Hoge Raad - 22/03293

Hoge Raad - 22/03293
Court:	Hoge Raad (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:	Article 15 GDPR Article 35 Uitvoeringswet Algemene Verordening Gegevensbescherming
Decided:	15.09.2023
Published:	15.09.2023
Parties:
National Case Number/Name:	22/03293
European Case Law Identifier:	ECLI:NL:HR:2023:1216
Appeal from:	GHAMS ECLI:NL:GHAMS:2019:3966
Appeal to:
Original Language(s):	Dutch
Original Source:	Hoge Raad (in Dutch)
Initial Contributor:	Enzo Marquet

The Dutch High Court held that when a data subject seeks to have their access rights enforced, they can also request preliminary injunction, even though the legal deadline for such enforcement has officially passed. The High Court also noted that making additional access requests without new information does not mean those requests are automatically manifestly unfounded or excessive.

English Summary

Facts

The case concerned an action for cassation brought before the Dutch Supreme Court on 15 September 2023, following an appeal against the Amsterdam Court of Appeal's judgment of 5 November 2019.

The main question brought before the Court was whether it was possible to raise an objection to the procesing of personal data in summary proceedings following the six-week time limit set out by Article 35(2) of the UAVG (Uitvoeringswet Algemene Verordening Gegevensbescherming). The UAVG is the Dutch national transposition of the GDPR. Article 35 UAVG implements Article 79 GDPR, and provides:

"1. If the decision on a request as referred to in Article 34 has been taken by a body other than an administrative body, the interested party may apply to the court with a written request to order the controller to comply with the request referred to in Articles 15 to 22 of the Regulation.

2. The application shall be made within six weeks of receipt of the answer from the controller. If the controller has not replied within the time limits referred to in Article 12, paragraph 3 of the Regulation, the submission of the application shall not be subject to a period."

In the present case, the data subject had made an application after the six-week time limit laid down in Article 35(2) UAVG. The facts are as follows. The data subject had taken out a student loan in 2002, and consequently, the details of it were registered in the Dutch Central Credit Registration Office (BKR). This body keeps records of private parties that have taken out credit. In early 2018, the data subject had applied for a loan and was denied due to the financial records on their credit history kept by the BKR.

On 27 June 2018, the data subject submitted an objection to processing (Article 21 GDPR) to BKR. By a letter dated 23 July 2018, BKR responded in the negative, refusing to comply with the objection.

On 30 October 2018, the data subject made a request to the court to order the controller to comply with the request made under Article 21 GDPR. The Court at first instance dismissed the application because it fell outwith the 6-week time limit under Article 35 UAVG. The data subject appealed this decision.

On 5 November 2019, the appeal was before the Amsterdam Court of Appeal. The Court upheld the First Instance ruling and dismissed the appeal. The Court of Appeal noted that:

"In a case like the present one, the claimant will have to substantiate his urgent interests against the background of Article 21 GDPR and 35 UAVG. That system is based on the idea that the parties first try to reach an agreement themselves and that, in the vent of a negative response under the penalty of inadmissability, the interested party has only a limited time to submit its objections to the Court."

The data subject appealed the decision and on 15 September 2023, the Hoge Raad (Dutch Supreme Court) ruled on the case.

Holding

The Supreme Court upheld the appeal and overtuned the Court of Appeal's ruling. In reaching its conclusion, the Court placed emphasis on the fundamental rights nature of the GDPR, pointing to Recitals 10 and 59 GDPR. Recital 10 establishes that Member States should provide for a high level of protection of the rights and freedoms of natural persons, and Recital 59 establishes that modalities should be provided for by the controller for facilitating the exercise of data subject's rights under the GDPR.

Following from this, the Court noted that Article 21 GDPR confers the right upon data subjects to confer to processing at any time. The Court also pointed to Article 12 GDPR, which establishes that the burden falls upon the controller to demonstrate that a data subject's request is manifestly unfounded or excessive, not the data subject.

The High Court first held that making additional access requests under Article 15 to Article 22, even though that request includes no new information, does not automatically mean the request is manifestly unfounded of excessive.

The High Court clarified that article 35 of the Dutch UAVG specifies that the petition procedure should be used when a data subject asks the court to instruct the data controller to accept or reject a request based on Articles 15 to 22 of the GDPR. The High Court stated that the regular court cannot be used to challenge a decision of a controller for access request. However, the High Court did hold that for urgent needs, temporary relief can be requested through a preliminary injunction. On top of that missing the deadline under article 35 UAVG does not deprive a data subject of its right from seeking legal action through this preliminary injunction.

Lastly, the High Court held that when a controller denies an access request, it must motivate its decision. It comes to the controller to show why the request is manifestly unfounded or excessive.

As such, the High Court annuled the decision by the regular court.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.