Rb. Midden-Nederland - UTR- 20 817 en UTR 20 3081
|Rb. Midden-Nederland - UTR- 20 _ 817 en UTR 20_3081|
|Court:||Rb. Midden-Nederland (Netherlands)|
|Relevant Law:||Article 77 GDPR|
Article 78(2) GDPR
4:13 General Administrative Law Act
|National Case Number/Name:||UTR- 20 _ 817 en UTR 20_3081|
|European Case Law Identifier:||ECLI:NL:RBMNE:2020:4442|
|Original Source:||de Rechtspraak (in Dutch)|
The Court of First Instance of the Central Netherlands confirmed that the Dutch DPA (Autoriteit Persoonsgegevens) is obliged to either send a progress report to the complainant or close the investigation completely within 3 months.
Where a complaint cannot be handled within 3 months, AP is obliged to: (i) deal with the complaint within a reasonable period; (ii) keep the complainant updated of the progress withing a reasonable period and inform the complainant if an investigation or coordination with other supervisory authorities is required.
English Summary[edit | edit source]
Facts[edit | edit source]
On 21 of January 2019 complainant lodged a complaint with Autoriteit Persoonsgegevens against a data broker called Focum. In his view, Focum processed his data unlawfully and wrongly rejected his erasure request. On 21 of February 2020 complainant started a court case against Autoriteit Persoonsgegevens for not deciding on his complaint on time and demanding compensation.
Dispute[edit | edit source]
Complainant believes that AP is obliged to issue a decision within a reasonable timeline, which is 8 weeks according to the Dutch Administrative law.
Autoriteit Persoonsgegevens disagrees: Article 78(2) GDPR defines the applicable time frame in line with Article 4:13(1) of the Dutch Administrative law. AP must inform complainant of the progress or settlement of the complaint within 3 months.
Holding[edit | edit source]
The Court ruled against complainant’s arguments for the following reasons:
1) Article 78(2) GDPR defines the applicable time frame in line with Article 4:13(1) of the Dutch Administrative law. The reason for not putting a deadline in the law is because complaints can lead to long and complex investigations and include cross-border data processing, meaning that other supervisory authorities might need to get involved.
2) According to Recital 141 GDPR, AP must update complainant within a reasonable period. In this case, AP sent an email to complainant on 20 march 2019, which counts as a progress report even if it doesn’t explicitly say so in the email itself. Moreover, the email stated that the investigation involved cross-border processing and that the complaint may be handled together with other European supervisory authorities.
3) When assessing whether the decision on the complaint took too long, the Court took the following into account:
- AP was conducting their investigation based on several different complaints from different people.
- The investigation included an on-site inspection and coordination with other supervisory authorities in the EU.
- COVID-19 measures that have slowed the AP down.
The Court concludes that the reasonable period mentioned in Recital 141 has not yet been exceeded.
4) This large-scale investigation was necessary and follows from the complaint, contrary to what complainant argued during the hearing.
5) AP kept complainant sufficiently informed of its investigation. Incidentally, one of the notices could not be considered a progress report, however, the subsequent notices from the AP were enough. AP also could not share more detail with the complainant in order to prevent Focum from finding out about the investigation.
Because of the above, the complaint about the late decision was filed prematurely and is inadmissible. AP was handling the investigation at a reasonable pace and kept informing complainant at a reasonable period.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
Statement COURT OF THE MIDDLE NETHERLANDS Seat in Utrecht Administrative law case numbers: UTR 20/817 and UTR 20/3081 Judgment of the Multi-Judge of 15 October 2020 in the case between [plaintiff], at [residence], plaintiff (authorized representative: mr. L. Brouwers), in the Dutch Data Protection Authority, defendant (Agents: mr. E. Nardelli and mr. OS Nijveld). Process course This judgment concerns the appeal submitted by the plaintiff because the defendant did not decide on his complaint in time. This judgment also concerns the appeal that the plaintiff filed on August 25, 2020 against the decision of the defendant of July 16, 2020, in which the defendant declared the claimant's objection against the decision of February 4, 2020 unfounded. In the decision of 4 February 2020, the defendant established that no penalty payments were forfeited for failing to make a timely decision. The defendant has submitted two statements of defense. The court has handled the appeals jointly. The hearing took place on September 23, 2020. Plaintiff appeared, assisted by his representative. The defendant was represented by his agents. Considerations What is this statement about? Plaintiff has filed a complaint against Focum. Focum is a trade information agency that collects data from consumers to make it available to clients with the aim of limiting their financial risks. Plaintiff, when he wanted to conclude a contract with an energy supplier, discovered that Focum processes his personal data. The plaintiff finds this processing unlawful and wishes to exercise his right to be forgotten. Focum wants to cooperate in this, but then the plaintiff must send in his ID and he does not want that. Plaintiff has offered Focum an alternative: he wants to visit Focum with his ID. Focum refuses this, because the company states that it is not set up for such a method. The plaintiff therefore submitted a complaint as referred to in Article 77, first paragraph, of the General Data Protection Regulation (GDPR) to the defendant on 21 January 2019. In the complaint, the plaintiff argues that Focum incorrectly processes personal data and that Focum wrongly does not implement the plaintiff's right to be forgotten. The