Hoge Raad - AVG 2023-09-21
| Hoge Raad - AVG 2023-09-21 | |
|---|---|
 | |
| Court: | Hoge Raad (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 5(1)(a) GDPR Article 6(1)(e) GDPR |
| Decided: | |
| Published: | |
| Parties: | |
| National Case Number/Name: | AVG 2023-09-21 |
| European Case Law Identifier: | ECLI:NL:PHR:2023:823 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Dutch |
| Original Source: | Hoge Raad (in Dutch) |
| Initial Contributor: | co |
The Supreme Court of the Netherlands (Hoge Raad) held, with regards to the E-Archive, a database containing a selection of judgments accessible by court officials, that it complies with GDPR requirements, as long as data subjects are informed when their personal data is included therein.
English Summary
Facts
An individual (data subject) brought three separate complaints with the Procurator General of the Supreme Court, who is competent to deal with complaints regarding courts acting in their judicial capacity. The data subject directed his complaints against three different district courts of courts of Northern-Netherlands, Amsterdam and The Hague (each of them a controller) for unlawful processing of his personal data, including in his professional capacity as a legal representative, via the E-Archive.
The E-Archive is an internal database containing a selection of judgments of Dutch Courts, accessible only to judicial and court officials in their judicial activities.
In particular, the complainant held, first, that the Nord Holland District Court included the name of the complainant in a E-Archive judgment without his consent and without informing him about the appearance of his data therein, which was then removed at his request.
Secondly, with respect to processing by the Amsterdam District Court, the complainant asserts that the court lacked a legal basis to search for his name in the E-Archive and disclose this data to the opposing party at a subsequent hearing. He objected to the processing and asked the court to stop processing his personal data, but the court replied that these judgments were not included in the E-Archive and thus it could not comply with his request.
Thirdly, as regards the Hague District Court, the data subject complained about the refusal of the Board of the Court to comply with his request not to disseminate his personal data via, inter alia, the E-Archive, as he considered that he had not been duly informed about the inclusion of his personal data in the E-Archive.
The Supreme Court of the Netherlands was thus called upon to investigate on the processing activities by the Boards of the above mentioned District Courts and it also took the chance to rule on the compliance of the E-Archive with the GDPR.
Holding
First of all, the Supreme Court assessed the compliance of the E-Archive with the GDPR and it held that the purposes it serves, namely that of guaranteeing quality of judicial decisions and promote legal unity and certainty are legitimate. Also, it considered the measures in place and those to be adopted to ensure an adequate level of protection of the personal data included in the E-Archive. The court further held that the processing activities by courts in using the E-Archive are lawfully based on both Article 6(1)(e) GDPR directly and on Article 6(4) GDPR too, thus concluding that the archive does comply with GDPR requirements.
Then, in order to handle the complaint brought by the data subject, the Supreme Court assessed whether the GDPR was applicable to the case at hand and whether it had competence to deal with such complaints. It concluded that the GDPR does apply to courts acting in their judicial capacity under Article 2(2)(d) GDPR. Also, under Article 55(3) GDPR and Recital (20) GDPR national Data Protection Authorities do not have competence to supervise processing activities of courts acting in their judicial capacity, and this task should be assigned to a special supervisor. According to Dutch Law, complaints relating to processing activities by courts in their judicial capacity shall be handled by the Procurator General of the Supreme Court.
With respect to the single claims, the Supreme Court held the majority of them to be unfounded, as it first considered that consent of the data subject is not required for the processing of his perosnal data, as this occurs on the basis of Article 6(1)(e) GDPR and on Article 6(4) GDPR. Further, as regards the inclusion of a judgment in the E-Archive, the Supreme Court held that it is up to the respective Courts to decide which cases shall be included therein, and found that in this case, the Courts took a balanced decision.
As regards two of the claims whereby the data subjects asserts that he had not been duly informed about the existence of the E-Archive and the inclusion of his data therein, the Supreme Court found these to be well-founded. Effectively, the Court held that not informing the data subject constitutes a violation of the principle of transparency of Article 5(1)(a) GDPR ruling, in particular, that the requirements of Article 13(1)(c) GDPR and of Article 13(3) GDPR in cases of further processing as referred to in Article 6(4) GDPR had not been met.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
