Rb. Rotterdam - 9900906
| Rb. Rotterdam - 9900906 | |
|---|---|
 | |
| Court: | Rb. Rotterdam (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 9 GDPR Article 843a Dutch Code of Civil Procedure |
| Decided: | 07.10.2022 |
| Published: | |
| Parties: | NN Defendant |
| National Case Number/Name: | 9900906 |
| European Case Law Identifier: | ECLI:NL:RBROT:2022:9287 |
| Appeal from: | |
| Appeal to: | Not appealed |
| Original Language(s): | Dutch |
| Original Source: | ECLI:NL:RBROT:2022:9287 (in Dutch) |
| Initial Contributor: | niilvfer |
The District Court of Rotterdam ordered a controller to provide the name and address details of a former employee to the defendant for the establishment of a legal claim. The provision of this information was not incompatible with Article 6(1)(f) GDPR, since it was necessary for the fulfillment of the defendant's legitimate interest.
English Summary
Facts
The defendant allegedly took out household contents insurance with the insurance company 'Nationale Nederlanden' (the controller). Under this insurance, the defendant made claims for damages based on false documents. The controller found out and claimed damages from the defendant for submitting claims based on false documents.
The defendant disputed that he made those false claims, and, moreover, that he took out any insurance at all. He alleged identity fraud by a former employee of the controller (the data subject). The defendant stated that the data subject received the money paid by the controller through some sort of fabrication. To prove this, the defendant claimed the release of the data subject's name and address details. In addition, the defendant argued that if it would be ordered to pay, he would have a claim against the data subject for that amount. He therefore believed it was in his interest to call the data subject in indemnity.
The controller disputed that it had to provide the address details. It argued that, the defendant did not sufficiently substantiate his interest in requesting the release of the data subject's name and address details. It also stated that the request was in violation of Article 6(1)(f) GDPR.
Holding
First, the Court stated that pursuant to Article 843a(1) of the Code of Civil Procedure (CCP), the defendant may demand certain specified documents relating to a legal relationship in which they are a party from the person who has these documents at their disposal. The defendant must however have a legitimate interest in receiving the documents. The Court stated that, without the name and address details, the defendant would be unable to hold the data subject liable for the damages resulting from the claim alleged by the defendant. The defendant thus had an interest in granting the claim to provide the name and address details. The Court added that it was not necessary for defendant to show that his underlying claim would succeed. It was sufficient that defendant may have an underlying claim.
Second, the Court held that, contrary to the controller's argument, Article 6(1)(f) GDPR does not stand in the way of granting the claim to provide the name and address data. As established for Article 834a CCP, the defendant had a legitimate interest in obtaining the personal data. Without these personal data, he would not be able to institute legal proceedings against the data subject. For this reason, the processing of the personal data was also necessary for defendant according to the Court. In this context, the Court also mentioned Article 9(1) and (2)(f) GDPR. The Court noted that, following this provision, the processing of medical data and personal data revealing - inter alia - racial or ethnic origin or political opinions was prohibited. Unless, the processing is necessary for the institution, exercise or substantiation of legal proceedings or when courts are acting within the scope of their jurisdiction. The Court held that while this provision does not explicitly apply to the present case, since even the processing of special categories of personal data is not prohibited if necessary for bringing a legal action, the processing of name and address data was permissible in the present case.
