| ABRvS - 202100789/1/A3 | |
|---|---|
 | |
| Court: | RvS (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 5(1)(b) GDPR Article 6(1)(e) GDPR Article 17(1) GDPR Article 17(3)(e) GDPR Article 11(1) ICOV Article 172 Gemw Article 5(4) ICOV Article 5(5) ICOV Article 6 (1) ICOV Article 8(1) ICOV |
| Decided: | 17.05.2023 |
| Published: | 17.05.2023 |
| Parties: | Mayor of Maastricht |
| National Case Number/Name: | 202100789/1/A3 |
| European Case Law Identifier: | ECLI:NL:RVS:2023:1923 |
| Appeal from: | Rb. Limburg (Netherlands) AWB 19/1801 |
| Appeal to: | Not appealed |
| Original Language(s): | Dutch |
| Original Source: | Rechtspraak (in Dutch) |
| Initial Contributor: | Nur Khmeydan |
The Court of Appeals ruled that the Mayor can reject data removal requests pursuant to Article 17 GDPR when processing data in the public interest.
English Summary
Facts
The data subject in question received official communication from the Mayor of Maastricht, indicating their placement on the "Top-X" list. This list is composed of individuals or groups identified as causing disturbances or engaging in criminal activities. Subsequently, the mayor denied the data subject’s request to be removed from this list. There were two main grounds for the refusal: firstly, the data subject was not actively cooperating with law enforcement agencies and continued causing a nuisance. Secondly, the individual was not partaking in the necessary mental health services that could potentially prevent future disturbances. As such, the Mayor deemed it appropriate to maintain the individual's listing as a precautionary measure to mitigate potential future disruptions.
Holding
The Court assessed whether the Mayor's processing of personal data constituted a violation of the principle of legality, and whether the Mayor was obligated to delete the data subject's personal data. In its assessment of the potential principle of legality violation, the Court highlighted that data processing is one of the responsibilities of a Mayor for fulfilling a task in the public interest, as specified by Section 172 of the Municipalities Act. Therefore, the public interest exception to the lawful processing of data under Article 6 (1) (e) of the GDPR is fulfilled. The Court further reasoned that the safeguards, which ensure data processing does not exceed what is necessary, established under Articles 8 (1), 5 (4, 5), 6 (1), and 11 (1) of the Covenant ICOV, comply with the requirement of collection of data for specific, explicit and legitimate purposes in Article 5 (1) (b) GDPR. The Court held that the Mayor was not obligated to delete the data subject's personal data, based on the exception provided in Article 17 (3) (e), which allows a rejection of a data deletion request when the data is being processed for a task of public interest.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
202100789/1/A3. Judgment date: May 17, 2023 DEPARTMENT ADMINISTRATIVE LAW Judgment on the appeal of: [plaintiff], living in Maastricht, against the judgment of the District Court of Limburg of 22 December 2020 in case no. 19/1801 in the proceedings between: [appellant] and the mayor of Maastricht. Process flow In a letter dated 11 October 2017, the mayor, at the request of [plaintiff] to remove him from the Top X list, stated that the inclusion on the list is not a decision. By decision of 29 May 2019, the mayor again made a decision on [plaintiff's] objection to the letter of 11 October 2017 and declared the objection well-founded and rejected the request. In a judgment of 22 December 2020, the court declared the appeal lodged against this by [plaintiff] unfounded. This statement is attached. The appellant has appealed against this decision. The mayor has submitted a further document. At the request of the Department, the mayor has submitted confidential documents. With regard to these documents, the mayor has stated, with reference to Section 8:29 of the General Administrative Law Act (hereinafter: Awb), that only the Department will be allowed to take cognizance of them. The Division returned the confidential documents unread without the Division in a different composition having taken a decision on the mayor's request for secrecy, because these documents were not necessary to rule on the appeal. The Division handled the case at the hearing of 18 July 2022, where [plaintiff], represented by mr. S.T. van Berge Hennegouwen, lawyer in Maastricht, appeared. Considerations Introduction 1. By letter dated 6 July 2017, signed by the mayor of Maastricht, [plaintiff] was informed that he would be placed on the Top-X list. This is a list of names of persons or groups that cause nuisance or crime, compiled by the Safety House, a partnership between municipalities, the police, the Public Prosecution Service, the Custodial Institutions Agency and a large number of civil society organisations. [plaintiff] requested the mayor to remove him from the Top X list, but the mayor rejected this request. According to the mayor, despite the assistance offered to him, [plaintiff] still causes nuisance in view of reports from the police. In addition, [plaintiff] does not cooperate sufficiently with the plan drawn up for him personally within the safety house to reduce nuisance. Because [plaintiff] has not yet started psychological or psychiatric treatment, the mayor has no confidence that the nuisance will stop. Court ruling 2. The court assumed that with the request to have his name removed from the Top X list, [plaintiff] meant to submit a request within the meaning of Article 17 of Regulation 2016/679 of the European Parliament and of the Council of the European Union of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter: GDPR) , that his personal data will be erased which are processed within the Safety House in connection with its placement on the Top X list. The court ruled that the mayor was not obliged to grant the request. Tasks related to maintaining public order are, according to the court, tasks of general interest. She further considered