Rb. Rotterdam - ROT 19/5030: Difference between revisions

From GDPRhub
Line 89: Line 89:


<pre>
<pre>
<!doctype html><html lang="nl"><head id="Head1" runat="server" profile="http://www.w3.org/2005/10/profile"><meta name="referrer" content="origin-when-cross-origin" /><title> ECLI: NL: RBROT: 2021: 2306, Rotterdam District Court, ROT 19/5030 </title><meta charset="utf-8"><meta http-equiv="x-ua-compatible" content="ie=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="shortcut icon" type="image/ico" href="/SharedWebResources.axd?images/favicon.ico" /><link rel="icon" type="image/ico" href="/SharedWebResources.axd?images/favicon.ico" /><!-- apple touch iconen--><link rel="apple-touch-icon" href="/SharedWebResources.axd?images/apple-touch-iconen/apple-touch-icon.png" /><link rel="apple-touch-icon" sizes="57x57" href="/SharedWebResources.axd?images/apple-touch-iconen/apple-touch-icon-57x57.png" /><link rel="apple-touch-icon" sizes="72x72" href="/SharedWebResources.axd?images/apple-touch-iconen/apple-touch-icon-72x72.png" /><link rel="apple-touch-icon" sizes="76x76" href="/SharedWebResources.axd?images/apple-touch-iconen/apple-touch-icon-76x76.png" /><link rel="apple-touch-icon" sizes="114x114" href="/SharedWebResources.axd?images/apple-touch-iconen/apple-touch-icon-114x114.png" /><link rel="apple-touch-icon" sizes="120x120" href="/SharedWebResources.axd?images/apple-touch-iconen/apple-touch-icon-120x120.png" /><link rel="apple-touch-icon" sizes="144x144" href="/SharedWebResources.axd?images/apple-touch-iconen/apple-touch-icon-144x144.png" /><link rel="apple-touch-icon" sizes="152x152" href="/SharedWebResources.axd?images/apple-touch-iconen/apple-touch-icon-152x152.png" /><link rel="apple-touch-icon" sizes="180x180" href="/SharedWebResources.axd?images/apple-touch-iconen/apple-touch-icon-180x180.png" /><!-- android icoon --><link rel="icon" sizes="192x192" href="/SharedWebResources.axd?images/android-icon-192x192.png"><!-- Bootstrap --><link type="text/css" rel="Stylesheet" href="/SharedWebResources.axd?css/bootstrap/bootstrap-3.3.6.custom.min.css" /><!-- Rechtspraak --><link type="text/css" rel="Stylesheet" href="/SharedWebResources.axd?css/rechtspraak/rechtspraak.sjablonen.custom.min.css" /><script src="/SharedWebResources.axd?js/jquery/jquery-1.11.0.min.js"></script><!-- bs dropdown via javascript --><script>
    $(function () {
        $('.dropdown.rs-mega-menu > a')
            .attr('data-toggle', 'dropdown');
    });