As the requirements for Article 843a CCP were met and testing against the GDPR did not lead to the conclusion that the processing of the name and address details is unlawful or prohibited, the Court allowed the claim filed for the release of the data subject's name and address details.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
ROTTERDAM COURT location Rotterdam case number: 9900906 \ CV EXPL 22-16397 ruling date: October 7, 2022 Judgment in incident of the subdistrict court judge in the case of Nationale-Nederlanden Schadeverzekering Maatschappij N.V. , location: The Hague, plaintiff in the main defendant in the incident, authorized representative: mr. M. Hamidy, against [defendant01] , city: [hometown01] , defendant in the main action, plaintiff in the incident, authorized representative: mr. A.K. Ramdas. The parties are hereinafter referred to as 'NN' and '[defendant01]'. 1 . The procedure The file consists of the following procedural documents: - the summons of May 9, 2022, with attachments; - the incidental claim regarding a claim pursuant to Article 210 DCCP; - the statement of defense in the incident ex art. 210 RV. 2 . The main dispute 2.1. In summary, NN demands: - order [defendant01] to pay her € 7,197.22 in principal and € 921.37 (incl. VAT) in extrajudicial costs, plus interest; - order [defendant01] to pay the costs of the proceedings, plus interest; - to declare the judgment provisionally enforceable. 2.2. NN bases the requirement on the following. [defendant01] has taken out contents insurance with NN. Under this insurance [defendant01] has submitted claims for damages based on false documents. With this, [defendant01] committed a breach of contract towards NN and acted unlawfully, as a result of which NN suffered damage. Moreover, NN has unduly paid the damage claims to [defendant01] (article 7:941 paragraph 5 DCC in conjunction with article 6:203 DCC), so that the amount must be repaid. 2.3. [defendant01] does not agree with the claim and disputes that he made a claim report and also that he took out insurance at all. He argues that identity fraud has been committed by a former employee of NN (hereinafter: the former employee). 3 . The dispute in the incident 3.1. [defendant01] claims in summary: - order NN to provide all name and address details of the former employee known to it, including in any case the name, address and place of residence, to [defendant01], subject to a penalty of € 1,000.00 per day or part thereof that it fails to comply therewith; - that he be allowed to summon the former associate in indemnification. 3.2. [defendant01] bases his claims on the following. By committing fraud, the former employee acted unlawfully towards [defendant01]. The former employee received the money paid out by himself through a construction, while [defendant01] himself never submitted a claim for damages and, moreover, there is no contractual relationship between NN and [defendant01]. If [defendant01] is ordered to pay any amount, he will have a claim against the former employee for that amount. He therefore believes that he has an interest in summoning that person indemnification. Because he does not know the name, address and place of residence of the former employee, [defendant01] claims that NN be ordered to provide this information. 3.3. With regard to the claim for indemnification, NN refers to the judgment of the subdistrict court judge. With regard to the claim for the release of the name and address details, NN has argued that [defendant01] has insufficiently substantiated its interest in the request to issue the name and address details of the former employee. In addition, the assessment framework of Article 6 paragraph 1 sub f GDPR is not met. Finally, the penalty must be rejected as insufficient and NN disputes that it must provide the address details because only the name and place of residence need to be known to [defendant01] in order to subsequently be able to access the address of the former employee via the Municipal Personal Records Database. to ask. 4 . The assessment in the incident Name and address details 4.1. [defendant01] has formulated two claims in the incident, in which the claim to issue the name and address details – as the subdistrict court understands – has been brought for the purpose of indemnification. Although [defendant01] has not explicitly based its claim pertaining to the provision of name and address details on Article 843a Rv, this claim must be assessed by the subdistrict court judge on that basis. After all, [defendant01] has based his claim on the relevant facts for the application of this provision and, pursuant to Article 25 Rv, the court will supplement the legal grounds ex officio. 4.2. Pursuant to Article 843a paragraph 1 Rv, a party that has a legitimate interest in this can demand, at its own expense, to inspect, copy or extract certain documents regarding a legal relationship to which it or its legal predecessors are a party, from the person who has these documents at its disposal or under has his resignation. On the basis of this article, four cumulative requirements must therefore be met for a claim for delivery of documents or access to documents to be admissible, namely: there must be a legitimate interest, it must be about certain modest, there must be a legal relationship, and the person from whom the documents are demanded must have these documents at his disposal or in his custody. 4.3. The first requirement has been met. The legitimate interest of [defendant01] lies in the fact that without the name and address details he is unable to hold the former employee liable for the damage resulting from the wrongful act alleged by [defendant01]. [defendant01] therefore has an interest in the granting of the claim to provide the name and address details. It is not necessary for [defendant01] to demonstrate that his underlying claim will succeed. To assume a legitimate interest, it is sufficient that [defendant01] may have an underlying claim. 4.4. The second requirement is also met. It concerns 'certain' documents, namely the name, address and place of residence of the former employee as referred to in marginal 15 of the initiating summons. In its statement of defense in the incident, NN argued that “it cannot be ruled out that [defendant01] had contact with one of the other persons involved in the fraud, not being the former employee of NN”. However, marginal number 15 of the initiating summons shows that NN is aware of the identity of the former employee involved in this case. For example, NN argues that “this person” was able to pay out damage claims up to an amount of € 2,500.00 without internal consultation and that the compensation claims paid to [defendant01] “were also handled by the fraudulent employee”. In this way, NN demonstrates that it is clear to it who is involved and from which data provision is requested. 