Rb. Gelderland - C/05/393140 / HA RK 21-165
| Rb. Gelderland - C/05/393140 / HA RK 21-165 | |
|---|---|
 | |
| Court: | Rb. Gelderland (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 14 GDPR Article 15 GDPR Article 17 GDPR Article 17(1)(c) GDPR Article 82 GDPR |
| Decided: | 17.01.2022 |
| Published: | 21.03.2022 |
| Parties: | Zakelijk Energie Beheer B.V. |
| National Case Number/Name: | C/05/393140 / HA RK 21-165 |
| European Case Law Identifier: | ECLI:NL:RBGEL:2022:1351 |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | Rechtspraak.nl (in Dutch) |
| Initial Contributor: | Giel Ritzen |
The District Court of Gelderland ordered a controller to provide the data subject with information under Article 14 GDPR, comply with his access request pursuant to Article 15 GDPR, and to erase his personal data pursuant to Article 17(1)(c) GDPR.
English Summary
Facts
The controller is Zakelijk Energie Beheer B.V., a company that (claims to) offer(s) customers to find the right energy provider. On 19 March 2021, the data subject was called by controller with an offer to join an “energy collective”, which he refused. On the same day, he requested the controller access to his personal information pursuant to Article 15, and to restrict the processing of his personal data pursuant to Article 18 GDPR.
On 29 July 2021, the data subject received a reply to his access request. However, he received this reply from a third party, namely Regionaal Energie Beheer, which stated that it “obtained the personal data of [data subject] from marketing partners, through market research, surveys, etc.” and that, “in order to be able to offer its products and services, it needs the personal data of [data subject], for example in order to establish and maintain a relationship with him or to comply with legal obligations.” Moreover, this third party explained they share his personal data with (other) third parties and that they collected his personal data from the website https://www.enqueteloket.nl on 28 January 2021.
The data subject then brought the issue before Court, and, among other things, requested the Court to order the controller to comply with the access request, to fulfil their information obligations under Article 14 GDPR, to erase his personal data, and to notify which recipients have received a notification pursuant to Article 19 GDPR. Moreover, he requested € 10,000 as compensation for his damages and the Court to refer preliminary questions to the CJEU regarding the notion of ‘damage’ in Article 82 GDPR.
Holding
The District Court partially acknowledged the data subject’s claims.
First, the Court considered that the data subject filed an access request with the controller, but got a response from a third party (Regionaal Energie Beheer), and not from the controller. Hence, the Court granted the data subject’s request to order the controller to comply with the data subject’s access request pursuant to Article 15 GDPR. Specifically, the controller has to state on which legal basis they rely on, and which third parties have received his personal data based on what legal basis.
Second, the Court acknowledged the data subject’s claim that the website that had provided his personal data to Regionaal Energie Beheer, could not have done so because the website had not been activated until 29 March 2021. Therefore, the Court ordered the controller to comply with its information obligations pursuant to Article 14 GDPR.
Third, the Court rejected the data subject’s claim to be notified of which recipients the controller had notified pursuant to Article 19 GDPR, because the data subject did not claim that such a notification had even taken place, and thus, it is unclear whether the controller can comply. However, the Court acknowledged the data subject’s claim to have his personal data erased pursuant to Article 17(1)(c) GDPR, because it followed from the established facts that his personal data had been processed unlawfully.
Lastly, the Court stated that it was not competent to rule on the request to be compensated, since, according to Dutch civil law (Article 71 Rv.), the District Court cannot rule on claims under € 25,000. Therefore, it referred the case to “the Cantonal Chamber” of the Court.
Comment
Although the data subject requested the Court to be compensated for his damages pursuant to Article 82 GDPR, the Court did not discuss this provision but referred to Dutch civil law (Article 6:162 BW). Then, it declared itself incompetent to deal with this request because, according to Dutch civil (procedural) law, the District Court does not rule on requests under € 25,000, but the Cantonal Chamber of the Court does so.
