Rb. Noord-Holland - C/15/311101 / HA RK 20-227
The District Court of Northern Holland confirmed that the Dutch Youth Act does not legally require municipalities to store 'youth assistance' records, containing children's personal data, for 20 years. The Court strongly criticised the way in which the municipality of Langedijk dealt with a request for erasure of such a record.
| Rb. Noord-Holland - C/15/311101 / HA RK 20-227 | |
|---|---|
 | |
| Court: | Rb. Noord-Holland (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 17(1) GDPR Article 17(3)(b) GDPR Article 35(1) UAVG Article 7.3.8 Jeugdwet Article 7.3.9 Jeugdwet |
| Decided: | 21.05.2021 |
| Published: | 25.05.2021 |
| Parties: | Applicant unknown Langedijk Municipal |
| National Case Number/Name: | C/15/311101 / HA RK 20-227 |
| European Case Law Identifier: | ECLI:NL:RBNHO:2021:4235 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Dutch |
| Original Source: | Court ruling (in Dutch) |
| Initial Contributor: | Kave Noori |
Facts
The case concerns whether the refusal of the municipality of Langedijk to delete data on a minor contained in its youth assistance record was lawful. The request was made by the minor's mother, acting on behalf of her child.
In the Netherlands, municipalities are responsible under the Youth Act (Jeugdwet) for providing what is known as youth assistance (Jeugdhulp). The municipalities must provide support for children under the age of 18 who, for example, have problems in the family, are struggling with mental health problems and similar. Anyone, citizen, or a public authority who is concerned about the wellbeing of a child can file a report of concern (zorgmelding) with the municipality.
In this case, the municipality of Langedijk had received an unspecified number of reports of concern regarding the minor in recent years, which is why there is a file on the minor. The mother demanded that the municipality delete all the data it had on the minor in the file. Almost two months later, the municipality informed her that the request was complex and would take another two months to process.
Less than 4 months after the original request, the municipality responded that it could not delete the requested data. The municipality took the position that it was legally required to retain the data, with the exception of two emails. As a result, the mother and the minor challenged the decision in court under Article 35(1) of the Dutch Act implementing the GDPR (UAVG).
Dispute
Must the municipality delete the data?
The mother argued that the municipality kept more data than was necessary. The mother contended that the data served no purpose because the municipality did not investigate reports of concern and did not provide youth services to the minor. According to the mother, this violated her right to privacy under Article 8 of the European Convention on Human Rights (ECHR). In the mother's view, it was important that inaccurate information did not take on a life of its own. In addition, the mother considered that any information about her and the minor that the municipality held was a violation of her privacy, as the municipality did not practice data minimisation.
The municipality, on the other hand, argued that it was required by law to retain the data. The municipality relied on Article 17(3)(b) GDPR and Article 7.3.8(3) of the Youth Act to argue that it was obliged to retain the data for 20 years, counting from the date of the last modification of the record. Moreover, the municipal argued that the exception in Article 7.3.9(2) of the Youth Act is not applicable until the 20 years have elapsed. The exception in Article 7.3.9(2) of the Youth Act requires that a file be deleted at the request of the data subject unless it must be retained because it is reasonably plausible that it is in the substantial interest of someone who is not the data subject to retain the information and the deletion would violate a law.
Holding
Must the municipal delete the data?
The court concluded that the municipality's decision to refuse deletion of the data was wrong and based on an incorrect interpretation of the statute. The court analyzed the language of Article 7.3.8(3) of the Youth Act which begins with the phrase "without prejudice to the provisions of Article 7.3.9." The court explained that "without prejudice" means that the aforementioned Article 7.3.9 of the Youth Act applies in full in the case and even overrides the provision in Article 7.3.8(3) of the Youth Act so that the data can be deleted within the period of 20 years. Based on this the court held that the municipality must delete the data.
