Difference between revisions of "Rb. Gelderland - AWB 19/2901"

From GDPRhub
Line 12: Line 12:
 
[[Article 6 GDPR#1b|Article 6(1)(b) GDPR]] [[Category:Article 6(1)(b) GDPR]]
 
[[Article 6 GDPR#1b|Article 6(1)(b) GDPR]] [[Category:Article 6(1)(b) GDPR]]
  
[[Article 5 GDPR#r39|Recital 39 GDPR]] [[Category:Recital 39 GDPR]]
+
[[Article 5 GDPR#r39|Recital 39 GDPR]]  
 
|-
 
|-
 
|Decided:||4. 2. 2020
 
|Decided:||4. 2. 2020
Line 33: Line 33:
 
|}
 
|}
  
.............
+
The Gelderland Court of First Instance confirmed that the measure according to which passengers can purchase tickets on the buses only by means of credit/ debit cards is compatible with the principles of necessity and proportionality and the subsequent processing of personal data is necessary for the performance of this purchase contract. Therefore, the processing is compatible with the GDPR.  
  
 
==English Summary==
 
==English Summary==
Line 39: Line 39:
 
In the Netherlands, as of 1 July 2018 a passenger who wishes to purchase a ticket on the bus from the bus driver can only pay for this ticket with a debit or credit card and no longer with cash. The plaintiff requested the Dutch DPA to investigate the obligation to pay with a debit or credit card and the abolition of cash payments on the bus and to take an enforcement action against this measure under the GDPR. The DPA rejected the request and the plaintiff appealed its decision. He also asked the Court to suspend the present judgement until the CJEU issues a judgement on the preliminary questions which the Constitutional Court of Belgium referred with its judgement no. 135/2019 on the processing of passenger data. The DPA argued that the legal basis for the processing of PIN and credit card details when purchasing a ticket from a bus driver is [[Article 6 GDPR#1b|Article 6(1)(b) GDPR]].     
 
In the Netherlands, as of 1 July 2018 a passenger who wishes to purchase a ticket on the bus from the bus driver can only pay for this ticket with a debit or credit card and no longer with cash. The plaintiff requested the Dutch DPA to investigate the obligation to pay with a debit or credit card and the abolition of cash payments on the bus and to take an enforcement action against this measure under the GDPR. The DPA rejected the request and the plaintiff appealed its decision. He also asked the Court to suspend the present judgement until the CJEU issues a judgement on the preliminary questions which the Constitutional Court of Belgium referred with its judgement no. 135/2019 on the processing of passenger data. The DPA argued that the legal basis for the processing of PIN and credit card details when purchasing a ticket from a bus driver is [[Article 6 GDPR#1b|Article 6(1)(b) GDPR]].     
 
   
 
   
 +
===Dispute===
 +
The Court had to assess whether the Dutch DPA has been able to conclude that the third party did not violate the GDPR and subsequently whether it did not have to take an enforcement action indeed. To this end, the Court had to assess whether [[Article 6 GDPR|Article 6 GDPR]] provides a legal basis for processing credit cards details and whether the processing is compliant with [[Article 5 GDPR|Article 5 GDPR]]. It also had to examine whether the criteria of necessity and proportionality had been met in this case.   
 +
 
===Holding===
 
===Holding===
The Court had to assess whether the Dutch DPA has been able to conclude that the third party did not violate the GDPR and subsequently whether it did not have to take an enforcement action indeed. To this end, the Court had to assess whether [[Article 6 GDPR|Article 6 GDPR]] provides a legal basis for processing
+
The Court found that the legal basis of [[Article 6 GDPR#1b|Article 6(1)(b) GDPR]] is valid, hence there was no reason to further examine possible application of other legal grounds. Moreover, the Dutch DPA could reasonably consider the purpose of abolishing cash, since this measure was included in the action programme "Social Security in Public Transport" and aimed at the prevention of theft and robbery. For this purpose, the only plausible option for all third parties and bus routes could be only that one. The DPA could reasonably take the position that the processing of personal data in case of debit or credit card payments is limited to what is necessary for the purpose pursued and the principle of data minimisation is respected. The DPA could reasonably consider that there was no other, less drastic method to achieve the same objective.
 +
 
 +
The Court declared the appeal unfounded.   
  
 
==Comment==
 
==Comment==
Line 54: Line 59:
 
<pre>DECISION
 
<pre>DECISION
  
Court of the Hague
+
Process sequence
  
Trade team - interim relief judge
+
By decision of 10 January 2019, the defendant rejected a claimant's request to take enforcement action against [third party].
Case number: C/09/581973 v KG ZA 19/1024
 
Judgment in preliminary relief proceedings of 13 November 2019
 
in the matter of
 
[plaintiff] at [place] ,
 
plaintiff,
 
Lawyer M.A.C. de Vilder-van Overmeire in Amsterdam,
 
against:
 
the State of the Netherlands, Ministry of Security and Justice, The Hague,
 
defendant,
 
lawyer Mr. N.N. Bontje in The Hague.
 
The parties will hereinafter be referred to respectively as '[plaintiff]' and '[the State]'.
 