respondent must impose an appropriate sanction on Focum, according to the plaintiff. Because the defendant has not yet decided on the complaint and the plaintiff believes that it should have, the plaintiff filed an appeal with the court on February 21, 2020. The plaintiff also wants an assessment of the decision in which the defendant has refused to pay him penalties for the late decision. According to the plaintiff, the defendant is obliged to do so. The plaintiff has therefore submitted a separate notice of appeal against the decision of 16 July 2020. Which decision period should the defendant adhere to when dealing with a complaint? The relevant regulations are included in an appendix. That appendix is part of the judgment. The court finds that the plaintiff's complaint must be regarded as a request for enforcement within the meaning of the General Administrative Law Act (Awb). This was the intention of the legislator, as appears from the explanatory memorandum to the Implementation Act of the General Data Protection Regulation (UAVG). 1 4. The question now is within what period the respondent must decide on the plaintiff's complaint. Respondent refers to Article 78, second paragraph, of the GDPR and takes the position that this article contains a statutory decision period as referred to in Article 4:13, first paragraph, of the Awb. Under Article 78, second paragraph, of the GDPR, the defendant is obliged to inform the plaintiff within three months of the progress or the settlement of his complaint. 5. Plaintiff sees this differently. According to him, Article 78, second paragraph, of the GDPR does not contain a hard statutory decision period, as referred to in Article 4:13, first paragraph, of the Awb. After all, it does not say until when the defendant could make a final decision on the complaint. The absence of such a statutory decision period means, on the basis of Article 4:13, first paragraph, of the Awb that the complaint must be completed within a reasonable period of time after receipt of the application. A reasonable term is a term of eight weeks according to the second paragraph of that article. This means that the plaintiff's complaint should have been handled by the defendant eight weeks after it was received. This has wrongly not happened. 6. Plaintiff cannot be proved right. Article 78 of the GDPR does contain a decision period as referred to in Article 4:13 of the Awb. This is explicitly intended by the legislator, in view of the explanation to the UAVG. Both the explanatory memorandum to the UAVG, 2 and the explanatory memorandum to the UAVG, 3 state that Article 78 of the GDPR is a term as referred to in Article 4:13, first paragraph, of the Awb. The fact that no clear end date for the decision is mentioned in Article 78 of the GDPR does not change this. The reason why no end date can be set for the handling of a complaint such as this one is that the investigation of such a complaint can be very time consuming. It can lead to large-scale and complex investigations. If a complaint also concerns cross-border processing of data, the respondent must coordinate his actions with the supervisory authorities from other countries that are involved in this data processing. Before a decision can be taken, a draft of that decision must first be submitted to all supervisory authorities involved. The supervisors must reach an agreement and, if that is not successful, can still refer a dispute to the European Data Protection Board. In such cases, the respondent has little or no influence on the duration of the handling of the complaint. This means that an end date for the handling of the complaint cannot be given and that this is not intended by the legislator. 7. Where the respondent is bound by virtue of Article 78 of the GDPR, it is that he sends a notification of the progress to the claimant within a period of three months or settles the complaint within that period. The recitals of the GDPR, which explain the articles of the law, also state under 141 that the defendant must inform the plaintiff within a reasonable period of time of the progress and the outcome of the complaint. In the opinion of the court, what a reasonable term is depends on the concrete situation. Furthermore, recital 141 states that if the case requires further investigation or coordination with another supervisory authority, interim information should be provided to the data subject. 8. In summary, the respondent is therefore obliged to: - send the plaintiff within three months either a notice of the progress or to deal with his complaint in its entirety. If the complaint is not resolved within three months, the respondent must: settle - the complaint within a reasonable period of time; - and in the meantime, keep the claimant informed of progress within a reasonable period and whether an investigation or coordination with another supervisory authority is required. The court will discuss below whether the defendant has met these requirements in this case. Has the defendant informed the claimant about the progress within three months or has the complaint fully dealt with? 9. It is a fact that the defendant did not deal with the complaint within three months, so in this case it must be assessed whether the defendant notified the claimant of the progress within three months. Respondent states that this has been complied with and refers to the e-mail of 20 March 2019, which he claims is a progress message. Plaintiff is of the opinion that this e-mail cannot be regarded as a progress message as referred to in Article 78, second paragraph, of the GDPR, because according to him, this message only requests additional documents. 