GHARL - 200.351.300/01

GHARL - 200.351.300/01
Court:	GHARL (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:	Article 17(2) GDPR Article 19 GDPR
Decided:	16.09.2025
Published:	24.09.2025
Parties:	Data Subject versus Stichting Regiecentrum Bescherming en Veiligheid (RBV - Foundation for the Center for Protection and Safety)
National Case Number/Name:	200.351.300/01
European Case Law Identifier:	ECLI:NL:GHARL:2025:5678
Appeal from:	Rb. Noord-Nederland (Netherlands) 197831
Appeal to:	Unknown
Original Language(s):	Dutch
Original Source:	De Rechtspraak (in Dutch)
Initial Contributor:	Shravan

A court ordered a centre for protection and security to inform the recipient of a file on a data subject about the file’s deletion, in accordance with Article 19 GDPR.

English Summary

Facts

The controller is the Management Centre for Protection and Security, a center offering protection to children, young people and adults in Friesland (Stichting Regiecentrum Bescherming en Veiligheid-RBV).

Between 2015 and 2018, several departments of RBV were involved in the data subject's life and therefore created and maintained a file containing his personal data.

On 10 June 2024, the data subject, invoking Article 17 GDPR, requested the destruction of the file. RBV agreed, confirming in writing on 26 November 2024 that the file would be destroyed within six weeks.

Before the scheduled deletion, on 6 December 2024, the data subject filed a case before the court of first instance (District Court of North Netherlands) seeking immediate destruction of the file.

RBV subsequently destroyed the file on 7 January 2025.

The court of first instance dismissed the data subject's claim on 5 February 2025 because the RBV had already agreed to and completed the data erasure.

The data subject, appealed the decision of the court of first instance before the court of appeal (Court of Appeal Arnhem-Leeuwarden), requesting the court to order RBV to notify other "processors" of his file about its destruction, based on Article 17(2) GDPR.

Holding

First, the Court held that Article 17(2) GDPR applies only when data have been made public, for instance, published online or in publicly accessible register in a way where others may view or reuse them. Ordinary exchanges of information with authorities or institutions do not amount to “making public,” and thus RBV had no duty to notify other controllers of the deletion of the data under this provision.

Second, the Court pointed that Article 19 GDPR requires controllers to communicate the erasure of personal data to each recipient to whom the personal data have been disclosed, and not just processors, without further or specifically directed request from the data subject, unless doing so is impossible or disproportionate.

In this case, the RBV should have ascertained, before destroying the file, whether personal data within the meaning of Article 19 GDPR had been provided, and complied with the notification obligation. The court found that RBV thereby breached its accountability obligations under Article 5 and Article 24 GDPR. RBV had mentioned at the hearing that it had shared data with a juvenile probation organisation. Apart from that, it is undisputed that the data subject's file at the RBV has since been destroyed and can no longer be determined whether, and if so to whom, personal data from the file have been provided.

Further, the Court partly granted the supplementary request, ordering RBV to notify the juvenile probation organisation of the erasure of the data subject's personal data under Article 19 GDPR.

The Court dismissed the remainder of the appeal and saw no reason to impose a penalty on the RBV.

Comment

The judgment draws a clear distinction between Article 17(2) and Article 19 GDPR, confirming that the right to erasure operates differently for public and non-public data. Controllers are required to notify other controllers of erasure requests only when personal data have been publicly disclosed, while private disclosures instead trigger Article 19 duties. The ruling also underscores the need for effective record-keeping and verification processes to meet Article 19 obligations where Controllers must be able to trace disclosures and demonstrate compliance even when full rectification later becomes impossible.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