  
1 The proceedings
+
By decision of 14 May 2019 (the contested decision), the defendant dismissed plaintiff's objection as unfounded.
 +
 
 +
Plaintiff appealed against the contested decision.
 +
 
 +
The defendant filed a statement of defence.
 +
 
 +
Third party submitted a written statement of defence.
 +
 
 +
The investigation at the hearing took place on 16 December 2019. Plaintiff has appeared. The defendant is represented by its agents. Third Party is represented by its agents and M.J.M. Piels.
 +
Considerations
 +
 
 +
Why doesn't the court grant the plaintiff's request for arrest?
 +
 
 +
1. The plaintiff has requested that his case be stayed pending the answer to preliminary questions from the Constitutional Court of Belgium and pending the ruling on the appeal to the Administrative Jurisdiction Division of the Council of State (the Division) in a similar case previously conducted by him.
 
1.1.
 
1.1.
The course of the procedure is evidenced by
 
- the summons with productions;
 
- the conclusion following a summons from the State;
 
- the productions submitted by the State;
 
- the letter from [plaintiff] dated 4 November 2019, containing productions;
 
- the oral hearing held on 5 November 2019 at which the State submitted pleadings.
 
  
1.2.
+
The court sees no reason to do so. In its ruling of 17 October 2019 (judgment no. 135/2019), the Constitutional Court of Belgium referred preliminary questions to the Court of Justice of the European Union. These questions relate to the national (Belgian) law of 25 December 2016 on the processing of passenger data. By this law, the (EU) 2016/681 of the European Parliament and the Council of 27 April 2016, 2004/82/EC of the Council of 29 April 2004 and 2010/65/EU of the European Parliament and the Council of 20 October 2010 have been transposed into (national) law. Directive 2004/82/EC aims at improving border controls and combating illegal immigration and covers the professional transport of persons by air. Directive 2010/65 aims to simplify and harmonise the administrative procedures applicable to maritime transport. Directive 2016/681 lays down rules on the transfer by air carriers of Passenger Name Records (PNR) on flights for the purpose of the prevention, detection, investigation and prosecution of terrorist offences and serious crime.
Judgment was given at the hearing today.
 
  
1.3.
+
One of the questions of the Constitutional Court of Belgium concerns the applicability of Article 23 of the AVG to (this) national legislation. For the rest, the questions relate to Directive (EU) 2016/681.
After the hearing another letter was received from [plaintiff] dated 6 November 2019. In this letter she states, insofar as relevant at this time, that it is contrary to, among other things, the proper order of procedure that the employee of the Immigration and Naturalization Service (IND) present at the hearing also spoke - in addition to the State's lawyer - and she requests that what this IND employee put forward be disregarded. The State was given the opportunity to respond in writing to this letter on the part of [the plaintiff] and indicated in a letter dated 8 November 2019 that it did not feel the need to respond.
 
  
1.4.
+
In the opinion of the Court, the answers given by the European Court to the questions asked do not affect the plaintiff's appeal in this case. The directives mentioned are not at issue and the AVG has been directly applied in this case and not through national legislation.
Subsequently, another letter from [plaintiff] dated 8 November 2019 was received. In this letter [plaintiff] requests, as far as relevant now, to disregard the "writing" that the State's attorney first provided at the hearing (the pleading notes) because it is contrary to the proper order of procedure and because it seriously neglects the procedural interests of [plaintiff], or to "reopen the investigation at the hearing" and to give [plaintiff] the opportunity to respond in writing to the "writing" of the State.
 
  
1.5.
+
Nor is there any reason to await the decision of the Division on the appeal of the plaintiff against the decision of this court of 5 September 2019 in cases AWB 18/546 and 18/14871. The enforcement request at issue in this case relates to facts other than those referred to in the judgment of 5 September 2019.
The Court in preliminary relief proceedings saw no reason to disregard the statements of the IND employee. The State appeared in the proceedings in the correct manner, with an attorney at law. The fact that an IND employee was also present at the hearing, who also spoke - as an informant - does not, contrary to the claimant's opinion, constitute a violation of the proper procedural order. For that matter, there is also no reason to disregard the statements made by this IND employee to which [the claimant] was able to respond during the hearing. The same applies to the pleading notes submitted by the State at the hearing. Contrary to the proceedings on the merits, the preliminary relief proceedings do not have a written round prior to the oral hearing and a defendant does not have to draw a conclusion in response. The nature of the preliminary relief proceedings means that a defendant is free to first put forward a defence at the hearing against what has been put forward in the summons and in doing so - as the State did in this case - to plead on the basis of pleading notes to be submitted. Now that [plaintiff] has been given the opportunity to respond to the State's defense, there is no question of a conflict with the proper order of procedure. The provision in the Rules of Procedure for Summary Proceedings of the Commercial and Family Courts to which [plaintiff] refers, on the basis of which documents must in principle be submitted 24 hours before the oral hearing, relates to documents a party wants to rely on and not to pleading notes in which the defence presented at the hearing is laid down.
 
  
2. The facts
+
What is this judgment about?
On the basis of the documents and the proceedings at the hearing, the following shall be taken as a starting point in these proceedings.
 
