RvS - 201901006/1/A2
From GDPRhub
| RvS - 201901006/1/A2 | |
|---|---|
 | |
| Court: | RvS (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 79 GDPR Article 82 GDPR |
| Decided: | 1.4.2020 |
| Published: | 1.4.2020 |
| Parties: | Anonymous The AP |
| National Case Number/Name: | 201901006/1/A2 |
| European Case Law Identifier: | ECLI:NL:RVS:2020:898 |
| Appeal from: | Rb. Gelderland 18/3073 |
| Appeal to: | |
| Original Language(s): | Dutch |
| Original Source: | de Rechtspraak (in Dutch) |
| Initial Contributor: | n/a |
The Council of State awarded appellant with 500 EUR compensation for the unlawful sharing of his sensitive personal data. The amount was raised from 300 EUR to 500 EUR. Sensitive data in question contained strictly confidential medical information which was shared between forensic psychiatric observation clinic Pieter Baan Centrum and Regional Disciplinary Board for Healthcare in Zwolle.
English Summary
Facts
Appellant’s strictly confidential medical data was shared by a forensic psychiatric observation clinic with the Regional Disciplinary Board for Healthcare. The appellant was not informed about this. His subsequent objection and request for compensation was rejected by the Minister for Legal Protection on the basis that the Appellant’s honor or reputation has not been affected, nor has he suffered otherwise. The Court of Gelderland, which heard the dispute, ruled that sensitive personal data has indeed been shared unlawfully and awarded 300 EUR in damages to the Appellant.
Dispute
The Appellant claims that he is entitled to a higher compensation. The State Council had to assess whether that is the case.
Holding
The State Council agreed with the Court of Gelderland that the appellant was intitled to compensation of non-material damage according to the Dutch Civil Code and increased the amount awarded to 500 EUR. In deciding this, the Council considered the nature, duration and seriousness of the breach: • Nature: sensitive data was processed without consent or any other applicable legal basis; • Seriousness: sensitive data was shared with a small group of professionals and members of the Board have a duty of confidentiality by virtue of their position; • Duration: the breach occurred on the 15th of January 2018. On 22nd of January the Board confirmed that they would disregard the information. The Council took into account that the Appellant did not demonstrate any negative consequences of the breach.
Comment
Add your comment here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
201901006/1/A2.
Date of judgment: 1 April 2020
SECTION
ADMINISTRATIVE LAW
Ruling on the appeal of:
[appellant], residing at [residence],
against the judgment of the District Court of Gelderland of 19 December 2018 in Case No 18/3073 in the proceedings between:
[appellant]
and
the Minister for Legal Protection.
Process Process
By decision of 13 March 2018, the Minister rejected a request for compensation from [the appellant].
By decision of 17 May 2018, the Minister dismissed [the appellant's] objection.
On 6 June 2018, [the appellant] appealed against the decision of 17 May 2018 and asked the court to order the Minister to pay damages.
By decision of 19 December 2018, the court upheld the appeal lodged by [the appellant] against the decision of 17 May 2018, annulled the decision of 17 May 2018, revoked the decision of 13 March 2018, ordered the Minister to pay damages of € 300 to [the appellant] and ordered that this decision replace the annulled decision. This decision is attached.
The [appellant] has lodged an appeal against this decision.
The Minister has given a written explanation.
The Division heard the case on 1 August 2019, where [the appellant] and the Minister, represented by F. Boone, appeared.
The Division reopened the investigation pursuant to Section 8:68(1) of the General Administrative Law Act (Awb) and referred the case to a multiple chamber.
[Appellant] submitted a further document.
The Division heard the case on 15 January 2020, where [the appellant] and the Minister, represented by F. Boone, appeared.
Considerations
Introduction
1. On January 15, 2018, the director of the Pieter Baan Centre submitted documents containing medical information about him to the Regional Health Care Disciplinary Board in Zwolle (hereinafter referred to as: the Disciplinary Board) in a complaint procedure against him, without [the appellant's] consent and without his knowledge. The draft versions of the psychological and psychiatric sections of Pro Justitia reports sent included strictly confidential personal details of [the appellant]. On 17 January 2018, [the Appellant] was informed by the Disciplinary Board of the disclosure of the sensitive personal data and was provided with copies of the reports. On 19 January 2018, [the appellant] asked the Disciplinary Board to disregard the documents when considering his complaint against the Director. On 22 January 2018, the Disciplinary Board informed [the appellant] that his personal details would be disregarded in the complaints procedure.
