AP (The Netherlands) - z2023-00037
|AP - z2023-00037
|AP (The Netherlands)
|Article 5(1)(a) GDPR
Article 6(1)(e) GDPR
Article 14 GDPR
|Municipality of Voorschoten
|National Case Number/Name:
|European Case Law Identifier:
|AP (in NL)
The Dutch DPA fined the Municipality of Voorschoten € 30,000 for unlawfully tracking its residents’ waste consumption data through waste collection bins equipped with tracking chips.
English Summary[edit | edit source]
Facts[edit | edit source]
In 2019, the Municipality of Voorschoten (the controller) implemented a new waste collection policy aimed at reducing residential waste. As part of this policy, the Municipality replaced residential waste disposal bins with new bins which contained a chip with a unique number. This chip was linked to residents’ addresses, therefore, residents were directly identifiable. The Municipality fitted its waste collection trucks with a reader that identified the chip number. When the trucks collected waste, the truck identified the chip and collected data related to the chip number, its associated addresses, the date and time of waste collection, the location of waste collection and the type of waste collected.
In 2019, the Municipality notified residents of the bin replacement via letter, but did not inform them of the chip or of the data collected. On 9 March 2019, a resident of the Municipality filed a complaint with the Dutch DPA against the updated collection system. As a result, the investigative department of the DPA opened an investigation against the Municipality. The findings of this investigation were sent to the Dutch DPA on 13 March 2023.
Holding[edit | edit source]
The Dutch DPA held that the Municipality had violated Articles 5(1)(a), 6 and 14 GDPR.
Firstly, the DPA found a violation of the principles of lawfulness and transparency under Article 5(1)(a) GDPR, as the Municipality failed to inform its residents of the data processing and it used an invalid legal basis to do so.
Secondly, the DPA held that the Municipality was in violation of Article 6 GDPR and Article 5(1)(a) GDPR (lawfulness) as it lacked a legal basis for processing. The Municipality sought to rely on Article 6(1)(e) GDPR (public necessity) for processing. However, the DPA held that the processing did not meet the necessity test established under Article 6(1)(e) GDPR, because less invasive means could be adopted to fulfil the objective of reducing residential waste, which did not include the direct tracking of each household’s waste consumption.
Lastly, the DPA found a violation of Article 14 GDPR for not informing the residents of the Municipality’s data processing activities. The letter which the Municipality sent to residents regarding the replacement of the bins made no mention of the data processing generally, and more specifically made no mention of the categories of data processed, the purpose of processing, or the legal basis relied upon for processing.
As a result of the violations, the DPA imposed a fine of € 30,000.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1 Personal Data Authority P.O. Box 93374, 2509 AJ The Hague Hoge Nieuwstraat 8, 2514 EL The Hague T 070 8888 500 - F 070 8888 501 autoriteitpersoonsgegevens.nl Municipality of Voorschoten Attn: The Municipal Executive P.O. Box 393 2250 AJ VOORSCHOTEN Date 2 November 2023 Our reference z2023-00037 Contact person [CONFIDENTIAL] Subject Decision to impose an administrative fine Dear College, The Primary Investigation Department of the Authority for Personal Data (hereinafter: AP) has, following of an enforcement request, investigated the processing of personal data by the college of the mayor and aldermen of the municipality of Voorschoten (hereinafter: the college) in the context the implementation of the waste collection policy in the municipality. The findings of the investigation are recorded in an investigation report, which was sent to the college on 13 March 2023. In the decision now before us, the AP finds that the college, without an adequate basis and therefore unlawfully processed personal data relating to the so-called landfill history of residents of the municipality of Voorschoten. The AP further finds that the college did not correctly inform the residents of the municipality of Voorschoten did not correctly inform the personal data processed in this regard, the purpose and basis of the processing. As a result, the college was in breach of Articles 5, first paragraph, opening words and under a, read in conjunction with Article 6, first paragraph, opening words and under e and Article 14, first paragraph, opening words and points c and d, of the General Data Protection Regulation (hereinafter: AVG). With this decision, the AP imposes an administrative fine of €30,000 on the college. The following is a discussion (1) the procedure, (2) the college's views on the investigation findings, (3) the assessment and (4) the decision to impose the administrative fine. Finally, it states what an interested party can do if they do not agree with this decision. Date 2 November 2023 Our reference z2023-00037 2/14 1. Investigation and findings On 9 March 2019, the AP received an enforcement request from a resident of the municipality of