Authority
Arnhem-Leeuwarden Court of Appeal
Date of judgment
September 16, 2025
Date of publication
September 24, 2025
Case number
200.351.300/01
Areas of law
Civil law
Specific characteristics
Appeal
Subject matter
GDPR case. Request for erasure (Article 17 GDPR). Question whether the controller is obligated to inform others of the request for erasure of personal data or of the erasure itself. Before proceeding with the erasure, the controller failed to investigate whether and, if so, to whom personal data had been provided, which in itself constitutes a violation of its obligations under the GDPR (specifically, Articles 17, paragraph 2, and 19 GDPR). The fact that the applicable privacy policy did not provide grounds for such an investigation cannot benefit the controller, as that policy cannot affect its legal obligations. Sources
Rechtspraak.nl
Enriched judgment
Judgment
COURT OF APPEAL ARNHEM-LEEUWARDEN
location Leeuwarden
civil law department
Court of Appeal case number 200.351.300
Case number District Court of Northern Netherlands, location Leeuwarden, 197831
Order of September 16, 2025
in the case of
[appellant]
residing in [place of residence 1]
who filed an appeal and
appeared as petitioner before the court, hereinafter: [appellant]
without a lawyer
and
Stichting Regiecentrum Bescherming en Veiligheid (Protection and Security Control Centre Foundation)
established in Leeuwarden and
acted as defendant before the court, hereinafter: the RBV
without a lawyer. 1 Course of the appeal proceedings
[Appellant] filed an appeal with the Court of Appeal (hereinafter: the Court of Appeal) against the order1 issued by the District Court of Noord-Nederland, Leeuwarden location, on February 5, 2025 (hereinafter: the contested order). The course of the appeal proceedings is apparent from:
-
the notice of appeal, also containing a supplementary request and a request for interim relief
-
the statement of defense
-
the minutes (official transcript) of the oral hearing held on August 27, 2025.
2 The substance of the case
2.1.
[Appellant] requested the District Court to order the RBV to immediately destroy the file it had compiled against him, to impose a penalty on the RBV, and to order the RBV to pay the costs of the proceedings.

2.2.
The District Court denied these requests on February 5, 2025, and ordered the parties to bear their own costs. 2.3.
[Appellant] requests that the Court of Appeal instruct the RBV to notify other "processors" of his file of the RBV's destruction of that file and that the RBV be imposed a penalty for this, both as a decision on the merits and in the form of interim relief. [Appellant] also requests that the RBV be ordered to pay the costs of the proceedings before the District Court and the Court of Appeal.

2.4.
The Court of Appeal will decide that [appellant]'s supplementary request is partially admissible and will explain this below. The Court of Appeal upholds the District Court's order.

3. Explanation of the Court of Appeal's decision
The facts on which the Court of Appeal bases its decision
3.1.
Various departments of the RBV were involved in [appellant]'s life between 2015 and 2018. Therefore, the RBV has one or more files on [appellant] in its archives (hereinafter: the file).

3.2.
On June 10, 2024, [appellant] requested the RBV to destroy the file.

3.3.
In a letter dated November 26, 2024, the RBV wrote to [appellant]:
I have decided to grant your request for destruction. The files will be destroyed six weeks after the date of this letter. If you disagree with this decision, please respond to this letter before January 6.
3.4.
On December 6, 2024, the court received the request from [appellant] mentioned under 2.1.

3.5.
On January 7, 2025, the RBV destroyed the file.

Substantive assessment
3.6.
The court notes that Articles 5 and 24 of the GDPR establish that the controller has ongoing responsibility for compliance with the obligations under the GDPR regarding the processing of personal data. In this context, it is important that the controller – in short – must organize its policies, (internal) procedures, and organization in such a way that it always meets and can comply with its obligations under the GDPR. This is no different if a controller uses a (privacy) policy or protocol in this regard.

3.7.
Article 17 of the GDPR contains the provisions for the right to erasure. In the event of a request for erasure received from a data subject, the controller, if the data subject's personal data has been made public by the controller, is obligated, pursuant to Article 17(2) of the GDPR, to inform other controllers processing the personal data of the request. Recital 66 of the GDPR states that the purpose of this obligation is to strengthen the right to be forgotten in the online environment and thus specifically relates to personal data posted online.

3.8.
Contrary to [appellant]'s argument, partly citing the provisions of the Open Government Act (not applicable here), it must therefore be assumed that "making public" within the meaning of Article 17 of the GDPR means making personal data available to (a specific group of) the public, for example, by posting it online or including it in registers accessible through an account or otherwise, allowing this information to be viewed or used by others, who then themselves become data controllers. The broader interpretation advocated by [appellant], namely that any provision or transfer of personal data falls within the scope of "making public" within the meaning of Article 17, paragraph 2, of the GDPR, is also countered by the fact that this creates a significant overlap with the provisions of Article 19 of the GDPR concerning the notification obligation, and that this provision would, in fact, have little meaning. That article stipulates that the controller is, in principle, obligated—without a further or specific request from the data subject—to inform each recipient to whom personal data has been disclosed of the data erasure.

3.9. The RBV has disputed that it disclosed [appellant]'s personal data from the file in the sense intended above. Given the nature of the RBV as a youth protection organization, this is also not plausible. [Appellant]'s arguments also provide no reason to assume that the RBV's challenge should be considered incorrect. [Appellant]'s request to compel the RBV to inform other authorities of the erasure of his personal data, or of his request to do so, cannot therefore be based on Article 17 of the GDPR.