At the end of this decision (under 39), the Section briefly set out what this decision means in more general terms and what is to be decided in this case.
Decision-making
2. By letter dated 4 February 2018, [the appellant] objected to the Minister's submission of the reports and applied for compensation. In the proceedings that led to the court's ruling, the Minister stated that the Disciplinary Board was contacted immediately after the sensitive personal data were sent with a request to destroy the documents as soon as they were received. The Minister also took the position that the reports were not provided deliberately in order to influence the Disciplinary Board or to damage [the appellant]. In the decision of 17 May 2018, the Minister referred to the opinion of the Disciplinary Board of 9 March 2018 that the reports should not have been provided:
"In the opinion of the Board, the appendices, which evidently contain medical information, were indeed wrongly provided without the complainant's consent and without his knowledge. The appendices have no relevance for the present case and (therefore) do not serve to defend the defendant. The circumstances invoked by the defendant that a clerical error has been made, or that the lawyer of the RPP, after sending the documents - and therefore too late - advised not to send the annexes, should remain at the defendant's expense. The part of the complaint is well-founded'.
The Division is of the opinion that it should be held that the Minister took the position that the processing of [appellant's] personal data was unlawful. In addition, the Minister stated that he saw no grounds for compensation because [the appellant] had not been harmed in his honour or reputation or otherwise in his person.
Court ruling
3. The court found in the judgment that the transmission of the personal data was unlawful. [the appellant] rightly objected to the disclosure, on the grounds that he did not consent to the forwarding of his personal data as referred to in Article 8, opening words and under a, of the Personal Data Protection Act (Wet bescherming persoonsgegevens, Wbp). According to the court, [the appellant] is entitled to damages to be determined on a fair basis. With regard to the amount of the damages to be determined, the court considered it important that the privacy-sensitive personal data ended up with a small group of professionals, i.e. employees and members of the Disciplinary Board, and that they were bound by a duty of confidentiality by virtue of their duties. According to the District Court, this does not detract from the fact that [the appellant's] privacy was violated and that this was understandably perceived by the appellant as harmful and harmful. The court therefore considered compensation of € 300 to be fair and ruled that the Minister should pay this amount to [the appellant].
Dispute on appeal
4. The Minister has not appealed the court's decision. In that ruling, the court ruled that the decision of 17 May 2018 was unlawful and annulled that decision, in so far as it did not award any compensation.
5. 5. [Appellant] claims to be entitled to higher compensation than € 300.00.
Ex officio judgement
6. The District Court did not acknowledge that with the introduction of Title 8.4 in the Awb on the basis of Article 8:4, paragraph 1, opening words and under f of the Awb, the possibility to appeal against a decision regarding compensation for loss on account of unlawful management actions has lapsed. It follows from this that the District Court has annulled the decision of 17 May 2018, although rightly so, but on incorrect grounds. The court should have declared the objection against the decision of 31 March 2018 inadmissible instead of revoking this decision. Pursuant to Section 8:88 of the General Administrative Law Act, the court should have assessed whether [the appellant] was entitled to compensation.
7. The court's ruling qualifies for set aside, insofar as the court has revoked the 31 March 2018 decision, has determined that the Minister will pay damages of €300 to [the appellant] and has determined that this ruling will replace the annulled decision. The Division will declare the objection to this decision inadmissible after all.
8. The Division will assess the application for damages below.
Applicable law
9. On 25 May 2018, Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (the General Data Protection Regulation, hereinafter AVG) became applicable. The AVG will be directly applicable in each Member State as of 25 May 2018 (Article 99(3) of the AVG). The Wbp was repealed on 25 May 2018. The AVG has immediate effect. The transitional law contained in Section 48(10) of the AVG Implementation Act does not apply in this case.
10. The AVG applies to the claim for damages. On 4 June 2018, i.e. after the AVG came into effect, [the appellant] requested the court to order the Minister to pay damages.
