Rb. Den Haag - AWB - 22 5012: Difference between revisions
No edit summary |
No edit summary |
||
| Line 64: | Line 64: | ||
}} | }} | ||
The Dutch District Court of Den Haag rejected two claims of immaterial damage to the data subject against both the Dutch Tax Authority, ''de belastingdienst,'' and the Dutch DPA. Among others complaints, the data subject complained that the Tax Authority had provided information to the DPA regarding his ongoing procedures at the Tax Authority. | |||
The Dutch District Court of Den Haag rejected two immaterial damage | |||
== English Summary == | == English Summary == | ||
=== Facts === | === Facts === | ||
On 17 May 2020, the data subject exercised his right of access ([[Article 15 GDPR]]) | On 17 May 2020, the data subject exercised his right of access ([[Article 15 GDPR]]) at the Dutch Tax Authority, ''de belastingdienst'' (controller). | ||
On 17 June 2020, the data subject filed a complaint at the Dutch DPA, because the controller had refused to sent him his file (''original complaint).'' | On 17 June 2020, the data subject filed a complaint at the Dutch DPA, because the controller had refused to sent him his file in response to the access request. (''original complaint).'' | ||
On 25 March 2021, the DPA rejected the complaint of the data subject. | On 25 March 2021, the DPA rejected the complaint of the data subject. | ||
On 2 November 2021, the data subject appealed the decision of the DPA (in Dutch: ''bezwaar'') | On 2 November 2021, the data subject appealed the decision of the DPA rejecting his initial complaint (in Dutch: ''bezwaar''). Therefore, the DPA had to look at the initial complaint again. | ||
On 2 June 2022, the controller | On 2 June 2022, the controller made a decision regarding the data subject's access request. It is not clear from this ruling what the controller decided. | ||
On 11 July 2022, after assessing the original complaint again, the DPA upheld the complaint of the data subject en warned the controller for not answering the access request within the time limit, in violation of [[Article 12 GDPR#3|Article 12(3) GDPR]]. The data subject, appealed this decision to the court (in Dutch: ''Beroep''). | On 11 July 2022, after assessing the original complaint again, the DPA upheld the complaint of the data subject en warned the controller for not answering the access request within the time limit, in violation of [[Article 12 GDPR#3|Article 12(3) GDPR]]. The data subject, appealed this decision to the court (in Dutch: ''Beroep''). | ||
On | On ...., the DPA asked the controller for information regarding ongoing procedures with the data subject. The controller answered and provided information about ongoing financial procedures with the data subject. In this answer, the DPA clarified to the controller that any information about fiscal procedures between the data subject and the controller was not relevant for its assessment of a potential GDPR violation. It had only requested information that was relevant for its GDPR assessment for a potential violation of [[Article 5 GDPR]]. The data subject became aware of this exchange between the controller and the DPA. On 18 October 2022, the data subject filed <u>another</u> complaint at the DPA against the controller because it had provided this information to the DPA. | ||
On an unspecified data, the data subject went to court against both the controller and the DPA. | On an unspecified data, the data subject went to court against both the controller and the DPA. He filed a claim against both the controller and the tax authority. | ||
<u>Regarding his claim against the controller</u>, the data subject | <u>Regarding his claim against the controller</u>, the data subject stated that the controller never informed him about its decision of 2 June 2022 regarding the access request. For this, the data subject claimed a compensation of €25,000. | ||
<u>Regarding his claim against the DPA</u>, he stated that the DPA did not properly execute its tasks (in Dutch: ''Onbehoorlijk bestuur).'' The data subject requested €25,000 | <u>Regarding his claim against the DPA</u>, he stated that the DPA did not properly execute its tasks (in Dutch: ''Onbehoorlijk bestuur).'' The data subject requested €25,000 for immaterial damages. The data subject also stated that the DPA violated Article 6 ECHR for the lack of a hearing within a reasonable time. | ||
=== Holding === | === Holding === | ||
''First'', the court determined that it did not have the authority to assess the decision of the controller. The court was only competent to assess the decision of the DPA. Therefore, the court did not have the authority to order the controller to | ''First'', the court determined that it did not have the authority to assess the decision of the controller regarding the access request. The court was only competent to assess the decision of the DPA. Therefore, the court also did not have the authority to order the controller to provide financial compensation for the data subject. | ||
'' | ''Second,'' the court assessed the data subject's claims against the DPA for immaterial damages. The court rejected this claim for several reasons. Among other reasons, the data subject had not explained what the claimed immaterial damage exactly entailed. | ||
''Third,'' regarding the claim about the reasonable time (Article 6 ECHR), the court determined that a term of 2 years was reasonable in this case, where two public institutions were involved in the procedure. To determine if a reasonable term has been violated, the following circumstances of the case needed to be assessed according to the court: the complexity of the case, the manner in which the complaint was handled by the administrative body and the court, the procedural conduct of the data subject throughout the proceedings and the nature of the measure and the interest of the data subject. However, the court merely determined that the procedure had not exceeded two years, which seems to be the only circumstance which was assessed by the court to reject the data subject's claim on this point. | |||
