Rb. Midden-Nederland - UTR 20/523
| Rb. Midden-Nederland - UTR 20/523 | |
|---|---|
 | |
| Court: | Rb. Midden-Nederland (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 15 GDPR |
| Decided: | 26.04.2021 |
| Published: | 09.05.2022 |
| Parties: | State Secretary of Justice and Security |
| National Case Number/Name: | UTR 20/523 |
| European Case Law Identifier: | ECLI:NL:RBMNE:2021:1703 |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | de Rechtspraak (in Dutch) |
| Initial Contributor: | Eva Lu |
The District Court Midden-Nederland held that a data subject had the right to a copy of personal data being processed and not the actual documents in which his data was processed pursuant to Article 15 GDPR. It also held that the overview provided has to be in a clear and comprehensible form.
English Summary
Facts
On 9 July 2019, the data subject made a request to the Ministry of Justice and Security (the controller) to access his personal data pursuant to Article 15 GDPR. The controller decided to reject this request on 15 October 2019.
During the hearing on 26 November 2019, the controller deemed the data subject's request to be formulated too generally. In response to this, the data subject specified it by requesting access to the personal data processed during the exchange of documents by the Dutch Immigration and Naturalization Service with the civil registry of the municipality and the Court of Appeal of Arnhem-Leeuwarden. The data subject specifically wanted to know which personal data had been processed in connection with the procedure before the Court of Appeal concerning an alleged sham paternity recognition of his daughter, and by which departments these data had been processed.
In the contested decision from 19 December 2019, the controller considered the data subject’s objection to the decision as unfounded since his request did not concern personal data that had been processed by the Repatriation and Departure Service. Moreover, the data subject had initially failed to respond sufficiently to the request of the controller to provide additional information regarding his request to access. Consequently, there is no right to penalty payment due to the failing of a timely decision as the controller had the right to reject the data subject's application as unfounded.
The data subject appealed this decision.
Holding
First, the data subject was interested in the detailed documents and appendices in which his personal data had been processed. In the District Court’s opinion, the data subject had no right to this under Article 15 GDPR. This Article does not provide the right to physical or digital copies in which the personal data has been processed. This is further specified in Article 15(3) GDPR as it states that the data subject has the right to a copy of the personal data itself and not a copy of the document in which the data is processed. However, he has a right to an overview, in comprehensible form, of all personal data. As a result, the data subject cannot obtain a copy of the original document or file containing the data.
Second, the data subject submitted that from the overview provided by the controller, it is not possible to ascertain who provided residence documents submitted in the appeal of the municipality, the legal basis for the submission of these documents and what exactly was said and written down. The District Court held that the questions raised regarding the submission of documents in the appeal of the municipality are not relevant in this appeal on the assessment of the GDPR.
Finally, the data subject had argued that the overview of personal data provided by the controller was insufficient as it was unclear which data had been processed. The District Court agreed with the data subject and ordered the controller to rectify this and take a new decision in consideration of this ruling within four weeks after publication of this case.
To summarize, the District Court held that the overview of personal data provided by the controller was insufficient under Article 15 GDPR. The District Court also further explained that while Article 15 GDPR grants the data subject the right to a copy of their personal data being processed, it does not grant access to the documents in which their data is processed.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
CENTRAL NETHERLANDS COURT Seating location Utrecht Administrative law case number: UTR 20/523 ruling of the single chamber of 26 April 2021 in the case between [claimant] , at [place of residence] , claimant (authorized representative: mr. E.C. Weijsenfeld), and the State Secretary for Justice and Security, defendant (Agent: mr. S. Raterink). Process sequence In the decision of 15 October 2019 (primary decision), the defendant rejected the claimant's request for access to his personal data. In the decision of 19 December 2019 (contested decision), the respondent declared the claimant's objection against the primary decision unfounded. The applicant appealed against the contested decision. Defendant has filed a statement of defence. The hearing during the hearing took place on August 18, 2020. Plaintiff was represented by his authorized representative. Defendant was represented by his authorized representative. After the hearing, the investigation was suspended in order to give the defendant the opportunity to provide the plaintiff's representative with an overview of the correspondence from DT&V and the municipality [place of residence] and of the IND and the municipality [place of residence] about the provision of information. personal data of the claimant in documents by the defendant to the municipality [place of residence] . In a letter dated September 14, 2020, the defendant provided an overview of the processing of the plaintiff's personal data by the DT&V and the IND with the municipality of [place of residence]. The appropriate safeguards taken by the defendant to protect the plaintiff's privacy are also discussed in more detail. By letter dated October 16, 2020, the claimant responded to the overview provided by the respondent. On November 23, 2020, the court closed the investigation, with the parties' permission to settle the case without further hearing. Considerations Introduction 1. On 9 July 2019, the Claimant submitted a request for access to his personal data to the Minister of Justice and Security, pursuant to Articles 12 and 15 of the General Data Protection Regulation (GDPR)1. On November 26, 2019, the claimant further specified this request during the hearing because, according to the respondent, it was formulated too generally. Plaintiff has requested access to his personal data that were processed during the exchange of documents by the IND with the registry office of the municipality [place of residence] and the Arnhem-Leeuwarden Court of Appeal. The claimant specifically concerns the personal data that have been processed during the proceedings before the Court of Appeal about the alleged false recognition of his daughter, and the question by which service these data have been processed. In the contested decision, the defendant declared the objection unfounded because the request does not relate to personal data processed by DT&V. Moreover, according to the respondent, the claimant initially responded insufficiently to the respondent's request to provide additional information regarding the request for inspection, so that there is no entitlement to a penalty payment for late decision. Amended decision 2. The overview provided by the respondent as a result of the hearing and the accompanying motivation mean that the respondent has no longer upheld the contested decision. The court regards the defendant's letter of 14 September 2020 as an amended decision to that extent. 