Rb. Den Haag - AWB - 20 4694
| Rb. Den Haag - AWB - 20 _ 4694 | |
|---|---|
 | |
| Court: | Rb. Den Haag (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 5(1)(a) GDPR Article 6(1)(a) GDPR Article 7 GDPR Article 13 GDPR Article 25 GDPR Article 56(1) GDPR Aricle 1:2, lid 3 Awb |
| Decided: | 22.12.2021 |
| Published: | 25.01.2022 |
| Parties: | Consumentenbond Autoriteit Persoonsgegevens |
| National Case Number/Name: | AWB - 20 _ 4694 |
| European Case Law Identifier: | ECLI:NL:RBDHA:2021:15405 |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | Rechtspraak.nl (in Dutch) |
| Initial Contributor: | Giel Ritzen |
The District Court of Den Haag held that the Consumentenbond had to be considered a stakeholder in a complaint against Google. The Dutch DPA ruled on an enforcement request in due time.
English Summary
Facts
On 26 November 2018, the Consumentenbond (a Dutch non-profit organisation which promotes consumer protection), on behalf of consumer [A], filed a complaint with the Dutch DPA, the Autoriteit Persoonsgegevens (AP), against Google LLC. The complaint was part of a joint action with other European consumer organisations, such as the umbrella organisation BEUC and the Norwegian, Swedish and Czech consumer associations.
The complaint concerned the unlawful tracking of the consumer’s location by the consumer’s Samsung galaxy A3 smartphone, which runs the operating system Android (by Google). According to the complaint, crucial information was hidden and users were guided by dark patterns to consent to share their location, in violation of Article 5 GDPR, Article 6 GDPR, Article 7 GDPR, Article 13 GDPR, and Article 25 GDPR.
The DPA, however, claimed that the Irish DPA (the DPC), is the leading supervisory authority pursuant to Article 56(1) GDPR, because the complaint concerns cross-border processing and Google’s European headquarters is located in Ireland. On 5 June 2019 and 2 September 2019, the DPA notified the Consumentenbond and the consumer that the Irish DPA was investigating the complaint and further information would follow.
On 26 November 2019, the Consumentenbond and consumer served the DPA with a notice of default for failing to make a timely decision, but the DPA replied on 2 December 2019 that the notice was premature since they had until 2 December 2019 to reply. Moreover, they informed the Consumentenbond and consumer that Google had made changes related to the complaint and additional evidence in relation to the consumer had to be filed before 6 January 2020.
The DPA kept informing the Consumentenbond and consumer every three months, on 27 Febryary 2020 and 27 May 2020, of the “progress” by the DPC, stating that an update would follow in three months. Finally, on 30 November 2020, two years after the complaint was filed, the Consumentenbond brought the case before Court because the DPA had still not taken a decision.
Holding
The Court discussed two matters: (1) whether the Consumentenbond can be regarded as a stakeholder within the meaning of Article 1:2, third paragraph, of the General Administrative Law Act (Awb), and (2) whether the decision by the DPA failed to decide in due time on the enforcement request.
The Consumentenbond claimed it is a stakeholder. The DPA, however, claimed this is not the case because “the statutory objectives of the claimant are too general to be able to also protect the interest of the protection of personal data or privacy of third parties in an administrative law procedure.” The Court, however, found that the statutory objectives are not too general, and that the Consumentenbond has shown with their activities to focus on the prevention of abuses in the area of consumer privacy. According to the Court, these privacy interests are so intertwined with the general interest of the Consumentenbond, that this interest is included in the statutory objectives. Hence, the Court concluded that the Consumentenbond is a stakeholder.
The Court further examined whether the DPA failed to decide the matter in a timely manner. In this respect, the Dutch DPA considered that, since the Irish DPA is now the leading supervisory authority and is investigating the complaint, it (the Dutch DPA) can no longer investigate the complaint on their own behalf. Moreover, the Court referred to the reasoning of the Court of Midden-Nederland in its judgement of 15 October 2020, regarding the question within which term the DPA must decide on the request for enforcement. The Court found that the decisive factor was that “the complaint has become part of a large and complex investigation into the cross-border processing of personal data”, and the (Dutch) DPA can therefore not determine “the scope and path of the investigation”, or set a date for the decision. Moreover, because the DPA informed the Consumentenbond every three months, it fulfilled its obligations. Hence, the Court concluded that the DPA has not failed to decide in due time on the enforcement request.