Comment
Criticism of how the municipal handled the case
The court went on to heavily criticize how the municipality had interpreted the law and handled the case. The court found that the municipality incorrectly asserted that it did not have to rely on a substantial interest of a party other than the data subject, pursuant Article 7.3.9(2) of the Youth Act. The court also noted that the municipality intended to argue that the substantial interest of the party other than the data subject, was that the minor potentially would want to read the file as an adult. The court found this contention to be without merit and, if accepted, led to the consequence that in many cases it will be difficult for data subjects to request the deletion of a youth assistance record.
Thereafter the court questioned how the municipality arrived at its legal interpretations. The court considered that if the municipality had read legal literature and previous court rulings it could have concluded that it was applying the law incorrectly. The court noted that there were several previous cases wherein the parents had requested that data would be removed from a youth assistance file, where it was not presumed that the parents had to wait for 20 years.
In conclusion, the court noted that it was under the impression a situation had arisen in the contact with the mother in the where the municipality was all about being proven right and had lost sight of the subject matter. During the proceedings the municipality had submitted many documents containing privacy-sensitive information about the mother, which the court considered irrelevant for the case. The court emphasised the municipality must be careful when deciding which sensitive information it submits in a legal proceeding, as well as that the municipal must take the consequences for the data subject in to consideration and assess if there is a genuine interest in adequate litigation to submit the information. Lastly the court took the view that the municipality's actions confirmed the mothers view that her data was not in good hands with the municipality.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
Body
Court of North Holland
Date of judgment
21-05-2021
Date of publication
25-05-2021
Case number
C/15/311101 / HA RK 20-227
Jurisdictions
Civil rights
Special characteristics
First instance - single
Content indication
Request for destruction of personal data on the basis of Article 17(1) of the GDPR in conjunction with Article 7.3.9(1) of the Youth Act is granted.
Locations
Rechtspraak.nl
Enhanced pronunciation
Share pronunciation
Print
Save as PDF
Copy link
Statement
decision NOORD-HOLLAND COURT Trade, Kanton and Administration Seat Alkmaar case number / application number: C/15/311101 / HA RK 20-227 Decision of 21 May 2021 in the case of 1. [the mother] also in her capacity as legal representative of [minor], both residing in [place of residence], applicants, hereinafter: [applicants], lawyer mr. C.M. Sent in Amsterdam, against the legal entity under public law GEMENTE LANGEDIJK, with its registered office in Noord-Scharwoude, municipality of Langedijk, defendant, hereinafter: the municipality, lawyer mr. E.C. Pietermaat-Smith te Zoetermeer.1 The case in brief This case concerns the question of whether the municipality can use the data in the youth care file of [applicants] on the basis of Articles 17 paragraph 1 of the General Data Protection Regulation (GDPR) and 7.3.9 paragraph 1 Youth Act must destroy. According to the municipality, the data in the youth care file of [applicants] must be kept for at least 20 years, after the last amendment, pursuant to Article 7.3.8 paragraph 3 of the Youth Act. A request to destroy the data in the youth care file can only be made after this statutory period has elapsed. The court rules that the municipality misinterprets Article 7.3.8 paragraph 3 of the Youth Act and must destroy the data of [applicants] in the youth care file.2 The procedure2.1.The course of the procedure is apparent from:- the petition received on 15 December 2020 with exhibits, - the statement of defense received on April 2, 2021, - the e-mail of April 5, 2021 from mr. Sent with exhibits, - the fax message received on April 8, 2021 from mr. Pietermaat-Smith with exhibits, - on April 9, 2021 a skype meeting has taken place. The Registrar has made notes of what the parties have put forward to explain their positions. mr. Sent made use of pleadings, which were submitted.3. Facts3.1.
[the mother] (hereafter: the mother) has a minor son named [minor] (hereafter: [minor] ) born on [date of birth]. In recent years, care reports have been made about [minor].3.2. By e-mail of 9 July 2020 - addressed to, among others, Mr. [xx] (data protection officer) of the municipality - the mother made a request for the destruction of all data available within the municipality of [minor] and her.3.3.Mr [xx] informed the mother by e-mail of 10 July 2020 that she must submit a formal request for the destruction of the personal data. That same day, the mother requests by e-mail that all data of [minor] and herself be destroyed immediately.3.4. By e-mail of September 3, 2020, Mr. [xx] informed the mother that the response period to her request is extended by two months pursuant to Article 12(3) of the GDPR, due to the complexity of the request. 3.5. The municipality decided on that request on November 2, 2020. In it she made it known that she cannot comply with the request of [applicants] because she has a legal processing obligation to keep this data. This with the exception of two e-mail messages. 3.6.