that the mayor, in view of the nuisance caused, the psychological problems and the treatment that is necessary, but has not yet been received, may consider it necessary for the performance of a task of general interest within the meaning of Article 6, first paragraph, opening words and under e, and Article 17, third paragraph, opening words and under b, of the Avg. Finally, the court ruled that Directive (EU) 2016/343 of the European Parliament and of the Council of 9 March 2016 on the reinforcement of certain aspects of the presumption of innocence and of the right to be present at the hearing in criminal proceedings (hereinafter: Directive) does not apply, because this procedure only concerns the deletion of personal data. Grounds of appeal 3. [plaintiff] argues that the court wrongly ruled that the mayor could place him on the Top X list. According to him, the mayor has not sufficiently substantiated that he is causing nuisance. Furthermore, [plaintiff] argues, referring to the preamble of the directive, that the court wrongly ruled that the directive is not applicable, because it failed to recognize that the mayor, also in the context of the request for removal, objects that he has been in conflict with the judiciary. has come into contact. [plaintiff] argues that the placement on the Top X list and the refusal to remove him from it are contrary to the principle of legality, because there is no clear and clearly formulated legal basis for following him, while the far-reaching and intrusive nature of this partnership that is required. The legal basis is not contained in Article 7 of the Covenant on cooperation and data processing for an integrated personal/system-oriented approach (hereinafter: Covenant) and does not exist in Article 172 of the Municipalities Act because the placement is said to be in the public interest and that interest falls under the maintenance of public order would fall. According to [plaintiff], it follows from the legislative history that this article is intended for light powers that must be proportional and not for a systematic and long-term invasion of the privacy of the appellant. Assessment of the appeal Is there a violation of the principle of legality? 4. On 25 May 2018, the GDPR became applicable and the Wbp was repealed. The GDPR applies to this case, because the decision on the objection dates from after 25 May 2018. 4.1. The processing of personal data may be lawful if it is necessary for the performance of a task carried out in the public interest. To this end, it must first be assessed whether the purpose for which the personal data are processed is well-defined and explicitly described. It must also be assessed whether the relevant purpose is also achieved with the processing of the personal data at issue. The purpose must fit within the task of general interest. In case the processing of the personal data is necessary to achieve the specific purpose in this sense, it must then be assessed whether the invasion of privacy is proportionate to the interests served by the processing of the personal data (see the ruling of the Department of 16 February 2022, ECLI:NL:RVS:2022:497). As the Division previously ruled in its judgment of 20 September 2017, ECLI:NL:RVS:2017:2555, it must be assessed in the light of the EU Charter whether the invasion of privacy is limited to what is necessary to achieve the purpose is strictly necessary. In particular, it must be assessed whether the purpose for which the personal data are processed cannot reasonably be achieved in another way that is less detrimental to the persons involved in the processing of personal data. 4.2. Article 5, first paragraph, opening lines and under b, of the GDPR stipulates that personal data must be collected for specific, explicit and legitimate purposes. 4.3. Article 1, under 1.1, of the Covenant states that the Safety House is a partnership of and the information support center for the network partners from the justice, care and administrative chain, whereby these partners in the Maastricht Heuvelland area arrive at a chain-transcending approach under unambiguous direction. of complex personal and area-oriented problems with the aim of reducing nuisance, crime and social exclusion and where possible preventing it. In this case, the purpose for which the personal data is processed is well-defined and explicitly described in Article 2, under 2.1, of the Covenant: increasing the safety, quality of life and well-being of citizens within the working area of the municipality of Maastricht and the Heuvelland municipalities. . In view of the above, the Division is of the opinion that the collection of personal data by the Safety House is in accordance with Article 5, paragraph 1, preamble and under b, of the GDPR. 4.4. Article 6, paragraph 1, opening words, of the GDPR stipulates that processing is only lawful if at least one of the conditions referred to under a to f is met. In this case, it must be assessed whether the processing is necessary for the performance of a task of public interest as referred to under e. Pursuant to Section 172 of the Municipalities Act, the mayor is charged with maintaining public order. The purpose as described above arises from the mayor's obligation to maintain public order. In the ruling of 25 March 2020, ECLI:NL:RVS:2020:849, the Division ruled that the division of tasks for the Safety House, meaning that instead of the Municipal Executive, the mayor is ultimately responsible for data processing and ensures reliable and safe provision of information, is correct in view of the mayor's responsibility for maintaining public order. The processing of personal data by the mayor is therefore the fulfillment of a task of public interest. 