Voorschoten. On 18 October 2020, it became clear that the resident was not only acting on his own behalf but also on behalf of another resident of the municipality. The residents are referred to in this decision together and in singularly referred to as "complainant". The complainant's request relates to the processing of personal data in waste collection in the municipality of Voorschoten. In response, the Primary Investigation Department of the AP conducted an investigation and recorded its findings in an investigation report dated 22 December 2022. The report revealed the following facts. On 29 March 2016, the municipal council of the municipality of Voorschoten adopted the Waste Policy Plan 2016-2020. adopted. According to the Waste Policy Plan, the municipality aims to reduce the amount of residual waste. In addition, better separation of waste streams should result in more raw materials can be reused. The municipality does not apply a system of differentiated tariffs (diftar), whereby each household is charged on the basis of the actual use of the waste facilities. waste facilities. Nor are there any plans to introduce a diftar system. The Waste Policy Plan distinguishes between single-family houses or ground-level houses (hereafter: low-rise) and flats (hereafter: high-rise) on the other. Residents of low-rise buildings use grey residual waste containers (wheelie bins) that are periodically emptied by a rubbish truck. Residents of high-rise buildings use underground residual waste containers at the street. To implement the Waste Policy Plan, the college has - as far as relevant here - taken the following two measures: 1) Low-rise buildings In March 2019, all grey residual waste containers (wheelie bins) in the municipality were replaced with new containers with a chip. This chip contains a unique number. The number of containers in the municipality has been reduced as each household (residential address) has only one container since then. The new container has been provided with a barcode sticker with the container's address, but this sticker has no further function and can be removed without consequences. The rubbish truck is equipped with a reader that can read the chip number. If there is recognition is present, the container is emptied. The municipality then stores data in an IT system of the collection service of the municipality. This includes the chip number, associated address, date and time of emptying, location data of emptying and type of waste. Subsequently, the container cannot be weeks because the rubbish truck will not accept the container again. The data was kept in the IT system as long as the container is in use and the data were erased from the system when the container was replaced. Low-rise residents were informed by letter about the container replacement, but the letter did not specify what personal data would be processed by means of the chip in the new containers would be processed, the purpose of such processing and its basis. Date 2 November 2023 Our reference z2023-00037 3/14 2) High-rise buildings At the end of 2018, the above-ground shared containers were replaced by underground containers. These containers can only be opened with a token, which like the residual waste containers for low-rise buildings contain a chip with a unique number. For each underground container, it can be which tokens have access to the container. A token can be used to open a container five times a day. container can be opened five times a day, after which access to the container is denied. After the container is opened with a token, the municipality stores data in an IT system of the municipality. This includes token number, address details, date and time of deposit location details and type of waste. This data was kept in the IT system for five years. The residents of the high-rise buildings were informed by letter about the new containers with token, but the letter did not state what personal data would be processed with the token, what purpose of such processing and the basis for it. The investigation report concluded that the college, as the data controller, was processes personal data of residents for household waste collection. The report addressed whether the college could rely on the basis it invoked "necessity for the performance of a task in the public interest" (Article 6(1), introductory phrase and point e, of the AVG). In the context of low-rise buildings, the investigation report held that the brief processing of personal data via the chip reader on the rubbish truck is necessary for the performance of the task of the college. After all, it needs to be verified that it is a council-issued container and that it has not been emptied recently. This only applies insofar and for as long as this is necessary to empty and temporarily block the grey container. However, it is not necessary to store record which container (chip number and address) was presented with waste and when (date and time). presented. This would only be different if this so-called "tipping data" were used for a diftar system, but the municipality of Voorschoten does not do that. In the context of high-rise buildings, it was similarly held that it is necessary for