10. The court does not follow the plaintiff in his position. In doing so, the court first of all establishes that a progress report as referred to in Article 78, second paragraph, of the GDPR is free of form. There are no requirements in the GDPR that such a message must meet. It is true that the e-mail message of 20 March 2019, unlike, for example, the letters of 5 September and 10 December 2019, does not explicitly state that it concerns a progress message, but that does not alter the fact that the plaintiff is actually aware of this e-mail message. posed of progress. In the e-mail message the plaintiff was informed that the defendant will investigate what he can do to deal with the complaint, so that it is clear that the complaint has actually been dealt with. The message also states that the complaint concerns the international processing of personal data and that this affects the handling of the complaint. It also states that the plaintiff's complaint may be handled in collaboration with other European supervisory authorities, which may take some time to process. In the opinion of the court, the defendant informed the claimant of the progress with this e-mail within three months of the submission of the complaint in accordance with Article 78, second paragraph, of the GDPR and recital 141 of the GDPR. Has the defendant observed the reasonable period in handling the plaintiff's complaint? 11. With the submission of the legal documents, the defendant has enclosed documents relating to the investigation he is conducting in response to the plaintiff's complaint. He has requested the court for limited access to these documents. By decision of April 22, 2020, the court decided that there are compelling reasons not to notify the plaintiff of those documents. The plaintiff has subsequently given the court permission as referred to in Article 8:29, paragraph 5, of the Awb to include the documents whose confidentiality is permitted in the assessment of his appeals. 12. The respondent initially referred to these so-called 8:29 documents to substantiate its position on the duration of the investigation into the complaint. However, on September 10, 2020, he sent a progress notice to the claimant containing partly the same information, which can be shared from that moment on. During the hearing, the respondent provided further information on the duration of the investigation. From the 8:29 documents, the progress notice of September 10, 2020 and the explanation of the respondent during the hearing, the following appears. Not only has plaintiff complained to defendant about Focum, but more complaints have been received about this company. Respondent has bundled these complaints. These complaints fall within the defendant's focus area 'Data trade'. Respondent intends to pay extra attention to complaints about data trade in the coming years. That is why research is now being done on a number of trade information agencies, including Focum. Respondent has further explained that an investigation into a trade information agency, such as Focum, is a lengthy process because of the size, complexity of the processing operations and the assessment thereof. Part of the investigation is an on-site investigation at the Focum office. This investigation was announced in advance because of the Covid-19 measures, contrary to what is normally the case, and took place in the week of September 14, 2020. The on-site investigation took three days and, due to the absence of certain employees at Focum, still not completed. After the on-site investigation, the investigation data is processed. This can lead to further investigation. After that, both sides will have to be heard with Focum. If a violation is found, the respondent will then draw up a report and start an enforcement process. Respondent further explained that the investigation into Focum has an international component, whereby he is dependent on feedback from regulators from other Member States of the European Union. Finally, the respondent also mentioned that, due to the nationwide lockdown as a result of the Covid-19 pandemic, the on-site investigation was carried out later than would otherwise have been the case. 13. The court finds that with this explanation the defendant has sufficiently explained why the plaintiff's complaint has not yet been decided at the time of the plaintiff's notice of default, but even now. This is an extensive investigation, which not only concerns the plaintiff's complaint, but also complaints from other people. Respondent has sufficiently explained that the settlement of the plaintiff's complaint requires a response to legally complex questions that transcend national borders and, apart from delays due to measures in connection with the Covid-19 measures, is a long process. This leads the court to conclude that the reasonable period referred to in recital 141 of the GDPR to decide on the claimant's complaint has not yet been exceeded. 14. The plaintiff stated during the hearing that he did not want his complaint to be included in a large-scale investigation. According to him, this is just a simple complaint, which the defendant could and should have settled independently of the large-scale investigation. According to the plaintiff, the defendant only had to consider his right of access. By failing to do so, the reasonable term has been exceeded, according to claimant. 15. Plaintiff is not right in this. The wording of the plaintiff's complaint of January 21, 2019 shows that the plaintiff's primary position is that his personal data are being unlawfully processed by Focum and that he wants to exercise his right to be forgotten, without sending a copy of his passport. The respondent has interpreted this as meaning that the plaintiff complains both about the unjustified data processing and about the exercise of his right of access, but that does not follow from the complaint itself. The claimant is concerned that Focum unlawfully processes his personal data and that this must stop. Respondent has rightly pointed out that to determine whether Focum's data processing is unlawful, it is precisely this large-scale investigation that serves and that the plaintiff's complaint cannot therefore be separated from this investigation. Has the defendant kept the claimant sufficiently informed of the progress? 