeal is therefore well founded on this point. The court annuls the contested decision because it violates Article 7:15 of the Awb. The court must then answer the question whether there is reason to uphold the legal consequences of the annulled contested decision on the basis of Article 8:72, third paragraph, opening words and under a, of the Awb. In view of the foregoing, the court answers this question in the affirmative. The court will decide on the requested costs in the objection and the other grounds of appeal put forward by the plaintiff do not lead to the conclusion that the defendant could not have taken the contested decision. The court rejected the plaintiff's request for reimbursement of costs of the proceedings, because the plaintiff did not substantiate this request.
Conclusion
16. The court concludes that the defendant has correctly decided on the plaintiff's request for information under the GDPR. It has not been shown that the overview of the personal data provided was incomplete or that the defendant was obliged to provide copies of a number of documents to the claimant.
17. Since the appeal is well founded, the defendant must reimburse the plaintiff for the costs of the proceedings that he has incurred. Under the Administrative Costs Decree, the costs of legal assistance provided professionally by a third party are eligible for reimbursement. Because the plaintiff has litigated without an authorized representative, this is not the case. Plaintiff has requested reimbursement of his lost time costs of €75 in connection with attending the hearing (45 minutes). Pursuant to the Administrative Costs Decree, the lost time costs claimed by the claimant are reimbursed in accordance with a rate that, depending on the circumstances, amounts to between €7 and €84 per hour. It is expressly stated in the explanatory notes to the legal costs form that the lost time costs eligible for reimbursement must be substantiated with supporting documents. Plaintiff has failed to do so. According to settled case-law, in that situation compensation should be granted at the minimum rate. In view of this, the court has set the compensation for lost time costs at € 5.25 (45 minutes x € 7). In addition, the court determines that the defendant must reimburse the court fee of € 178 paid by the plaintiff.
Decision
The court: - declares the appeal well-founded; - annuls the contested decision:
- ordered that the legal effects of the annulled contested decision remain in force;
- orders the defendant to reimburse to him the court fee of €178 paid by the plaintiff;
- orders the defendant to pay the plaintiff's legal costs to an amount of € 5.25.
This statement was made by mr. L.M. Reijnierse, judge, in the presence of L. Ruizendaal-van der Veen, registrar. The decision was handed down on December 8, 2020 and will be made public by publication onsrecht.nl.
Registrar Judge
Copy sent to parties on:
Remedy
An appeal can be lodged against this decision with the Administrative Jurisdiction Division of the Council of State within six weeks of the date of its dispatch.
1
Regulation 2016/679 of the European Parliament and of the Council of the European Union of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the GDPR)
2
Court of Justice of the European Union 17 July 2014 (ECLI:EU:C:2014:2081).
3
ABRvS 7 June 2017 (ECLI:NL:RVS:2017:1519).