3.10.
With regard to the notification obligation referred to in Article 19 of the GDPR, contrary to what the RBV apparently believes, it is not limited to only processors of personal data as referred to in Article 4, paragraph 8 of the GDPR. Every recipient of the personal data must be informed. A 'recipient' is defined in Article 4, paragraph 9, of the GDPR as 'any natural or legal person, public authority, agency or other body, whether a third party or not, to whom the personal data are disclosed'.

3.11.
Article 30 of the GDPR obliges a controller to maintain a register of processing activities. This register must include, among other things, the categories of recipients to whom the personal data have been or will be disclosed. However, contrary to [appellant]'s argument, this registration obligation does not extend so far that the register must record, at the individual or file level, which personal data have been disclosed to which recipient. Therefore, [appellant] cannot be accepted in his argument that the RBV should have maintained a separate register detailing which personal data had been disclosed to whom, and that the RBV should therefore be deemed capable of complying with the notification obligation even after the file has been destroyed.

3.12.
This does not alter the fact that the RBV should have examined the file, before destroying it, to determine whether personal data had been provided within the meaning of Article 19 GDPR, in which case it was obligated to comply with its notification obligation. At the hearing, the RBV acknowledged that, in assessing the erasure request, it did not also investigate to whom personal data from the file had been provided—nor, moreover, whether disclosure had occurred within the meaning of Article 17, paragraph 2 GDPR. The RBV explained this by stating that the privacy policy of Jeugdzorg Nederland (Youth Care Netherlands) it used offered no basis for this. This cannot, in view of recital 3.6, avail it. In that respect, the RBV failed to comply with its obligations under the GDPR as a data controller.
3.13
However, the obligation to notify all recipients does not apply if "this proves impossible or involves disproportionate effort" (see Article 19 GDPR). It is established that [appellant]'s file at the RBV has since been destroyed. Consequently, it can no longer be determined whether, and if so to whom, personal data from the file were provided, other than the RBV's assertion during the oral hearing that it is highly likely that [appellant]'s personal data were shared with a youth probation organization via the Judicial Information Service (JustID). To that extent, [appellant]'s request is therefore admissible, and the RBV will be ordered to notify JustID of the erasure of [appellant]'s personal data processed by the RBV. In the absence of further explanation, the court finds insufficient grounds to assume that personal data was also provided to the other organizations mentioned by [appellant]. The court therefore concludes that such notification has (now) proven impossible as referred to in Article 19 of the GDPR. The fact that this is related to a violation by the RBV of its obligations under the GDPR does not alter this. To the extent that the supplementary request is based on Article 19 GDPR, it is therefore partly admissible.

3.14.
From the foregoing considerations, it follows that there are grounds to grant the order requested by [appellant] to the RBV, as set out below. The Court of Appeal sees no reason to grant interim relief. Because the Court of Appeal assumes that the RBV, as a certified institution, will comply with the order set out below, the Court of Appeal also sees no reason to impose a penalty on the RBV.

3.15.
Regarding the costs of the proceedings before the District Court, the Court of Appeal has no reason to decide differently than the District Court did. The Court of Appeal adopts the reasoning provided by the District Court and makes it its own. The Court of Appeal adds that [appellant]'s request regarding the notification obligation was not before the Court at the time.

Conclusion
3.16.
The appeal against the District Court's decision is unsuccessful and will be dismissed. The supplementary request will be granted in part. There are no grounds for granting interim relief.

3.17.
Although the appeal is unsuccessful and [appellant]'s supplementary request on appeal is only partially admissible, the Court of Appeal does see reason to order the RBV to pay the legal costs. It has already been established that [appellant]'s request, which is on appeal, is directly related to the RBV's failure to comply with obligations under the GDPR. The legal costs in this case consist of the court fee levied on [appellant]. There are no grounds for awarding attorney's fees, as [appellant] conducted these proceedings himself. The requested statutory interest on the legal costs will be awarded as set out below.

4. The decision
The Court:
4.1.
dismisses the appeal against the order of the District Court of Noord-Nederland, Leeuwarden location, of February 5, 2025;

4.2. Orders the RBV to inform the Judicial Information Service (JustID) of the erasure of [appellant]'s personal data;

4.3
Orders the RBV to pay the costs of [appellant]'s appeal proceedings, estimated at €362 for court fees;

4.4.
Orders that these costs must be paid within 14 days of today. If payment is not made on time, these costs will be increased by the statutory interest rate;

4.5
Rejects any additional or alternative requests.

This order was issued by Judges W.F. Boele, M.W. Zandbergen, and A.A.J. Smelt, and pronounced in open court on September 16, 2025.