11. The old law, i.e. the Wbp, applies to the assessment of the unlawfulness of the act as it occurred prior to 25 May 2018. It is not disputed on appeal that the Minister acted contrary to Section 8(a) of the Wbp and that this would also be contrary to the AVG.
Article 82 of the AVG
12. Article 82 of the AVG reads as follows:
1. Any person who has suffered material or non-material damage as a result of a breach of this Regulation shall be entitled to receive compensation for the damage suffered from the controller or processor.
2. Any controller involved in processing shall be liable for any damage caused by processing operations in breach of this Regulation. A processor shall be liable for damage caused by processing only where the processing does not comply with the obligations laid down in this Regulation specifically addressed to processors or was carried out outside or in breach of the lawful instructions of the controller.
13. The Minister has not disputed the competence of the administrative courts and has also declared, on request, that he is in agreement with them. As also considered by the Division in today's judgments with numbers ECLI:NL:RVS:2020:899, ECLI:NL:RVS:2020:900 and ECLI:NL:RVS:2020:901, the Administrative Court is, in its opinion, competent to adjudicate an application for compensation for material or immaterial damage resulting from an act in violation of the AVG by an administrative body pursuant to Section 8:88 of the General Administrative Law Act. The Division derives arguments for this from the AVG and the AVG Implementation Act.
14. The AVG is directly applicable in each Member State (Article 99(3) of the AVG). Claims for compensation in the event of acts contrary to the AVG derive directly from the AVG. Article 82(6) of the AVG provides that legal proceedings for the exercise of the right to compensation are to be conducted before the courts of the Member State referred to in Article 79(2). More generally, Article 79(1) lays down the right to an effective remedy.
15. The AVG does not determine which courts within a Member State have jurisdiction to rule on the right to compensation. In the absence of procedural rules of Union law, it is settled case-law of the Court of Justice of the European Union (hereinafter 'the Court of Justice') that it is for the Member States to designate the competent courts and to apply their national procedural law in cases where Union law is enforced. However, such national rules must satisfy the conditions of equivalence and effectiveness (compare the judgment of 16 December 1976, C-33/76, Rewe, ECLI:EU:C:1976:188, and the judgment of 13 July 2006, C-295/04 - 298/04, Manfredi, ECLI:EU:C:2006:461, paragraph 62). These conditions require that a national procedural rule protecting the rights which individuals derive from Union law must not be less favourable than that governing similar domestic actions (principle of equivalence) and that a procedural rule must not render the exercise of rights conferred by the Union impossible or excessively difficult in practice (principle of effectiveness). A procedural rule must also comply with the principle of effective judicial protection, as currently enshrined in Article 47 of the Charter (judgments of the Court of Justice of 18 March 2010, C-317/08, C-318/08, C-319/08 and C-320/08, Alassini and others, ECLI:EU:C:2010:146).
This means that, under these conditions, national law must determine which court has jurisdiction to rule on applications for compensation.
16. Pursuant to Section 8:88(1)(a) of the General Administrative Law Act in conjunction with Section 34 of the Implementing Act, the administrative court has the power to order an administrative body, at the request of an interested party, to pay compensation for damage that an interested party has suffered or will suffer in connection with a written decision as referred to in Section 34 of the Implementing Act. To this end, it is envisaged as follows.
17. In paragraph 3.3. Legal Protection' of the AVG Implementation Act, Article 34 reads as follows:
Article 34. Applicability of the General Administrative Law Act by decision of administrative bodies
A written decision on a request as referred to in Articles 15 to 22 of the Regulation shall be taken within the time limits referred to in Article 12(3) of the Regulation and, insofar as it has been taken by an administrative body, shall be deemed to be a decision within the meaning of the General Administrative Law Act.
18. Articles 15 to 22 of the AVG offer interested parties, among other things, the right of access to personal data, the right to rectification or erasure of personal data, the right to limit the processing of personal data concerning them, as well as the right to object to the processing of personal data, the right to data portability and the right not to be subjected exclusively to automated data processing.
19. These rights are inextricably linked to the control of the processing of personal data and enable interested parties to ascertain whether personal data have been processed lawfully and, inter alia, to seek compensation for unlawful processing.