the duty of the college to check whether a token provides access to the waste container and whether the maximum number of deposits per day is not exceeded. Again, however, it is NOT necessary to keep records of which token (token number and address), when (date and time), where (container location data) which type of waste was offered. This would only be different if the tipping data are used for a diftar system, but as mentioned, the municipality of Voorschoten does does not. As there is no need for the long-term processing of the landfill data, such processing cannot be based on the basis of necessity for a task of public interest. The processing is therefore Date 2 November 2023 Our reference z2023-00037 4/14 unlawful to that extent (Article 5(1)(a) read in conjunction with Article 6, first paragraph (e) of the AVG). The investigation report also concluded that the college had not correctly informed about the personal data processed via the chip in the container respectively token for the underground container, the purpose and basis of such processing. In doing so, the college violated its duty to inform (Article 5, first paragraph, opening words and under a, read in conjunction with Article 14, first paragraph, opening words and points (c) and (d) of the AVG). 2. The college's views on the report The AP sent the investigation report and its underlying documents to the college sent. In doing so, the AP expressed its intention to take remedial action to end the excessive storage of landfill data, to destroy the data already stored and to inform the residents correctly. still be properly informed. In addition, the AP expressed its intention to impose an administrative fine. The college took the opportunity to submit a view by letter dated 28 March 2023. A meeting with representatives of the college took place on 24 May 2023. In the view and during the interview, the following was expressed on behalf of the college with regard to the investigation report following was put forward. Insofar as the view relates to the measures to be imposed, these are discussed in section 4 of this decision. 2.1. Regarding processing responsibility, processing and facts The College first of all endorsed that it is the controller for the processing of personal data taking place in the context of the Waste Policy Plan, as defined in the investigation report. The college further endorsed the facts as set out in the report. 2.2. Regarding the need for grey containers The college has explained that the primary objective of the Waste Policy Plan is to initiate a transition in which waste is increasingly converted into a raw material. By increasing the percentage of separated waste, the aim is that by 2030 only raw materials will be collected and therefore no residual waste. To achieve this, waste separation must be encouraged. Stricter management with regard to aboveground containers (wheelie bins) and underground containers is one of the means to that end. By linking the grey containers to an address, it is possible to prevent prevent residents from mistakenly reporting their grey container as missing and after receiving a new container can offer two containers from now on. If a container with a chip is reported missing is reported missing and not found within two weeks, linking it to the address will allow the old chip number can be blocked. The old container can then no longer be emptied and be replaced by a container with a different chip number. It was stated on behalf of the college that in Date 2 November 2023 Our reference z2023-00037 5/14 the past, 300 containers had to be replaced in one year. In February 2023, 30 containers reported missing, and 29 returned to the municipality because the missing containers were not emptied and were abandoned. It follows that the deployment of the chip is effective. In addition, thanks to the chip, a container can only be emptied once every fortnight. After emptying, the chip blocked for a fortnight. In the conversation on 24 May 2023, the college explained that the rubbish truck drives daily and that the collection day varies per neighbourhood. Without a chip and blocking of the container, residents of the border areas of a neighbourhood, in particular, might offer their residual waste more frequently offer their residual waste more often than once every fortnight. These two points (limiting the number of containers and the collection frequency) lead to a maximum amount of residual waste collected from residents. This aims to provide a positive incentive to separate more waste so that it does not have to be offered as residual waste. It is necessary to keep landfill records, the college said. The college further points out that a resident can complain to the college because the grey container is no longer functioning properly, it has not been emptied or has gone missing. In doing so, it may relevant to investigate when waste was last presented. Around 2,000 containers emptied, resulting in several dozen reports per week. On 24 May 2023, the college promised the AP to set the retention period of landfill data for the grey containers to 14 days, instead of keeping them as long as the container is in use. 2.3. Regarding necessity in