</script><script src="/SharedWebResources.axd?js/bootstrap/bootstrap-3.3.6.min.js"></script><!-- Uitspraken --><link type="text/css" rel="Stylesheet" href="/Content/css/slimbox/slimbox2.css" media="screen" /><link type="text/css" rel="Stylesheet" href="/Content/css/rechtspraak.uitspraken.min.css" /><link type="text/css" rel="Stylesheet" href="/Content/css/print-uitspraak.min.css" media="print" /><link type="text/css" rel="Stylesheet" href="/SharedWebResources.axd?css/calendar.css" /><link id="highlightsh" type="text/css" rel="Stylesheet" disabled href="/Content/css/disable.uitspraak.highlight.min.css" /><script type="text/javascript">
                (function (window, document, dataLayerName, id) {
                function stgCreateCookie(a, b, c) { var d = ""; if (c) { var e = new Date; e.setTime(e.getTime() + 24 * c * 60 * 60 * 1e3), d = "; expires=" + e.toUTCString() } document.cookie = a + "=" + b + d + "; path=/" }
                var isStgDebug = (window.location.href.match("stg_debug") || document.cookie.match("stg_debug")) && !window.location.href.match("stg_disable_debug"); stgCreateCookie("stg_debug", isStgDebug ? 1 : "", isStgDebug ? 14 : -1);
                var qP = []; dataLayerName !== "dataLayer" && qP.push("data_layer_name=" + dataLayerName), isStgDebug && qP.push("stg_debug"); var qPString = qP.length > 0 ? ("?" + qP.join("&")) : "";
                document.write('<script src="https://statistiek.rechtspraak.nl/containers/' + id + '.sync.js' + qPString + '"></' + 'script>');
                })(window, document, 'dataLayer', '11b7c5ed-2b4c-406d-9d93-8e2bcf98a2dd');
            </script><meta property="dcterms:identifier" content="ECLI:NL:RBROT:2021:2306" datatype="xsd:anyURI" /><meta property="dcterms:title" content="ECLI:NL:RBROT:2021:2306, Rechtbank Rotterdam, ROT 19/5030" /><meta property="dcterms:issued" content="2021-03-22" datatype="xsd:date" /><link rel="dcterms:publisher" /><link rel="dcterms:type" href="http://psi.rechtspraak.nl/uitspraak" title="Statement" /><meta property="dcterms:language" content="nl" datatype="xsd:language" /><meta property="dcterms:creator" content="&lt;span&gt;Rechtbank Rotterdam&lt;/span&gt;" scheme="overheid.RechterlijkeMacht" resourceidentifier="http://standaarden.overheid.nl/owms/terms/Rechtbank_Rotterdam" /><meta property="dcterms:modified" content="2021-03-22" datatype="xsd:date" /><meta property="dcterms:abstract" content="&lt;inhoudsindicatie