Rb. Limburg - ROE 19/259
From GDPRhub
| Rb. Limburg - ROE 19/259 | |
|---|---|
 | |
| Court: | Rb. Limburg (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 15(1) GDPR Article 15(4) GDPR Article 41(1)(i) Implementation Act GDPR |
| Decided: | 09.06.2022 |
| Published: | 16.06.2022 |
| Parties: | The City Government of the Municipality Maastricht |
| National Case Number/Name: | ROE 19/259 |
| European Case Law Identifier: | ECLI:NL:RBLIM:2022:4404 |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | Rechtspraak.nl (in Dutch) |
| Initial Contributor: | Giel Ritzen |
The District Court of Limburg held that a data subject's right of access does not include each individual instance of personal data processing. An overview of the specific processing operations can be sufficient. It is also not necessary to include details regarding the investigation that was done to create this overview.
English Summary
Facts
The controller is the City Government of the Municipality of Maastricht. The data subject used to work for the controller.
The data subject filed an access request but found the controller’s response insufficient. After the controller rejected her objection, the case was brought to the Court.
The Court found that the controller violated general principles of good administration. The Court gave the controller the opportunity to rectify its mistakes and ordered the controller to make a new substantive decision on the data subject’s access request within six weeks. If the controller were to refuse access, it must explain why refusal was necessary and proportionate. The Court extended the deadline in a second interlocutory decision.
In the new substantive decision, the controller provided an overview of each specific processing of the data subject‘s personal data. However, it omitted several details about the data subject, in particular about her as a former employee. The controller weighed the interests of the employee and the rights and freedoms of others and based this omission on Article 15(4) GDPR in combination with Article 41(1)(i) Implementation Act GDPR. The controller provided the information it omitted to the Court. The Court justified the omission in an interim decision of 20 December 2021.
This judgement builds on those interlocutory judgements.
Holding
The Court upheld the data subject’s appeal from the contested decision because of violations of the principles of good administration, and it annulled the decision. However, it also upheld the legal consequences of the annulled part of the contested decision, as the defects of the contested decision had been remedied. Then, the Court considered the data subject’s appeal to the new substantive decision.
First, the Court stipulated that Article 15(1) GDPR does not include a right to access every specific processing of personal data. An overview of the specific processing operations can be sufficient. It must, however, specify which information is processed, for which purpose, who receives the data, where it comes from, and, if possible, the envisaged storage period. Moreover, the Court considered that controllers might need to investigate the processing operations to provide all of the requested information. The Court held that this particular does not have to be reflected in the overview provided to the data subject.
Second, the Court rejected the data subject's arguments that (1) a specific list was missing from the overview of processing operations, (2) the controller’s investigation was incomplete, and (3) that the controller should have kept emails which contained her personal data. The Court stated that the list the data subject referred to was legitimately omitted. Moreover, it did not follow the data subject in her argument that the controller’s investigation was insufficient because the receipt of personal data had not been registered. In this regard, the Court stipulated that the controller did not have to keep the emails it sent to its attorney that contained the data subject's personal data.
