RvS - 201902604/1/A3

RvS - 201902604/1/A3
Court:	RvS (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:	Article 15 GDPR Article 35(2) Wbp
Decided:	22.01.2020
Published:	22.01.2020
Parties:	[Anonymous The chief of police]
National Case Number/Name:	201902604/1/A3
European Case Law Identifier:	ECLI:NL:RVS:2020:180
Appeal from:	Rb. Zeeland-West-Brabant (Netherlands)
Appeal to:
Original Language(s):	Dutch
Original Source:	de Rechtspraak (in Dutch)
Initial Contributor:	n/a

The Dutch State Council (Raad Van Staten) ruled that whenever the data subject is not provided with a complete overview of the personal data processed in a comprehensible form, a description of the purpose(s), the personal data's categories, the recipients or categories of recipients as well as the available information on the origin, as requested, the data controller had to search again to be compliant with Article 15 GDPR.

English Summary

Facts

The claimant was previously involved in several proceedings regarding the police's treatment towards herself and the disclosure of her personal data to the public. To know more about the processing of her personal data by the Chief of Police, she submitted a subject access request.

The Chief of Police provided her with a summary of the personal data processed with the information requested with undue delay, in June 2017. Thus, the Chief of Police set a penalty payment. Following the first answer, the Chief of Police completed with another decision in October 2017 which has been challenged by the applicant before the Court Rb. Zeeland-West-Brabant (Netherlands).

The Court Rb. Zeeland-West-Brabant annulled the decision of October 2017 as it found it incomplete. However, based on the new Chief of Police supplementing decision submitted in January 2018 during the proceedings, it also ruled that the data controller does not have to take any other decision regarding the subject access request. Indeed, the lower court considered that the supplementing decision, so-called the "new overview" decision provided enough information and was, thus, complete.

The claimant's appeal the Court Rb. Zeeland-West-Brabant's judgement before the Dutch State Council (Raad Van Staten).

The applicant claimed mainly that the new overview decision has not been provided in comprehensible form. Especially, she argued that the information related to the purpose(s) of the processing, the recipients or categories of recipients and the origin were not stated clearly. Also, she argued that the new overview decision was still incomplete, as some of the personal data were missing.

Dispute

The Raad Van Staten had to decide on whether the information provided in the proceeding were sufficient enough to comply with Article 15 GDPR and the National data protection law.

Holding

The Raad Van Staten considered that the data controller had to search another time and find all the personal data about the data subject to answer with accurate and clear information.

Comment

Share your comment here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the Dutch original for more details.

Ruling

201902604/1/A3.

Date of judgment: 22 January 2020

SECTION

ADMINISTRATIVE LAW

Ruling on the appeal of:

[appellant], residing at [residence],

against the judgment of the District Court of Zeeland-West Brabant of 19 February 2019 in Case No 17/7440 in the proceedings between:

[appellant]

and

the chief of police.

Process sequence

By decision of 2 June 2017, the Chief of Police decided, at the request of [appellant], to inform her whether he is processing personal data relating to her.

By decision of 6 October 2017, the chief of police upheld the objection made by [appellant].

By decision of 19 February 2019, the District Court upheld the appeal lodged by [appellant] against the decision of 6 October 2017, annulled the decision and determined that the legal consequences of this decision remain intact. This judgment is attached.

[Appellant] has lodged an appeal against this decision.

The chief of police has given a written explanation.

The [appellant] has granted the Division permission to give its decision partly on the basis of the information not made available for inspection.

The Section heard the case at the hearing on 3 December 2019, where [the appellant] and the Chief of Police, represented by L. van den Berg, appeared.

Considerations

Legal framework

1.    The relevant laws and regulations are set out in an appendix. This forms part of the ruling.

Introduction

1.1.    [appellant] is involved in several proceedings concerning the way in which she has been treated by the police and how her personal data have been handled. Personal details of [appellant] have been made public. Because [the appellant] wants to know exactly what happened to her personal data, she asked the Chief of Police on 28 February 2017 to inform her whether he is processing her personal data and, if so, what personal data is being processed, what the purpose of this is, to whom these data have been provided and what the origin, as far as known, of these data is. In addition, she has requested the Chief of Police to provide her with copies of the documents in which her personal data have been processed.

1.2.    The Chief of Police confirmed receipt of the request on 21 March 2017. He noted that the request covered the period from 29 October 2013 to 28 February 2017. The appellant subsequently served notice of default on the Chief of Police for not having decided on the application in time.

    By decision of 2 June 2017, the Chief of Police provided [the appellant] with a summary of the personal data processed by him. This decision states what the purpose of this is, to whom these data have been provided and what the origin, as far as known, of these data is. Because this decision was not taken on time, the chief of police set a penalty payment. In response to [appellant's] objection, the Chief of Police saw reason to supplement the overview with the decision of 6 October 2017.