4.5. With regard to the third requirement of a legal relationship, the following is considered. There is a legal relationship between [defendant01] and the former employee that arises from the alleged claim of [defendant01] against the former employee in an unlawful act. Although NN is not a party to this legal relationship, the third requirement has been met. After all, a claim based on Article 843a paragraph 1 Rv can be brought against other parties to the legal relationship referred to in this provision, and against third parties who are not party to that legal relationship (ECLI:NL:HR:2015:1834, ground 3.6.4 to 3.6.6). 4.6. Finally, there is no reason to assume that NN would not have access to the name and address details of the former employee, except insofar as NN has stated that it can only report the place of residence as last known to it. However, the theoretical possibility that NN's data is not (or no longer) up-to-date does not prevent the fourth requirement from being met. AVG 4.7. NN has argued that any processing of personal data is, in principle, unlawful, and that Article 6, paragraphs 1 to 3, of the AVG stipulates in which cases and under what conditions the processing is lawful. According to NN, the claim of [defendant01] does not meet the assessment framework that can be derived from Article 6 paragraph 1 sub f AVG. 4.8. In the opinion of the subdistrict court, the provisions of the GDPR do not stand in the way of granting the claim for the provision of name and address details. It has already been discussed in legal consideration 4.3 that [defendant01] has a legitimate interest as referred to in Article 843a Rv in obtaining the name and address details, since without this name and address information he is unable to institute legal proceedings against the former employee. The processing of the personal data is therefore also necessary for [defendant01] . In addition, the subdistrict court will include in its judgment what is stipulated in Article 9 of the GDPR about the processing of special categories of personal data. It follows from paragraph 1 in conjunction with paragraph 2, opening words and under f of this article, that the processing of medical data and personal data that show - among other things - race, ethnic origin or political opinions, is prohibited, unless the processing is necessary for the institution , exercise or defense of a legal claim or when courts are acting within their jurisdiction. This provision does not explicitly apply to the present case because it (only) concerns name and address data. However, the subdistrict court does deduce from this provision that, since even the processing of special categories of personal data is not prohibited when this processing is necessary for the establishment of a legal claim, the processing of name and address data is permitted in this case now that [defendant01] has needs information for instituting a legal claim against the former employee. Name and address details – conclusion 4.9. Since the four requirements of Article 843a Rv have been met and testing against the GDPR does not lead to the conclusion that the processing of the name and address data is unlawful or prohibited, the subdistrict court will grant the claim for the issue of the Assign name and address details of the former employee. The subdistrict court judge will follow the wording in the petition of [defendant01] in the sense that to identify the former employee, reference will be made to marginal 15 in the initiating summons and that the period for providing the name and address details will be set at seven days after this sentence. Penalty payment 4.10. In view of NN's undertaking to comply with the conviction, the subdistrict court decided not to attach a penalty to that conviction. Moreover, [defendant01] has insufficiently substantiated his interest in a penalty payment. Address data 4.11. It cannot be excluded that the combination of name and place of residence as provided by NN occurs in multiples. To prevent unnecessary complications with the summons in indemnity, the address details of the former employee will therefore also have to be provided by NN, all the more so since NN has insufficiently substantiated its interest in withholding this information. disclaimer 4.12. As NN rightly pointed out, the judgment on the claim regarding the provision of name and address details influences (the judgment on) the claim to be allowed to summon the former employee. After all, this last claim is insufficiently determinable in the current formulation – in which essential personal details are missing – and therefore cannot yet be decided on. When NN will have provided the name and address details of the former employee and these have been brought into question, a final judgment in the incident for summons in indemnity can follow. 4.13. The subdistrict court gives [defendant01] the opportunity to inform the subdistrict court in writing at the docket hearing of Wednesday, November 2, 2022 at 2:30 p.m. about the data relating to the person to which his claim for summons in indemnity relates. In view of the foregoing, any further decision in the incident to summons will be stayed until [defendant01] has had the opportunity to submit the necessary information. Litigation costs 4.14. The decision on the costs in the incident is reserved until the final ruling in the incident. in the main 4.15. Until a decision is made in the incident for summons in indemnity, every decision in the main action will be stayed ex officio. 5 . The decision The subdistrict court: in the event orders NN to provide [defendant01] with the name and address details known to it of the former employee, as referred to in marginal number 15 in the initiating summons, within seven days of this judgment; gives [defendant01] the opportunity to submit in writing at the docket hearing of Wednesday November 2, 2022 at 2:30 p.m. said docket hearing must be received at the registry at 12:00 noon; reserve any further decision; in the main reserves any further decision. This judgment was rendered by mr. K.J. Speak out and speak publicly. 48637