Hence, the Court rejected the appeal to the new substantive decision.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
COURT limburg Seating location Maastricht Administrative law case number: ROE 19/259 judgment of the single chamber of 9 June 2022 in the case between [plaintiff] , living in [place of residence] , plaintiff and the Municipal Executive of the Municipality of Maastricht, defendant (authorized representative: mr. V.L.S. van Cruijningen). Process sequence By decision of August 24, 2018, the defendant decided on the request for access by the plaintiff, which is based on Article 15 of the General Data Protection Regulation (GDPR). By decision of December 18, 2018 (the contested decision), the defendant declared the objection of the plaintiff unfounded, upheld the objection on one part, and upheld the decision of 24 August 2018. Plaintiff appealed against the contested decision. Defendant has filed a statement of defence. The investigation in court initially took place on April 3, 2019. After the investigation was closed, the court reopened the investigation. At the hearing of March 8, 2021, the court resumed the investigation and then closed it again. Plaintiff appeared at both hearings. The defendant was represented at both hearings by its aforementioned representative from law firm Capra and by [name 1] and [name 2], who work for the defendant's municipality. By interlocutory judgment of 17 June 2021 (the interlocutory judgment), the court gave the defendant the opportunity to remedy the deficiencies found in the contested decision within six weeks of the date of the interlocutory judgment, taking into account the considerations and directions in the interlocutory judgment. In a second interim decision of 15 July 2021 (the extension decision), the court extended the period it gave the defendant to repair the defects until October 5, 2021. Respondent made a new decision in response to the interim ruling on September 21, 2021. Plaintiff has submitted a written statement in this regard. Defendant was given the opportunity to respond to the submission and made use of it. Plaintiff was given the opportunity to respond to Defendant's response and made use of it. The court has ruled that a further hearing will not be held. Considerations Introduction 1. This ruling builds on the interim ruling. The court will adhere to everything it has considered and decided in the interim judgment, unless expressly considered otherwise below. The court is not free to change the judgments given without reservation in the interim judgment. This is only different in very exceptional cases. In this regard, the court refers to the judgments of the Administrative Jurisdiction Division of the Council of State (the Division) of 24 August 20111 and 15 August 20122. 2. In its interlocutory judgment, the court ruled that the contested decision cannot be upheld insofar as it has not been signed on behalf of the defendant by a person authorized to do so, it is contrary to the principle of due care and motivation and the decision of 24 August 2018 is not has been revoked. The court gave the defendant the opportunity, by withdrawing the contested decision, by means of a new decision to be taken, to remedy the defects in signature, due care and reasoning associated with the contested decision and to revoke the decision of 24 August 2018. Specifically, the court instructed the defendant to do the following: 1) revoke the decision of August 24, 2018 and take a new substantive decision on the request for inspection of the plaintiff of May 25, 2018, whereby for the new substantive decision it will suffice to refer to the inspection of the personal data that Plaintiff has requested in a decision of 24 August 2018 and the contested decision and thereby: 2) - give the claimant access to her personal data in the correspondence between lawyer and defendant by expanding the overview with these personal data or - if the right of access to these personal data is disregarded, weigh up the Plaintiff's interest in inspecting these personal data against the interest of protecting the rights and freedoms of others and explain why not applying the right of access to the extent necessary and is proportionate to safeguard the rights and freedoms of others; 3) have the decision signed on behalf of the defendant by a person authorized to do so. 3. By decision of 21 September 2021, the defendant revoked the decision of 24 August 2018, rectified the signature defect and made a substantive decision. For its substantive decision, the respondent referred to the overviews and other appendices to the revoked decision of 24 August 2018 and the contested decision. Furthermore, the respondent has provided access to the personal data of the claimant in correspondence between Capra and the respondent by means of an additional overview. In the overview, the respondent has invoked Article 15, fourth paragraph, of the AVG, read in conjunction with Article 41, first paragraph, preamble and under i, of the AVG Implementation Act, a number of appreciative data and considerations about the claimant as a person, in particular about her as a (former) employee, omitted and the weighing up of interests on which it is based has been made known, as well as motivated why refusal of access is necessary and proportionate to the extent. 