the case of underground containers By regulating access to underground containers with a token, first of all, the amount of residual waste for residents of high-rise buildings is reduced. It also prevents residents who have a grey container can also deposit waste in the underground containers. This would reduce the effect of of the stricter management of grey containers. Furthermore, regulating access prevents residents of other municipalities from improperly using the underground containers. The college further points to the management of tokens. There is a strict policy that per household only one token is issued per household. In addition, the token can open a container for residual waste can be opened. This requires the deposit data to be kept for at least 24 hours. Also with regard to the tokens, a resident can file a complaint. This is because it sometimes that an underground container or token does not function properly. Also to deal with these complaints complaints, it is necessary to consult the deposit history. This may show whether the token has has been presented recently and has therefore broken down (in which case the token will be replaced free of charge) or has not been presented for some time (which is an indication that the token has been lost, in which case the resident should pay for replacement). Date 2 November 2023 Our reference z2023-00037 6/14 On 24 May 2023, the college promised the AP to set the retention period of landfill records for underground waste containers to 14 days, instead of five years. 2.4. Regarding the provision of information The college agrees with the finding in the investigation report that the provision of information to the residents does not meet the requirements of the AVG. Nevertheless, according to the college, it should be noted that the college has tried to inform residents appropriately. In letters dated 5 and 22 March 2019, the college tried to clarify the purpose for which the containers were replaced. For instance, it was mentioned that the containers will be fitted with chips for the purpose of managing the containers so as to be in line with the objective of increased waste separation as described in the Waste Policy Plan. It was then explained that the chips will be linked to the residential address, after which even the specific method by which the chip is used to achieve better management of waste collection. For instance, it is explained that the collection vehicle scans the chip and then stores that the container has been emptied. According to the college, it at least partially explains for what purpose the personal data is being processed. On the other hand, the college recognises that the provision of information about the containers for the high-rise buildings has fallen short. The letter dated 30 November 2018 was also not sufficiently clear to give residents a proper picture of the processing of personal data under of the waste policy. 3. Assessment 3.1. Controller and processing of personal data As established in sections 3.1, 3.2 and 3.3 of the investigation report, and endorsed by the college endorsed, the Municipal Executive, as data controller for the collection of residual waste, processes personal data of residents of Voorschoten municipality. These include the chip number of the container or token, the associated address details, date and time of emptying the container or opening the underground container. container or opening the underground container, location details and type of waste. This data are linked to an address via the chip number and make the residents concerned directly or indirectly identifiable. identifiable. 3.2. Violation 1: processing personal data without a basis Under the AVG, personal data must be processed in a way that, in relation to the data subject is lawful, inter alia (Article 5(1), introductory sentence and (a)). The processing is only lawful if and to the extent that at least one of the conditions ("foundations") is met listed in Article 6, first paragraph. Date 2 November 2023 Our reference z2023-00037 7/14 For the processing operations at issue, the College has taken the view that they are based on the basis that the processing operations are necessary for the performance of a task carried out in the public interest interest (Article 6(1)(e) of the AVG). Therefore, successively address the existence of a public task and the need to process personal data for that purpose. processing. 3.2.1. Public task As mentioned in the investigation report, it follows from Article 10.21 and onwards of the Environmental Management Act that on the municipal council and the municipal executive have a public duty to ensure the collection of household waste at least once a weekly collection of household waste. The municipal council has the power to adopt a waste ordinance, which the council of the municipality of Voorschoten has done. In doing so the municipal council has scope to adopt an environmental policy plan pursuant to section 10.23, second paragraph, read in conjunction with Section 4.6 of the Environmental Management Act. In the waste ordinance entrusted the college with the collection of household waste. From this follows that the college has a public interest task with regard to the collection of household waste. As the Administrative Law Division of the Council of State (hereinafter: the Division) ruled in its ruling of 30 June 2021 (ECLI:NL:RVS:2021:1420), the municipal government is allowed a certain amount of leeway in fulfilling of that task a certain amount of leeway. The council is implementing the policy laid down in the Waste Policy Plan 2016-2020. Part of this is that the council is committed to reducing facilities for residual waste to encourage waste separation. 