20. For the ways in which the right to compensation can be realised, the Explanatory Memorandum (Parliamentary Papers II 2017-2018, 34851 no. 3) to the AVG Implementation Act is included in the implementation table under Section 82, "Current Title 8.4 of the General Administrative Law Act or Civil Court". The Division deduces from this that it must be possible to bring a claim for compensation for damage resulting from an infringement of the AVG by an administrative body before both the administrative courts and the civil courts.
21. The Section therefore concludes from Article 8:88 of the General Administrative Law Act in conjunction with Article 34 of the AVG Implementation Act that it is in line with the intention of the national legislator that the same court that adjudicates on, inter alia, decisions of administrative bodies at a request as referred to in Articles 15 to 22 of the AVG may also be requested to pay compensation for related damage. The Division considers this to be in the interests of the concentration of legal protection and thus also in the interests of effective and efficient legal protection (principle of effectiveness and Article 47 of the Charter of Fundamental Rights of the European Union). By way of comparison, the Section refers to the judgment of the Court of Justice of the European Union of 15 April 2008, C-268/06, EU:C:2008:223, paragraph 51 (Impact), from which it can be inferred that a concentration of legal protection is in line with the principle of effectiveness. In the view of the Division, the principle of equivalence is also satisfied because the opening up of the administrative procedure is not a procedural rule which treats claims under Union law less favourably than comparable claims under national law.
22. This means that a person who, on the basis of Article 82 of the AVG, claims compensation for damage resulting from the unlawful processing of personal data by an administrative body, has the freedom of choice, in accordance with Article 8:88 of the Awb, to submit his request to the administrative court in connection with a decision as referred to in Article 34 of the AVG Implementation Act, or to realise his claim for compensation through the civil law channels. Article 8:88 of the General Administrative Law Act is interpreted as meaning that the power of the administrative court is less strictly limited to the requirement of an unlawful decision, because although there must be a connection with a decision as referred to in Article 34 of the AVG Implementation Act, this decision, for example on a request for inspection, does not have to be unlawful as such. In such a case, therefore, the administrative court may, in the application procedure pursuant to Section 8:88 of the General Administrative Law Act, give an opinion on the unlawfulness of the processing of the data to which the decision on the request for information relates. The latter decision does not have to be unlawful for this purpose, nor does it have to contain an opinion on the lawfulness of the processing of the data. The Division notes that if the request exceeds € 25,000.00, the application of Section 8:88 of the General Administrative Law Act entails that the civil court has exclusive jurisdiction to hear such a request.
23. The Division is of the opinion that in this transitional phase, in which a request was made after 25 May 2018 for compensation for damage in connection with acts that took place in whole or in part before that date and that were contrary to the Wbp and would now also be contrary to the AVG, and in which the substantive assessment framework was therefore already the same, the legal protection set out under 22 must also be offered. This is in line with the views of the parties.
Rejection of request for a preliminary ruling
24. [Appellant] asked the Division to refer a preliminary question to the Court of Justice of the European Union with a view to clarifying the answer to the question whether, and if so to what extent, article 82 of the AVG constitutes an independent basis for the award of damages by the administrative courts.
25. The Division rejects this request. Article 82 of the AVG has direct effect and makes it possible for interested parties to realise the claim for damages for unlawful processing in the national legal order. According to settled case law of the Court of Justice (see paragraph 15 above), the organisation of the judicial procedure and the manner of legal protection are in principle matters of national law, if the EU legal preconditions are met. To this end, the Division has ruled that, in addition to the civil court, the administrative court has jurisdiction to assess a claim for damages on the basis of Section 82 of the General Administrative Law Act (AVG) by applying Section 8:88 of the General Administrative Law Act (Awb). There is no reason to ask a preliminary question, because there can be no reasonable doubt as to the answer to the question (see the judgment of the Court of Justice of 6 October 1982, Cilfit, ECLI:EU:C:1982:335, points 13, 14 and 16).
Assessment of the claim for damages
26. 26. [Appellant] submits that the Court erred in its application of Section 6:106 of the Civil Code, because the amount of compensation determined on an equitable basis was set too low. He claims that he is entitled to higher damages than €300.00.