4. The defendant submitted the documents containing the information that he omitted from the overview to the court, invoking Article 8:29 of the General Administrative Law Act (Awb). The court found the limited cognizance of these documents justified in an interim decision of 20 December 2021. This decision was taken by a single chamber of the court other than the single chamber deciding on the appeal (hereafter referred to as the court). Plaintiff has given the court permission to rule in part on the basis of these documents. The court did not take cognizance of these documents, because the plaintiff did not contest that the defendant was allowed to omit the information that he omitted in the overview. The appeal against the contested decision 5. The court establishes that with the decision of September 21, 2021, the defendant has complied with what the court ordered him to do in an interim decision. The fact that the defendant did this with an amending decision and not with the withdrawal of the contested decision does not alter the fact that the deficiencies found in the interim judgment in the contested decision were rectified with the decision of 21 September 2021. Conclusion 6. Since the claimant's appeal against the contested decision succeeds, since she was correct as regards the defects in the contested decision found in the interim decision, the District Court will declare the appeal against the contested decision well-founded and annul the contested decision in so far as it is not has been signed on behalf of the defendant by a person authorized to do so, it is contrary to the principle of due care and motivation as described in more detail above under 2, and the decision of 24 August 2018 has not been revoked. It will uphold the legal effects of the annulled part of the contested decision, because, as I have said, those defects in the contested decision were combined with the decision of September 21, 2021 have been restored. The legal profession 7. According to Article 6:19, first paragraph, of the Awb, the claimant's appeal against the contested decision is (by operation of law) also directed against the decision of 21 September 2021. The court therefore also assesses the following, after a brief introduction, grounds of appeal raised by the claimant against that decision. 8. The court states first and foremost that the right of access to personal data that are being processed, laid down in Article 15, first paragraph, of the GDPR, does not include a right of access to any specific processing of personal data. Article 15, first paragraph, of the GDPR gives the right to inspect personal data that are being processed and information about the purpose of the processing, who receives the data, all information available about who the data comes from if it does not come from the data subject and, if possible, how long the data will be kept or the criteria on the basis of which the retention period is determined. A controller must conduct an investigation into each specific processing operation in order to allow a data subject to inspect all personal data that are processed, but in the court's opinion this investigation and all specific processing operations do not necessarily have to be reflected in the overview with which the data subject is processed. data subject is given access to the personal data of him that are being processed. 8.1 In the overviews accompanying the decision of 24 August 2018 and the contested decision, the defendant has chosen to do so. In formulating the instruction to the defendant, the court followed the choice of the defendant in the interim decision. In the overview accompanying the decision of September 21, 2021, the defendant has also provided the plaintiff with access to the personal data of her that he processes for each specific processing. Respondent has thereby each time allowed Plaintiff both access to personal data of her that he processes and insight into processing of personal data that he has found. 9. Plaintiff argues that defendant wrongly limits itself in the overview to giving access to her personal data in the advice of his lawyer. According to her, the defendant also sent information about her to his lawyer. As an example, it cites a letter from the defendant submitted by the defendant's representative in a complaint procedure October 7, 2014, which allegedly contained a list of cases she allegedly brought. Defendant made up the list. 10. In his response, the defendant disputes that he limited himself to providing access to personal data in correspondence between the lawyer and him and he indicates that he also searched for personal data of the plaintiff in his correspondence to a lawyer. He gives as an example the letter of 15 August 2010 that he has included in the overview. Defendant explains that he shared a lot of information verbally during discussions with a lawyer and that he handed over any documents to the lawyer. It has also happened that he has sent documents to a lawyer by secure e-mail after a telephone announcement without explanation. He didn't keep the emails. He further explains that his representative attached the list mentioned by the claimant in a complaint procedure initiated by the claimant against his representative to the letter of 7 October 2014 mentioned by the claimant. He indicates that his authorized representative has found the list in his file and that he has not kept the list. 11. In its response to the response of the respondent, the claimant maintains her position, with reference to a judgment of the Court of Justice3, that she is entitled to copies of documents and that the respondent does not comply with the GDPR by providing an overview . She believes that the e-mails that the defendant did not keep should have been kept, because they are archival documents. It also points out that the defendant must register to whom it provides personal data. According to her, this applies to both the personal data that the defendant has shared with his lawyer by e-mailed documents, and the personal data that he has shared with his lawyer by handing over documents to him. 12. The court has seen the overview in the decision of 21 September 2021. The overview includes a letter dated August 5, 2010 from the municipality to Capra. The court assumes that the respondent refers to this letter with the aforementioned letter of 15 August 2010 and that the mention of 15 August 2010 is an apparent clerical error. The overview is therefore not limited to providing access to the personal data of the claimant in the advice of the defendant's lawyer. Plaintiff is therefore not correct in so far as she says that the defendant has limited herself to giving her personal data access in the advice of his lawyer. 