3.2.2. Necessity to process personal data The necessity requirement entails that the processing of personal data must be proportionate and must be subsidiary. In its judgment of 30 June 2021 (as cited), the Division considered that in order to assess necessity, it must first be ascertained whether the purpose for which the personal data is processed is well-defined and explicitly defined. Furthermore, it must be determine whether that purpose can be achieved with the processing. In doing so, the purpose must fit within the task of public interest. Next, it must be assessed whether the invasion of privacy is proportionate to the interests served by the processing. In particular, it must be assessed whether the purpose cannot be achieved in another way less prejudicial to the individuals concerned. The more detailed a possible data subject describes an alternative, the more intrusive the AP's investigation should be. The Division further considered that the risk of abuse of the system relates to the security of the processing and is not relevant to determining its lawfulness. Section 3.2.1 of this decision discussed the public interest task and the college's scope to make policy in doing so. In view of the provisions of the Environmental Management Act and the adopted Waste Policy Plan, considers that the purpose for which the personal data are processed - the reducing the amount of residual waste by regulating the volume of that waste stream - in this case Date 2 November 2023 Our reference z2023-00037 8/14 well-defined and explicitly defined. The AP also notes that the purpose can be achieved by processing personal data. The address-related numbers in the chip in the grey containers and tokens indeed play a key role in limiting the amount of residual waste a household can offer. Furthermore, the purpose of the processing fits within the public task, described in section 3.2.1. It must then be considered whether the invasion of privacy is proportionate to the interests served, notably particular by considering whether the purpose can be achieved in a less detrimental way. In the application for enforcement, the complainant raised the possibility of anonymous chips. The link to an address is however, necessary to manage (issue and block) the chips and thus achieve the objective. Indeed, without this link, it is not possible to prevent a household from having multiple containers and/or tokens, or from ending up with a company or resident in another municipality. This would actually undermine its use and purpose. The fact that the green GFT container and blue paper container are not equipped with a chip, is not an indication of the lack of need to to process personal data to achieve the purpose regarding residual waste. Those containers - and the so-called environmental parks in the municipality - are after all intended precisely for separated waste streams and not for residual waste. As stated in the investigation report, the AP considers that the processing of personal data is in proportionate to the purpose to be served. Using a chip and storing data to be able to check whether a container has been emptied in the past two weeks is necessary for that purpose. Likewise, it is necessary for that purpose to record data for container management, such as which address a container belongs to (chip number) and whether it is missing. A longer processing of landfill data beyond the stated period of two weeks does not further contribute to the above stated purpose and is therefore disproportionate. The same applies to the token for underground waste containers. The use of a chip and the storage of data is necessary to monitor whether the daily maximum number of deposits is not is exceeded. Also with the token, it is necessary for its management to have some time to be able to look back, so that the operation of a token can be checked if a resident reports a malfunction is reported. It can be assumed that every household offers residual waste at least once a fortnight offers, so no further than that need be looked back to see if the token worked recently. Again, longer processing than this fortnight does not further contribute to the stated purpose, and is therefore not proportionate. 