  
2.1.
+
2. In this judgment, the court assesses the defendant's refusal to take enforcement action against [third party] under Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation; AVG). This concerns the measure that, as of 1 July 2018, a passenger who wishes to purchase a ticket on the bus from the bus driver can only pay for this ticket with a debit or credit card and no longer with cash. The plaintiff has requested the defendant to investigate the obligation to pay with a debit card or credit card and the abolition of cash payment on the bus and to take enforcement action against this.
[plaintiff] works as a lawyer and is, among other things, active in aliens law. In this context, she also maintains contacts with the Immigration and Naturalisation Service (hereinafter referred to as: IND).
 
  
2.2.
+
For the relevant laws and regulations, the court refers to the appendix. This appendix is part of the judgment.
Plaintiff] originally has the nationality of Azerbaijan.
 
  
2.3.
+
How does the court review the defendant's decision?
On 17 February 2014, [plaintiff] submitted an application for the granting of Dutch citizenship. In doing so, she signed a 'Declaration of willingness to renounce the current nationality(s) in connection with the application for naturalisation to become a Dutch national'. In this declaration, [claimant] declares that she knows how to renounce her nationality, what the associated costs are, and that after she has become a Dutch national she will renounce her 'current' nationality and send the proof of renunciation to the IND.
 
  
2.4.
+
3. In this case, the application of articles 5 and 6 of the AVG plays a role in the light of recital 39 in the preamble. The defendant has adopted a basis for processing PIN and credit card details when buying a ticket from a bus driver in Article 6(1)(b) of the AVG.
By Royal Decree of 3 April 2014, [plaintiff] has been granted Dutch citizenship. The decision was presented to [claimant] during a ceremony on 27 May 2014.
+
3.1.
  
2.5.
+
The court will assess whether the defendant has been able to conclude that [third party] is not in breach of the AVG. If this is indeed not the case, the defendant is not entitled to take enforcement action.
By order of 19 August 2019, Dutch citizenship was revoked by the State Secretary for Justice and Security (hereinafter: the State Secretary). In so far as relevant, this order states the following:
 
“(…)
 
The reason for withdrawing your Dutch nationality is that you have not done everything possible to lose your Azerbaijani nationality (hereinafter: original nationality).
 
(…)
 
The first information letter relating to your distance commitment was sent to you on 10 June 2014. This letter explained to you that you must prove within three months that you have taken action to renounce your original nationality.
 
This letter also pointed out to you that if you move or emigrate without providing a change of address (and any additional contact details), and you do not respond in time to a request for information, this may lead to withdrawal of your Dutch nationality. You have not responded to this letter.
 
Subsequently, you have been reminded several times that you must renounce your original nationality, i.e. on 30 September 2014, 9 December 2014 and 16 January 2015. You have always been informed that failure to do so would result in the withdrawal of your Dutch citizenship. You have not responded to these reminders.
 
The Basic Registration of Persons (BRP) shows that you were registered at the address [address 1] from 27 July 2012 until 14 June 2017. From 14 June 2017 until today, you are registered at address [address 2] . All letters have been sent to the correct address. The letters of 9 December 2014 and 15 January 2015 were sent to you by registered mail. They have not been returned.
 
On 3 May 2017, you were informed of my intention to withdraw your Dutch citizenship. You have been given the opportunity to respond in writing or orally to the intention to revoke your Dutch nationality. You have not made use of the opportunity to give your views.
 
The intention to withdraw Dutch citizenship that was sent to you by registered letter on 3 May 2017 was not collected by you and returned to you on 1 June 2017. The reason why is illegible.
 
Because the IND did not make a statement for a long time, you were asked by letter of 6 May 2019 about the state of affairs regarding your obligation to renounce your Dutch nationality. This letter has not been returned. However, the IND was not allowed to receive a response from you.
 
An attempt was made to reach you by telephone in vain. The telephone number that the IND has received from you is no longer in use and your voicemail has been recorded on the telephone number that the IND received from the municipality [Gemeente]. You have not responded to this.
 
Several times you have been given ample opportunity to submit a statement showing that you have lost your Azerbaijani nationality. To date, the IND has not been allowed to receive such a statement from you.
 
(…)”
 
  
2.6.
+
To this end, the Court will assess whether article 6 of the AVG provides a basis for processing PIN and credit card details. It will also examine whether the defendant has been able to claim that the processing of these personal data meets the requirements of Article 5 of the AVG. Relevant in this respect is whether the reason why [third party] only allows debit and credit card payments in the coach is justified. Subsequently, the court assesses whether the requirements of necessity and proportionality have been met in the case of payment by debit and credit card and whether an alternative (subsidiarity) may exist (recital 39 of the AVG).
The aforementioned decision was sent by registered post to [plaintiff] and also placed in its Notices Box on mijnoverheid.nl.
 
  
2.7.
+
Is there a basis for data processing?
On 23 August 2019, [the claimant] contacted the IND by e-mail and by telephone and made it known that she did not agree with the aforementioned decision.
 