12.1 The list that Plaintiff cites as an example of a document that is missing from the overview was allowed to be missing from the overview, in view of legal considerations 7.2 and 7.2.1 in the interim decision. For that reason alone, the lack of the list in the overview cannot provide grounds for ruling that the overview does not include all the processing of personal data of the claimant in correspondence between lawyer and defendant. That is why it has not been made plausible that the investigation into processing operations that was still held was not complete, or that the claimant has still not been given access to all her personal data that the respondent is processing. The court notes the following in this regard. It is not in dispute that the list was made. Plaintiff also has the list. After all, it has attached the list to its pleadings for the hearing on 8 March 2021 and therefore has access to the list. It is not disputed that the list was drawn up for internal deliberation, the list was used by the defendant's representative in a complaint procedure instituted by the plaintiff against him and that the list was not sent to an office colleague of the defendant's representative. Plaintiff can therefore check whether the personal data of her that have been processed with the drawing up and sharing of the list are correct and whether the processing operations are lawful and, if desired, exercise the rights that she, as a data subject under the GDPR, still has with regard to these processing operations. has. 12.2 The court finds that, with reference to the registration obligation, the plaintiff has also failed to demonstrate that the investigation into processing operations was incomplete as yet, or that she was not given access to all of the personal data of her that the defendant processes. The mere position that the receipt of personal data must also be registered as documents containing personal data, e-mailed or handed over, is insufficiently concrete to be able to assume that the overview in the decision of 21 September 2021, together with the overviews in the decision of 24 August 2018 and the contested decision, do not include all documents that lawyers of (law firm) Capra have received from the defendant. The court notes in this regard that the defendant's explanation as to why there is no longer any correspondence between him and a lawyer does not relate to documents, but only to correspondence between defendant and lawyer. 12.3 Plaintiff does not contest the method that the defendant has followed according to his explanation, so that the court may assume that the defendant followed this method. Plaintiff believes that Defendant should have kept the e-mails with which Defendant sent documents containing her personal data to his lawyer. The court disagrees. If the defendant called a lawyer about upcoming e-mails and subsequently did not include any explanation in the e-mails, it may be assumed that these e-mails do not contain any information that is relevant to these proceedings and the defendant has therefore do not have to keep them in the context of this procedure. 12.4 The court therefore sees no reason in what the claimant has argued to rule that the investigation into the processing of personal data of her in correspondence between the lawyer and the defendant has not been complete, nor that the access given to personal data of her processes the defendant in that context and the information to which it is otherwise entitled under Article 15(1) of the GDPR is incomplete. Defendant could now also suffice with an overview. In the interim judgment, the court has already ruled that Article 15, first paragraph, of the GDPR does not confer a right to documents. The court refers to legal considerations 5.2 and 5.2.1 in the interim decision. She sees no reason in the judgment cited by the plaintiff to judge otherwise. This judgment, which Plaintiff has also cited before, but which the Court has not specifically addressed previously, does not demonstrate a right to documents containing personal data. Conclusion 13. The appeal (by operation of law) against the decision of 21 September 2021 is therefore unfounded. This means that this decision stands. Court fees and legal costs 14. Despite the fact that the appeal against the contested decision is well-founded, the court sees no reason in this case to determine that the defendant reimburses the plaintiff for the court fee it has paid. The reason for that is the following. Plaintiff has chosen to continue to litigate against the decision of September 21, 2021. No court fee is levied for the handling of that appeal that has arisen by operation of law. If the claimant had challenged this decision in separate appeal proceedings, she would have owed court fees for the hearing of that appeal. In a case such as this, in which the appeal lodged is well-founded, the court fee paid is therefore regarded as payment of the court fee for the handling of the appeal that has arisen by operation of law. The court fee paid is, as it were, transferred from the appeal procedure that has been instituted to the appeal procedure that has arisen by operation of law. Because the appeal against the decision of 21 September 2021 is unfounded, there is no reason to have the court fee paid reimbursed. 15. The court also sees no reason for a compensation for costs of the proceedings, because it has not become apparent that costs incurred in the objection or appeal proceedings should be eligible for compensation. Decision The court: - declares the appeal against the contested decision well founded, annuls the contested decision decision insofar as it has not been signed on behalf of the defendant by a person authorized to do so, it is contrary to the principle of due care and motivation as described in more detail above under 2, and the decision of 24 August 2018 has not been revoked and provides that the legal effects of the annulled part of the contested decision are maintained, since those deficiencies were rectified with the decision of 21 September 2021; - declares the appeal against the decision of 21 September 2021 unfounded by operation of law. This statement was made by mr. N.J.J. Derks-Voncken, judge, in the presence of mr. A.W.C.M. Frings, clerk. The decision was pronounced in public on June 9, 2022 Registrar Judge Copy sent to parties on: June 9, 2022 Remedy An appeal can be lodged against this decision, the interim decision and the extension decision with the Administrative Jurisdiction Division of the Council of State within six weeks of the date on which this decision was sent. 1(ECLI:NL:RVS:2011:BR5704) 2(ECLI:NL:RVS:2012:BX4694) 3ECLI:EU:C:2017:994
