Rb. Gelderland - AWB-22/4722
From GDPRhub
| Rb. Gelderland - AWB-22/4722 | |
|---|---|
 | |
| Court: | Rb. Gelderland (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 15 GDPR Article 22 GDPR |
| Decided: | 15.08.2023 |
| Published: | 28.09.2023 |
| Parties: | Belastingdienst |
| National Case Number/Name: | AWB-22/4722 |
| European Case Law Identifier: | ECLI:NL:RBGEL:2023:4646 |
| Appeal from: | |
| Appeal to: | Not appealed |
| Original Language(s): | Dutch |
| Original Source: | de Rechtspraak (in Dutch) |
| Initial Contributor: | n/a |
The Gelderland District Court obliged the Dutch Tax Authority to comply with an Article 15 GDPR access request for information held by their Fraud Signalling Provision (FSV). The Court also held that informing a data subject that their information was not used for automated decision-making or profiling was not sufficient for the purposes of Article 15(1)(h) GDPR, and that, in this regard, the data subject has the right to inspect and validate the use of their information.
English Summary
Facts
The data subject is the owner of multiple companies that were subject to several investigations that subsequently led to him losing subsidy grants. The data controller filed a request to access all information related to him and his companies in the Tax Authorities' records to understand why the grant was lost. The data subject specifically inquired about any information on him that was processed by the Tax Authority's Fraud Signalling Provision (FSV) and whether he was being subject to automated decision-making.
The Tax Authority confirmed that the data subject’s personal data was held by the FSV and indicated that the information was not used for automated decision-making or profiling. The Authority denied the data subject access to information held by the FSV because there was an ongoing investigation into the legality of the systems used by the Tax Authority.
Following the rejection, the data subject appealed the decision and requested access to information about him in eight of the Tax Authority's systems, including the FSV. In a decision of 10 January 2022, the Tax Authority rejected the appeal and stated that the request fell outside of the scope of the initial request and that access could not be granted due to the ongoing investigation. The data subject appealed the decision of 10 January 2022 to the Gelderland District Court.
Holding
The Court first evaluated if the controller met the obligation to grant access to data according to Article 15 GDPR. In this instance, the controller is the Minister of Finance, as they are responsible for the oversight of the Dutch Tax Authority.
Given the first request's broad nature, which requested information from FSV and similar systems controlled by the Tax Authority, the Court acknowledged that ongoing investigations into these systems prevented the Authority from providing access to them. However, the Court ruled that the controller was required to confirm whether the data subject's personal data was held in systems used by the Tax Authority.
Next, the Court considered whether the data subject's second request made in their appeal fell within the scope of the first access request and if the controller was obligated to comply with it. The Court held that the first request's broad nature meant that the request regarding the eight specified systems were not an expansion of but a clarification of the original request. The Authority's refusal, based on the ongoing investigations of the FSV and similar systems, was deemed not to be a reasonable basis for refusing the access request.
The Court held that if specific systems could not be accessed, the controller should specifically explain to the data subject why this was, rather than offering a generalised answer. Therefore, the Court concluded that the controller was obligated to meet the data subject's request and that the Authority's grounds for refusal were invalid.
Lastly, the Court assessed whether the data subject had received a sufficient response about the use of his data for automated decision-making or profiling, in line with Article 22 GDPR. Given that the data subject's information was identified in the FSV's systems, he held the right to be informed about the existence of any automated decision-making. The Court argued that simply informing the data subject that his information was not used for automated decision-making or profiling was not sufficient and that, in this regard, the data subject had the right to inspect and validate the use of his information.