3.2.3. Conclusion The college retained the deposit data of grey containers for as long as the container was in use, and the deposit records of tokens for five years. This far exceeds the two-week time limit. For the period exceeded, there is no need to process personal data processing as part of the public interest task. It is therefore concluded that this processing in so far does not meet the requirements of Article 6(1)(e) of the AVG and is therefore unlawful. Date 2 November 2023 Our reference z2023-00037 9/14 The college stated that the retention period had been adjusted and the stored landfill data in July 2023 have been deleted to the extent that they were older than two weeks. A supervisor from the AP inspected on 2 October 2023 accessed the systems and found that no landfill data was present that exceeded the 14-day retention period. In view of the above, it is established that the college in the period from the end of 2018 (high-rise) and March 2019 (low-rise) respectively until July 2023 was in breach was in breach of Article 5(1)(a), read in conjunction with Article 6(1)(a) and (e) of the AVG. (e) of the AVG. 3.3. Breach 2: failure to properly inform data subjects about the processing of personal data Under the AVG, personal data must be processed in a way that is transparent towards the data subject is, inter alia, transparent (Article 5(1), introductory phrase and (a)). The information the controller must provide to data subjects about personal data not obtained from obtained from the data subjects is named in Article 14 of the AVG. These include the processing purpose and the legal basis of the processing (first paragraph, introductory phrase and point (c)) and the categories of personal data (first paragraph, introductory sentence and point (d)). As stated in the investigation report, the college has written to the residents of the municipality informed about the replacement of grey containers and above-ground containers. To this end, the college sent letters on 30 November 2018 (high-rise buildings), 5 March 2019 and 22 March 2019 (low-rise buildings). However, these letters are mainly about the actual course of action regarding the replacement of the grey containers and underground containers, and make no or insufficient mention of any of the processing of personal data of data subjects. As mentioned in the investigation report, the the letters do not state which categories of personal data are processed via the chip in the container and the token for the underground container respectively, the purpose and basis of such processing. The college endorsed this observation in the view. The college by letter dated September 1, 2023 (according to the college sent on 22 September 2023) again informed about the processing of personal data in connection with the collection of residual waste. This letter does contain all the required information. This means that the breach has ended. In view of the above, it is established that in the period from the end of 2018 (high-rise buildings) March 2019 (low-rise buildings) until 22 September 2023, respectively, the Municipal Executive violated the obligation to provide information. Thereby, the college was in violation of Article 5, paragraph 1, opening words and under a, read in conjunction with Article 14(1)(c) and (d) of the AVG. Date 2 November 2023 Our reference z2023-00037 10/14 4. Administrative fine 4.1. Views of the college As mentioned in paragraph 2 of this decision, the College's view also addressed the imposition of a remedial measure and/or administrative fine. Thus, the college argues that the imposition of a remedial measure is not necessary. The processing described in the investigation report is discontinued by the college ceased insofar as it is not necessary for the implementation of the waste policy. As mentioned above, the retention period has since been set at 14 days and the older data has been deleted. In addition, the college has re-notified the residents of the municipality in the manner as per the investigation report should have been. The college further argues that it cannot agree to impose an administrative fine. First of all, it concerns personal data with a rather low risk level. After all, it concerns address details of residents, which could only be obtained by enriching them with data from the Basic Registration of Persons (hereinafter: BRP). (hereafter BRP) to a specific person. In addition, the chip in the container and the token only contain a number. and the token only contain a number. The chip can only be read with the IT system of the waste service be read and linked to an address. Only two employees of the municipality have access to this information and furthermore only when necessary for the implementation of the waste policy. In addition, the college points out that the short-term processing of personal data when emptying the grey container or opening the underground container respectively, according to the report, is necessary for the implementation of the waste policy, and that the problem lies only in the longer than necessary storage of landfill data. Finally, the college points out that the AP did not impose a fine on the municipality of Arnhem (decision of 1 August 2017), while that case is broadly similar to that of the municipality of Voorschoten. That too involved the excessive retention of personal data in the context of implementing the waste policy. In that case, the AP imposed an order for periodic penalty payments to end the breach. 4.2. Remedial sanction The college has already ended the violations found by deleting the unlawfully processed data, adjusting the processing and informing residents of the municipality about the processing. informed. As a result, there is also no fear of the breaches recurring. A recovery sanction is therefore not at issue. 