xmlns=&quot;http://www.rechtspraak.nl/schema/rechtspraak-1.0&quot; id=&quot;ECLI:NL:RBROT:2021:2306:INH&quot; lang=&quot;nl&quot; xml:space=&quot;preserve&quot;&gt;&lt;para&gt;AVG, geen misbruik van recht, begrip ‘verwerker’, ruime uitleg van het begrip &#39;verwerkingsverantwoordelijke&#39;, gegrond&lt;/para&gt;&lt;/inhoudsindicatie&gt;" /><meta property="dcterms:created" content="2021-03-19" datatype="xsd:date" /><link rel="dcterms:subject" href="http://psi.rechtspraak.nl/rechtsgebied#bestuursrecht" title="Administrative law" /><link rel="canonical" href="https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBROT:2021:2306" /></head><body><div class="rs-wrapper"><div class="rs-header"><div class="container"><div class="rs-logo"> <a href="https://www.rechtspraak.nl" title="Homepage Rechtspraak.nl"><img class="ms-siteicon-img" src="/SharedWebResources.axd?images/logo_2016.png" alt="Logo of the judiciary" /></a> <!--  <img src="data:image/svg+xml, %3Csvg version%3D%221.1%22 id%3D%22logo%22 xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22 xmlns%3Axlink%3D%22http%3A%2F%2Fwww.w3.org%2F1999%2Fxlink%22 x%3D%220px%22 y%3D%220px%22    viewBox%3D%220 0 117 71%22 style%3D%22enable-background%3Anew 0 0 117 71%3B%22 xml%3Aspace%3D%22preserve%22%3E%3Cstyle type%3D%22text%2Fcss%22%3E    .st0%7Bfill%3Anone%3B%7D    .st1%7Bfill%3A%23151F6D%3B%7D    .st2%7Bfill%3A%23AA0061%3B%7D%3C%2Fstyle%3E%3Cg%3E    %3Cg%3E        %3Cg%3E            %3Cg%3E                %3Cg%3E                    %3Cg%3E                        %3Cg%3E                            %3Crect x%3D%22-19.4%22 y%3D%22-5.2%22 class%3D%22st0%22 width%3D%22155.9%22 height%3D%2287.9%22%2F%3E                        %3C%2Fg%3E                    %3C%2Fg%3E                %3C%2Fg%3E            %3C%2Fg%3E        %3C%2Fg%3E    %3C%2Fg%3E    %3Cg%3E        %3Cg%3E            %3Cg%3E                %3Cg%3E                %3C%2Fg%3E            %3C%2Fg%3E        %3C%2Fg%3E    %3C%2Fg%3E    %3Cpath class%3D%22st1%22 d%3D%22M11.7%2C65.6c0.1%2C1%2C0.9%2C1.7%2C1.9%2C1.7c0.9%2C0%2C1.5-0.4%2C1.9-1l1.3%2C1c-0.8%2C1-1.9%2C1.4-3%2C1.4c-2.1%2C0-3.8-1.5-3.8-3.7        c0-2.2%2C1.6-3.7%2C3.7-3.7c2%2C0%2C3.4%2C1.4%2C3.4%2C3.8v0.5H11.7z M15.3%2C64.3c0-1-0.7-1.7-1.8-1.7c-1%2C0-1.7%2C0.7-1.8%2C1.7H15.3z%22%2F%3E    %3Cpath class%3D%22st1%22 d%3D%22M35.7%2C65.6c0.1%2C1%2C0.9%2C1.7%2C1.9%2C1.7c0.9%2C0%2C1.5-0.4%2C1.9-1l1.3%2C1c-0.8%2C1-1.9%2C1.4-3%2C1.4c-2.1%2C0-3.8-1.5-3.8-3.7        c0-2.2%2C1.6-3.7%2C3.7-3.7c2%2C0%2C3.4%2C1.4%2C3.4%2C3.8v0.5H35.7z