  
2.8.
+
4. The plaintiff argues that he does not enter into an agreement with [third party] when using the bus, because he did not give permission for this. If it is assumed that he did give permission, he did not freely or unambiguously give this permission. The transport company has a monopoly position and the plaintiff is dependent on public transport.
The following notice was published in the Netherlands Government Gazette of 26 August 2019:
+
4.1.
"By order of the State Secretary for Justice and Security of 19 August 2019, the Royal Decree of 3 April 2014, number [number] , by which [plaintiff], born on [date of birth] , in [place of birth] (Soviet Union), of Azerbaijani nationality was granted Dutch citizenship, was revoked pursuant to Article 15, first paragraph under d of the Netherlands Nationality Act.
+
 
This means that [plaintiff] has lost Dutch citizenship with effect from 19 August 2019'.
+
In the opinion of the court, the defendant was right to base the processing of the personal data of bus passengers on the transport contract. As the District Court also considered in its judgment of 5 September 2019, if a passenger uses public transport, he enters into a transport contract with a transport company. In this case, that is the plaintiff as a bus passenger and Breng/[third party] as a carrier. The processing of PIN and credit card details is therefore based on an agreement with [third party] as referred to in Section 6(1)(b) of the AVG.
 +
4.2.
  
2.9.
+
This ground for appeal does not succeed. The court will therefore not discuss the plaintiff's grounds relating to other provisions of Article 6 of the AVG concerning the lawfulness of the processing of personal data, such as consent of the data subject or a statutory obligation.
On 26 August 2019 [plaintiff] objected to the decision to withdraw her Dutch citizenship. On 29 August 2019, she applied to the District Court of The Hague, sitting in Haarlem, for an interim injunction and requested that the legal consequences of the order of 19 August 2019 be suspended. This application was granted by judgment of 9 September 2019, so that pending the objection procedure - which has not yet been completed - the applicant again has Dutch nationality.
 
  
2.10.
+
Does [third party] have a legitimate purpose to only allow debit or credit card payments on the bus?
By letter of 9 September 2019, [plaintiff] requested the IND to rectify the publication in the Netherlands Government Gazette, or at least to publish the judgment of the District Court of 9 September 2019. By letter of 12 September 2019, the State Secretary informed the IND on behalf of the State Secretary that no rectification would be made, because the granting of the interim injunction only means that the legal consequences of the contested decision will be suspended and not that the contested decision is incorrect. The decision of the District Court of 9 September 2019, as also stated in that letter, will not be published due to a lack of legal or policy basis.
 
  
2.11.
+
5. The plaintiff argues that it is not necessary for security reasons to abolish cash payments on all bus routes. A sufficient level of security is only necessary on specific, high-risk bus routes. A general invasion of the privacy of all passengers on all bus routes is not necessary. Furthermore, security cannot be seen as a necessity for data processing, according to the plaintiff.
By letter of 3 October 2019, [plaintiff] informed the IND that the IND is guilty of violation of privacy and violation of the honour or good name of [plaintiff] in the lawful exercise of her profession as a lawyer. She claims that as a result of the publication in the Netherlands Government Gazette she suffers material as well as immaterial damage. On the basis of article 82 paragraph of the General Data Protection Regulation (hereafter: AVG) she claims an advance payment of € 5,000 on the final damages. It also summoned the IND to comply with the request for rectification or adjustment of the publication in the Netherlands Government Gazette within two working days. In response to this, in a letter dated 7 October 2019, on behalf of the State Secretary, it was stated that no reason was seen to justify the payment of an advance payment on any compensation, because the objection to the Decree of 19 August 2019 is still being processed and it has not yet been established that there is a wrongful act in the civil-law sense or a ground for compensation as referred to in Section 8:88 of the General Administrative Law Act (Awb). With reference to the letter of 12 September 2019, it is also announced that the State Secretary will not rectify the publication in the Netherlands Government Gazette or publish the court's ruling of 9 September 2019.
+
5.1.
  
3. The dispute
+
The District Court is of the opinion that the defendant could reasonably consider the purpose for which [third party], as controller, abolished the cash payment on the bus and thereby processed personal data to be justified. [third party] has come to its decision as a result of the action programme "Social Security in Public Transport". This integrated action programme was drawn up in 2016 by parties from the public transport sector, carriers, trade unions, the police, local and regional authorities and central government. An integrated approach was chosen for the entire public transport sector to improve the safety of passengers and employees in public transport. One of the measures in this report is to no longer allow cash money in the bus to prevent theft and robbery.
3.1.
 
[plaintiff] claims, in substance, the State:
 
a. on pain of a penalty payment:
 
  
o remove the publication in the Government Gazette;
+
The following table is included in this action programme, where A incidents are understood to mean: assault, threat (with a weapon), theft, drug nuisance, vandalism, vandalism and offences such as pushing, pulling and spitting:
o to place a rectification in the Government Gazette and on the website of the IND for the factually incorrect information, whereby the content of the rectification will be drawn up in consultation with the authorised representative of [claimant] in the objection procedure;
 
o ensure the removal of all search results from the publication via Google-Search;
 
on pain of a penalty payment, prohibit future publication of privacy-sensitive information of [plaintiff];
 
order the defendant to pay an advance on the damages of € 15,000, € 1,000 in extrajudicial costs and the costs of this proceedings plus statutory interest.
 