It is, however, unclear why the Court could not discuss the compensation request. Even if one assumes that, according to Article 35 GDPR Implementation Act (UAVG), the Court is not competent to rule on such requests because Article 82 GDPR is not explicitly mentioned, it is unclear why they did not refer to this provision, or why it was not applicable. Moreover, the District Court Amsterdam decided in the past that, even though Article 35 UAVG does not mention Article 82 GDPR, it was still competent to rule on such requests.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
order GELDERLAND COURT Team canton and commercial law Arnhem seat case number / claim number: C/05/393140 / HA RK 21-165 103/1496 Order of January 17, 2022 in the case of [applicant] , residing at [residence] applicant, authorized representative mr. N. Ligthart and the private company with limited liability BUSINESS ENERGY MANAGEMENT B.V., Located in Amsterdam , stakeholder, not published. The parties will hereinafter be referred to as [applicant] and Business Energy Management. 1 The procedure The course of the procedure is apparent from: † the petition, † the oral hearing held on 15 November 2021. [applicant] appeared, assisted by mr. Ligthart, aforesaid, † [applicant's] hearing notice. 2 The facts 2.1. On March 19, 2021, Business Energy Management called [applicant] and made him an offer to participate in an energy collective. The applicant did not accept this offer. 2.2. On the same day, [applicant] submitted a request by e-mail for access to his personal data at Business Energy Management pursuant to art. 15 GDPR and has requested Business Energy Management to cease processing his personal data on the basis of Art. 18 GDPR. 2.3. After the parties exchanged a number of messages, Regional Energy Management sent a substantive response to [applicant]'s request for inspection by email of 29 July 2021. Regional Energy Management writes that it has obtained the personal data of [applicant] from marketing partners, through market research, surveys, etc. In order to be able to offer its products and services, it needs the personal data of [applicant], for example to establish a relationship with him. to maintain, or to comply with legal obligations. The notice also states that Regional Energy Management shares data with third parties. Regional Energy Management has also provided the personal data of [applicant] registered with it and has written that it received his data via the website https://enqueteloket.nl on January 28, 2021. 3 The request 3.1. [applicant] requests the court to order, by provisionally enforceable order, to order Business Energy Management to order within two weeks of this order: I. to provide [applicant] with the personal data collected from him by means of overviews from the moment of the alleged consent, per legitimate interest and per processing, including the processors who have processed his personal data on behalf of Business Energy Management; II. to provide [applicant] with the data referred to in paragraphs 1, 2, 3 and 4 of art. 14 GDPR; III. [applicant] to give access to the personal data processed by him on the basis of Art. 15 GDPR, including the processing purposes referred to in Art. 6 GDPR; IV. to provide [applicant] with data showing that [applicant] has given permission for the processing of his personal data as referred to in Art. 7 yo 15 GDPR. If Business Energy Management is able to provide this information, it must: a. to confirm that the identification obligation as performed by Business Energy Management is too heavy a threshold for the practices that Business Energy Management carries out in view of the data already processed; b. to inform [applicant] that he should be aware of the identity of the contact details of the controller or the representative of the controller or the data protection officer and thereby the processing purpose for which the personal data are intended before contact was made with [applicant] sought. V. [applicant] to provide a list of all processors and companies with whom Business Energy Management has shared his personal data and from whom his data has been received, stating the basis on which these were received, VI. [applicant] to provide the notification as referred to in art. 19 GDPR that Business Energy Management has sent to each recipient of his personal data and the confirmation from those recipients that they have limited the processing of the personal data of [applicant], VII. to erase his personal data without undue delay after requests I to III have been fulfilled pursuant to Art. 17 GDPR, VIII. to inform the recipients of his personal data that they must delete the data of [applicant], all under penalty of a penalty, and [applicant] requests that the court: IX. refers questions for a preliminary ruling to the Court of Justice of the European Union about the interpretation of the term 'damage' in art. 82 GDPR; X. Business Energy Management orders to pay [applicant] € 10,000 by way of compensation within two weeks after this decision, XI. Business Energy Management orders to pay to [applicant] the costs of the proceedings and subsequent costs, plus statutory interest. 3.2. The statements of [applicant] are discussed in more detail below, insofar as relevant. 4 The assessment 4.1. In this case, in the first place - briefly - it concerns the question of what personal data Business Energy Management has of [applicant], from whom it obtained it and with whom it has shared it. [Applicant] then wants his data at Business Energy Management and those third parties to be deleted. In addition, the question is whether [applicant] is entitled to compensation under Art. 82 GDPR. The requests of [applicant] (grouped together where possible) will be discussed below. The requests for inspection pursuant to art. 15 GDPR under I, III, IV and V 4.2. The requests under I, III, IV and V of [applicant] are aimed at gaining access to the personal data held by Business Energy Management. These requests are largely eligible for the following reasons. 