As a result, the Court annulled the Tax Authority's decision of 10 January 2022 and instructed the Minister of Finance to issue a new decision regarding the data subject's appeal within six weeks of the Court decision.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
COURT OF GELDERLAND Place of Arnhem Administrative law case number: ARN 22/4722 ruling of the single chamber of in the matter between [plaintiff], from [place of residence], plaintiff (representative: Mr. L.J.M. Stortelder), and the Minister of Finance (representatives: Mr. E.J.P. Nevens and Mr. K. Jarbandhan). Introduction 1. In this ruling, the court assesses the claimant's appeal against the partial rejection of his request for access to his personal data. 1.1. With the contested decision of January 10, 2022 on the plaintiff's objection, the inspector has stuck to that decision. On June 14, 2023, the (deputy) director of the Tax Authorities ratified the contested decision on behalf of the minister. 1.2. The court heard the appeal on June 16, 2023. The following took part: the plaintiff, the plaintiff's representative and the minister's representatives. Assessment by the court 2. The court assesses the partial rejection of the claimant's request for access to his personal data. She does this on the basis of the plaintiff's grounds for appeal. 3. The appeal is well-founded. The minister does not sufficiently comply with the claimant's GDPR request, does not properly justify why the access request was refused in eight systems and that the claimant's personal data have not been used for automated decision-making and/or profiling. The plaintiff's other grounds of appeal fail. Below, the court explains how it reaches this decision and what consequences this decision has. 3.1. The legislation and regulations that are important for the assessment of the appeal can be found in the appendix to this ruling. What is this case about? 4. The claimant has requested access to data registered about him in the Tax Authorities' systems. The request states that the claimant and his companies have been subjected to various inspections on several occasions and that the flow of subsidies has been stopped by government agencies. That is why the claimant wants to know whether his data has been processed in the Fraud Signaling Facility (FSV) and other systems. In response to the request, the minister confirms that the claimant's data appears in FSV, but according to the minister, the claimant's data has not been used for automatic decision-making or profiling. In addition, according to the minister, access to systems comparable to FSV cannot be provided due to an ongoing investigation into systems comparable to FSV. In the objection procedure, the claimant requests to check at least eight specific systems whether his data appears therein. The minister takes the position that this request falls outside this procedure and that it cannot be complied with due to the investigation. Who is the defendant in this case? 5. The Minister of Finance is the controller of the Tax Authorities and must respond to a GDPR request.1 5.1. The decision on the claimant's GDPR request was made on behalf of the Minister of Finance. The contested decision was taken on behalf of the inspector, while the Minister of Finance is authorized to make that decision. The contested decision was therefore taken on behalf of an unauthorized administrative body. 5.2. In the appeal procedure, the decision on the objection was confirmed by the (deputy) director of the Tax Authorities who is authorized to make the decision on behalf of the Minister of Finance.2 The court therefore attaches no consequences to the lack of jurisdiction. The Minister of Finance is the defendant in this case and the court was able to hear the case with the parties at a hearing. Should the court attach consequences to late submission of the defense statement? 6. The plaintiff states that the minister submitted his defense too late and requests the court to take action. 6.1. According to the minister, the defense was submitted on time. 6.2. This ground of appeal fails. The plaintiff rightly argues that the defense was submitted outside the period for submitting the defense3 and therefore too late. However, according to settled case law of the Administrative Jurisdiction Division of the Council of State (the Division), this is a procedural period,4 meaning that no consequences are attached to exceeding this period. In addition, the defense was not submitted so late that due process was violated. The statement of defense was submitted eleven days before the hearing, the scope of the statement of defense is limited and the content of the statement of defense is in line with the previously submitted procedural documents. The claimant has therefore had sufficient opportunity to respond to the statement of defence. The court therefore attaches no consequences to late submission of the defense statement. Does the minister comply with the GDPR request? 7. The claimant states that the minister has not complied with his GDPR request. To this end, the plaintiff argues that he formulated his request broadly. At the hearing, the plaintiff argued that in any case a search must be made for the most useful applications within the Tax Authorities. 7.1. The minister takes the position that the plaintiff's GDPR request only relates to personal data processed in FSV and FSV comparable systems. The minister only looked at FSV. According to the minister, the plaintiff's GDPR request is not specific enough to look at all systems and the minister further argues that this is not possible. 