4.3. Administrative fine The AP does see reason to use its power to impose an administrative fine. administrative penalty. Of the arguments put forward in the opinion of the Board of Appeal, one ground relates to the question of whether a fine should be imposed. whether a fine should be imposed (i.e. the ground that the AP in a previous case had sufficed with Date 2 November 2023 Our reference z2023-00037 11/14 an order for a penalty payment). These will now be addressed; the other grounds raised will be dealt with in the light of the amount of the fine to be imposed. The college points, as mentioned in section 4.1, to a decision of the AP dated 1 August 2017 that was directed addressed to the College of Mayor and Aldermen of the Municipality of Arnhem. That case shows similarities in similarities to the case now before us in that the Arnhem case also involved the processing of personal data in the context of waste processing using chips (there in access passes for underground waste containers). There, too, the purpose of the processing was to reducing the size of the flow of residual waste. However, a further comparison of the cases comes up against to the applicable legal regime. At the time of the Arnhem case, it was not the AVG, but its predecessor, the Personal Data Protection Act Personal Data Protection Act (hereinafter: Wbp). Under the Wbp, a different regime of fines applied than now applies under the AVG 1 Under the old regime, no fine could be imposed for the provisions breached by the Arnhem College be imposed without first having been given a binding instruction. That principle only suffered exception if the breach had been committed intentionally or was the result of seriously culpable negligence. The Arnhem college had not previously been given a binding instruction, nor had there been any intention or serious negligence. For that reason alone, no fine could be imposed in that case. imposed. With the AVG becoming applicable on 25 May 2018, the breaches identified in this decision can violations can indeed be fined directly. In the mere circumstance that an administrative fine could be imposed because of the fine regime in force at the time, the AP sees no reason to waive it now. to waive it now. 4.4. Personal Data Authority fine policy 2019 When exercising the power to impose an administrative fine, the AP applies in respect of public authorities, the Fines Policy Rules Authority Personal Data 2019 (hereinafter: Fines Policy Rules 2019). The offences for which the AP can impose a fine are divided into three penalty categories. These categories are ranked according to the severity of the violation of the said articles, with category I containing the least serious offences and category III containing the most serious offences. Associated with the categories are fines increasing in height. This follows from Article 2, sections 2.1 and 2.3 of the Fine Policy 2019. Category I Fine band between €0 and €200,000 Basic fine: €100,000 Category II Penalty band between €120,000 and €500,000 Basic fine: €310,000 Category III Fine band between €300,000 and €750,000 Basic fine: €525,000 1 The penalty regime was laid down in Chapter 10, Section 2 (Article 66 et seq.) of the Wbp. Date 2 November 2023 Our reference z2023-00037 12/14 According to Article 6 of the Fines Policy 2019, the AP determines the amount of the fine by adjusting the basic fine upwards or downwards, depending on the extent to which the factors listed in Article 7 warrant it. Under Article 8, it is possible to apply the next higher or lower category apply if the fine category determined for the offence does not allow an appropriate punishment allows. In case of multiple violations relating to the same or related processing activities, the total fine shall not exceed the statutory maximum fine of the most serious violation. 4.5. Penalty category and basic fine The violation of Article 5, first paragraph opening words and under a, read in conjunction with Article 6, first paragraph, opening words and (e) of the AVG (processing personal data without a basis), according to Annex I to the Fine Policy 2019, classified in category III. This also applies to the violation of Article 5, first paragraph, opening words and point (a), read in conjunction with Article 14, first paragraph, opening words and points (c) and (d) of the AVG (failure to comply with the information obligation). The fine bandwidth and base fine of this category (bandwidth between €300,000 and €750,000 with a basic fine of €525,000) may be appropriate given the following discussion of fine increasing and decreasing factors, they do not result in an appropriate punishment for the violations found. Therefore, fine category II will be applied, whose fine band runs from €120,000 to €500,000 and the basic fine is €310,000 is. The factors listed in Article 7 of the 2019 Fines Policy give rise to the following points for comments. The factors not discussed are not applicable in this case. a. Nature, gravity and duration of the infringement Regarding the gravity of the