Rb. Midden-Nederland - ECLI:NL:RBMNE:2023:6043
| Rb. Midden-Nederland - ECLI:NL:RBMNE:2023:6043 | |
|---|---|
 | |
| Court: | Rb. Midden-Nederland (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 12(3) GDPR |
| Decided: | 09.11.2023 |
| Published: | 29.11.2023 |
| Parties: | University of Utecht |
| National Case Number/Name: | ECLI:NL:RBMNE:2023:6043 |
| European Case Law Identifier: | ECLI:NL:RBMNE:2023:6043 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Dutch |
| Original Source: | De Rechtspraak (in Dutch) |
| Initial Contributor: | n/a |
The Central Netherlands District Court awarded a data subject €707 in damages for a controller's late response to an access request. The controller was in violation of Article 12(3) GDPR, as they had failed to respond to the data subject's access request within the one-month deadline.
English Summary
Facts
On 2 December 2022, the data subject made an access request to the University of Utrecht (the controller), under Article 15 GDPR. In the request, the data subject asked for 'all information about my [their] records'.
On 11 January 2023, the controller responded asking the data subject to clarify their request, as the original request was too general and not specific enough.
On 13 January 2023, the data subject replied, noting that they did not need to provide the controller with any more information.
On 10 February 2023, the controller set aside the data subject's request due to their lack of response and notified them thereof. The data subject subsequently brought a claim against the controller in the Central Netherlands District Court for the lack of response to their access request.
Holding
The Court held that the controller was in violation of Article 12(3) GDPR, as they had failed to respond to the data subject's access request within the one-month deadline.
The Court noted that, while the controller did respond with a request for more information, this response was after the one-month deadline established by Article 12(3) GDPR. Usually, a request for more information would have suspended the one-month deadline. However, in this case it was not suspended, as the response was done after the deadline had passed. The Court further held that there was no infringement of Article 15 GDPR, as the data subject did not respond to the controller's request for more information. As such, the controller was entitled to set aside the access request on 10 February 2023.
As a result, the Court held that the controller was liable for damages for their violation of Article 12(3) GDPR, and awarded the data subject €707 in damages. The amount awarded was calculated on the basis of domestic administrative law, as the controller (the University of Utrecht) is an administrative body.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
On 2 December 2022, the claimant asked the college to the college with an appeal in response to Articles 5, 12 and 15 of the General Data Protection Regulation (GDPR) for information about those documents and all personal data processed therein.
The request reads as follows: “On June 16, 2021, your lawyer sent a letter with a characteristic “Departing further documents UU”. The letter confirmed my suspicion that you have much more pieces than you have admitted so far. It also confirmed my suspicion that changes had been made to my personal data. This was wrongly without the legally required communication within the meaning of art. 14 GDPR, or art. 34 Wbp. It also confirmed my suspicion that you have concealed many data processing operations with all my WBP and GDPR requests so far. Under appeal to art. 5, 12, 15 GDPR I ask for all information about those documents, and about all personal data processed there. You must also comply with your justification obligation ex art. 5 para. 2 GDPR.’
After the claimant has given the body default, he appealed on 26 January 2023 because the college would not have decided on his request in time.
On 11 January 2023, the College requested the claimant to supplement or concretise his request, because his request is insufficiently specified and too general.
The plaintiff replied to that letter on 13 January 2023 and, in short, wrote that he finds the question of the college incomprehensible because his request is clear.
With the decision of 10 February 2023, the College has waived the claimant’s request. The plaintiff then responded.
The court dealt with the plaintiff’s appeal on 13 October 2023 at the hearing. This has participated: the claimant and the representatives of the college. [A] was also present on behalf of the college.
Considerations and considerations
The appeal against not deciding in time
Because the college has decided against the claimants of 2 December 2022 with the decision of 10 February 2023, he no longer has an interest in an opinion on his appeal for not making timely decisions.