M39.3%2C64.3c0-1-0.7-1.7-1.8-1.7c-1%2C0-1.7%2C0.7-1.8%2C1.7H39.3z%22%2F%3E    %3Cpath class%3D%22st1%22 d%3D%22M48.4%2C63.5c-0.4-0.4-0.9-0.7-1.4-0.7c-1.3%2C0-2.1%2C1.1-2.1%2C2.2c0%2C1.1%2C0.8%2C2.2%2C2.1%2C2.2c0.5%2C0%2C1.1-0.2%2C1.4-0.7        l1.2%2C1.2c-0.7%2C0.7-1.9%2C1-2.5%2C1c-2.1%2C0-3.8-1.5-3.8-3.7c0-2.2%2C1.7-3.7%2C3.8-3.7c0.9%2C0%2C1.9%2C0.3%2C2.5%2C1.1L48.4%2C63.5z%22%2F%3E    %3Cpath class%3D%22st1%22 d%3D%22M71.8%2C63.4c-0.3-0.5-0.8-0.7-1.4-0.7c-0.5%2C0-1%2C0.3-1%2C0.8c0%2C1.3%2C3.8%2C0.2%2C3.8%2C3c0%2C1.7-1.5%2C2.3-3%2C2.3        c-1.1%2C0-2.1-0.3-2.8-1.1l1.1-1.1c0.5%2C0.5%2C1%2C0.8%2C1.7%2C0.8c0.5%2C0%2C1.2-0.3%2C1.2-0.8c0-1.5-3.8-0.3-3.8-3c0-1.6%2C1.4-2.3%2C2.9-2.3        c0.9%2C0%2C1.9%2C0.3%2C2.5%2C1.1L71.8%2C63.4z%22%2F%3E    %3Cpath class%3D%22st1%22 d%3D%22M96.7%2C67.5L96.7%2C67.5c-0.5%2C0.8-1.4%2C1.1-2.3%2C1.1c-1.3%2C0-2.6-0.7-2.6-2.1c0-2.3%2C2.7-2.4%2C4.4-2.4h0.4v-0.2        c0-0.9-0.7-1.3-1.6-1.3c-0.7%2C0-1.4%2C0.3-1.9%2C0.7l-0.9-0.9c0.8-0.8%2C1.8-1.1%2C3-1.1c3%2C0%2C3%2C2.2%2C3%2C3.2v4h-1.6V67.5z M96.6%2C65.3h-0.4        c-1%2C0-2.6%2C0.1-2.6%2C1.1c0%2C0.6%2C0.7%2C0.9%2C1.2%2C0.9c1.1%2C0%2C1.8-0.6%2C1.8-1.6V65.3z%22%2F%3E    %3Cpath class%3D%22st1%22 d%3D%22M105.7%2C67.5L105.7%2C67.5c-0.5%2C0.8-1.4%2C1.1-2.3%2C1.1c-1.3%2C0-2.6-0.7-2.6-2.1c0-2.3%2C2.7-2.4%2C4.4-2.4h0.4v-0.2        c0-0.9-0.7-1.3-1.6-1.3c-0.7%2C0-1.4%2C0.3-1.9%2C0.7l-0.9-0.9c0.8-0.8%2C1.8-1.1%2C3-1.1c3%2C0%2C3%2C2.2%2C3%2C3.2v4h-1.6V67.5z M105.7%2C65.3h-0.4        c-1%2C0-2.6%2C0.1-2.6%2C1.1c0%2C0.6%2C0.7%2C0.9%2C1.2%2C0.9c1.1%2C0%2C1.8-0.6%2C1.8-1.6V65.3z%22%2F%3E    %3Cpath class%3D%22st1%22 d%3D%22M5.7%2C58.7v3.7h0c-0.4-0.5-1.1-1.1-2.4-1.1c-2%2C0-3.4%2C1.6-3.4%2C3.7c0%2C2.1%2C1.3%2C3.7%2C3.5%2C3.7c1%2C0%2C1.9-0.4%2C2.4-1.2h0        v1.1h1.7v-9.8H5.7z M3.7%2C67.1c-1.3%2C0-2.1-1.1-2.1-2.2c0-1.1%2C0.8-2.2%2C2.1-2.2s2.1%2C1.1%2C2.1%2C2.2C5.8%2C66.1%2C5%2C67.1%2C3.7%2C67.1z%22%2F%3E    %3Cpath class%3D%22st1%22 d%3D%22M55.6%2C61.3c-1.1%2C0-1.8%2C0.6-2.1%2C1.2h0v-3.7h-1.8v9.8h1.8v-3.8c0-0.9%2C0.5-1.8%2C1.6-1.8c1.2%2C0%2C1.3%2C1.3%2C1.3%2C2.1v3.6        h1.8v-4.4C58.2%2C62.6%2C57.5%2C61.3%2C55.6%2C61.3z%22%2F%3E    %3Cpolygon class%3D%22st1%22 points%3D%22113.9%2C64.7 116.9%2C61.5 114.6%2C61.5 111.9%2C64.4 111.9%2C58.7 110.2%2C58.7 110.2%2C68.5 111.9%2C68.5        111.9%2C64.9 112%2C64.9 114.8%2C68.5 117.1%2C68.5  %22%2F%3E    %3Cpath class%3D%22st1%22 d%3D%22M79.9%2C61.3c-1%2C0-1.9%2C0.4-2.4%2C1.2h0v-1.1h-1.7V71h1.8v-3.4h0c0.4%2C0.5%2C1.1%2C1.1%2C2.4%2C1.1c2%2C0%2C3.4-1.6%2C3.4-3.7        