  
3.2.
+
Table 1: registered A incidents regional transporters
To that end, [plaintiff] argues - in summary - the following. By its publication in the Netherlands Government Gazette and its refusal to remove or rectify it, the State is acting in violation of the provisions contained in the GDPR and in violation of Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms (hereinafter: 'ECHR'). Irrespective of the outcome of the objection, the decision to revoke the Dutch nationality of [plaintiff] unlawfully came about and the State failed to observe essential procedural guarantees in respect of [plaintiff]. The publication in the Netherlands Government Gazette has no compelling legal basis, is based on official arbitrariness and - other than intentionally causing damage to [plaintiff's] reputation and intentionally violating [plaintiff's] privacy - serves no legitimate purpose under the law. As a result of the publication in the Netherlands Government Gazette, [plaintiff] suffers material and immaterial damage because this publication has consequences for her activities as an attorney at law.
+
[...]
 +
As [third party] explained at the hearing, national efforts are being made to reduce the number of A incidents, including robberies. At [third party] robberies of bus drivers have taken place on their bus lines and this has had a huge impact on employees and passengers. By abolishing cash payments on buses, the number of robberies has dropped to almost zero nationwide.
 +
In view of this report and the explanations provided by [third party], the defendant was able to consider the introduction of debit and credit card payments on the buses a justified objective. In this respect, the Court deems it plausible that the only option that can be chosen is to apply this national measure to all [third party] bus routes, because otherwise the robberies will be relocated. This ground for appeal is unsuccessful.
  
3.3.
+
Is the processing of PIN and credit card details necessary and proportionate for the performance of the transport contract with [third party]?
The State defends, which will be discussed below, to the extent necessary.
 
  
4. The assessment of the dispute
+
6. The plaintiff has argued that the burden of proof of necessity, proportionality and subsidiarity should not be placed on him but on Breng/[third party]. It concerns him not only his bank details but also his PIN code. There is a danger of hacking and profiling, according to the plaintiff.
Delete and rectify publication Government Gazette
+
6.1.
  
4.1.
+
In the District Court's opinion, the defendant could reasonably take the position that the processing of personal data in the case of a debit or credit card payment in the bus is limited to what is necessary for the purposes for which they are processed, and the requirement of minimum data processing has also been met. As [third party] explained at the hearing, payment by debit or credit card is made via a payment service provider (PSP). When buying a ticket in the coach, the details of the Passenger's debit card and credit card are pseudonymised and only the last four digits of the debit card and credit card are visible to the carrier. The PSP collects and processes these payments and periodically transfers the revenue to [third party]. [third party] will only periodically receive an overview of the total amount. Only the last four digits of the debit or credit card payments can be found on this overview in order to be able to retrieve them in case of any uncertainties about payments. No other information is received by [third party]. The PIN code also passes through the PSP and is not stored with [third party]. As a result, the invasion of the plaintiff's privacy by [third party] is limited to the minimum necessary to buy a ticket from the bus driver. This ground for appeal is unsuccessful.
[Claimant] can only be received in her claims for interim relief if no other specifically designated and adequately secured procedure is available to her in which she can achieve the same result as in these interim relief proceedings. In view of this, [plaintiff] cannot be received in its claim for removal and rectification of the publication in the Netherlands Government Gazette. The following reason for this is as follows.
 
  
4.2.
+
Is there an alternative to [third party]?
Articles 16 and 17 of the GDPR - on which [plaintiff] also relies - lay down that someone whose personal data are being processed has the right to request the rectification and erasure of those data. A decision on such a request must then be taken within one month, pursuant to Article 12(3) of the AVG. If, as in this case, such a decision is taken by an administrative body, then, pursuant to Article 34 of the GDPR Implementing Act, that decision is considered a decision within the meaning of the General Administrative Law Act, to which objection and appeal are possible. Pending this objection and appeal procedure, the administrative court may - in urgent cases - be asked to make an interim injunction.
 
  
4.3.
+
7. The plaintiff is of the opinion that [third party] did not have to introduce the measure for all bus routes and should limit it to the high-risk bus routes. According to the plaintiff, [third party] can create a website on which employees and passengers can see on which routes cash can no longer be paid for at that time.
The State rightly argued that the State Secretary had already decided by letter of 7 October 2019 on [plaintiff's] request to rectify the publication in the Netherlands Government Gazette. Plaintiff] may object to this decision and, if necessary, request a provisional injunction. In view of this, the claim to rectify the publication is subject to [plaintiff]'s right to a specifically designated procedure with sufficient safeguards, in which - in view of the possibility of making an administrative interim injunction - she will be able to achieve the same result in the short term as she intends in these preliminary relief proceedings. This closes the way to the civil judge in preliminary relief proceedings.
+
7.1.
  