    Following [appellant's] notice of appeal, the chief of police amended, supplemented and substantiated this overview on a number of points. This resulted in a new overview that was appended to the statement of defence of the Chief of Police to the District Court of 16 January 2018. In this new overview, the chief of police has made a subdivision into five categories. At the hearing [appellant] stated that her appeal does not relate to category 3. Category 1 is divided into two subcategories. Subcategory a relates to documents filed with the Complaints Department. Subcategory b relates to documents from an external complaints committee. Category 2 relates to documents relating to legal proceedings conducted in a disciplinary investigation into a district attorney. Category 4 relates to documents from a Regional Service Centre. Category 5 relates to other (contact) information.

1.3.    The District Court annulled the decision of 6 October 2017 because the overview accompanying that decision was incomplete in view of the amendment and addition on appeal. Subsequently, the District Court ruled that the new overview did meet the statutory requirements, so that the legal consequences of the annulled decision can be maintained. This meant that the chief of police did not have to take a new decision on [the appellant's] objection and that the new overview was considered complete. Furthermore, the District Court ruled that the Chief of Police determined the penalty payment on correct grounds.

The appeal

1.4.    [appellant] first of all submits on appeal that the course of the proceedings recorded by the court in the judgment is incorrect. Subsequently, [appellant] argues that the chief of police forfeited a penalty payment rather than assumed by the District Court. Finally, [appellant] argues that the District Court has wrongly ruled that the new overview is complete.

1.5.    The Division will assess these arguments below.

The course of the proceedings

2.    According to [appellant], the course of the proceedings is incorrect because it follows that on 12 December 2018 the District Court would have announced that no further hearing would take place. However, [appellant] was not aware of this.

2.1.    As follows from the judgment of the Division of 14 November 2018, ECLI:NL:RVS:2018:3729, the course of the proceedings provides a brief description of the proceedings. By letter of 9 October 2018, the District Court announced that no further hearing would take place, unless the parties indicated that they wished to be heard orally at the hearing. By letter of 14 November 2018, the District Court reminded the parties of the letter of 9 October 2018. By letter of 17 November 2018, [appellant] responded by stating that it no longer needed to be heard at the hearing. The fact that the court mentions a letter of 12 December 2018 in the course of the proceedings must be based on a manifest error. There is therefore no reason to draw any consequences from this.

    The argument fails.

The penalty payment

3.    [appellant] served notice on the chief of police on 8 April 2017. By letter dated 12 April 2017, the chief of police informed [appellant] that the notice of default could not be dealt with because it had been received by e-mail. The chief of police informed [appellant] that it is not possible to send a notice of default by e-mail. Subsequently, [appellant], by letter dated 17 April 2017, again served notice of default on the Chief of Police.

3.1.    [appellant] states that she served notice of default on the Chief of Police on 8 April 2017 by both e-mail and ordinary mail. The chief of police had attached a reply envelope to his letter of 30 March 2017, with which she sent a letter in which she responded to a request for inspection. She also sent a notice of default, as she wrote in her letter of 17 April 2017.

3.2.    [Appellant] submitted its request on 28 February 2017. Pursuant to Section 35(1) of the Wbp, the term allowed to the Chief of Police to decide on that request was four weeks. The chief of police should therefore have taken a decision on the application before 28 March 2017. Subsequently, [the appellant] served notice of default on the chief of police by e-mail of 8 April 2017, gave him a term to decide on her request within two weeks and stated that if he did not do so, he would forfeit a penalty payment. It has not become apparent, nor has [the appellant] demonstrated that she also sent a notice of default by ordinary post on that day. The chief of police denies having received such a letter. By letter dated 12 April 2017, the chief of police informed [appellant] that a notice of default cannot be submitted by e-mail but must be submitted by ordinary mail. By letter of 17 April 2017, [appellant] again served notice of default on the Chief of Police, gave him a period of two weeks to decide on her request and stated that if he fails to do so, he would forfeit a penalty payment.

    The Section is of the opinion that the first day on which the Chief of Police owes a penalty payment is 2 May 2017. This is the day after two weeks had elapsed for a decision to be made after the letter of 17 April 2017. The chief of police has not yet opened the digital route for submitting applications and therefore the e-mail from [appellant] of 8 April 2017 cannot be regarded as a notice of default. Since the simultaneous dispatch by ordinary mail on that date has not been proved and receipt is denied, 8 April 2017 cannot be assumed. The District Court has rightly reached the same conclusion.

    The argument fails.

The overview of personal data processed

The argument of [appellant]

4.    [Appellant] argues that the Court wrongly held that the personal data included in the new overview have been provided in a comprehensible form, that they are provided with a description of the purpose(s) of the processing, that it is clear to which categories of data the processing relates, that it is clear who the recipients or categories of recipients are and that it is clear what the origin of the data is. Moreover, according to [Appellant] not all personal data are mentioned on the overview. For example, data sent by the Chief of Police to the Central Board of Appeal (hereinafter: CRvB) are not mentioned on the overview. The Chief of Police should also have included processing relating to internal consultations, her contact with police officers, letters, e-mail messages, telephone and internal notes and minutes of conversations in the new overview. For these reasons, she did not have sufficient access to her personal data. Furthermore, the chief of police wrongly included some processing operations in the overview, according to [appellant].

