Rb. Midden-Nederland - C/16/573226 / HL RK 24-29
| Rb. Midden-Nederland - C/16/573226 / HL RK 24-29 | |
|---|---|
 | |
| Court: | Rb. Midden-Nederland (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 15(1)(c) GDPR Article 15(1)(g) GDPR Article 23 GDPR Article 41(1)(e) UAVG |
| Decided: | 30.10.2024 |
| Published: | 30.12.2025 |
| Parties: | GRAYDON NEDERLAND B.V. |
| National Case Number/Name: | C/16/573226 / HL RK 24-29 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Dutch |
| Original Source: | De rechtspraak (in Dutch) |
| Initial Contributor: | Eleonora |
The court imposed a penalty to the controller of 100,00 a day with a maximum of 2.000 euros until the controller provides a complete list with identities of recipients under Article 15(1)(c) GDPR to the data subject.
English Summary
Facts
The data subject made 9 access requests to the controller, two of the requests were not answered. On 8 April 2024, the data subject initiated legal proceedings against the controller before the district court. They argued that the controller violated Article 15(1)(c) GDPR because the controller did not give a full list of recipients of their personal data. The data subjects also wants access to who they share and will share personal data with in the future, especially recipients in third countries and international organisations.
Second, the data subject argued that the controller must, under Article 15(1)(g) GDPR, reveal the source of the data. The data subject also claims the controller violated Article 12(1) until 12(4) GDPR.
The controller argued that they have no obligation to share the identity of third parties because this is confidential business information. Therefore, the controller feels that they can partially restrict the data subject’s right of access based on Article 23 GDPR and Article 41(1)(e) of the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming – UAVG) The controller reacted to the second point and claims that all personal data is taken from one public source (de Kamer van Koophandel).
Holding
First, the court assessed if the controller could rely on Article 41(1)(e) UAVG and Article 23 GDPR to deny an access request.
The court did not find that a list of clients could damage the controller’s financial interests based on Article 41(1)(e) UAVG. The court found that the controller did not demonstrate why their customer base is a business secret. The controller did not explain how the size of the customer base and the identity of the third parties requested by the data subject negatively influenced its financial interests. Overall, the protection of business secrets is not a fundamental right and the rights of the data subject have priority over the rights of the controller.
Furthermore, the controller does not have an obligation to share what parties they will share personal data with in the future. The controller is only obligated to share what information they shared personal data with up until the access request.
The court evaluated Article 15(1(g) GDPR and decided that the controller also gave enough evidence that the Kamer van Koophandel was their only source.
Third, the court found that the court rejected the data subject’s claim that the controller violated Article 12(1) until 12(4) GDPR because the data subject gave no arguments.
Thus, the court largely rejected the claims made by the controller. The court ordered the controller to give a complete list of third parties with which they shared the data subject’s personal data. The regional court imposed a penalty to the controller of 100,00 a day with a maximum of 2.000 euros. The controller must pay the data subject 370,00 euros for procedural costs
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
Order CENTRAL NETHERLANDS COURT Civil Law Commercial Chamber Lelystad Location Case number / Petition number: C/16/573226 / HL RK 24-29 Order of October 30, 2024 in the case of [Applicant], residing in [place of residence], Applicant, hereinafter referred to as [Applicant], appearing in person and 1. the private limited liability company GRAYDON NEDERLAND B.V., established in Amsterdam, 2. the private limited liability company CREDITSAFE NEDERLAND B.V., established in Amsterdam, 3. the public limited company GRAYDON HOLDING N.V., established in Amsterdam, interested parties, hereinafter referred to as GraydonCreditsafe, attorney Mr. E.E. Troll in Amsterdam. 1 The proceedings 1.1. The course of the proceedings is apparent from: - the petition with 12 appendices, received by the registry on April 8, 2024; - the statement of defense with 1 appendix, received by the registry on September 24, 2024; - the oral hearing on October 2, 2024, at which the following appeared: - [petitioner]; - Mr. Troll, aforementioned; - [A], lawyer at GraydonCreditsafe; - Mr. Troll's speaking notes. 1.2. The judgment is set for today. 2 The facts 2.1. GraydonCreditsafe is a trade information agency that creates business insights based on company data from various (public) sources, such as the Trade Register of the Chamber of Commerce. 2.2. GraydonCreditsafe processes both company data and personal data. GraydonCreditsafe is therefore the controller (Article 4(7) of the General Data Protection Regulation, hereinafter GDPR). 2.3. [Applicant] is the director and sole shareholder of [company] B.V. This company is registered in the Trade Register of the Chamber of Commerce. 2.4. On February 7, 2024, [Applicant] submitted a request for access to data to GraydonCreditsafe. [Applicant] posed nine questions to GraydonCreditsafe. 2.5. GraydonCreditsafe failed to answer two of the nine questions. 3 The Request and the Defense 3.1. [Applicant] requests the court to order GraydonCreditsafe: to provide all recipients to whom (his) personal data has been or will be disclosed, in particular recipients in third countries or international organizations, to him (Article 15(1)(c) GDPR); To oblige [the applicant] to provide him with all available information about the source of (his) data (Article 15, paragraph 1, subparagraph g, GDPR); To order [the applicant] to violate Article 12, paragraphs 1 through 4, GDPR; To have the costs of the proceedings reimbursed; To impose a reasonable penalty for each day that Graydon fails to fully comply with the request. 