7.2. This ground of appeal succeeds. The court notes that the claimant's request for access states that he requests access to data registered about him in systems of the Tax Authorities. It is stated that he in any case wishes to inspect his data in FSV, in other systems of the Tax Authorities comparable to FSV and also in other systems or lists that exist. The request is therefore formulated in general terms and includes more than access to FSV and other systems comparable to FSV. In that case, the minister can be expected to at least try to find out whether the claimant's data has been processed in applications and other systems. In addition, the minister stated at the hearing that in other cases the most common systems had been searched. Yet, despite the plaintiff's broadly formulated request, the search was only conducted in FSV and not in other systems and applications. Therefore, the minister has not fully decided on the claimant's GDPR request. Should the minister decide not to comply with the request for access to systems comparable to FSV? 8. The claimant states that his request for access to his personal data in systems comparable to FSV has not been met. According to the claimant, it cannot be held against him that an investigation is still ongoing and that it is an extensive job to map applications. According to the claimant, the external investigation is advice within the meaning of section 3.3. of the General Administrative Law Act (AWB). If advice is not issued in a timely manner, the absence thereof does not prevent a decision from being taken.5 8.1. The minister takes the position that the investigation into systems comparable to FSV has not been completed, as a result of which the request for access to those systems cannot be met. After it was determined in February 2020 that FSV did not comply with the GDPR, this facility was disabled. A follow-up study has been started into systems comparable to FSV, which is being carried out by an independent external party. It is an extensive job to map out whether such systems exist. This concerns 600 primary processes and 800 applications. The plan for the investigation was sent to the House of Representatives in October 2020. The investigation is expected to take at least three years and, according to the minister, the outcome of the investigation cannot be anticipated. Until the investigation is completed, it is unknown whether systems comparable to FSV are used within the Tax Authorities and which systems they would be. According to the minister, it would also be contrary to due care to answer the question whether the claimant appears in systems comparable to FSV if the minister does not have access to this information. 8.2. This ground of appeal fails. The court explains that judgment below under 8.2.1 to 8.2.4. 8.2.1. Even though the investigation had not yet been completed at the time of the contested decision, a decision was made. This decision means that the request for access to systems comparable to FSV cannot be met. The fact that the investigation has not yet been completed did not prevent a decision being made. 8.2.2. The minister was also allowed to take the position that at the time of the contested decision he could not provide a definitive answer as to whether the claimant appears in systems that are comparable to FSV. The investigation into those systems was still ongoing at the time the contested decision was taken. It was therefore still unclear at that time whether the plaintiff appears in such systems and, if so, which systems they are. 8.2.3. The court also notes that the minister has promised that once the investigation has been completed, a further decision will be taken ex officio on the request for access to systems comparable to FSV. The court notes that this has now happened.6 The plaintiff can invoke legal remedies against that new decision. 8.2.4. The court is therefore of the opinion that the minister was entitled to reject the plaintiff's request for access to his personal data in systems comparable to FSV at the time of the contested decision because of the ongoing investigation. Is there proper justification for why the access request was refused in eight systems? 9. The claimant states that KPMG has already conducted research into various information facilities within the Tax Authorities. According to the plaintiff, it has become known that certain applications and information facilities have led to findings and the Tax Authorities' own research has shown that the Auto Database application has also led to findings. The claimant therefore wants to inspect the data that has been registered about him in the following applications and facilities: 1) Internal and external signals for the SME supervision process 2) Risk Qualifications Allowances 3) Processing fraud signals Allowances 4) Approach to the Repeat Offender Team 5) Declaration of OB identification number 6) Data Foundation Fraud Risk Indicators (FRI) 7) OB Carousel Fraud 8) Database Auto. 9.1. The minister takes the position that the claimant only specifies his request in his notice of appeal and that that part of the request therefore falls outside this procedure. In addition, according to the minister, the request with regard to the eight applications and systems mentioned by the plaintiff cannot be carried out until the investigation has been completed. At the hearing, the minister announced that the Car Database and Internal and external signals for the SME supervision process are locked, that research into the Multiple Offenders Approach Team is still being investigated and that some of the eight systems are not applications and facilities. 