4.4.
+
In the District Court's opinion, the defendant could reasonably take the position that [third party] cannot reasonably achieve the objective of increasing safety in the bus for employees and passengers by means of a less drastic working method. The position of [third party] that such a website will not be consulted by everyone and will lead to confusion and lack of clarity in communication among passengers and employees is plausible. third party] can also be followed that this proposal of plaintiff is not workable. It is also important that there is a national agreement. [third party] can be followed that it is not desirable to be the only one to deviate from it.
[plaintiff] has not yet explicitly asked the State Secretary to delete the publication in the Netherlands Government Gazette, but it is not clear why she cannot also take the designated route as described under 4.2 to achieve this. The circumstance that [the plaintiff] claims to have an urgent interest in her claim and that the administrative-law proceedings in respect of the request for delisting will still have to be commenced does not make this any different. It was [plaintiff's] choice not to first apply to the State Secretary for a delisting of the publication in the Netherlands Government Gazette, but to institute these preliminary relief proceedings with regard to the intended delisting. The resulting delay is at the risk of [the plaintiff] and does not constitute an urgent interest in these preliminary relief proceedings. Moreover, it has become apparent that the State Secretary has always responded very quickly to requests from [plaintiff] (cf. the correspondence referred to under 2.10 and 2.11). It is not to be expected that this will be different in the case of a request for a deletion that has yet to be submitted. Finally, with regard to the urgent interest, it is taken into account that the publication in the Netherlands Government Gazette already dates from 26 August 2019 and that these preliminary relief proceedings were not requested before 22 October 2019. In the light of the time that [plaintiff] itself has allowed, it is also impossible to see why there is now such an urgent interest that the designated legal proceedings - which also provides for urgent proceedings - cannot be waited for.
+
7.2.
  
Other claims
+
The plaintiff may, incidentally, choose to buy bus tickets in advance. The plaintiff can also travel with a non-nominative public transport chip card which he can recharge at the ticket machine (anonymously). The defendant did not have to come to any other conclusion that the plaintiff was inconvenienced by this. Therefore, this ground of appeal is unsuccessful.
4.5.
 
Since the applicant cannot be received in its claim for the deletion and rectification of the publication in the Netherlands Government Gazette, there is also no reason to take order measures in respect of the related claims (removal of all search results from the publication via Google-Search, prohibition of future publication of [plaintiff's] privacy-sensitive information and payment of an advance on damages).
 
  
Final sum and legal costs
+
Other grounds of appeal. Conclusion
4.6.
 
Finally, the requested order measures will be refused. [plaintiff], as the unsuccessful party, shall be ordered to pay the costs of the present proceedings.
 
  
5. The decision
+
8. The plaintiff has put forward further grounds of appeal. The plaintiff's fear that there will increasingly be a society in which the privacy of the citizen will be put under pressure. However, these grounds do not directly relate to the contested decision and therefore cannot detract from its lawfulness. The other grounds for appeal do not detract from this either.
The preliminary relief judge:
 
  
5.1.
+
9. Because the grounds of appeal are unsuccessful, the appeal is unfounded. There are no grounds for an order to pay the costs of the proceedings.
refuses the requested order measures;
+
Decision
  
5.2.
+
The court declares the appeal unfounded.
orders [the plaintiff] to pay the costs of these proceedings, hitherto estimated on the part of the State at € 2,972, of which € 980 will be spent on the salary of the lawyer and € 1,992 on court fees;
 
  
5.3.
+
This ruling was made by J.H. van Breda, chairman, W.P.C.G. Derksen and W.P.C.G. Derksen.
declares this order to pay costs enforceable on a provisional basis.
 
  
This judgment was rendered by H.J. Vetter and pronounced in public on 13 November 2019.  
+
Mr S.E.M. Lichtenberg, Judges, in the presence of Mr M.G. Smeenk, Registrar.
 
</pre>
 
</pre>

Revision as of 11:12, 7 February 2020

Rb. Gelderland - AWB 19/2901
CourtsNL.png
Court: Rb. Gelderland (Netherlands)
Jurisdiction: Netherlands
Relevant Law: Article 5 GDPR

Article 6(1)(b) GDPR

Recital 39 GDPR

Decided: 4. 2. 2020
Published: 5. 2. 2020
Parties: Autoriteit Persoonsgegevens (Dutch DPA)
National Case Number: AWB 19/2901
European Case Law Identifier: ECLI:NL:RBGEL:2020:619
Appeal from: n/a
Language: Dutch
Original Source: (in NL)

The Gelderland Court of First Instance confirmed that the measure according to which passengers can purchase tickets on the buses only by means of credit/ debit cards is compatible with the principles of necessity and proportionality and the subsequent processing of personal data is necessary for the performance of this purchase contract. Therefore, the processing is compatible with the GDPR.

English Summary

Facts

In the Netherlands, as of 1 July 2018 a passenger who wishes to purchase a ticket on the bus from the bus driver can only pay for this ticket with a debit or credit card and no longer with cash. The plaintiff requested the Dutch DPA to investigate the obligation to pay with a debit or credit card and the abolition of cash payments on the bus and to take an enforcement action against this measure under the GDPR. The DPA rejected the request and the plaintiff appealed its decision. He also asked the Court to suspend the present judgement until the CJEU issues a judgement on the preliminary questions which the Constitutional Court of Belgium referred with its judgement no. 135/2019 on the processing of passenger data. The DPA argued that the legal basis for the processing of PIN and credit card details when purchasing a ticket from a bus driver is Article 6(1)(b) GDPR.

Dispute

The Court had to assess whether the Dutch DPA has been able to conclude that the third party did not violate the GDPR and subsequently whether it did not have to take an enforcement action indeed. To this end, the Court had to assess whether Article 6 GDPR provides a legal basis for processing credit cards details and whether the processing is compliant with Article 5 GDPR. It also had to examine whether the criteria of necessity and proportionality had been met in this case.