4.5. It must then be assessed whether this processing of personal data is necessary. In order to determine whether the processing of personal data is necessary, it must be assessed whether the purpose for which the personal data are processed cannot reasonably be achieved in a different, less disadvantageous manner. The purpose of the processing is to reduce nuisance, crime and social loss and to increase the safety, quality of life and well-being of citizens. This goal is achieved by processing data about someone from the target group who causes the crime and nuisance, depending on the specific case, approach and covenant partners involved. There are also various guarantees that the data processing does not go beyond what is necessary. Article 8, under 8.1, of the Covenant stipulates that the Municipal Executive is ultimately responsible for the processing of data insofar as these become available within the Safety House and the cooperation based on this Covenant. Article 5, under 5.1, stipulates that data will only be processed and recorded per form if there is a legal basis for this in accordance with the provisions of the Personal Data Protection Act and its further elaboration as described in Article 7 of the Agreement. In a concrete situation, each individual personal data is only processed if it is careful, adequate, relevant and not excessive for the purpose or purposes for which it is processed. Article 5, under 5.4 and 5.5, stipulates that the processing and exchange can only take place in accordance with applicable laws and regulations. Only the covenant partners who are concretely involved in a specific case receive information about a data subject according to Article 6, under 6.1. Furthermore, it appears from Article 11, under 11.1, that the exchange of personal data by covenant partners is limited to those personal data that are necessary for the purposes stated in Article 2 of this covenant. In view of the above and the fact that in this case a great interest is served by the processing, namely reducing nuisance, crime and social exclusion and increasing the safety, quality of life and well-being of citizens, there is finally no reason for the opinion that the invasion of the privacy of [plaintiff] is disproportionate to the interests served by the processing of the personal data. 4.6. In view of what has been considered above, [plaintiff] wrongly argues that there is insufficient basis for the processing of his personal data in the context of his placement on the Top X list of the Safety House. 4.7. The argument fails. Does the directive apply? 5. The court rightly ruled that the mayor rightly considered the directive inapplicable. [plaintiff] is not followed in the argument that the fact that the mayor includes the times he has come into contact with the judiciary in the decision-making process should lead to a different judgment. According to point 11 thereof, the Directive applies only to criminal proceedings. Point 11 also explicitly states that the Directive does not apply to civil law proceedings or administrative law proceedings (compare the judgments of the Division of 4 July 2018, ECLI:NL:RVS:2018:2229, and 28 August 2019, ECLI:NL: SS:2019:2886). 5.1. It follows from the foregoing that there can be no reasonable doubt about the answer to the question raised as to whether the Directive is applicable. Having regard to the judgments of the Court of Justice of 6 October 1982, Cilfit, ECLI:EU:C:1982:335, paragraph 16 and 6 October 2021, Consorzio Italian Management, ECLI:EU:C:2021:799, paragraphs 39 and 40, there is therefore no reason to refer questions for a preliminary ruling. 5.2. In view of the above, what [plaintiff] has argued about being contrary to the directive needs no further discussion. 5.3. The argument fails. Did the mayor have to delete the personal data? 6. Pursuant to Article 6, paragraph 1, opening words and under e, of the GDPR, processing is only lawful if the processing is necessary for the performance of a task of public interest. Pursuant to Article 17(1) of the GDPR, the data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller is obliged to delete personal data without undue delay if one of the aforementioned cases applies. Pursuant to Article 17, third paragraph, opening words and under b, of the GDPR, the first paragraph does not apply insofar as processing is necessary for the performance of a task of public interest. 6.1. Although the court wrongly assumes that [plaintiff] does not dispute the facts and circumstances against him, it correctly ruled that the mayor did not have to remove [plaintiff] from the Top X list. The Division endorses the considerations of the court in this regard and adds the following in response to the appeal. Contrary to what [plaintiff] argues, it has not been sufficiently shown what constitutes the nuisance and conduct against him. In the decision of 29 May 2019, the mayor states more generally that [plaintiff] has complex multiple problems, that he has come into contact with the judicial authorities several times and has been convicted, and that his behavior and situation cause nuisance to others. In that decision, however, the mayor also refers to the letter from the Safety House dated 14 January 2019. This letter explains more explicitly and in more detail why [plaintiff] is and must remain on the list. Cases for which [plaintiff] has come into contact with the judiciary include violation of personal integrity, harassment, threats and (simple) assault. Furthermore, according to the letter, the police received very frequent reports from citizens about nuisance caused by [plaintiff]. The police, probation service and involved social services estimate the risk of recidivism to be high. Even after being placed on the Top X list, [plaintiff] was held in pre-trial detention several times in 2018. 6.2. The argument fails. Conclusion 7. The appeal is unfounded. The court's decision is affirmed. The mayor does not have to pay legal costs. Decision The Administrative Jurisdiction Division of the Council of State: confirms the challenged statement. Thus established by mr. A.W.M. Bijloos, chairman, and G.T.J.M. Jurgens and mr. J.Th. Drop, members, in the presence of mr. D. van Leeuwen, registrar. e.g. Beeless chair e.g. Van Leeuwen clerk Pronounced in public on May 17, 2023 373-898