27. Although Article 82(1) of the AVG states that full compensation for actual non-material damage resulting from infringements of the AVG must take place in a manner that does justice to the objectives of the Regulation, the AVG does not stipulate how the non-material damage must be determined and calculated. The Court of Justice has consistently held that, in the absence of Community rules, it is for the domestic legal order of each Member State to determine the rules governing the exercise of the right to compensation, subject to compliance with the principles of equivalence and effectiveness (see Manfredi judgment, paragraph 64).
However, recital 146 in the preamble to the AVG must be taken into account when exercising the right to compensation laid down in Article 82 of the AVG. This states, inter alia, that the controller or processor must compensate any damage which a person may suffer as a result of a processing operation infringing this Regulation. The concept of damage should be interpreted broadly in the light of the case law of the Court of Justice of the European Union, in a way that fully meets the objectives of this Regulation. It is also stated that data subjects should receive full and effective compensation for any damage suffered by them.
28. The Court of Justice has not yet provided any explanation specifically on the concept of damages or on the compensable immaterial damages in case of unlawful processing of personal data, including under the (repealed) Privacy Directive (Directive 95/46/EC). However, the Court of Justice has consistently held that the damage to be compensated must be real and certain (see judgment of the Court of Justice of 4 April 2017, ECLI:EU:C:2017:256, paragraph 91, C- 337/15 P, European Ombudsman v. Staelen, ECLI:EU:C:2017:256, paragraph 91).
29. In the light of the above case-law of the Court of Justice and of Article 146 in the preamble, national law is therefore relevant in determining whether the alleged damage is eligible for compensation.
30. According to the settled case law of the Division (see, for example, ECLI:NL:RVS:2010:BN4952 of 25 August 2010), the assessment of an application for compensation for non-material damage is based on a connection with civil compensation law.
31. Article 6:106 of the Dutch Civil Code reads:
For damage that does not consist of pecuniary loss, the injured party is entitled to compensation to be determined in accordance with fairness:
[…]
b. if the injured party has suffered bodily injury, damage to his honour or good name or any other harm to his person;
[…]"
32. The impairment referred to in Section 6:106(1)(b) of the Civil Code in person 'otherwise' shall in any case be deemed to have occurred if the injured party has suffered mental injury. The party who invokes this will have to provide sufficient concrete data from which it can be deduced that psychological damage has occurred in connection with the circumstances of the case. This requires that the existence of mental injury can be established according to objective standards. Even if the existence of mental injury in the aforementioned sense cannot be assumed, it cannot be excluded that the nature and seriousness of the breach of the standards and of the consequences thereof for the injured party will mean that the impairment referred to in Section 6:106, opening words and under b, of the Civil Code is present in his person 'in a different way'. In such a case, the party invoking this will have to substantiate the impairment in his person with concrete data. This will only be different if the nature and seriousness of the breach of the standards mean that the relevant adverse consequences for the injured party are so obvious that an impairment in the person can be assumed. An impairment in the person 'in any other way' as referred to in Section 6:106(b) of Book 6 of the Dutch Civil Code does not already exist in the case of the mere violation of a fundamental right. (See the judgments of the Supreme Court of 15 March 2019, ECLI:NL:HR:2019:376, paragraph 4.2.2, of 28 May 2019, ECLI:NL:HR:2019:793, paragraph 2.4.5, and of 19 July 2019, ECLI:NL:HR:2019:1278, paragraph 2.13.2).
33. The Section is of the opinion that the framework outlined in section 32 can meet the requirements of the AVG and the case law of the Court of Justice as set out in section 27.
34. [appellant] did not argue that he suffered mental injury as a result of the Minister's unlawful conduct, which can be established on objective grounds.
35. (appellant) claims that he has been harmed in person. He claims that his privacy has been violated because the reports contain strictly confidential and sensitive personal data and he has not given permission for the data to be processed.
36. The Division agrees with the court that [the appellant] is entitled to compensation for non-material damage. The Minister acted in violation of Section 16 of the Wbp) and thereby violated [the appellant's] right to respect for his privacy. An infringement of [the appellant's] privacy may be regarded as an infringement in the person referred to in Section 6:106(1) and (b) of the Dutch Civil Code which entitles him to compensation for immaterial damage.