4.3. [applicant] has asked Business Energy Management what personal data it has about him. A third party, Regional Energy Management, responded to that request. It is unclear what the relationship is between this third party and Business Energy Management. That is why [applicant] still does not know which personal data of [applicant] Zakelijk Energie Beheer has. Therefore, the request under III can be granted. The request under I will also be granted, on the understanding that it will not be stipulated that the statements to be provided must be provided from the time of the alleged consent. [Applicant] has stated that he has not given such permission, so that the date of permission cannot be reconciled. 4.4. The request under IV will be rejected. The GDPR does not provide a basis for granting this request. Moreover, [applicant] has taken the position that he has not given permission, so that it is impossible to see how Business Energy Management can provide him with any information about this. 4.5. Business Energy Management will also be ordered to provide a list of all processors and companies that have received the personal data of [applicant], as requested under V. [applicant] has submitted sufficient facts showing that Business Energy Management has shared his personal data with third parties. The request under II and V ex art. 14 GDPR 4.6. [Applicant] states that Business Energy Management has received his personal data from a third party. According to him, Business Energy Management did not receive his personal data from https://enqueteloket.nl, because this domain was not yet registered on January 28, 2021 with the Internet Domain Registration Foundation in the Netherlands, but only on February 24, 2021. The domain was registered on 29 January 2021. became active in March 2021. 4.7. The request under II will be partially granted. Article 14 GDPR gives [applicant] the right to receive information about the person from whom the controller, in this case Business Energy Management, has received his personal data. The term referred to in paragraph 3 will be set at two weeks, as requested. The request will be rejected, insofar as it relates to paragraph 4 of art. 14 GDPR. [Applicant] has not stated that Business Energy Management intends to further process his personal data for a purpose other than that for which the personal data were obtained. 4.8. Business Energy Management will also be ordered to provide a list of third parties from whom it has received the personal data of [applicant], as requested under V. In addition, it will be stipulated that Business Energy Management must state its basis for doing so. The request under VI 4.9. The request under VI will be rejected. [applicant] has not argued that Business Energy Management will inform the recipients of his personal data pursuant to art. 19 GDPR of a rectification or erasure of personal data or restriction of processing pursuant to Articles 16, 17(1) and 18 GDPR. Without explanation, which is missing, it is therefore not clear whether Business Energy Management can comply with the request. The request under VII and VIII 4.10. The request made under VII is also eligible for grant. Pursuant to art. 17 GDPR, Business Energy Management must delete the personal data of [applicant] in its possession, because it follows from the undisputed statements of [applicant] that his personal data have been processed unlawfully (Art. 17 paragraph 1 under c AVG). The court will determine that Business Energy Management must erase its personal data within a period of fourteen days after it has complied with the order that will be given on the basis of the request under I, II and III. 4.11. The request under VIII will be rejected. under art. 17 AVG only includes the obligation for the controller, in this case Business Energy Management, to inform every recipient to whom personal data has been provided of, among other things, the deletion of personal data. Business Energy Management cannot therefore be obliged to instruct those recipients to delete the personal data of [applicant], as requested by [applicant]. penalty payment 4.12. A penalty will be attached to each conviction. The penalty will be set at € 250.00 per day that Business Energy Management does not comply with the conviction and will be maximized at € 5,000.00. The requests under IX and X 4.13. With the requests under IX and X, [applicant] requests the court to order Business Energy Management to pay him compensation of € 10,000.00. 4.14. The court must, pursuant to art. 69 Rv to investigate ex officio whether a procedure initiated with a petition should have been initiated with a summons on the basis of the law. If this is the case, the judge must, if necessary, order the applicant to correct or supplement the application within a certain period of time. The judge must also order that the proceedings be continued in accordance with the rules that apply to the summons procedure. 4.15. The request under X is based on the rules for tort in art. 6:162 CC. It does not follow from the law that such a case is initiated by means of a petition. Nor does it concern a case in which the court makes an ex officio decision. This means that the rules of the summons procedure apply. [Applicant] should therefore have initiated the claim for compensation with a summons. The court will settle the case in accordance with art. 69 Put right on the right track, taking into account the following. 