C83.4%2C62.9%2C82.1%2C61.3%2C79.9%2C61.3z M79.6%2C67.1c-1.3%2C0-2.1-1.1-2.1-2.2c0-1.1%2C0.8-2.2%2C2.1-2.2c1.3%2C0%2C2.1%2C1.1%2C2.1%2C2.2        C81.6%2C66.1%2C80.8%2C67.1%2C79.6%2C67.1z%22%2F%3E    %3Cpath class%3D%22st1%22 d%3D%22M26.4%2C68.5v-3.9h1.3l2.4%2C3.9h2.1l-2.6-4.1c1.5-0.2%2C2.4-1.3%2C2.4-2.8c0-2.3-1.9-2.9-3.9-2.9h-3.5v9.8H26.4z        M26.4%2C60.3H28c1%2C0%2C2.1%2C0.1%2C2.1%2C1.3c0%2C1.3-1.2%2C1.4-2.3%2C1.4h-1.4V60.3z%22%2F%3E    %3Cpath class%3D%22st1%22 d%3D%22M65.1%2C67c-0.2%2C0.1-0.6%2C0.2-0.8%2C0.2c-0.8%2C0-1-0.5-1-1.2V63h1.8v-1.5h-1.8v-1.6h-1.8v1.6h-1.3V63h1.3v3.2        c0%2C1.7%2C0.4%2C2.5%2C2.3%2C2.5c0.4%2C0%2C0.9-0.1%2C1.3-0.2V67z%22%2F%3E    %3Cpath class%3D%22st1%22 d%3D%22M90.2%2C61.3c-0.1%2C0-0.3-0.1-0.5-0.1c-0.9%2C0-1.7%2C0.5-2.1%2C1.3h0v-1.1h-1.8v7h1.8v-3.8c0-0.4%2C0.2-1.8%2C1.9-1.8        c0.2%2C0%2C0.4%2C0%2C0.7%2C0.1V61.3z%22%2F%3E    %3Cpath class%3D%22st1%22 d%3D%22M21%2C48.7c0%2C0-2%2C1-4%2C1.4l-6.4-39.9c-0.1-0.7-0.4-1.4-0.8-2l-2-2.9L7%2C9c-0.2%2C0.7-0.2%2C1.4-0.1%2C2.1l7%2C39.2        c-3.4-0.3-6.3-1.6-6.3-1.6c-1.1%2C3.2%2C0.8%2C5.1%2C0.8%2C5.1c4.5-1.6%2C8.4-1.8%2C12.9-1.6C21.4%2C52.2%2C22.1%2C50.3%2C21%2C48.7z%22%2F%3E    %3Cpath class%3D%22st2%22 d%3D%22M78.7%2C32.1c-0.1%2C0.2-0.9%2C2.4-16.6%2C8.6c-10.3%2C4.1-1.6%2C11.5-10.4%2C14.4c0.4-1.4%2C2-4.4-2.4-9.9        c-3-3.8-0.6-8.1%2C4.9-10.6c-4.9%2C1-8%2C3.9-11.7%2C5.5c-5.8%2C2.6-10.9%2C1.5-19.2%2C5.5c5.3-5%2C11.7-4%2C12.3-7.5c0.2-1.4%2C0.3-3.3%2C0.3-3.3        c-2.3%2C1.6-6%2C0.9-6.2-1.9c-3.7%2C0.3-6.6-5%2C0.4-9.7c0.1-0.1%2C0.5-2.9%2C0.7-4.8c0.8-7.8%2C7.5-10.9%2C11-9.2c2.4-1%2C4.3%2C0.7%2C4.8%2C2.1        c-1.7-1-8.8-3.1-8.6%2C5c2.1%2C1.2%2C3.8-2.5%2C4%2C3.5c0.1%2C1.4-0.6%2C2.8%2C2.7%2C2.3c0%2C0%2C0.1%2C0.6-0.4%2C1.3c-1.1%2C1.6%2C0.6%2C1.4%2C1.5%2C1.1        c0.3-0.1%2C0.7%2C1.2-0.9%2C2.2c-0.8%2C0.5-1.5%2C0.2-1.5%2C1.4c0%2C0.4%2C0.2%2C1.2%2C0.5%2C1.3c1%2C0.3%2C3.1-0.1%2C4.8-4c-0.1%2C4.6-3.2%2C5.5-3.6%2C6.4        c-0.2%2C0.5-0.3%2C1.2-0.3%2C2.3c0%2C0.9%2C0.5%2C1.8%2C2%2C1.2c9.3-3.6%2C12.8-2%2C23.1-4.9c0.6-1.7%2C1.6-3%2C2.5-4.2c0%2C0%2C7.3-7.4%2C9.5-16.5        c0.8-3.4%2C0.1-3.5%2C0.1-5.9c0-2.3%2C1.7-3.7%2C3-3.7c1.2%2C0%2C1.3%2C1.7%2C3.2%2C0.5c0%2C0%2C0%2C0%2C0%2C0c1%2C0.5%2C1.2%2C1.6%2C1.3%2C2.7c1.3-1.1%2C1.2-1.8%2C1.9-1.6        c0.9%2C0.3-0.3%2C2.3-0.9%2C3.3c-1.4%2C2.4-2.7%2C3.6-4%2C4.1C86.6%2C9.3%2C82.9%2C25%2C78.7%2C32.1z M39.1%2C23.5c1.9%2C0%2C1.6-4.6%2C1.6-5.4        c-0.2-2.3-5.1%2C0.1-4.5%2C1.5C36.7%2C20.9%2C37.8%2C23.5%2C39.1%2C23.5z