Assessment

4.1.    Pursuant to Section 35(2) of the Personal Data Protection Act (Wbp), a data subject is entitled, if an administrative body processes his personal data, to a complete overview of the processing of personal data in a comprehensible form, a description of the purpose(s) of the processing, the categories of data to which the processing relates and the recipients or categories of recipients, as well as the available information about the origin of the data.

4.2.    In his defence, the Chief Constable took the position that [the appellant] lodged an appeal in order to express his dissatisfaction with the way in which he dealt with her interests in the appeal procedure instituted by the District Attorney following the disciplinary investigation. At the hearing, the Chief of Police explained that if he searches again, he will undoubtedly be able to find more e-mails containing personal information about [the appellant], but that there is a limit to what can be considered a reasonable effort to investigate which personal information is held by him. According to the chief of police, he has reached that limit. Furthermore, the chief of police has explained that the fifteen documents he sent to the CRvB look familiar to him. These documents are not mentioned on the new overview. The chief of police has explained that at least one of these documents processed the personal data of [the appellant].

4.3.    In view of the provisions of 4.2. alone, the new overview does not meet the requirements of Article 35, second paragraph, of the Wbp. The fact that [the appellant] started this procedure according to the Chief of Police in order to express her dissatisfaction with the way in which he handled her interests does not release the Chief of Police from his legal obligation to provide her with a complete overview of the processing of [the appellant's] personal data. Therefore, the Chief of Police must again search for personal data of [appellant] that he processed in the period from 29 October 2013 to 28 February 2017. This concerns only the processing of personal data of [appellant] by the Chief of Police and not the processing of personal data of [appellant] by third parties. In this new search, the Chief of Police must provide insight into the manner in which he has searched for the processing of her personal data. Because the Wbp was repealed on 25 May 2018 and the General Data Protection Regulation (hereafter: AVG) applies from that moment on, the chief of police must apply the AVG when providing a new overview and check whether the overview is in accordance with it. In view of the above, the District Court wrongly maintained the legal consequences of the annulled decision.

    The argument succeeds.

Conclusion

5.    The foregoing means that the appeal is well-founded. The judgment under appeal must be set aside to the extent that the court has upheld the legal consequences of the annulled decision. In doing what the District Court should do, the Division will determine that the Chief of Police must again make a decision on [the appellant's] objection, with due observance of this judgment. The argument of [appellant] that the court should have assessed whether the overview complies with the AVG when maintaining the legal consequences can therefore also be disregarded. With a view to an efficient settlement of the dispute, the Division also sees reason, pursuant to Section 113(2) of Section 8:113 of the General Administrative Law Act (Awb), to provide that the new decision can only be appealed against by the Division. Incidentally, it emerged at the hearing that it is not excluded that [the appellant] and the chief of police may reach an amicable solution.

6.    The chief of police should be ordered to pay the costs of the proceedings in a manner to be reported.

Decision

The Administrative Jurisdiction Division of the Council of State:

I. declares the appeal well-founded;

II. sets aside the judgment of the District Court of Zeeland-West Brabant of 19 February 2019 in case no. 17/7440 in so far as the District Court has upheld the legal consequences of the annulled decision of 6 October 2017;

III. provides that the Chief of Police must take a new decision on [appellant's] objection;

IV. provides that the new decision to be taken can only be appealed to the Division;

V. orders the chief of police to compensate [appellant] for legal costs incurred by [appellant] in connection with the handling of the appeal up to an amount of € 39.70 (in words: thirty-nine euros and seventy cents);

VI. orders the chief of police to reimburse to [appellant] the court fee paid by her in connection with the handling of the appeal in the amount of € 259.00 (in words: two hundred and fifty-nine euros).

Thus determined by C.H.M. van Altena, chairman, and G.M.H. Hoogvliet and H.C.P. Venema, members, in the presence of S. Langeveld-Mak, registrar.

w.g. Van Altena w.g. Langeveld-Mak

chairman of the court clerk

Pronounced in public on 22 January 2020

317-857.

 

ANNEX

 

General Administrative Law Act

Article 2:14

1. An administrative body may send a message addressed to one or more addressees electronically insofar as the addressee has indicated that he or she can be sufficiently reached by this means.

[…]

Article 4:17

1. If a decision on an application is not made in time, the administrative body shall forfeit to the applicant a penalty payment for each day that it is in default, but for a maximum of 42 days. The General Time-Limits Act does not apply to the latter period.

2. The penalty payment is € 23 per day for the first fourteen days, € 35 per day for the following fourteen days and € 45 per day for the remaining days.

3. The first day on which the periodic penalty payment is due is the day on which two weeks have elapsed after the day on which the period for making the decision has expired and the administrative body has received a written notice of default from the applicant.

[…]

Personal Data Protection Act [as it stood until 25 May 2018].

Article 35

1. The data subject shall have the right to address himself/herself freely and at reasonable intervals to the data controller with a request to inform him/her whether personal data relating to him/her are being processed. The data controller shall inform the data subject in writing within four weeks whether personal data relating to him or her are being processed.

2. Where such data are being processed, the communication shall contain a comprehensive overview thereof in a comprehensible form, a description of the purposes or purposes of the processing, the categories of data concerned by the processing and the recipients or categories of recipients, as well as available information as to the origin of the data.

[…]