In these proceedings, [applicants] are challenging that decision pursuant to Article 35, paragraph 1 of the General Data Protection Regulation Implementation Act (hereinafter: UAVG), insofar as it relates to the Youth Act.4 The request and the defense4.1.
[applicants] requests the court - as appears from the explanation at the hearing - by order, as far as possible provisionally enforceable: I. order the municipality to destroy and keep destroyed all information about [applicants] relating to the Youth Act, also insofar as this data is stored in the archive system (DMS) or in the specialist application of the municipality.4.2.
[applicants] bases its request on Article 17 paragraph 1 AVG in conjunction with Article 35 paragraph 1 UAVG in conjunction with Articles 7.3.8 and 7.3.17 Youth Act. 4.3. The mother argues that the data serves no purpose whatsoever. According to the mother, youth care was never provided and the care reports made were never followed up. According to the mother, it is very important that incorrect information does not continue to lead a life of its own and that it can be used unnecessarily. The mother also argued that the retention and persistence of the retention obligation constitutes too far-reaching an infringement of her constitutional and treaty guaranteed right to the protection of her privacy pursuant to Article 8 of the European Convention on Human Rights (ECHR). The mother considers all information known to the municipality about her and [minor] to be a disproportionate invasion of her privacy, because the municipality is not reluctant to minimize data. 4.4. The municipality takes the position that Article 17 paragraph 3 under b AVG in conjunction with Article 7.3.8 paragraph 3 Youth Act opposes the request of [applicants] to destroy her data. According to the municipality, [applicants] has no right to have their personal data destroyed, because processing takes place in the context of compliance with a legal obligation of the municipality. According to the municipality, this legal obligation is apparent from Article 7.3.8 paragraph 3 of the Youth Act. This stipulates that the retention period of the youth care file is 20 years, to be calculated from the last amendment. According to the municipality, the personal data in the youth care file can therefore only be destroyed after this statutory period has elapsed. The exception to this in Article 7.3.9 paragraph 2 of the Youth Act only becomes relevant after the statutory retention period has expired, according to the municipality.4.5. The parties' arguments are discussed in more detail below, insofar as relevant.5 The assessment Jurisdiction in civil court 5.1 The court considers itself competent to take cognizance of this request on the basis of Article 7.3.17 of the Youth Act. Admissibility of mother's request on behalf of [minor]5.2.It is no longer in dispute that the mother has sole custody of [minor]. Therefore, as the legal representative of [minor], she can make the present request on the basis of Article 1:253i paragraph 3 of the Dutch Civil Code in conjunction with 7.3.15 Youth Act. Does the municipality have to destroy the data of [applicants] in the youth care file? 5.3. Since 25 May 2018, the AVG has been applicable to the processing and requests for destruction of personal data. 5.4. Pursuant to Article 17, paragraph 1 of the AVG, a data subject has – in this case [applicants] – right to erasure of her personal data. Pursuant to Article 17, paragraph 3, under b of the GDPR, paragraph 1 does not apply if processing takes place in the context of compliance with a legal processing obligation by a controller, in this case the municipality. 5.5. The Youth Act contains information regarding the processing, storage and destruction of personal data has its own regulation that also regulates whether and to what extent the municipality has a retention obligation with regard to the file of the person concerned.5.6. Pursuant to Article 7.3.8 paragraph 3 of the Youth Act, the youth care worker is obliged to keep the file of the person concerned for twenty years to be kept, counting from the time when the last change to the file was made, or for such longer as reasonably ensues from the care of a good youth care provider. Article 7.3.9 paragraph 1 of the Youth Act stipulates that the youth care worker must destroy the data from the file after a request to that effect from the person concerned. Pursuant to Article 12(3) of the GDPR, the youth counselor must in any case destroy the data within three months of the submitted request. Pursuant to Article 7.3.9, paragraph 2 of the Youth Act, this is only different if it is reasonably likely that the retention of the data is of considerable importance to someone other than the person concerned, and insofar as the provisions of or pursuant to the law preclude destruction.5.7. The court