Rb. Rotterdam - ROT 19/4649

Rb. Rotterdam - ROT 19/4649
Court:	Rb. Rotterdam (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:	Article 15 GDPR
Decided:	19.03.2021
Published:	22.03.2021
Parties:	De Staatssecretaris van Justitie en Veiligheid, Dienst Terugkeer en Vertrek
National Case Number/Name:	ROT 19/4649
European Case Law Identifier:	ECLI:NL:RBROT:2021:2305
Appeal from:
Appeal to:	Unknown
Original Language(s):	Dutch
Original Source:	Rechtspraak.nl (in Dutch)
Initial Contributor:	n/a

The District Court Rotterdam holds that the right of access is limited to personal data concerning the data subject. An overview of the available data suffices. The original documents (or a copy) don't have to be provided.

English Summary

Facts

The plaintiff requested access to his personal data processed by The Repatriation and Departure Service (Dienst Terugkeer & Vertrek) on the basis Article 12 GDPR and 15 GDPR. The State Secretary of Justice, on behalf of The Repatriation and Departure Service, provided the plaintiff with an overview. The plaintiff argues not all available, underlying information was provided. He argues that the State Secretary is in therefore in breach of the GDPR. The State Secretary claims he is not in possession of the underlying information the plaintiff is refering to.

Dispute

Should information about people other than the data subject be included in an access request based on Article 15 GDPR? Does Article 15 GDPR require that (copies of) the original documents are provided?

Holding

The District Court Rotterdam holds that the right of access is limited to personal data concerning the data subject. Furthermore, an overview of the requested data suffices. The original documents (or a copy) don't have to be provided.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