4.16. The court must also, pursuant to art. 71 paragraph 2 DCCP to investigate ex officio whether it is authorized to take cognizance of the case or whether it should refer the case to a sub-district court. Pursuant to art. 93 sub a Rv hears and decides in cases concerning claims with an amount not exceeding € 25,000.00. 4.17. The receivable has an amount of less than € 25,000.00. The court will therefore declare itself incompetent to take cognizance of the present case and refer the case to a subdistrict court, all this insofar as the case relates to the requested compensation (art. 71 paragraph 2 DCCP). 4.18. Since the request under IX is directly related to the request made under X, the case will also be referred insofar as it relates to the request made under IX. The process costs 4.19. As the largely unsuccessful party, Business Energy Management will be ordered to pay the costs of these proceedings, including the subsequent costs. The costs on the part of [applicant] are therefore estimated at € 309.00 in court fees and € 1,126.00 (2 x € 563.00) in lawyer's salary. These amounts will be increased with statutory interest as requested. 5 The decision The court 5.1. recommends Business Energy Management to allow [applicant] to inspect the personal data processed by him within fourteen days of this decision on the basis of art. 15 GDPR, including the processing purposes referred to in Art. 6 GDPR, by providing a complete overview of all personal data collected from him per legitimate interest and per processing, including the processors who have processed his personal data on behalf of Business Energy Management, 5.2. orders Business Energy Management to pay [applicant] a penalty of €250.00 for each day that it acts contrary to the provisions in 5.1. pronounced conviction, up to a maximum of € 5,000.00 has been reached, 5.3. orders Business Energy Management to provide [applicant] with the information referred to in paragraphs 1 and 2 of art. 14 GDPR, 5.4. orders Business Energy Management to pay [applicant] a penalty of €250.00 for each day that it acts in violation of the provisions of 5.3. pronounced conviction, up to a maximum of € 5,000.00 has been reached, 5.5. recommends Business Energy Management to provide [applicant] with a list within fourteen days of this decision of all processors and companies with whom Business Energy Management has shared its personal data and from whom it has received the personal data of [applicant], stating on the basis on which the personal data was received, 5.6. orders Business Energy Management to pay [applicant] a penalty of €250.00 for each day that it acts contrary to the provisions of 5.5. pronounced conviction, up to a maximum of € 5,000.00 has been reached, 5.7. recommends Business Energy Management to within fourteen days after making the recommendations under 5.1. and 5.3. has satisfied to delete the personal data of [applicant], 5.8. orders Business Energy Management to pay [applicant] a penalty of €250.00 for each day that it acts contrary to the provisions of 5.7. pronounced conviction, up to a maximum of € 5,000.00 has been reached, 5.9. orders Business Energy Management to pay the costs of the proceedings and estimates those costs to date on the part of [applicant] at € 1,435.00, plus statutory interest as referred to in art. 6:119 Dutch Civil Code with effect from fourteen days after service of this decision until the day of full payment, 5.10. orders Business Energy Management to pay the costs incurred after this judgment, estimated at € 163.00 in lawyer's salary, to be increased, on the condition that Business Energy Management has not complied with this decision within fourteen days of notification and the decision has subsequently been served, with an amount of € 85.00 in lawyer's salary and the writ costs of service of the judgment, plus statutory interest as referred to in art. 6:119 Dutch Civil Code with effect from fourteen days after service of this decision until the day of full payment, 5.11. declares this decision provisionally enforceable to the extent, 5.12. rejects the request under I to VIII more or otherwise, 5.13. declares itself incompetent to take cognizance of the matter insofar as it concerns the requests made under IX and X, 5.14. refers the case to the extent in which it is located to the subdistrict court chamber of this court, location Arnhem, 5.15. orders that the proceedings there be continued as they are in accordance with the rules applicable to the writ of summons, 5.16. determines that the case will be there on 9 February 2022 at 11:30 am, 5.17. orders [applicant], by writ for Business Energy Management, to provide the in 5.16. to notify the said roll-up date by notification of this decision, 5.18. orders that this writ contains additions and/or corrections to the petition to be served in such a way that, together with that petition, it meets the requirements set out in art. 111 Rv to a summons, 5.19. determines that [applicant] can adapt his statements in that writ to the procedural rules of the summons procedure, 5.20. Points out to the parties that in the remainder of the proceedings before the subdistrict court they do not have to be represented by a lawyer, but can also appear in person or through an authorized representative, 5.21. points out that the court fee levied in these proceedings remains due and that in the proceedings that will be continued before the sub-district court of this court, the court fee will be charged again, 5.22. Business Energy Management points out that if he appears in the proceedings before the subdistrict court chamber of this court, no court fee will be levied on her. This decision was given by mr. T.P.E.E. van Groeningen and pronounced in public and signed on 17 January 2022 by mr. H.F.R. van Heemstra.
