RvS - 202100800/1/A3
From GDPRhub
| RvS - 202100800/1/A3 | |
|---|---|
 | |
| Court: | RvS (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 5(1)(b) GDPR Article 5(2) GDPR Article 6(1)(e) GDPR Wet maatschappelijke ondersteuning 2015 |
| Decided: | |
| Published: | |
| Parties: | |
| National Case Number/Name: | 202100800/1/A3 |
| European Case Law Identifier: | ECLI:NL:RVS:2022:497 |
| Appeal from: | Rb. Gelderland (Netherlands) 19/4763 |
| Appeal to: | |
| Original Language(s): | Dutch |
| Original Source: | rechtspraak.nl (in Dutch) |
| Initial Contributor: | Martijn Staal |
The Council of State held that a private foundation that carries out social support tasks on behalf of the municipality could rely on Article 6(1)(e) GDPR to require grocery receipts from beneficiaries in order to verify their expenditures and comply with financial accountability obligations with the municipality.
English Summary
Facts
The controller is the Stichting Regionale Instelling voor Beschermd wonen Arnhem en Veluwe Vallei (RIBW), a care provider for people who are (temporarily) unable to live independently. A caretaker does the weekly shopping for the residents who live there in a group. Since March 2018, data subject has been living there under supervision independently in a one-person flat. To increase her independence, they were allowed to get groceries themselves. However, they must use a debit card of the RIBW, after which they must provide the receipt of the shopping to the care taker, to prove that they spend the money on grocery shopping.
Data subject felt like their privacy was violated because these receipts, in combination with the debit card, show where, when and which groceries they are buying. Ultimately, they filed a complaint with the DPA because they stated their personal data was unlawfully processed. The DPA, however, rejected the complaint, stating that the RIBW could rely on Article 6(1)(e) GDPR. The data subject then brought the action before the District Court Gelderland, but it upheld the DPA's decision. The data subject then appealed to this decision before the Council of State.
Holding
The Council of State rejected the appeal.
Regarding the legal basis and purpose of the data processing
The Council of State noted that Article 5(1)(b) GDPR states that personal data must be collected for specified, explicit and legitimate purposes. It follows from recitals 41 and 45 of the preamble that the GDPR does not require specific legislation for each individual processing operation. It is sufficient to have legislation which serves as a basis for several processing operations. Such legislation must be clear and precise and its application predictable for those to whom it applies. In this context, article 5.1.2, first paragraph, under a, of the Social Support Act (Wmo) is important. This states that a provider that provides a customised care facility is authorised to process the client's personal data to the extent that these data have been obtained from the client and are necessary for the provision of services to that client, among other things, to which he has committed himself to. From the parliamentary history, it follows that this includes financial accountability towards the municipality. These purposes are well-defined, explicitly described and justified. The Council of State therefore is of the opinion that the collection of the receipts by RIBW is in accordance with Article 5(1)(b) GDPR.
Regarding the task of general interest
The Council of State held that RIBW fulfills a task of general interest, since it fulfills the implementation of municipal obligations under the Social Support Act 2015 (Wmo 2015) for the municipality. From article 2.1.1 of this act, it follows that the municipal tasks under the Social Support Act are those of general interest. Since RIBW implements these on behalf of the municipality, it can base its processing on Article 6(1)(e) GDPR.
Necessity and proportionality
The purpose of the processing of the receipts is to render financial account to the municipality. This is not possible with the alternative proposed by appellant (a periodical lump sum), because in such a case there is no way to check if the money was actually used for food. Since only the caretaker checks the receipts and no records are kept of who the receipts are from, only the care taker could trace the receipts to appellant. The Council of State finds that this processing is necessary and does not go further than strictly necessary.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
20100800/1/A3.
Judgment date: February 16, 2022
DEPARTMENT
ADMINISTRATIVE JURISDICTION
Decision on the appeal of:
[appellant], living in [place of residence],
against the judgment of the Gelderland District Court of 15 January 2021 in case no. 19/4763 in the proceedings between:
[appellant]
and
the Dutch Data Protection Authority (hereinafter: AP).
Process sequence
By decision of 27 February 2019, the AP rejected a request from [appellant] to take enforcement action.
By decision of 16 July 2019, the AP declared the objection lodged by [appellant] unfounded.