Holding

The Court found that the legal basis of Article 6(1)(b) GDPR is valid, hence there was no reason to further examine possible application of other legal grounds. Moreover, the Dutch DPA could reasonably consider the purpose of abolishing cash, since this measure was included in the action programme "Social Security in Public Transport" and aimed at the prevention of theft and robbery. For this purpose, the only plausible option for all third parties and bus routes could be only that one. The DPA could reasonably take the position that the processing of personal data in case of debit or credit card payments is limited to what is necessary for the purpose pursued and the principle of data minimisation is respected. The DPA could reasonably consider that there was no other, less drastic method to achieve the same objective.

The Court declared the appeal unfounded.

Comment

Share your comment here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the Dutch original for more details.

DECISION

Process sequence

By decision of 10 January 2019, the defendant rejected a claimant's request to take enforcement action against [third party].

By decision of 14 May 2019 (the contested decision), the defendant dismissed plaintiff's objection as unfounded.

Plaintiff appealed against the contested decision.

The defendant filed a statement of defence.

Third party submitted a written statement of defence.

The investigation at the hearing took place on 16 December 2019. Plaintiff has appeared. The defendant is represented by its agents. Third Party is represented by its agents and M.J.M. Piels.
Considerations

Why doesn't the court grant the plaintiff's request for arrest?

1. The plaintiff has requested that his case be stayed pending the answer to preliminary questions from the Constitutional Court of Belgium and pending the ruling on the appeal to the Administrative Jurisdiction Division of the Council of State (the Division) in a similar case previously conducted by him.
1.1.

The court sees no reason to do so. In its ruling of 17 October 2019 (judgment no. 135/2019), the Constitutional Court of Belgium referred preliminary questions to the Court of Justice of the European Union. These questions relate to the national (Belgian) law of 25 December 2016 on the processing of passenger data. By this law, the (EU) 2016/681 of the European Parliament and the Council of 27 April 2016, 2004/82/EC of the Council of 29 April 2004 and 2010/65/EU of the European Parliament and the Council of 20 October 2010 have been transposed into (national) law. Directive 2004/82/EC aims at improving border controls and combating illegal immigration and covers the professional transport of persons by air. Directive 2010/65 aims to simplify and harmonise the administrative procedures applicable to maritime transport. Directive 2016/681 lays down rules on the transfer by air carriers of Passenger Name Records (PNR) on flights for the purpose of the prevention, detection, investigation and prosecution of terrorist offences and serious crime.

One of the questions of the Constitutional Court of Belgium concerns the applicability of Article 23 of the AVG to (this) national legislation. For the rest, the questions relate to Directive (EU) 2016/681.

In the opinion of the Court, the answers given by the European Court to the questions asked do not affect the plaintiff's appeal in this case. The directives mentioned are not at issue and the AVG has been directly applied in this case and not through national legislation.

Nor is there any reason to await the decision of the Division on the appeal of the plaintiff against the decision of this court of 5 September 2019 in cases AWB 18/546 and 18/14871. The enforcement request at issue in this case relates to facts other than those referred to in the judgment of 5 September 2019.

What is this judgment about?

2. In this judgment, the court assesses the defendant's refusal to take enforcement action against [third party] under Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation; AVG). This concerns the measure that, as of 1 July 2018, a passenger who wishes to purchase a ticket on the bus from the bus driver can only pay for this ticket with a debit or credit card and no longer with cash. The plaintiff has requested the defendant to investigate the obligation to pay with a debit card or credit card and the abolition of cash payment on the bus and to take enforcement action against this.

For the relevant laws and regulations, the court refers to the appendix. This appendix is part of the judgment.

How does the court review the defendant's decision?

3. In this case, the application of articles 5 and 6 of the AVG plays a role in the light of recital 39 in the preamble. The defendant has adopted a basis for processing PIN and credit card details when buying a ticket from a bus driver in Article 6(1)(b) of the AVG.
3.1.

The court will assess whether the defendant has been able to conclude that [third party] is not in breach of the AVG. If this is indeed not the case, the defendant is not entitled to take enforcement action.

To this end, the Court will assess whether article 6 of the AVG provides a basis for processing PIN and credit card details. It will also examine whether the defendant has been able to claim that the processing of these personal data meets the requirements of Article 5 of the AVG. Relevant in this respect is whether the reason why [third party] only allows debit and credit card payments in the coach is justified. Subsequently, the court assesses whether the requirements of necessity and proportionality have been met in the case of payment by debit and credit card and whether an alternative (subsidiarity) may exist (recital 39 of the AVG).

Is there a basis for data processing?

4. The plaintiff argues that he does not enter into an agreement with [third party] when using the bus, because he did not give permission for this. If it is assumed that he did give permission, he did not freely or unambiguously give this permission. The transport company has a monopoly position and the plaintiff is dependent on public transport.
4.1.

In the opinion of the court, the defendant was right to base the processing of the personal data of bus passengers on the transport contract. As the District Court also considered in its judgment of 5 September 2019, if a passenger uses public transport, he enters into a transport contract with a transport company. In this case, that is the plaintiff as a bus passenger and Breng/[third party] as a carrier. The processing of PIN and credit card details is therefore based on an agreement with [third party] as referred to in Section 6(1)(b) of the AVG.
4.2.