Comment
Sandra Molenaar, director of the Consumentenbond, is disappointed with the ruling: "This is a setback for consumers. They are forced to wait for a ruling from the Irish regulator, but they have been doing so for over three years. And in the meantime the violations remain unpunished. That is enormously frustrating. The AP should do more to speed up the process. All the more so because Google is given every opportunity in the meantime to communicate with the Irish regulator and to exert influence that way. Consumers are not being heard. The way in which European supervision is currently organised is really inadequate. We will therefore draw attention to this in the coming period." (see: https://www.consumentenbond.nl/nieuws/2022/autoriteit-persoonsgegevens-niet-in-gebreke-in-google-zaak).
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
Body
Court of The Hague
Date of judgment
22-12-2021
Date of publication
25-01-2022
Case number
AWB - 20 _ 4694
Jurisdictions
Administrative law
Special characteristics
First instance - single
Content indication
The requirement is the stakeholder, the prevention of abuses with regard to consumer privacy is part of the statutory objective. Hearing duty violated. No penalty forfeited due to failure to decide on time, notice of default premature.
Locations
Rechtspraak.nl
Enhanced pronunciation
Share pronunciation
print
Save as PDF
Copy link
Pronunciation
COURT OF THE HAGUEAdministrative case number: SGR 20/4694 AVG decision of the single chamber of December 22, 2021 in the case between the Consumers' Association, The Hague, plaintiff (authorized representative: mr. GJ Zwenne), and the Dutch Data Protection Authority (AP), defendant (agent: mr. W van Steenbergen).Procedure of the proceedings In a letter dated November 26, 2018, Plaintiff, on behalf of [A] in The Hague (the consumer), filed a complaint with Defendant against Google LC, established in California (United States). Plaintiff furthermore, also on behalf of the consumer, requested the defendant to take enforcement action. By decision of December 5, 2019 (the primary decision), the defendant informed plaintiff that a response had to be given no later than December 2, 2019 about the progress of the complaint. The notice of default received on November 27, 2019 is premature and no penalty was forfeited due to a failure to make a timely decision on the request for enforcement. By decision of June 5, 2020 (the contested decision), the respondent (apparently) lodged the claimant's objection against the primary decision. declared unfounded. The applicant appealed against the contested decision. Defendant has filed a statement of defence. The hearing took place by means of a Skype connection on October 14, 2021. Plaintiff was represented by its authorized representative. [B], [C] and [D] have also appeared on the part of the claimant. Defendant was represented by his authorized representative. Mr. [E] has also appeared on the part of the defendant. Considerations What is this case about? 1.1. The submitted complaint concerns the unlawful tracking of the location of the consumer's Android smartphone (Samsung galaxy A3 (2017)), which is in violation of Articles 5, 6, 7, 12, 13 and 25 of the General Data Protection Regulation (GDPR). Plaintiff has furthermore, also on behalf of the consumer, requested the defendant to take enforcement action, because there is a collective infringement of said rules, which adversely affects many consumers. Plaintiff takes the position that it is an interested party within the meaning of Article 1:2, third paragraph, of the General Administrative Law Act (Awb). that the complaint is part of a joint action with other European consumer organisations. Similar complaints have therefore been submitted to fellow supervisors. Because the complaints relate to cross-border processing of personal data, this complaint will be handled in accordance with the provisions of chapters VI and VII of the General Data Protection Regulation (GDPR). At that time, a procedure is followed that determines which European authority is competent to act as lead supervisor and which authorities are considered to be involved supervisors. The picture is that now that Google's European headquarters is located in Ireland, the Irish authority is empowered to act as the lead regulator. If it has been established that the respondent is involved in the handling of the complaint from the role of the supervisory authority concerned, and which other authorities are also involved, the Irish authority will cooperate in investigating this complaint. Pursuant to Article 14(5) of the GDPR Implementation Act (UAVG), the term for making a decision is suspended for an indefinite period. The question of whether Plaintiff has the right to file a complaint under the GDPR or an enforcement request is not prejudged. supervisor as the lead supervisor investigates the processing and that the defendant is the supervisor involved. As soon as more information about the progress of the investigation is known, further notice will follow. In a letter dated November 26, 2019, the claimant gave the defendant notice of default for failing to make a timely decision on the request for enforcement. In a progress report dated December 2, 2019, the