breach, the AP notes that the unlawful processing of personal data was not isolated, but was the continuation of a processing that was lawful. However, the College failed to recognise that the basis for the processing ceased to exist after some time because the necessity of the processing is time-limited. In a similar vein, regarding the breach of the duty to inform, the college did inform the residents of the municipality did inform about the introduction of the chip in the container and the token, but that the college failed to recognise in time that the information was deficient in informing about the processing of personal data. In view of these points, the basic amount should be adjusted downwards. f. The degree of cooperation with the supervisory authority to remedy the breach and mitigate the potential negative negative consequences thereof Date 2 November 2023 Our reference z2023-00037 13/14 After receiving the investigation report, the college acknowledged all the findings therein. The college has shortly thereafter entered into discussions with the supplier of the software and had the adjustments made to it that were made necessary to bring the processing permanently into compliance with the AVG. The college has again - and now correctly - informed residents about the processing of personal data. In addition, the negative consequences of the processing have been eliminated by removing all historical data have been removed from the municipality's systems. For this reason too, the base amount should be adjusted downwards. g. Categories of personal data affected by the breach The AP further takes into account that the personal data processed, by their nature, can only lead to a limited invasion of privacy. The data processed was only traceable to address level. In addition, only two employees of the municipality were able to view the data and use the using the BRP to trace it back to the individuals of the household in question. Furthermore, the data only provide insight into the date on which residual waste was presented. The quantity of waste was not recorded recorded and the location at the time of collection depends, in the case of the grey containers, on the designated with the designated point of presentation and is the same for all residents of the same area. In the case of the underground containers, the location is logically the location of the container. For this reason too, the base amount should be adjusted downwards. Conclusion In view of the above, the AP sees reason to reduce the basic fine to the minimum of the penalty band, being €120,000. 4.6. Proportionality of fine level Finally, pursuant to Article 49(3) of the Charter of Fundamental Rights of the European Union and Articles 3:4 and 5:46 of the Awb (principle of proportionality), it will assess whether the application of its policy for determining the amount of the fine, given the circumstances of the specific case, does not lead to a disproportionate outcome. The AP qualifies the gravity of the breaches as minor, in particular due to the nature of the data (discussed above under circumstance g) and the circumstance that the offence in respect of basis was preceded by lawful processing (discussed above under circumstance a) and became unlawful due to the passage of time. Given the minor gravity of the offences and the circumstances under which the breaches were committed, the AP sees reason to set the fine lower set at €120,000. The AP considers a fine of €30,000 appropriate and necessary. Date 2 November 2023 Our reference z2023-00037 14/14 5. Dictum Administrative fine The AP imposes an administrative fine on the Municipal Executive of the Municipality of Voorschoten for the violation of Article 5, first paragraph, opening words and under a, read in conjunction with Article 6, first paragraph opening words and under e and Article 14, first paragraph, opening words and under c and d, of the AVG an administrative fine in the amount of amounting to €30,000.00 (in words: thirty thousand euros).2 Sincerely, Netherlands Personal Data Authority Mr A. Wolfsen chairman Remedies clause If you disagree with this decision, you may, within six weeks of the date of dispatch of the decision digitally or on paper, submit a notice of objection to the Personal Data Authority. Pursuant to Article 38 of the UAVG, filing a notice of objection suspends the effect of the decision imposing the imposition of the administrative fine. For filing a digital objection, see www.autoriteitpersoonsgegevens.nl, under the Contact heading, item "Tip, complaint or objection".3 The address for filing on paper is: Personal Data Authority PO Box 93374 2509 AJ The Hague. Indicate 'Awb-bezwaar' on the envelope and put 'bezwaarschrift' in the title of your letter. In your notice of objection, write at least: - your name and address; - The date of your objection; - the reference (case number) mentioned in this letter, or attach a copy of this decision; - the reason(s) why you disagree with this decision; - your signature. 2 The AP will hand over the claim to the Central Judicial Collection Agency (CJIB). 3 The direct URL is <https://www.autoriteitpersoonsgegevens.nl/over-de-autoriteit-persoonsgegevens/bezwaar-maken>.