Rb. Den Haag - AWB - 22 5012: Difference between revisions

Revision as of 21:39, 16 May 2023

Rb. Den Haag - AWB - 22 _ 5012

Court:	Rb. Den Haag (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:	Article 5 GDPR Article 15 GDPR
Decided:	26.04.2023
Published:	10.05.2023
Parties:	Authoriteit Persoonsgegevens
National Case Number/Name:	AWB - 22 _ 5012
European Case Law Identifier:	ECLI:NL:RBDHA:2023:5636
Appeal from:
Appeal to:
Original Language(s):	Dutch
Original Source:	De rechtspraak (in Dutch)
Initial Contributor:	kv33

The Dutch District Court of Den Haag rejected two claims of immaterial damage to the data subject against both the Dutch Tax Authority, de belastingdienst, and the Dutch DPA. Among others complaints, the data subject complained that the Tax Authority had provided information to the DPA regarding his ongoing procedures at the Tax Authority.

English Summary

Facts

On 17 May 2020, the data subject exercised his right of access (Article 15 GDPR) at the Dutch Tax Authority, de belastingdienst (controller).

On 17 June 2020, the data subject filed a complaint at the Dutch DPA, because the controller had refused to provide access to relevant files.

On 25 March 2021, the DPA rejected the complaint of the data subject. The reason for the rejection was not specified in this ruling.

On 2 November 2021, the data subject appealed the decision of the DPA rejecting his initial complaint. According to Dutch administrative law, the DPA itself had to assess this appeal (in Dutch: bezwaar). On 3 May 2022, the DPA asked the controller information regarding the data subject to assess this appeal. The controller replied on the same day and provided details about ongoing financial procedures between the controller and the data subject.

On 2 June 2022, the controller made a decision regarding the data subject's access request. It is not clear from this ruling if the controller provided access and if so, in what from.

On 11 July 2022, the DPA agreed with the appeal of the data subject en warned the controller for not answering the access request within the time limit, in violation of Article 12(3) GDPR. The data subject, who was apparently not satisfied, appealed this decision to the court (in Dutch: Beroep).

On 18 October 2022, the data subject filed another complaint at the DPA against the controller because it provided information to the DPA on 3 May 2022.

In his appeal at the court (beroep), the data subject filed claims against both the controller and the tax authority.

Regarding his claim against the controller, the data subject stated that the controller never informed him about its decision of 2 June 2022 regarding the access request. The data subject claimed a compensation of €25,000.

Regarding his claim against the DPA, he stated that the DPA did not properly execute its tasks (in Dutch: Onbehoorlijk bestuur). The data subject did not specify this claim. For this, the data subject requested €25,000 for immaterial damages. The data subject also stated that the DPA violated Article 6 ECHR for the lack of a hearing within a reasonable time. This claim also remained unsubstantiated.

Holding

First, the court assessed the claim against the controller. The court determined that it did not have the authority to assess the decision of the controller regarding the access request. Therefore, the court also did not have the authority to order the controller to provide financial compensation for the data subject.

Second, the court assessed the data subject's claim against the DPA for immaterial damages. The court rejected this claim for several reasons. Among other reasons, the data subject had not explained what the claimed immaterial damage exactly entailed. Also, the data subject had already received some financial compensation, established in Dutch law, because the DPA had not responded in time. Additional compensation was deemed unnecessary by the court.

Third, regarding the claim against the DPA about the reasonable time (Article 6 ECHR), the court determined that a term of 2 years was reasonable in this case, where two public institutions were involved in the procedure. In this case, the court determined that the two-year period had started on 2 November 2021, the date of the first appeal (bezwaar).

To determine if a reasonable term had been violated, the following circumstances of the case needed to be assessed according to the court: the complexity of the case, the manner in which the complaint was handled by the administrative body and the court, the procedural conduct of the data subject throughout the proceedings and the nature of the measure and the interest of the data subject. However, the court merely determined that the procedure had not exceeded two years, which seems to be the only circumstance which was assessed by the court to reject the data subject's claim.

Fourth, regarding the information provided by the controller to the DPA about any procedures between the controller and the data subject, the court determined that the GDPR had not been breached. The DPA was allowed to ask questions to the controller. The court did not provide an explanation/ motivation for this conclusion that the GDPR had not been breached.

In conclusion, the court refused all the claims of the data subject.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

@@ Line 96: / Line 96: @@
 ''Third,'' regarding the claim against the DPA about the reasonable time (Article 6 ECHR), the court determined that a term of 2 years was reasonable in this case, where two public institutions were involved in the procedure. In this case, the court determined that the two-year period had started on 2 November 2021, the date of the first appeal (''bezwaar'').
-To determine if a reasonable term has been violated, the following circumstances of the case needed to be assessed according to the court: the complexity of the case, the manner in which the complaint was handled by the administrative body and the court, the procedural conduct of the data subject throughout the proceedings and the nature of the measure and the interest of the data subject. However, the court merely determined that the procedure had not exceeded two years, which seems to be the only circumstance which was assessed by the court to reject the data subject's claim.
+To determine if a reasonable term had been violated, the following circumstances of the case needed to be assessed according to the court: the complexity of the case, the manner in which the complaint was handled by the administrative body and the court, the procedural conduct of the data subject throughout the proceedings and the nature of the measure and the interest of the data subject. However, the court merely determined that the procedure had not exceeded two years, which seems to be the only circumstance which was assessed by the court to reject the data subject's claim.
 ''Fourth,'' regarding the information provided by the controller to the DPA about any procedures between the controller and the data subject, the court determined that the GDPR had not been breached. The DPA was allowed to ask questions to the controller. The court did not provide an explanation/ motivation for this conclusion that the GDPR had not been breached.