defendant informed the plaintiff and the consumer that the Irish regulator is in talks with Google and that Google has made changes related to the complaint. Furthermore, the claimant was requested to submit additional supporting documents with regard to the consumer by 6 January 2020 at the latest (including which e-mail account the consumer used when installing the telephone). The decision period is suspended on the basis of Article 14, fifth paragraph, of the UAVG. 1.4. In the primary decision, the respondent stated that it had to inform the claimant about the progress of the complaint by 2 December 2019 at the latest. The notice of default received on November 27, 2019 is premature and no penalty has been forfeited. It follows from Article 78, second paragraph, of the GDPR that complaints must be responded to with a decision or a progress report within three months. 1.5. By a progress notice dated February 27, 2020, the defendant sent the claimant (and the consumer) a progress notice from the Irish regulator (Data Protection Commission, DPC) dated February 27, 2020, stating that an update will follow within three months. 1.6. In a letter dated March 23, 2020, the respondent has informed the claimant that the term for taking a decision on the objection will be postponed by a maximum of six weeks, as referred to in Article 7:10, paragraph 3, of the Awb, until May 6, 2020 at the latest. e-mail message of 1 May 2020, the respondent has informed the claimant that the decision period will not be met. 1.7. In a progress notice dated May 27, 2020, the defendant sent the claimant (and the consumer) a progress notice from the DPC dated May 27, 2020, stating that an update will follow within three months. What do the parties think? 2.1. position that the claimant is not an interested party. Plaintiff's statutory objectives are too general to also represent the interest of protecting personal data or privacy of third parties in administrative proceedings. Therefore, Plaintiff cannot submit an application within the meaning of the Awb and Plaintiff cannot claim a penalty under Section 4:17 of the Awb for failing to make a timely decision. 2.2. Plaintiff takes the position that he was wrongly not regarded as an interested party, that he wrongly concluded that the decision period has not been exceeded and that no penalty is owed and that he was wrongly not heard. What are the rules? 3.1. Article 1:2 of the General Administrative Law Act (Awb), insofar as relevant here, reads as follows: 1. An interested party is understood to mean: the person whose interest is directly involved in a decision.(…)3. With regard to legal persons, their interests are also considered to be the general and collective interests that they particularly promote by virtue of their objectives and according to their actual activities. What is the judge's opinion? Interested party 4.1. According to settled case law of the highest administrative court1 for the question whether a legal person is an interested party as referred to in Article 1:2, third paragraph, of the Awb, the determining factor is whether the legal person, pursuant to its statutory objective and according to its actual activities, has a general or collective interest in the special care. With Article 1:2, third paragraph, of the Awb, the legislator has, according to the drafting history2, wanted to ensure that associations or foundations can represent an interested party, provided that they have a general or collective interest that they aim to promote under the articles of association and for which they actually act. is directly involved in the decision. 4.2. Plaintiff, an association with full legal capacity, represents itself, according to Article 3 of its articles of association, as an independent organization, without any connection to any political or philosophical movement or organization, to promote the interests of the consumers in general and of its members in particular, in the Netherlands - and as far as possible and if necessary outside of it - for the purpose. The aim is to achieve a fully-fledged economic and social position of consumers in relation to the creation, distribution and consumption of private and public goods and services. In all this Plaintiff takes into account, among other things, the social consequences in the broad sense of private and collective consumption. 4.3. On appeal Plaintiff has argued that its statutory objectives are functionally limited to a specific target group and do not relate to the interests of every Dutch national. The privacy violations at issue in this case affect the economic position of consumers and lead to negative social consequences for consumers. The privacy interests of consumers are embedded in the statutory objective. These interests are further apparent from her many years of factual work in the field of privacy issues that affect the interests of consumers. Plaintiff conducts its own investigation into compliance with privacy rules by service providers and organizes all kinds of actions in this area. In addition to the action under discussion here against the privacy violation by Google, Plaintiff is currently also pursuing an action against Facebook. Plaintiff provides information about privacy and has launched