By decision of 15 January 2021, the court dismissed the appeal lodged by [appellant] against it. This statement is attached.
The appellant appealed against this decision.
The AP has given a written explanation.
[Appellant] has submitted further documents.
The Division heard the case on January 24, 2022, where [appellant], represented by [agent]], and the AP, represented by W. van Steenbergen, appeared.
Considerations
Introduction
1. The legal framework is included in the appendix to this ruling. That appendix forms part of this ruling.
1.1. The Regional Institution for Protected Living Arnhem and Veluwe Vallei (hereinafter: the RIBW) is a care provider for people who are (temporarily) unable to live independently. The RIBW has a residential accommodation in Wolfheze. For residents who live there in a group, the caretaker does the shopping every week. Since March 2018, [appellant] has lived there independently in a single apartment under supervision. In order to increase her independence, she has been able to take care of her shopping herself. [appellant] is the only resident of the residential accommodation who makes use of this option. A weekly budget as food money is available for those groceries. She can use a debit card from the RIBW to access the food money. The RIBW has opened a bank account for the residential accommodation. That bank account is not in the name of [appellant]. When the debit card has been used, the receipts for the groceries must be handed in to the caretaker. The caretaker checks on the basis of the till receipts whether the food money has actually been spent on groceries. Because it can be deduced from the receipts in combination with the debit card used where, when and what groceries she gets, [appellant] believes that her privacy is being violated. She must also hand in receipts if she uses cash from the RIBW for groceries. In combination with the issued receipt for the cash, those receipts can still be directly traced back to her. Because of her objections to handing in receipts, she does not use food money from the RIBW and does her shopping with her own resources.
Decision
1.2. [Buyer] filed a complaint against the obligation to hand in receipts for her groceries. The complaints committee of the RIBW has declared her complaint unfounded.
On June 21, 2018, [appellant] submitted a complaint to the AP, because she believes that her personal data is being processed unlawfully. On December 5, 2018, the AP informed her about the way in which her complaint was handled. Because the RIBW has explained to the AP why receipts must be handed in and that explanation is plausible, there is no reason to take enforcement action and the complaint has been considered settled.
The AP regarded [appellant]'s complaint as a request to take enforcement action and rejected that request by decision of 27 February 2019.
In its decision of July 16, 2019, the AP upheld its decision not to take enforcement action. The AP recognizes that the RIBW processes personal data of [appellant]. The AP takes the position that such processing is lawful. This is because the RIBW fulfills a task of general interest as referred to in Article 6, first paragraph, preamble and under e, of the General Data Protection Regulation (hereinafter: AVG). This task consists of offering social support in the form of sheltered housing (Article 1.1.1 of the Social Support Act 2015, hereinafter: Wmo). The RIBW has entered into an agreement with the Municipality of Arnhem on the provision of social support, and the Municipality pays the RIBW for this in advance. Requesting cash register receipts is necessary in order to be able to render financial account to the municipality and the tax authorities about the correct use of the allowances. According to the AP, that purpose cannot be achieved in a less disadvantageous way for [appellant] and the processing of personal data in relation to that purpose is not disproportionate.
Court verdict
1.3. The court is of the opinion that the processing of the personal data of [appellant] by the RIBW does not conflict with Article 6, first paragraph, under e, of the GDPR. Not every processing has to be based on a law in the formal sense or specific legislation. The court agrees with the AP in its position that the processing is necessary for the fulfillment of a task of general interest. On the basis of the Social Support Act and an agreement with the municipality, the RIBW has a general task to provide tailor-made facilities in the form of sheltered housing. In that context, financial accountability must be made to the municipality and the tax authorities. In addition, the court is of the opinion that the processing is not disproportionate in relation to its purpose. Furthermore, according to the court, the justification of the expenditure of funds at the level of the actual expenditure is not unusual.