9.2. This ground of appeal succeeds. The court first states that the plaintiff already mentioned the eight systems in the motivation of his objection of April 26, 2021 and that the minister did not respond to this in the contested decision. As discussed in 7.2, the claimant has also formulated his GDPR request broadly. There is no question of a change or extension of his request. The eight systems that the plaintiff specifically mentions in the objection and appeal are therefore also part of the access request that relates to the Tax Authorities' systems. The fact that an investigation is underway into systems comparable to FSV is insufficient without further justification to exclude the eight systems mentioned by the plaintiff from a search. The contested decision does not show why an attempt was not made to search the eight systems or why that search cannot be made. The minister's unsubstantiated comment at the hearing that a number of the systems are locked and some are not applications and facilities is insufficient to conclude that the claimant's request for access to the eight systems that he has cannot be met. named. The minister therefore does not provide proper reasons for refusing the request for access to the eight systems mentioned by the plaintiff. Have the personal data been used for automated decision-making and/or profiling? 10. Due to various investigations that have taken place at him and his companies and due to compulsory collection and subsidy flows that have been halted, the claimant suspects that his personal data have been used for automated decision-making or profiling. He states that the minister has not sufficiently substantiated that the FSV was not used for automated decision-making and/or profiling. His personal data appear in FSV. The mere substantiation that, given the reason and content of the registration in FSV, there is no reason to assume that this is the case, is insufficient, according to the claimant. 10.1. The minister takes the position that following the request for access to FSV, the claimant was informed that his name and citizen service number appear in this application and that no other personal data have been recorded. The registration was related to an information request from the UWV and the data was included in FSV on November 18, 2019. Given the content and reason for registration in FSV, the minister has no reason to assume that the personal data have been used in the context of automated decision-making or profiling. According to the minister, the GDPR does not oblige him to provide evidence that in a certain situation no personal data is processed in the context of automated decision-making or profiling. At the hearing, the minister indicated that FSV is a registration system that was used as an information system. Assessment framework 10.2. Under the GDPR, the claimant has the right to obtain confirmation from the controller as to whether or not his personal data is being processed and, if that is the case, to inspect those personal data and, among other things, the following information: - the processing purposes and - the existence of automated decision-making and profiling, and, at least in those cases, useful information about the underlying logic, as well as the significance and expected consequences of such processing for the data subject.7 Judgment of the court 10.3. This ground of appeal succeeds. The minister does not properly justify that the personal data have not been used in the context of automated decision-making or profiling. Personal data of the claimant have been found in FSV. Therefore, the claimant has the right to inspect the existence of automated decision-making and profiling. The minister has not provided this insight. The fact that FSV is a registration system and, given the content and reason for the registration in FSV, there would be no reason to assume that there is automated decision-making or profiling is insufficient. This does not exclude the existence of automated decision-making and profiling, nor whether the plaintiff's personal data found have been processed for automated decision-making or profiling. It is also not clear why, given the content and reason for the registration in FSV, there would be no reason to assume that there is automated decision-making or profiling. Should the minister have given access to the claimant's tax file and the RIEC8 documents? 11. The claimant requests access to his entire file. At the hearing, the plaintiff argued that he wanted to inspect the tax file and the RIEC documents. 11.1. The minister takes the position that a GDPR request relates to personal data and not to the request of complete files. According to the minister, the documents that had to be provided to the plaintiff in response to the GDPR request have also been provided to him. Assessment framework 11.2. The controller provides the data subject with a copy of the personal data that are being processed.9 The Department has considered that the purpose of Article 15 of the GDPR is to enable the data subject to become aware of the processing and to check its lawfulness.10 The Department has further considered that the obligation to provide 'a copy of the personal data' under Article 15(3) of the GDPR does not mean that an administrative body is obliged to provide a copy of the documents in which those personal data appear. An administrative body may do this, but it may also choose a different form in which the copy of the personal data is provided, as long as the chosen method of provision meets the purpose of Article 15(3) of the GDPR.11 Judgment of the court 11.3. This ground of appeal fails. In the primary decision, the minister informed the claimant that his name and citizen service number have been processed in FSV and provided a general explanation about the data processing by the Tax Authorities. The contested decision states that FSV indicates that the plaintiff's registration was related to an information request from the UWV and the date of inclusion in FSV is November 18, 2019. The court is of the opinion that the minister has thus fulfilled the purpose of Article 15(3) of the GDPR with regard to the FSV. The claimant has been able to inform himself of the processing of his personal data and its legality. The minister should therefore not have provided access to the tax file and/or the RIEC documents in response to the GDPR request and the search in FSV. Did the minister have to promise that the personal data will be deleted? 