ruled that the municipality must destroy the data of [applicants] in the youth care file. The court considers this as follows. At the hearing, the parties confirmed that there is a youth care file of [applicants]. Pursuant to Article 7.3.9 paragraph 1 of the Youth Act, this must be destroyed after a request to that effect from the person concerned. This is only different, as appears from article 7.3.9 paragraph 2 of the Youth Act, if the retention of the data is of considerable importance to others than the applicant, or insofar as the provisions of or pursuant to the law preclude destruction. The municipality's assertion that Article 7.3.8 paragraph 3 Youth Act is a legal processing obligation on the basis of which the municipality must refuse the request of [applicants] to destroy the data during the first 20 years is based on an incorrect reading of this article. After all, Article 7.3.8 paragraph 3 of the Youth Act starts with the phrase “without prejudice to the provisions of Article 7.3.9”. The term "without prejudice" in legislation standard means that the said article applies in full in the described case. This means that Article 7.3.9 of the Youth Act takes precedence over the provisions of Article 7.3.8 of the Youth Act, so that a request for destruction can also be made within a period of 20 years. 5.8. In view of its incorrect interpretation, the municipality has argued that it does not have to invoke a substantial interest of a party other than the applicant, as referred to in Article 7.3.9 paragraph 2 of the Youth Act. Insofar as the municipality nevertheless intended to state that the substantial interest of a person other than the applicant lies in the fact that [minor] might want to consult the youth care file when he becomes an adult, this statement is insufficiently motivated. After all, this starting point would, without further motivation, also mean that in many cases it will not be possible for many years to successfully file a request for destruction. 5.9. The court does not understand how the municipality arrived at the explanation it used. When consulting professional literature and various previous rulings, the municipality could have concluded that it was applying the law incorrectly. After all, there have already been several cases in which parents have requested that data be removed from the youth care file, without the assumption that the parents would first have to wait twenty years. The court has the impression that a situation has arisen at the municipality in which proceedings with the mother are now about being proven right and the municipality has lost sight of the content. This impression of the court also stems from the fact that the municipality has brought many productions at issue in these proceedings, which contain privacy-sensitive information about the mother. When asked, the municipality's lawyer stated that she considered this necessary since the mother disputes that youth care was actually provided. However, that is irrelevant to the decision in this case. After all, there is no discussion about the fact that a youth care file has been created at the municipality and the request for destruction is not based on the claim that this file was created incorrectly. When deciding which privacy-sensitive information to submit in a legal procedure, caution must also be exercised and the consequences for the data subject must be taken into account. It is important to consider whether in the given circumstances a real interest in adequate litigation makes it necessary to submit this information. In the court's view, the municipality has failed to do so sufficiently in the present case. This underlines the view of [applicants] that her data is not in good hands with the municipality. 5.10.The conclusion is that the municipality must destroy the data in the youth care file of [applicants], also insofar as these data are in the archive system (DMS) or in the specialist application of the municipality.Process costs 5.11.The municipality will the unsuccessful party is ordered to pay the legal costs of [applicants].5.12.The costs on the part of [applicants] have so far been estimated at: - court fee € 304.00 - lawyer's salary € 1,126 (2 points × rate II € 563.00) Total € 1,430.006 The decision The court 6.1. instructs the municipality to destroy all information about [applicants] relating to the Youth Act and to keep it destroyed, also insofar as this data is in the archive system (DMS) or stored in the professional application of the municipality,6.2.orders the municipality to pay the costs of the proceedings, estimated on the part of [applicants] to date at €1,430.00,6.3.declares this decision to be executable in stock ,6.4.points it differently or more ve rzoeke af. This decision was given by mr. A.E. Merkus and pronounced in public on May 21, 2021.11type: VBcoll: NMB AEM