ECLI:NL:RBROT:2021:2305 
InstitutionDate 
of judgment Date of publication Case number Jurisdiction Special features Content indication 
Sites 
Pronunciation 
Rotterdam District Court 19-03-2021ROT 
19/4649 Administrative Law 
First instance - single 
AVG, access request, no evidence of incompleteness of the processing list, no obligation to provide access to documents, unfounded 
Rechtspraak.nl 
ROTTERDAM COURT 
Court location Rotterdam 
Administrative law 
Case number: ROT 19/4649 
Judgment of the single-member chamber of 19 March 2021 in the case of [name of applicant], at [place of residence of applicant], applicant 
(Agent: F.L.M. van Haren), and 
The State Secretary for Justice and Security, Repatriation and Departure Service, defendant (Agent: S. Raterink). 
Process 
By decision of 18 April 2019 (primary decision), the defendant provided the claimant with an overview of (the processing of) his personal data within the Repatriation and Departure Service (DT&V). 
By decision of 1 July 2019 (the contested decision), the defendant dismissed the plaintiff's objection to the primary decision as unfounded. 
The claimant has lodged an appeal against the contested decision. 
The defendant submitted a statement of defence. 
The hearing took place on 18 February 2021. The applicant and his authorised representative participated in the hearing via Skype. The defendant was represented by its authorised representative. The case was heard jointly with the case with case number ROT 19/5030. At the hearing the court closed the investigation. Afterwards the cases were split for the purpose of ruling. 
Considerations 
1. The relevant laws and regulations are included in an appendix that forms part of this ruling. 
2. On 14 March 2019, the Claimant requested information from the Respondent pursuant to Articles 12 and 15(1) of Regulation 2016/679 of the European Parliament and of the Council of the European Union of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (the General Data Protection Regulation: AVG). In response to this request, the defendant provided with the primary decision an overview of (the processing of) the claimant's personal data within the DT&V. The claimant lodged an objection to the primary decision. 
3. In the contested decision, the defendant declared the claimant's objection unfounded and upheld the primary decision. The respondent bases this decision on the fact that the claimant has already received the information to which he is entitled pursuant to the AVG in the primary decision. As indicated in the primary decision, the authorised representative of the claimant has the possibility to receive information from the departure file. The Respondent used the names of the Claimant's alleged mother as they appear on the death certificate provided by the Claimant, namely [name]. The defendant sent the file '[filename ]' ([filename ]) to the plaintiff and does not have the underlying documents of that file. The Ministry of Foreign Affairs does not provide underlying information to the defendant in order to protect the researcher engaged, as well as the research method used by him. In due course this information can be requested and made available to the court for inspection, according to the defendant. 
4. The plaintiff first requests that the grounds of complaint be considered repeated and inserted in the appeal, because, in his opinion, the defendant failed to address their content. 
In the opinion of the court, however, the defendant has sufficiently substantiated the grounds for objection in the contested decision. In so far as the plaintiff does not specify in appeal on which points he considers the reasoning of the contested decision to be incorrect or incomplete, the mere reference to the grounds of objection in the grounds of appeal cannot lead to annulment. 
of the contested decision. 
5. The claimant wishes to have access to the personal data. In that context, the claimant argues on appeal that the contested decision incorrectly states as a fact that the Ministry of Foreign Affairs does not provide underlying information to the defendant. According to a letter (the court understands: the decision) from the Minister of Foreign Affairs dated 29 April 2019, the Respondent is the data controller and the Respondent has access to all file documents prepared and collected by the Minister of Foreign Affairs. The Ministry of Foreign Affairs explicitly states that in Baku (Azerbaijan) there was only verbal communication with the investigator / confidant and that no written information was given or obtained. The findings in the document '[filename ]' therefore originate from verbal communication between the investigator/trusted person in Baku and an employee of the Dutch embassy there. The claimant is of the opinion that - in view of this - the defendant in all reasonableness should have been in the possession of reports of conversations between the embassy staff and the confidant, since the '[file name ]' should be a reflection of these communications. Furthermore, there is also, for instance, a passport of the claimant's mother. In the document [file name ], the three names of his mother do not recur and there is only mention of the words 'the mother of the claimant'. The claimant took the position that the names of his mother were carelessly processed and that incorrect negative results were wrongly attached to this processing. The claimant refers to the investigative report of his agent in Baku and states that this shows that the information in the document is highly inconsistent with the facts known in this case. 
5.1. The District Court first of all stated that the right of inspection pursuant to Article 15 of the AVG is limited to personal data relating to the person concerned. The interpretation of the term "personal data" is therefore decisive for the scope of the right of inspection. The Court of Justice of the European Union (ECJ) and the Supreme Court have given a broad interpretation to the concept of "personal data". In its judgment of 20 December 2017 in case C-434/16, P. Nowak, (ECLI:EU:C:2017:994), the Court considered that the concept of personal data potentially extends to any kind of information, both objective and subjective, which concerns the data subject. The latter is the case if the information is linked to a natural person by reason of its content, purpose or effect. 
5.2. The Court is of the opinion that by means of the document '[file name ]' the defendant has provided the plaintiff with the information to which he is entitled pursuant to the AVG. In other words, the claimant has been provided with an overview, in comprehensible form, of all the personal data relating to him that have been processed. As follows from established case law of the Administrative Jurisdiction Division of the Council of State (Division) (see for instance the judgment of 5 February 2020, ECLI:NL:RVS:2020:352, paragraph 7), the person who argues that there should be more personal data must, after the administrative body has investigated the personal data and has not implausibly stated that there are no more personal data, make it plausible that there should be more personal data. The Court sees no ground for the opinion that the Respondent did not implausibly communicate that there are no more personal data. In that context it is relevant that the District Court in its judgment of today, case number ROT 19/5030, has ruled that the Minister of Foreign Affairs must be regarded as 'data controller' within the meaning of the AVG with regard to the processing of the claimant's personal data by the Dutch embassy in Baku. Insofar as the claimant wants to inspect the personal data of him that were processed by the Dutch embassy in Baku, the defendant could therefore suffice with the position that it does not have this information at its disposal. Also for the rest, the statement of the defendant that there are no more personal data in his possession than the data included in the processing overview, is not implausible in the opinion of the court. The claimant has not made it plausible that there should be more personal data. In this respect, the Court notes that, as it has already stated above, the right of inspection relates to the personal data concerning the claimant himself. To the extent that the claimant has argued that the personal data of his father and mother also relate to him, the court follows The plaintiff did not do so. The claimant has not made it plausible that the processing overview provided by the defendant with regard to his personal data is incomplete and that he is not able, on the basis of the information provided, to check whether his personal data have been processed correctly and lawfully. The claims of the claimant that the defendant has more file documents at its disposal, that the names of his mother do not appear in the document and that the information provided by the defendant does not correspond to the facts known in this file, are not considered adequate by the court. 
5.3. The District Court understands the claimant's argument as meaning that he wishes to receive the underlying documents. The District Court states first and foremost that Article 15 of the AVG does not give a right to the provision of the physical or digital documents in which the personal data are processed. This also follows from case law of the Court. For example, in its judgment of 17 July 2014 (ECLI:EU:C:2014:2081), the Court ruled that the AVG does not entitle the data subject to obtain a copy of the original document or file containing the data, if the request for inspection can be satisfied by another form of provision. Although the Court's judgment relates to Directive 95/46/EC, it is also relevant to the interpretation of the AVG. It follows from recital 9 of the preamble to the AVG that the objectives and principles of Directive 95/46/EC remain intact. In the opinion of the District Court, in view of the above, it was sufficient for the defendant in this case to provide the processing overview and the defendant was not obliged to allow the plaintiff access to the documents mentioned by him, insofar as he already had these documents. 
5.4. What the claimant has argued about the correctness of the data used, cannot play a role in this procedure. The only thing to be considered is whether the defendant has complied with its obligations pursuant to articles 12 and 15 of the AVG. 
6. The appeal is therefore unfounded. 
7. There is no reason to order an order for costs. 
Decision 
The court declares the appeal to be unfounded. 
This judgment was rendered by A.M.J. Adriaansen, judge, in the presence of H.L. de Vries, clerk. The verdict was pronounced in public on 19 March 2021. 