3.2. [Applicant] bases his request on the following: GraydonCreditsafe has provided [applicant]'s personal data to third parties, and [applicant] has the right to know who these third parties are. Despite repeated requests, GraydonCreditsafe has not answered the two remaining questions posed by [applicant]. [Applicant] also indicated that he made the request as a private individual and that it concerns access to his personal data. Finally, [applicant] stated that he wishes to receive a list of the names of the recipients. [Applicant] is not satisfied with the categories of recipients. 3.3. GraydonCreditsafe's defense is that [applicant]'s request should be rejected and that [applicant] be ordered to pay the legal costs incurred. 4 The Assessment 4.1. [Applicant] has requested access pursuant to Article 15 of the GDPR. 4.2. The right of access may be restricted by Union or Member State law under the conditions set out in Article 23 of the GDPR and in light of the interests stated in that provision. Article 41 of the General Data Protection Regulation Implementation Act (hereinafter: GDPR) contains exceptions under which the right of access may be waived. The controller may waive the right of access and refuse access if, in summary, this is necessary for the protection of the data subject or the rights and freedoms of others (Article 41 GDPR, paragraph 1(e)). 4.3. GraydonCreditsafe has argued that [the applicant]'s right of access must be restricted pursuant to Article 41, paragraph 1(e) of the GDPR. The protection of others also includes GraydonCreditsafe's own right. The recipients are GraydonCreditsafe's customers, and the names of the customers constitute confidential business information, which GraydonCreditsafe is entitled to, according to GraydonCreditsafe. 4.4. The court finds that GraydonCreditsafe has insufficiently substantiated that providing the list of customers to [the applicant] could be detrimental to it, specifically to GraydonCreditsafe's competitive position. GraydonCreditsafe's appropriate customers are banks, credit institutions, and municipalities, as GraydonCreditsafe has stated. Their identities are generally known. It is possible that the list contains the names of one or more customers who may not be known in the industry as regularly requesting credit information. However, if GraydonCreditsafe loses one or two customers to one of its competitors, this should not jeopardize its business operations. If this were the case, then GraydonCreditsafe's business operations would be in disarray. The fact remains that GraydonCreditsafe has been unable to demonstrate the size of its customer base and which portion of it is included in the list of which [the applicant] requests access and a copy. Therefore, it has not been demonstrated that [the applicant]'s request is excessive in nature. 4.5. Furthermore, not every customer base falls under the definition of a "trade secret." GraydonCreditsafe has insufficiently substantiated that its customer base does fall under this definition. Furthermore, the protection of trade secrets is not a fundamental right. GraydonCreditsafe itself argued that it has a special mix of customers. The court infers from this that GraydonCreditsafe and its competitors specialize and focus on different customers. The conclusion is therefore that [the applicant]'s interest must outweigh GraydonCreditsafe's right. 4.6. GraydonCreditsafe has also indicated that it obtained [applicant]'s personal data from the Trade Register of the Chamber of Commerce. There is no evidence that GraydonCreditsafe used any other sources of information. 4.7. The foregoing means that the request under 2 is rejected. The request under 1 is granted, subject to the following. GraydonCreditsafe must only provide the data of the customers to whom it provided [applicant]'s personal data at the time the request was submitted. If [applicant] wishes to inspect the data of customers to whom GraydonCreditsafe provides his personal data in the future, he will have to submit a new request. Under the GDPR, it is not possible to order GraydonCreditsafe to provide this data in advance. 4.8. The request by [the applicant] to order GraydonCreditsafe to violate Article 12, paragraphs 1 through 4 of the GDPR will not be granted, as [the applicant] has not attached any legal consequences to this. 4.9. The court deems it appropriate to impose a penalty. This will be set at €100.00 per day with a maximum of €2,000.00. 4.10. GraydonCreditsafe has been largely unsuccessful and must therefore pay the legal costs. Because [the applicant] was not represented by an attorney in these proceedings, he is eligible for an amount for travel and accommodation expenses, in accordance with Article 238, paragraph 1 of the Code of Civil Procedure. These are estimated at €50.00 because [the applicant] attended a hearing. In addition, GraydonCreditsafe must reimburse [the applicant] the court fee of €320.00 paid by him. 5 The decision The court 5.1. Orders GraydonCreditsafe to provide [the applicant] with a complete list of the recipients to whom [the applicant]'s personal data has been disclosed, in particular recipients in third countries or international organizations, within two weeks of the decision; 5.2. Orders GraydonCreditsafe to pay [the applicant] a penalty of €100.00 for each day or part thereof that it fails to comply with the order issued in 5.1, up to a maximum of €2,000.00; 5.3. Orders GraydonCreditsafe to pay the legal costs of €370.00, to be paid within fourteen days of notification thereof. If GraydonCreditsafe fails to comply with the judgments in a timely manner and the order is subsequently served, GraydonCreditsafe must also pay the costs of service; 5.4. Rejects the additional or alternative request. This order was issued by Mr. C.P. Lunter and pronounced in open court on October 30, 2024.