'' | ''Fourth,'' regarding the information provided by the controller to the DPA about any procedures between the controller and the data subject, the court determined that the controller did not violate the GDPR. The court did not provide an explanation/ motivation for this conclusion. | ||
In conclusion, the court refused all the claims of the data subject. | In conclusion, the court refused all the claims of the data subject. | ||
Revision as of 18:10, 16 May 2023
| Rb. Den Haag - AWB - 22 _ 5012 | |
|---|---|
 | |
| Court: | Rb. Den Haag (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 5 GDPR Article 15 GDPR |
| Decided: | 26.04.2023 |
| Published: | 10.05.2023 |
| Parties: | Authoriteit Persoonsgegevens |
| National Case Number/Name: | AWB - 22 _ 5012 |
| European Case Law Identifier: | ECLI:NL:RBDHA:2023:5636 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Dutch |
| Original Source: | De rechtspraak (in Dutch) |
| Initial Contributor: | kv33 |
The Dutch District Court of Den Haag rejected two claims of immaterial damage to the data subject against both the Dutch Tax Authority, de belastingdienst, and the Dutch DPA. Among others complaints, the data subject complained that the Tax Authority had provided information to the DPA regarding his ongoing procedures at the Tax Authority.
English Summary
Facts
On 17 May 2020, the data subject exercised his right of access (Article 15 GDPR) at the Dutch Tax Authority, de belastingdienst (controller).
On 17 June 2020, the data subject filed a complaint at the Dutch DPA, because the controller had refused to sent him his file in response to the access request. (original complaint).
On 25 March 2021, the DPA rejected the complaint of the data subject.
On 2 November 2021, the data subject appealed the decision of the DPA rejecting his initial complaint (in Dutch: bezwaar). Therefore, the DPA had to look at the initial complaint again.
On 2 June 2022, the controller made a decision regarding the data subject's access request. It is not clear from this ruling what the controller decided.
On 11 July 2022, after assessing the original complaint again, the DPA upheld the complaint of the data subject en warned the controller for not answering the access request within the time limit, in violation of Article 12(3) GDPR. The data subject, appealed this decision to the court (in Dutch: Beroep).
On ...., the DPA asked the controller for information regarding ongoing procedures with the data subject. The controller answered and provided information about ongoing financial procedures with the data subject. In this answer, the DPA clarified to the controller that any information about fiscal procedures between the data subject and the controller was not relevant for its assessment of a potential GDPR violation. It had only requested information that was relevant for its GDPR assessment for a potential violation of Article 5 GDPR. The data subject became aware of this exchange between the controller and the DPA. On 18 October 2022, the data subject filed another complaint at the DPA against the controller because it had provided this information to the DPA.
On an unspecified data, the data subject went to court against both the controller and the DPA. He filed a claim against both the controller and the tax authority.
Regarding his claim against the controller, the data subject stated that the controller never informed him about its decision of 2 June 2022 regarding the access request. For this, the data subject claimed a compensation of €25,000.
Regarding his claim against the DPA, he stated that the DPA did not properly execute its tasks (in Dutch: Onbehoorlijk bestuur). The data subject requested €25,000 for immaterial damages. The data subject also stated that the DPA violated Article 6 ECHR for the lack of a hearing within a reasonable time.
Holding
First, the court determined that it did not have the authority to assess the decision of the controller regarding the access request. The court was only competent to assess the decision of the DPA. Therefore, the court also did not have the authority to order the controller to provide financial compensation for the data subject.
Second, the court assessed the data subject's claims against the DPA for immaterial damages. The court rejected this claim for several reasons. Among other reasons, the data subject had not explained what the claimed immaterial damage exactly entailed.
Third, regarding the claim about the reasonable time (Article 6 ECHR), the court determined that a term of 2 years was reasonable in this case, where two public institutions were involved in the procedure. To determine if a reasonable term has been violated, the following circumstances of the case needed to be assessed according to the court: the complexity of the case, the manner in which the complaint was handled by the administrative body and the court, the procedural conduct of the data subject throughout the proceedings and the nature of the measure and the interest of the data subject. However, the court merely determined that the procedure had not exceeded two years, which seems to be the only circumstance which was assessed by the court to reject the data subject's claim on this point.
Fourth, regarding the information provided by the controller to the DPA about any procedures between the controller and the data subject, the court determined that the controller did not violate the GDPR. The court did not provide an explanation/ motivation for this conclusion.
In conclusion, the court refused all the claims of the data subject.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