new initiatives, such as the privacy meter, the privacy counter and the 'Dupe van je Data' reporting point. Finally, Plaintiff also has regular contact with Defendant about privacy issues. Defendant has not disputed the factual activities mentioned and emphasized that Plaintiff is an important discussion partner who does a lot of good work in the field of privacy protection, but believes that it is decisive that Plaintiff's articles of association do not are primarily aimed at the protection of personal data or privacy.4.4. The court considers that according to its statutory objective, the plaintiff defends a general and collective interest and in this context, with the factual activities referred to, focuses in particular on preventing abuses in the field of of consumer privacy. In the opinion of the court, these privacy interests are so intertwined with the public interest in the prevention of such abuses that their protection must be deemed to be part of the statutory objectives of the plaintiff. Now that, in the opinion of the court, this public interest is directly involved in a decision to be taken by the respondent on the claimant's request to take enforcement action against Google, the respondent has wrongly taken the position that the claimant is not an interested party in a decision. to the enforcement request.34.5. For this reason alone, the appeal is well-founded and the decision must be quashed. In addition, the Court finds that Plaintiff was wrongly not heard in the objection now that the Defendant has for the first time taken a position of principle in the contested decision on the question of whether Plaintiff can be regarded as an interested party. It would have been reasonable to discuss the relevant facts for this decision with the claimant during a hearing. In view of the foregoing, the contested decision is contrary to Articles 1:2 and 7:3 of the Awb. The court will consider below whether it is possible to provide for the case itself. Timeliness of decision 5.1. With regard to the question of whether a decision on the enforcement request was not made in time and whether the defendant owes plaintiff a penalty, the court considers if follows.5.2.The court is of the opinion that, now that the Irish authority has been designated as the leading supervisory authority and has initiated an investigation, the position of the claimant that the defendant – apart from the ongoing investigation – can conduct its own investigation, is outdated.5.3 For the question of within what period the defendant should decide on the enforcement request, the court agrees with the considerations of the Midden-Nederland District Court in the decision of 15 October 20204. It is of decisive importance that the complaint has become part of a large and complex research on cross-border processing of personal data. For these reasons, the defendant cannot arbitrarily determine the scope and time frame of the investigation. Nor can a fixed end date of the decision period be assumed under these circumstances. In addition, the defendant kept the plaintiff regularly informed of the progress of the investigation. Defendant has thus fulfilled its obligations in this regard. This means that there is no question of a late decision on the complaint and that the notice of default was served too early. No fines have therefore been forfeited. Conclusion 6.1. The foregoing leads to the conclusion that the legal consequences of the contested decision, insofar as they relate to the declaration of unfounded objection to the penalty decision, can be maintained. 6.2. Now that the appeal is well-founded, the defendant must pay the costs incurred of the plaintiff on appeal. These costs are set at € 1,496 (1 point for submitting a notice of appeal and 1 point for appearing at a hearing in a case of average weight with a value per point of € 748) on the basis of the Administrative Costs Decree. . The defendant must also reimburse the court fee paid by the claimant.DecisionThe court -declares the appeal well-founded;-annuls the contested decision;-determines that the legal consequences of the contested decision remain in force;-determines that this decision replaces the annulled contested decision; orders the defendant to pay the costs of the plaintiff's proceedings up to an amount of € 1,496; - orders the defendant to reimburse the court fee paid by the plaintiff in the amount of € 354. This decision was made by mr. D. Biever, judge, in the presence of A.J. van Rossum, clerk. The decision was pronounced in public on December 22, 2021. Clerk of the court.Copy sent to the parties at:Legal remedy. An appeal can be lodged against this decision within six weeks of the date on which it was sent to the Administrative Jurisdiction Division of the Council of State. If an appeal has been lodged, a preliminary injunction can be requested from the preliminary relief judge of the appeals court.1 See, for example, the decision of the Administrative Jurisdiction Division of the Council of State (the Division) of 5 October 2016 (ECLI:NL: RVS:2016:2645) 2 Parliamentary Papers II, 1988-1989, 21 221, no. 3 Explanatory Memorandum, pp. 32-353Compare the decision of the Rotterdam District Court of 22 April 2021 (ECLI:NL:RBROT:2021:4926) 4 ECLI:NL:RBMNE:2020:4442