This ground for appeal does not succeed. The court will therefore not discuss the plaintiff's grounds relating to other provisions of Article 6 of the AVG concerning the lawfulness of the processing of personal data, such as consent of the data subject or a statutory obligation.

Does [third party] have a legitimate purpose to only allow debit or credit card payments on the bus?

5. The plaintiff argues that it is not necessary for security reasons to abolish cash payments on all bus routes. A sufficient level of security is only necessary on specific, high-risk bus routes. A general invasion of the privacy of all passengers on all bus routes is not necessary. Furthermore, security cannot be seen as a necessity for data processing, according to the plaintiff.
5.1.

The District Court is of the opinion that the defendant could reasonably consider the purpose for which [third party], as controller, abolished the cash payment on the bus and thereby processed personal data to be justified. [third party] has come to its decision as a result of the action programme "Social Security in Public Transport". This integrated action programme was drawn up in 2016 by parties from the public transport sector, carriers, trade unions, the police, local and regional authorities and central government. An integrated approach was chosen for the entire public transport sector to improve the safety of passengers and employees in public transport. One of the measures in this report is to no longer allow cash money in the bus to prevent theft and robbery.

The following table is included in this action programme, where A incidents are understood to mean: assault, threat (with a weapon), theft, drug nuisance, vandalism, vandalism and offences such as pushing, pulling and spitting:

Table 1: registered A incidents regional transporters
[...]
As [third party] explained at the hearing, national efforts are being made to reduce the number of A incidents, including robberies. At [third party] robberies of bus drivers have taken place on their bus lines and this has had a huge impact on employees and passengers. By abolishing cash payments on buses, the number of robberies has dropped to almost zero nationwide.
In view of this report and the explanations provided by [third party], the defendant was able to consider the introduction of debit and credit card payments on the buses a justified objective. In this respect, the Court deems it plausible that the only option that can be chosen is to apply this national measure to all [third party] bus routes, because otherwise the robberies will be relocated. This ground for appeal is unsuccessful.

Is the processing of PIN and credit card details necessary and proportionate for the performance of the transport contract with [third party]?

6. The plaintiff has argued that the burden of proof of necessity, proportionality and subsidiarity should not be placed on him but on Breng/[third party]. It concerns him not only his bank details but also his PIN code. There is a danger of hacking and profiling, according to the plaintiff.
6.1.

In the District Court's opinion, the defendant could reasonably take the position that the processing of personal data in the case of a debit or credit card payment in the bus is limited to what is necessary for the purposes for which they are processed, and the requirement of minimum data processing has also been met. As [third party] explained at the hearing, payment by debit or credit card is made via a payment service provider (PSP). When buying a ticket in the coach, the details of the Passenger's debit card and credit card are pseudonymised and only the last four digits of the debit card and credit card are visible to the carrier. The PSP collects and processes these payments and periodically transfers the revenue to [third party]. [third party] will only periodically receive an overview of the total amount. Only the last four digits of the debit or credit card payments can be found on this overview in order to be able to retrieve them in case of any uncertainties about payments. No other information is received by [third party]. The PIN code also passes through the PSP and is not stored with [third party]. As a result, the invasion of the plaintiff's privacy by [third party] is limited to the minimum necessary to buy a ticket from the bus driver. This ground for appeal is unsuccessful.

Is there an alternative to [third party]?

7. The plaintiff is of the opinion that [third party] did not have to introduce the measure for all bus routes and should limit it to the high-risk bus routes. According to the plaintiff, [third party] can create a website on which employees and passengers can see on which routes cash can no longer be paid for at that time.
7.1.

In the District Court's opinion, the defendant could reasonably take the position that [third party] cannot reasonably achieve the objective of increasing safety in the bus for employees and passengers by means of a less drastic working method. The position of [third party] that such a website will not be consulted by everyone and will lead to confusion and lack of clarity in communication among passengers and employees is plausible. third party] can also be followed that this proposal of plaintiff is not workable. It is also important that there is a national agreement. [third party] can be followed that it is not desirable to be the only one to deviate from it.
7.2.

The plaintiff may, incidentally, choose to buy bus tickets in advance. The plaintiff can also travel with a non-nominative public transport chip card which he can recharge at the ticket machine (anonymously). The defendant did not have to come to any other conclusion that the plaintiff was inconvenienced by this. Therefore, this ground of appeal is unsuccessful.

Other grounds of appeal. Conclusion

8. The plaintiff has put forward further grounds of appeal. The plaintiff's fear that there will increasingly be a society in which the privacy of the citizen will be put under pressure. However, these grounds do not directly relate to the contested decision and therefore cannot detract from its lawfulness. The other grounds for appeal do not detract from this either.

9. Because the grounds of appeal are unsuccessful, the appeal is unfounded. There are no grounds for an order to pay the costs of the proceedings.
Decision

The court declares the appeal unfounded.

This ruling was made by J.H. van Breda, chairman, W.P.C.G. Derksen and W.P.C.G. Derksen.

Mr S.E.M. Lichtenberg, Judges, in the presence of Mr M.G. Smeenk, Registrar.