Appeal
2. [appellant] argues that the court has not recognized that there is no legal basis for data processing. The purpose of the data processing is wrongly not clearly defined and explicitly defined and checking the use of food money is not a legitimate purpose. The latter also applies to financial accountability to the municipality for the care provided. Moreover, it does not follow from Article 5.2.2 of the Social Support Act or the General Provisions for a Purchase Agreement of the Central Gelderland Region (hereinafter: General Provisions) that the RIBW has a financial accountability obligation. In addition, it argues that the RIBW does not have its own task of general interest. Accountability is not a task in the public interest. She also states that there is an alternative to making food money available by checking till receipts. The RIBW can periodically provide her with a fixed amount as food money. That lump sums can be justified is apparent from the fact that the RIBW provides lump sums to clients as compensation if no TV and telephone are available. Finally, it argues that the processing of personal data is not proportionate to the purposes to be served. The receipts submitted can always be traced back to her and the processing of her personal data is a serious violation of her privacy, according to [appellant].
Assessment of the appeal
- Assessment framework
2.1. The processing of personal data may be lawful if it is necessary for the performance of a task carried out in the public interest. To this end, it must first be assessed whether the purpose for which the personal data are processed is well-defined and explicitly described. It must also be assessed whether the relevant purpose is also achieved with the processing of the personal data at issue. In doing so, the goal must fit within the task of general interest. In the event that the processing of the personal data is necessary for achieving the specific purpose in this sense, it must then be assessed whether the invasion of privacy is proportionate to the interests served by the processing of the personal data. As the Division previously ruled in the judgment of 20 September 2017, ECLI:NL:RVS:2017:2555, in the light of the EU Charter, it must be assessed whether the invasion of privacy is limited to what the the purpose is strictly necessary. In particular, it must be assessed whether the purpose for which the personal data are processed cannot reasonably be achieved in another way that is less detrimental to the persons involved in the processing of personal data. The intensity with which this must be done is partly determined by the specificity of the proposed alternatives. In other words: the more detailed the person concerned describes the alternative, the more intrusive the investigation of the AP must be.
- Purposes of data processing
2.2. Article 5, first paragraph, preamble and under b, of the GDPR provides that personal data must be collected for specified, explicit and legitimate purposes. It follows from recitals 41 and 45 of the preamble that the GDPR does not require specific legislation for each individual processing. Legislation that serves as the basis for various processing operations will suffice. That legislation must be clear and precise and its application must be predictable for those to whom it applies. In this regard, Article 5.1.2, first paragraph, under a, of the Social Support Act is important. It states that a provider that provides a customized facility is authorized to process the personal data of the client, insofar as these data have been obtained from the client and are necessary for the provision to that client of, among other things, the services to which he has committed himself to the Commission. whether the client has connected. It follows from the history of the drafting of Article 5.1.2 of the Social Support Act, Parliamentary Papers 2, 2013/14, 33 841, no. 3, page 172 that this also involves accountability to the municipal executive and the provision of data to the CAK. It follows from the above that personal data of clients are processed by the RIBW on the basis of Article 5.1.2, first paragraph, under a, of the Social Support Act, insofar as this is necessary to be able to provide a customized facility and to be able to account to the Board. take off. These purposes are specific, explicit and justified. The fact that the RIBW, as a contractor, also has a duty of accountability to the municipality, follows from Article 9 of the General Provisions. [appellant] has not refuted that on the basis of that provision the RIBW can be required to justify the actual expenditure on food and that it is therefore necessary to collect cash register receipts, as the AP argues. In view of this, the Division is of the opinion that the collection of personal data by the RIBW is in accordance with Article 5, first paragraph, opening words and under b, of the GDPR.
The argument fails.
- Public interest task
2.3. Article 6, first paragraph, preamble, of the GDPR provides that processing is only lawful if at least one of the conditions referred to in a to f is met. In this case, it must be assessed whether the processing is necessary for the performance of a task carried out in the public interest (Article 6(1)(e) of the GDPR). It follows from Article 2.1.1, first paragraph, of the Social Support Act that the municipal council has a task of general interest. This provision states that the municipal council is responsible for social support. The history of the drafting of Article 2.1.1 of the Social Support Act, Parliamentary Papers 2, 2013/14, 33 841, no. 3, page 129, states that this provision contains the task of the municipalities to provide social support and the basic provision is for the responsibility of the municipality. The task assignment relates to all parts of the concept of social support, according to the history of its creation. Article 2.6.4, first paragraph, of the Wmo provides that the Municipal Executive may have the implementation of the Wmo carried out by third parties. The municipality has concluded an agreement with the RIBW about the provision of a customized facility and the RIBW is therefore a provider as referred to in Article 1.1.1, first paragraph, of the Social Support Act. As such, the RIBW fulfills a task of general interest of the Board.
