Rb. Den Haag - AWB - 22 5012
| Rb. Den Haag - AWB - 22 _ 5012 | |
|---|---|
 | |
| Court: | Rb. Den Haag (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 5 GDPR Article 15 GDPR |
| Decided: | 26.04.2023 |
| Published: | 10.05.2023 |
| Parties: | Authoriteit Persoonsgegevens |
| National Case Number/Name: | AWB - 22 _ 5012 |
| European Case Law Identifier: | ECLI:NL:RBDHA:2023:5636 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Dutch |
| Original Source: | De rechtspraak (in Dutch) |
| Initial Contributor: | kv33 |
TO BE UPDATED
The Dutch District Court of Den Haag rejected two immaterial damage claims of the data subject against both the Dutch Tax Authority, de belastingdienst, and the Dutch DPA.
English Summary
Facts
On 17 May 2020, the data subject exercised his right of access (Article 15 GDPR) to the Dutch Tax Authority, de belastingdienst (controller).
On 17 June 2020, the data subject filed a complaint at the Dutch DPA, because the controller had refused to sent him his file (original complaint).
On 25 March 2021, the DPA rejected the complaint of the data subject.
On 2 November 2021, the data subject appealed the decision of the DPA (in Dutch: bezwaar) to reject his initial complaint. Therefore, the DPA had to look at the initial complaint again.
On 2 June 2022, the controller did make a decision on the data subject's access request. It is not clear from this ruling what the controller decided.
On 11 July 2022, after assessing the original complaint again, the DPA upheld the complaint of the data subject en warned the controller for not answering the access request within the time limit, in violation of Article 12(3) GDPR. The data subject, appealed this decision to the court (in Dutch: Beroep).
On 18 October 2022, the data subject filed another complaint at the DPA against the controller. The data subject claimed that the controller had informed the DPA about the existence of any procedures between the data subject and the controller. According to the data subject, this was in violation with the GDPR. The DPA had originally started this information exchange with the controller, but the DPA had also clarified to the controller that any information about fiscal procedures between the data subject and the controller was not relevant for its assessment of a potential GDPR violation. It had only requested information that was relevant for its GDPR assessment for a potential violation of Article 5 GDPR.
On an unspecified data, the data subject went to court against both the controller and the DPA.
Regarding his claim against the controller, the data subject stated that the controller never informed him about its decision of 2 June 2022 regarding the access request. For this, the data subject claimed a compensation of €25,000.
Regarding his claim against the DPA, he stated that the DPA did not properly execute its tasks (in Dutch: Onbehoorlijk bestuur). The data subject requested €25,000 (tax-free) for immaterial damages. The data subject also stated that the DPA violated Article 6 ECHR for the lack of a hearing within a reasonable time.
Holding
First, the court determined that it did not have the authority to assess the decision of the controller. The court was only competent to assess the decision of the DPA. Therefore, the court did not have the authority to order the controller to compensate the data subject.
Second, the court assessed the data subject's claims against the DPA for immaterial damages. The court rejected this claim for several reasons. Among other reasons, the data subject had not explained what the claimed immaterial damage exactly entailed.
Third, regarding the claim about the reasonable time (Article 6 ECHR), the court determined that a term of 2 years was reasonable in this case. To determine if a reasonable term has been violated, the following circumstances of the case need to be assessed: the complexity of the case, the manner in which it was handled by the administrative body and the court, the procedural conduct of the data subject throughout the proceedings and the nature of the measure and the interest of the person concerned affected by the measure.
The court determined that the procedure had not exceeded two years. Therefore, the data subjects claim was rejected on this point.
Third, regarding the information provided by the controller to the DPA about any procedures between the controller and the data subject, the court determined that the controller did not violate the GDPR. The court did not provide an assessment for this conclusion.
In conclusion, the court refused all the claims of the data subject.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