16. After the aforementioned e-mail message of 20 March 2019, the defendant informed the claimant on 14 May 2019 that his complaint will be handled by a different department than before. He regards this communication as a progress message. On September 5, 2019 and on December 10, 2019, the respondent sent the plaintiff letters explicitly stating that it concerns a progress report. The letters of September 5 and December 10, 2019 are the same in content. The respondent has explained in these letters that questions were put to Focum on 15 May 2019 and that these questions were answered on 19 June 2019. Respondent further states that he needs more time to reach a decision because he is in the process of assessing Focum's questions and is conducting further investigations in response to these answers. After the plaintiff failed to submit his appeal in time, the defendant sent three more progress notices, namely on 9 March 2020 and on 1 September and 10 September 2020. In the notice of 10 September 2020, the defendant provided more information about the scope of the investigation into Focum and the steps taken so far. 17. The GDPR does not require the defendant to send a progress report every three months. The respondent must, however, regularly (within a reasonable period as referred to in recital 141 of the GDPR) inform the claimant of the progress. The court is of the opinion that the defendant has done the same here. Incidentally, the court does not consider that the notice of 14 May 2019, in which the plaintiff was informed that the file would be dealt with by another department, can be regarded as a progress report. This letter does not show that the transfer to another department means a scaling up of the handling of the plaintiff's complaint, as the respondent has explained. However, the subsequent messages of September 5, 2019 and December 10, 2019 can be regarded as progress messages. Respondent explained during the hearing that he could not disclose more details about the investigation because, if more information became known about the investigation and Focum became aware of it, Focum could anticipate that investigation. The defendant wanted to avoid this investigation risk and the court finds this justified. In the progress reports of September 5, 2019 and December 10, 2019, the respondent did report what had actually been done to deal with the plaintiff's complaint and also stated that the plaintiff's complaint was still being dealt with. worked. This is sufficiently specific in this situation. The fact that these messages, just like the message of 9 March 2020, are otherwise the same in terms of content and nothing more is mentioned about foreign research in them, does not alter this. Respondent has made it sufficiently clear that he could no longer disclose about the investigation, but that he did want to make it clear that work was being done behind the scenes on the settlement of the plaintiff's complaint. The court is of the opinion that at the time when the plaintiff declared the defendant in default on 20 January 2020, there was no further question of a situation in which the plaintiff was ignorant of the progress. After all, the last progress report was dated 10 December 2019, which means that the frequency of reporting is also in order. What does this mean for the claimant's appeals? 18. It follows from what has been considered above that the respondent has complied with his obligation as referred to in Article 78, second paragraph, of the GDPR because he has informed the claimant of the progress of the handling of his complaint within three months. It was also mentioned that the complaint may be handled in collaboration with other European regulators. The respondent has also subsequently informed the claimant sufficiently in the meantime within a reasonable period of time and the reasonable period to decide on the complaint has not been exceeded at this time. This means that the notice of default of 20 January 2020 was submitted prematurely - that is, too early. If a notice of default has been lodged prematurely, the subsequent appeal against the late decision is inadmissible. So that's the case here. Because the defendant is not yet too late with a decision on the plaintiff's complaint, no penalty payments have been forfeited and the defendant is therefore not owed any penalty payments to the plaintiff. The appeal against the decision of 16 July 2020 is therefore unfounded. Is the claimant entitled to reimbursement of his legal costs? 19. In the event of an inadmissible and unfounded appeal, it is not likely that the plaintiff will be reimbursed for his legal costs. After all, he has not been proved right by the court. In this case, however, the court has investigated whether there is reason to reimburse the plaintiff's legal costs. This could be the case if the frequency and content of the progress messages left something to be desired. After all, although the GDPR does not provide a firm decision period, the option of lodging an appeal against a timely decision offers a legal option for a court to assess whether the defendant meets the requirements referred to in Article 78, second paragraph, of the GDPR and whether he is acting in accordance with recital 141 of the GDPR. Until the complaint has been settled, the plaintiff can always not submit such an appeal in time. The plaintiff himself cannot assess whether the complaint will be handled in accordance with the regulations and can only have this assessed by the judge. This is partly because the latter can assess the content of the progress messages in the light of, among other things, the content of the secret documents. As has been considered above, the court finds the progress reports sufficient in terms of content and frequency. Therefore, the defendant does not have to reimburse the plaintiff's legal costs. Decision The court declares: - the appeal late inadmissible; - declares the appeal against the decision of 16 July 2020 unfounded. This statement was made by mr. VE van der Does, chairman, and mr. MP Glerum and mr. M. Eversteijn, members, in the presence of mr. MEC Bakker, registrar. The decision was issued in public on October 15, 2020.