The argument fails.
- Necessity
2.4. In order to determine whether the processing of the personal data is necessary, it must be assessed whether the purpose for which the personal data are processed cannot reasonably be achieved in a different, less disadvantageous way. The purpose of the processing by the RIBW is to render financial account to the municipality. As an alternative to making food money available and checking sales receipts, [appellant] mentions providing food money in lump sums. The AP correctly states that in that case it cannot be checked whether the budget made available by the municipality to the RIBW for food is also used for that purpose. It is therefore not possible to report financially to the municipality. The AP can also be followed in its position that the RIBW may justify the actual expenditure. In view of this, the court rightly ruled that the purpose of the processing cannot be achieved in a different, less disadvantageous way.
The argument fails.
- Proportionality
2.5. In a letter dated 1 July 2019, the RIBW explained the RIBW's working method. Only the house mentor of a residential accommodation checks whether the food money has been spent on food on the basis of the receipts submitted. It is not registered from whom those receipts come so that other employees of the organization cannot trace the receipts back to people. The receipts and bank statements of the debit card used are periodically submitted to a regional manager and centrally archived at the financial administration of the RIBW. The data is processed in annual accounts, according to the RIBW. The appellant has not contested this statement. In the opinion of the Division, the court rightly ruled that the processing of personal data does not go further than is necessary. It is important here that the method described above is only followed in order to be able to account to the municipality for the allowances provided by the municipality. No more data is processed for this than is necessary.
The argument fails.
Conclusion
3. The appeal is unfounded. The attacked decision needs to be confirmed.
3.1. The AP does not have to reimburse legal costs.
Decision
The Administrative Jurisdiction Division of the Council of State:
confirms the attacked statement.
Adopted by mr. C.H.M. van Altena, chairman, and mr. E. Steendijk and mr. C.M. Wissels, members, in the presence of mr. K.S. Husband, clerk.
The chairman is unable to sign the ruling
The Registrar is prevented from signing the judgment
Pronounced in public on February 16, 2022
629
APPENDIX
REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ( General Data Protection Regulation)
Article 5
1. Personal data must:
†
b. collected for specified, explicit and legitimate purposes and may not be further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research or statistical purposes shall not be considered incompatible with the original purposes in accordance with Article 89(1) ("purpose limitation");
†
2. The controller is responsible for and can demonstrate compliance with paragraph 1 ("accountability").
Article 6
1. Processing is only lawful if and insofar as at least one of the following conditions is met:
†
e. the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority conferred on the controller;
†
Social Support Act 2015
Article 1.1.1
1. In this Act and the provisions based on it, the following definitions apply:
- provider: natural person or legal person who is obliged towards the Board to provide a general facility or a customized facility;
†
- Social Support:
1°. promoting social cohesion, informal care and voluntary work, the accessibility of facilities, services and spaces for people with disabilities, safety and quality of life in the municipality, as well as preventing and combating domestic violence,
2°. supporting the self-reliance and participation of people with disabilities or with chronic psychological or psychosocial problems as much as possible in their own living environment
3°. offering sheltered housing and shelter;
- tailor-made facility: set of services, aids, home adaptations and other measures tailored to the needs, personal characteristics and possibilities of a person:
1°. for self-reliance, including a short-term stay in an institution to relieve the caregiver, the necessary transport, as well as aids, home adaptations and other measures,
2°. for the purpose of participation, including the necessary transport, as well as aids and other measures,
3°. for the benefit of sheltered housing and reception;
†
Article 2.1.1
1. The municipal council is responsible for social support.
†
Article 2.6.4
1. The Board may have the implementation of this Act carried out by third parties, subject to the determination of the rights and obligations of the client.
†
Article 5.1.2
1. A provider that provides a customized facility and a third party to whom payments are made from a personal budget, is authorized to process the client's personal data, including data about health, as well as personal data of the client's caregiver with regard to the help that the latter offers or can provide to the client, insofar as these have been obtained from the council, from the client or from the informal carer and are necessary for:
a. providing the client with the services, aids, home adaptations and other measures to which he has committed himself towards the commission or the client;
†