12. The claimant wants a commitment that his personal data will be deleted. 12.1. The minister takes the position that the claimant can submit a separate request to delete his personal data. 12.2. This ground of appeal fails. The request for a commitment that the plaintiff's personal data will be deleted does not fall within the scope of the plaintiff's GDPR request. As the minister rightly noted, the claimant can submit a separate request to the Tax Authorities if he wishes his personal data to be deleted. Has the reasonable period been exceeded? 13. The claimant argues that the reasonable period has been exceeded. 13.1. The question of whether the reasonable period12 has been exceeded must be assessed based on the circumstances of the case. The handling of a case such as this may take a maximum of two years from the date on which the notice of objection was submitted. If the reasonable period has been exceeded, the starting point for compensation is a rate of €500 per six months by which that period has been exceeded. 13.2. The main rule is that the objection phase may take six months and the appeal phase one and a half years. The court notes that two years and more than five months have passed from the plaintiff's notice of objection on March 5, 2021 to this ruling. The procedure therefore took more than five months too long and there is no reason to justify this long duration. The plaintiff is therefore entitled to compensation of €500. 13.3. The objection procedure took longer than 6 months and the court proceedings remained within a period of one and a half years. The exceeding of the deadline can therefore be attributed to the minister. The court will therefore order the minister to pay €500 in damages for exceeding the reasonable period. Conclusion and consequences 14. The appeal is well-founded because the contested decision is contrary to Article 3:2 and Article 7:12, first paragraph, of the General Administrative Law Act. This means that the plaintiff is partially right. The court therefore annuls the contested decision. 14.1. Given the nature and extent of the defects, the court sees no reason to resolve the matter itself or to apply an administrative loop. The minister must conduct an investigation into the systems and applications and provide proper reasons for the new decision. Insofar as it concerns systems and applications that fall within the scope of the now completed investigation into applications and systems comparable to FSV, the minister is free to attach a copy of the decision of June 9, 2023 and refer to it. The minister will therefore have to make a new decision taking this ruling into account. The court sets a period of six weeks for this. 14.2. Because the appeal is well-founded, the minister must reimburse the plaintiff for the court fee of € 184 and the plaintiff will also receive compensation for his legal costs in the appeal phase. The minister must pay this compensation. This compensation amounts to € 1,674 because the claimant's representative submitted a notice of appeal and participated in the hearing. Furthermore, no costs were incurred that could be reimbursed. The plaintiff has requested reimbursement of his legal costs in the objection phase. Because the contested decision is annulled, but the minister must make a new decision on the objection, the primary decision of February 1, 2021 will not be revoked. Therefore, the conditions of Article 7:15, second paragraph, of the General Administrative Law Act for reimbursement of legal costs in the objection phase are not met. Decision The court: - declares the appeal well-founded; - annuls the decision of January 10, 2022; - instructs the minister to do this within six weeks after the day of sending this decision to make a new decision on the plaintiff's objection, taking this into account pronunciation; - orders the minister to pay € 1,674 in legal costs; - determines that the minister must reimburse the plaintiff for the court fee of € 184; - orders the minister to pay compensation to the plaintiff up to an amount of €500. This statement was made by Mr. A.T.G. van Wandelen, judge, in the presence of E.J. Iflé, clerk. The verdict was delivered in public on: clerk right A copy of this ruling has been sent to the parties on: Information about appeal A party that does not agree with this ruling can send an appeal to the Administrative Jurisdiction Division of the Council of State explaining why this party does not agree with this ruling. The appeal must be submitted within six weeks of the day on which this decision was sent. If the petitioner cannot await the hearing of the appeal because the case is urgent, the petitioner can ask the preliminary relief judge of the Administrative Jurisdiction Division of the Council of State to take a provisional measure (a temporary measure). Appendix: important legislation and regulations for this ruling General Administrative Law Act Article 3:5: In this section, advisor is defined as: a person or board, charged by or pursuant to legal regulations with advising on decisions to be taken by an administrative body and not working under the responsibility of that administrative body. Regulation (EU) 2016/679 (GDPR): Article 12: Transparent information, communication and further rules for the exercise of the rights of the data subject 1. The controller shall take appropriate measures to ensure that the data subject receives the information referred to in Articles 13 and 14 and the communications referred to in Articles 15 to 22 and Article 34 in relation to the processing in a concise, transparent, intelligible and easily accessible form and in clear and simple language, especially when the information is specifically intended for a child. The information shall be provided in writing or by other means, including, where appropriate, electronic means. If the data subject so requests, the information may be communicated orally, provided that the identity of the data subject is proven by other means. 