Do you disagree with this statement? 
An appeal against this decision may be lodged with the Administrative Law Division of the Council of State within six weeks of the day on which the decision was sent. 
Annex - legal framework 
1. It follows from recital 9 of the Preamble to the AVG that the objectives and principles of Directive 95/46/EC remain valid, (...). 
Article 12 of the AVG, on the transparent information, communication and modalities for exercising the rights of the data subject, reads: 
1. The controller shall take appropriate measures to ensure that the data subject receives the information referred to in Articles 13 and 14 and the communications relating to the processing referred to in Articles 15 to 22 and Article 34 in a concise, transparent, intelligible and easily accessible form, and in clear and plain language, in particular where the information is addressed specifically to a child. The information shall be provided in writing or by other means, including electronic where appropriate. If the data subject so requests, the information may be provided orally, provided that the identity of the data subject is proved by other means. 
2. The controller shall facilitate the exercise of the data subject's rights under Articles 15 to 22. In the cases referred to in Article 11(2), the controller may not refuse to act on a data subject's request to exercise his or her rights under Articles 15 to 22 unless the controller demonstrates that he or she is unable to identify the data subject. 
3. The controller shall provide the data subject with information on the follow-up given to the request pursuant to Articles 15 to 22 without undue delay and in any event not later than one month from the receipt of the request. Depending on the complexity of the requests and the number of requests, this period may be extended, if necessary, by a further two months. The controller shall inform the data subject of any such extension within one month of receiving the request. Where the data subject makes the request electronically, the information shall be provided electronically if possible, unless the data subject requests otherwise. 
4. If the controller does not comply with the data subject's request, he or she shall, without undue delay and no later than one month after receipt of the request, inform the data subject of the reasons for the inaction and of the possibility of complaint to a supervisory authority and of an appeal to a court of law. 
5. The provision of the information referred to in Articles 13 and 14, and the communication and taking of the measures referred to in Articles 15 to 22 and 34, shall be free of charge. Where requests by a data subject are manifestly unfounded or excessive, in particular owing to their repetitive nature, the controller may either 
(a) charge reasonable fees in view of the administrative costs of providing the requested information or communication and taking the requested action 
measures; or 
(b) refuse to comply with the request. It shall be for the controller to prove the manifestly unfounded or excessive nature of the request. 
(...) 
Article 15 of the AVG, on the data subject's right of access, reads: 
1. The data subject shall have the right to obtain a decision from the controller on whether or not personal data relating to him are processed and, where this is the case, to have access to such personal data and to the following information: 
a) the purposes of the processing; 
b) the categories of personal data 
concerned; 
(c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular to recipients in third countries or international organisations; 
(d) if possible, the period for which the personal data are expected to be stored or, if that is not possible, the criteria for determining that period; 
(e) the data subject's right to request the controller to rectify or erase personal data concerning him or her, or to restrict the processing of personal data concerning him or her, and the right to object to such processing; 
(f) that the data subject has the right to lodge a complaint with a supervisory authority; 
(g) where the personal data are not collected from the data subject, all available information on the source of such data; 
(h) the existence of automated decision making, including profiling as referred to in Article 22(1) and (4), and, at least in those cases, useful information on the logic involved as well as the significance and expected consequences of such processing for the data subject. 
(...) 
3. The controller shall provide the data subject with a copy of the personal data being processed. If the data subject requests additional copies, the controller may charge a reasonable fee based on the administrative costs involved. If the data subject makes the request electronically and does not request any other arrangement, the information shall be provided in a commonly used electronic format. 
4. The right to obtain a copy referred to in paragraph 3 shall be without prejudice to the rights and freedoms of others.