In view of the circumstances of this case, including the nature, duration and seriousness of the infringement, the Division will fairly determine this damage at € 500. To this end, the Division will take into account the special sensitivity of the nature of the personal data processed in this case without the consent of [the appellant]. For the processing of special (sensitive) personal data as referred to in Article 9 of the AVG, a higher level of protection has been laid down in the AVG than for ordinary personal data. The adverse consequences of the provision of the sensitive personal data are obvious. It is also important to note that the data were submitted by the director as part of a complaint procedure against him, without there being any justification as referred to in Article 9(2) of the AVG. With regard to the seriousness of the breach, the Division considers that the privacy-sensitive personal data ended up with a small group of professionals and that the members of the Disciplinary Board who have a duty of confidentiality by virtue of their position. With regard to the duration of the breach, it is important to note that the Pieter Baan Centre took action to undo the provision of the sensitive data following the submission of the data on 15 January 2018. Subsequently, in a letter dated 22 January 2018, the Disciplinary Board indicated that it would disregard the reports sent and not add them to the file. To the extent that [the appellant] disputes that this was done, in view of the questions put to the director during the hearing at the Disciplinary Board, it is important that [the appellant], if asked at the hearing, did not make it plausible that this had led to adverse consequences.
Conclusion
37. In doing what the court should do, the Division will still decide on the application for damages. In so doing, the Division will determine that the Minister will pay [the appellant] damages of € 500.
38. The Minister must be ordered to pay the costs of the proceedings (travel costs of public transport) on appeal and appeal in a manner to be reported.
What does this judgment entail in brief?
39. In these and three other judgments today, the Division discusses the possibilities of claiming compensation for damages before the administrative courts if someone claims that an administrative body has processed personal data in violation of the applicable privacy legislation (since 25 May 2018 the General Data Protection Regulation (AVG) and the AVG Implementation Act). Before the AVG and the AVG Implementation Act entered into force, the case law of the Division offered fewer possibilities, which meant that the citizen was then directed to the civil courts. This route remains open, but in a larger number of cases it is now also possible to approach the administrative courts for requests for compensation up to € 25,000. For the answer to the question as to when this is possible, see in particular above under 22. This is therefore a procedural question of legal protection, i.e. when, in the event of unlawful processing of personal data, the administrative court can be approached.
In terms of content, the Division then decides that in order to be eligible for compensation, the requirements of Section 6:106 of the Dutch Civil Code must be met. For these cases, this means that the honour or good name of the person concerned must be affected, or that the person must be affected in some other way. In this respect, the Division is in line with the case law of the Supreme Court. In this case, the Division decided that [the appellant] may claim damages of € 500; the court awarded € 300 in the first instance. In doing so, the Division takes into account, on the one hand, the unlawful processing of personal data with a special sensitivity and, on the other hand, the fact that these data only ended up with a small group of professionals (see above under 36).
Decision
The Administrative Jurisdiction Division of the Council of State:
I. declares the appeal well-founded;
II. annuls the decision of the District Court of Gelderland of 19 December 2018 in case no. 18/3073; in so far as it revoked the decision of 13 March 2018, it is stipulated that the Minister for Legal Protection will pay compensation and it is stipulated that this decision will replace the decision of 17 May 2018;
III. declares the objection lodged by [the appellant] against the decision of 17 May 2018 inadmissible in so far as it decides on the application for compensation made by [the appellant];
IV. orders the Minister for Legal Protection to pay [the appellant] compensation of € 500.00 (in words: five hundred euros);
V. orders the Minister for Legal Protection to pay the costs of the proceedings incurred by [the appellant] in connection with the hearing of the appeal and the appeal up to an amount of € 46.71 (in words: forty-six euros and seventy-one cents).
Thus determined by J.E.M. Polak, chairman, and E.A. Minderhoud and E.J. Daalder, members, in the presence of M.A.E. Planken, registrar.
The chairman is prevented from signing the decision.
The Registrar is prevented from signing the decision.
Pronounced in public on 1 April 2020
299.
Annex