However, pursuant to Article 6:20, paragraph 5, of the General Administrative Law Act (Awb), this appeal can still be declared well-founded if the claimant has an interest in doing so. That interest in this case lies in the question of whether the plaintiff is entitled to a penalty payment for not deciding in time on his application. The college should have taken the power of Article 4:18 of the Awb at its disposal on the question of whether such a periodic penalty payment is due and, if so, about the amount thereof, but the college has left this. The profession is therefore well-founded. Because the plaintiff has asked the court to determine the penalty payment, the court will do so with the application of Article 8:55c of the Awb.
Is the plaintiff entitled to a penalty payment for non-decidation on his application in time?
The plaintiff has stated that he has issued his request for access as referred to in Article 15 of the GDPR at the bar of Utrecht University on 2 December 2022. The court sees no reason not to assume this date as the date on which the request was received by the college. The college has not sent receipt of receipts indicating a different date. Pursuant to Art. 4:13, first paragraph, of the Awb, in conjunction with Article 12(3) of the GDPR, the college should have decided on the claimant request within one month. The college didn't do that. The Complainant ruled in default on 2 January 2023. This is not premature, based on receipt of the request on 2 December 2022.
The Board did ask the plaintiff to supplement his application on 11 January 2023, but because that request was made after the expiry of the decision-making period, the decision period was not suspended within the meaning of Article 4:15, paragraph 1, introductory and under (a) of the Awb.
If an administrative body does not take a decision on time, the administrative body must pay a penalty payment for each day it is late, for up to 42 days. The periodic penalty payment is € 23, - per day for the first fourteen days, the following fourteen days € 35, - per day and the other days € 45, - per day.
In this case, the periodic penalty payment will be due from 17 January 2023 until 10 February 2023. The court therefore determines the penalty payment at € 707,- (14 x € 23,-) + (11 x € 35,-).
The appeal against the decision of 2 December 2022
On the basis of Article 6:20, paragraph 4, the District Court is competent to (still) refer to the college the appeal that has arisen from operation of law to hear it as an objection. However, the outcome that would follow is already clear, because the College maintains the view that claimants request of 2 December 2022 should be disshetised, as he has not complied with the possibility to supplement his request with missing data. Plaintiff does not agree with that. Because these positions are clear, the court will decide the appeal against the decommissioning.
With the college, the court is of the opinion that the data provided by the plaintiff at his request of 2 December 2022 is insufficient for the assessment thereof, within the meaning of Article 4:5, first paragraph, preamble and under c, of the Awb. The Complainant has requested all “information about those documents” and all personal data processed therein. The plaintiff referred to documents and changes from his personnel file which he suspects exist. This request is insufficiently specified and formulated too generally.
The college has therefore rightly asked for supplementation or concretization. In his response to the request of the college, the plaintiff did not make clear what modest and mutations he means. The plaintiff has therefore not complied with the request to supplement or concretise his application. Pursuant to Article 4:5, paragraph 1, preamble and under c, of the Awb, the college was therefore allowed to disclaim the request of 2 December 2022 as it did in the decision of 10 February 2023. The appeal against that decision is therefore unfounded.
Law and litigation costs
Because the court declares the appeal valid for not deciding in time, the college must compensate the court fee to the plaintiff for the right of court paid by him. For a conviction in the costs of the proceedings, the court sees no reason,
Decisions and decision on the decision
The court:
- declares the appeal for non-timely decision-making;
- annul it with a decision in order not to take a decision in time;
- determine the penalty payment to be paid by the defendant at € 707,-;
- declares the appeal against a decision of 10 February 2023 unfounded;
- instructs the defendant to compensate the court of € 184 to the plaintiff for paid justice.
This statement was made by Mr. J.J.J. Catsburg, judge, in the presence of Mr. L.E. - L.E. Mollerus, clerk. The ruling was publicly pronounced on 9 November 2023.