3. Pursuant to the provisions of Article 6:19 of the General Administrative Law Act (Awb), the appeal is also directed against the amended decision. In view of what was put forward by the claimant in the letter of October 16, 2020, the amended decision did not fully comply with the request. Plaintiff therefore has an interest in a substantive assessment of the amended decision. The appeal against the (contested) decision of 19 December 2019 will be declared inadmissible due to the lack of legal interest, because this decision has been replaced by the decision of 14 September 2020. Assessment grounds for appeal 4. It has become apparent from the further grounds and from the proceedings at the hearing that the plaintiff's concern is, among other things, to provide the documents and appendices in full in which personal data concerning him have been processed. In the opinion of the court, the claimant is not entitled to this in the context of his application. Article 15 of the GDPR does not entitle you to copies of the physical or digital documents in which the personal data are processed. Article 15(3) of the GDPR only refers to the provision of a copy of the personal data itself and not a copy of the document in which the personal data has been deposited. There is, however, a right to an overview, in comprehensible form, of all personal data. That is, in a form that enables the data subject to take cognizance of his data and to check whether they are correct and have been processed in accordance with the GDPR. The Claimant cannot derive the right from the GDPR to obtain a copy of the original document or file containing the data, if the request for access can be met by means of another form of provision. The ground of appeal fails. 5. Furthermore, the claimant has submitted that it cannot be deduced from the overview provided by the respondent who provided the residence documents that were submitted in the appeal of the municipality [residence], what the legal basis for the submission of these documents is and what exactly has been said and written down. The interests of the claimant have been harmed by the transfer of these documents. Contrary to the claimant's view, the court sees no reason in the residence documents submitted by him on appeal to conclude that the further search made by the defendant into the processing of personal data by the defendant was incomplete. The fact that the claimant states that it has not given permission for the municipality [place of residence] to submit residence documents in the aforementioned appeal does not mean that the respondent has not complied with the obligation to grant access to the claimant's personal data within the framework of the AVG. The questions raised by the claimant in this regard about the submission of documents in the appeal of the municipality [place of residence] do not form part of the assessment in this appeal about the AVG. The ground of appeal fails. 6. Finally, the claimant has argued that it does not follow from the overview provided by the respondent which personal data of the claimant have been processed under point 15. The court follows the claimant on this point. The mere remark that the document is in the possession of the authorized representative and the applicant is not sufficient to enable the claimant to take cognizance of his data and to check whether those data are correct and have been processed in accordance with the GDPR. The claimant's appeal to that extent succeeds. Penalty sum not making a timely decision 7. In the opinion of the court, the respondent has rightly decided, in response to the claimant's request for periodic penalty payments for late decision, that he is not entitled to this. In this situation, Article 8:55c of the Awb is not applied and the defendant does not owe a penalty. This is because a situation arises as referred to in Article 4:17, sixth paragraph, under c of the Awb, now that the application was manifestly unfounded. After the claimant had given the defendant notice of default in a letter dated September 10, 2019, he was requested by letter dated September 19, 2019 to supplement the application with information to which the request relates. Because the claimant has not clearly supplemented the application, the defendant was able to declare the application manifestly unfounded. Only in objection did the claimant make clear what his request for access to personal data was about. 8. The appeal against the decision of 14 September 2020 is well-founded, due to the lack of reasons for point 15 of the overview of personal data provided (see legal consideration 6). Respondent will have to make a new decision with due observance of this ruling. This means that the defendant will have to provide an overview with an amended motivation under point 15 in order to meet the requirements of the GDPR. 9. The court sees reason to order the defendant in the appeal costs incurred by the plaintiff. The court sets these costs on the basis of the Administrative Costs Decree for legal assistance provided professionally by a third party at €1,068 (1 point for submitting the notice of appeal and 1 point for appearing at the hearing, with a value per point of € 534,- and a weighting factor 1). 10. Since the District Court declares the appeal well-founded, the District Court determines that the defendant reimburses the applicant for the court fee paid by him. Decision The court: † declares the appeal against the decision of 19 December 2019 inadmissible; † orders the defendant to reimburse the plaintiff for the court fee paid of € 178; † orders the defendant to pay the plaintiff's legal costs to an amount of € 1,068. † declares the appeal against the decision of 14 September 2020 well founded; † annuls the decision of 14 September 2020 insofar as it does not state under point 15 which personal data of the claimant have been processed; † instructs the defendant to take a new decision on the objection within four weeks of the date on which this decision was sent, with due observance of this decision. This statement was made by mr. L.M. Reijnierse, judge, in the presence of mr. E.H.W. Schierbeek, clerk. The decision was handed down on April 26, 2021 and will be made public by publication onsrecht.nl. clerk judge A copy of this ruling has been sent to the parties at: Do you disagree with this statement? If you do not agree with this ruling, you can send a letter to the Administrative Jurisdiction Division of the Council of State explaining why you do not agree with it. This is called an appeal. You must submit this notice of appeal within six weeks of the day on which this decision was sent. You can see this date above. 1 Regulation 2016/679 of the European Parliament and of the Council of the European Union of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/ EC (the GDPR).