2. The controller shall facilitate the exercise of the data subject's rights under Articles 15 to 22. In the cases referred to in Article 11(2), the controller shall not refuse to comply with the data subject's request for exercise his rights under Articles 15 to 22, unless the controller demonstrates that he is unable to identify the data subject. 3. The controller shall provide the data subject with information on the action taken on the request without undue delay and in any case within one month of receipt of the request pursuant to Articles 15 to 22. Depending on the complexity of the requests and the number of requests, that period may be extended by a further two months if necessary. The controller shall inform the data subject of such an extension within one month of receipt of the request. When the data subject submits his request electronically, the information will be provided electronically if possible, unless the data subject requests otherwise. 4. If the controller does not respond to the data subject's request, he shall, without undue delay and at the latest within one month of receipt of the request, inform the data subject as to why the request was unsuccessful and inform him of the possibility of lodging a complaint. must lodge an appeal with a supervisory authority before the court. 5. The provision of the information referred to in Articles 13 and 14, and the communication and taking of the measures referred to in Articles 15 to 22 and Article 34 shall be free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular due to their repetitive nature, the controller may either: a. a) charge a reasonable fee in view of the administrative costs associated with providing the requested information or communication and taking the requested measures; either b) refuse to comply with the request. It is up to the controller to demonstrate the manifestly unfounded or excessive nature of the request. 6. Without prejudice to Article 11, where the controller has reason to doubt the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request additional information necessary to confirm the identity of the data subject. 7. The information to be provided to data subjects under Articles 13 and 14 may be provided using standardized icons to provide the data subject with a useful overview, in a clearly visible, intelligible and clearly legible form, of the intended processing. When the icons are displayed electronically, they are machine readable. 8. The Commission is empowered to adopt delegated acts in accordance with Article 92 to determine what information the icons should display and the procedures by which the standardized icons should be established. Article 15: Right of access of the data subject 1. The data subject has the right to obtain from the controller information as to whether or not personal data concerning him or her are being processed and, where that is the case, to have access to those personal data and to the following information: a. a) the processing purposes; b) the categories of personal data concerned; c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations; d) where possible, the period for which the personal data are expected to be stored, or, if that is not possible, the criteria for determining that period; e) the data subject has the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning him or her, as well as to object to such processing; f) that the data subject has the right to lodge a complaint with a supervisory authority; g) where the personal data is not collected from the data subject, all available information about the source of that data; (h) the existence of automated decision-making, including profiling referred to in Article 22(1) and (4), and, at least in those cases, meaningful information about the logic underlying it, as well as the significance and envisaged consequences of such processing for the person concerned. 2. Where personal data are transferred to a third country or to an international organization, the data subject has the right to be informed of the appropriate safeguards in accordance with Article 46 on transfers. 3. The controller shall provide the data subject with a copy of the personal data being processed. If the data subject requests additional copies, the controller may charge a reasonable fee based on administrative costs. Where the data subject submits his request electronically and does not request any other arrangement, the information shall be provided in a commonly used electronic format. 4. The right to obtain a copy referred to in paragraph 3 shall not affect the rights and freedoms of others. European Convention for the Protection of Human Rights and Fundamental Freedoms Article 8: 1. Everyone has the right to respect for his private and family life, his home and his correspondence. 2. No interference by any public authority shall be permitted in the exercise of this right, other than to the extent provided by law and necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country , the prevention of disorder and criminal offences, the protection of health or morals or for the protection of the rights and freedoms of others.