M43.2%2C32.3c-3%2C1.1-0.8%2C3.2-2.7%2C5.9C41.9%2C37.3%2C43.4%2C37.6%2C43.2%2C32.3z%22%2F%3E    %3Cpath class%3D%22st1%22 d%3D%22M30.1%2C23.1c0%2C0%2C4.2-3.2%2C8.9-3.8c1.7-0.2%2C2.6-0.6%2C3.1-1.1c0.2-0.2%2C1.5-1.2%2C1.9%2C0.1c0.4%2C1.2%2C0.7%2C1.9%2C1.7%2C1.9        c1.1%2C0.1%2C3.5-0.4%2C3.6%2C1.4c0%2C0%2C1.5-2.5-0.9-3.3c0%2C0%2C0.8-0.5%2C1-1.1c0%2C0-2.8-3.8-9.1-2.4c0-0.4%2C0.5-1.2%2C2.7-1.1c0%2C0-4.2-2.4-12.2%2C4.4        C30.7%2C18.2%2C30.4%2C20.9%2C30.1%2C23.1z%22%2F%3E    %3Cpath class%3D%22st1%22 d%3D%22M70.6%2C40.4c-2%2C0.1-3.9%2C0.3-5.7%2C0.7c1-2.3%2C5.8-16.1%2C7.5-21.8C71.9%2C23.3%2C70.7%2C35.7%2C70.6%2C40.4z M70.9%2C40.4        c0.5-2.8%2C1.8-11.9%2C2.6-21.1c0.2%2C0.8%2C5.5%2C15.4%2C8.6%2C22.1c-2.7-0.7-5.9-1-9.3-1C72.1%2C40.4%2C71.5%2C40.4%2C70.9%2C40.4z M100.3%2C18.9        c-0.4%2C1-5.5%2C16.4-6.9%2C22.3c-0.8%2C0.2-1.5%2C0.3-2.2%2C0.5c-0.2%2C0-0.2%2C0.2-0.1%2C0.4c2.2%2C2.7%2C6.1%2C4.4%2C10.5%2C4.4c4.4%2C0%2C8.3-1.8%2C10.5-4.4        c0.1-0.1%2C0.1-0.3-0.1-0.4c-0.2-0.1-0.5-0.1-0.7-0.2c-2.1-7.4-6.5-18.8-8-22.7c0.3%2C0%2C0.6-0.3%2C0.6-0.6v-0.4c0-0.3-0.3-0.6-0.6-0.6        H101c-3.6%2C0-4-3-7.8-3c-1.3%2C0-2.1%2C0.4-2.3%2C0.4c-0.2-1.3-1-2.3-2-2.8c1.6-0.6%2C2.7-2.1%2C2.9-3.9C92%2C6.2%2C91%2C4.6%2C89.6%2C3.8        c0%2C0.4-0.1%2C0.8-0.3%2C1.1c0.9%2C0.6%2C1.5%2C1.7%2C1.4%2C3c-0.1%2C1.8-1.7%2C3.2-3.5%2C3.1c-1.8-0.1-3.2-1.7-3.1-3.5c0.1-1.1%2C0.7-2.1%2C1.6-2.6        C85.5%2C4.5%2C85.3%2C4.2%2C85%2C4c-1.1%2C0.7-1.9%2C2-2%2C3.4c-0.1%2C2%2C1%2C3.7%2C2.8%2C4.4c-1.1%2C0.5-1.9%2C1.6-2%2C2.8c-0.2-0.1-1-0.4-2.3-0.4        c-3.7%2C0-4.2%2C3-7.8%2C3h-2.3c-0.3%2C0-0.6%2C0.3-0.6%2C0.6v0.4c0%2C0.3%2C0.3%2C0.6%2C0.6%2C0.6c0%2C0%2C0.1%2C0%2C0.1%2C0c-0.4%2C1-5.5%2C16.4-6.9%2C22.3        c-0.8%2C0.2-1.5%2C0.3-2.2%2C0.5c-0.2%2C0-0.2%2C0.2-0.1%2C0.4c2.2%2C2.7%2C6.1%2C4.4%2C10.5%2C4.4c4.4%2C0%2C8.3-1.8%2C10.5-4.4c0.1-0.1%2C0.1-0.3-0.1-0.4        c-0.2-0.1-0.5-0.1-0.7-0.2c-2.1-7.4-6.5-18.8-7.9-22.6c2.9%2C0%2C4.5-2.3%2C6.7-2.3c2.7%2C0%2C4%2C2.2%2C6.1%2C2.2c2.1%2C0%2C3.4-2.2%2C6.1-2.2        C95.7%2C16.6%2C97.3%2C19%2C100.3%2C18.9z M99.5%2C40.4c-2%2C0.1-3.9%2C0.3-5.7%2C0.7c1-2.3%2C5.8-16.1%2C7.5-21.8C100.8%2C23.3%2C99.6%2C35.7%2C99.5%2C40.4z        M99.8%2C40.4c0.5-2.8%2C1.8-11.9%2C2.6-21.1c0.2%2C0.8%2C5.5%2C15.4%2C8.6%2C22.1c-2.7-0.7-5.9-1-9.3-1C101%2C40.4%2C100.4%2C40.4%2C99.8%2C40.4z M88.6%2C15.1        c0%2C0.7-0.6%2C1.3-1.3%2C1.3c-0.7%2C0-1.3-0.6-1.3-1.3c0-0.7%2C0.6-1.3%2C1.3-1.3C88%2C13.8%2C88.6%2C14.4%2C88.6%2C15.1z%22%2F%3E%3C%2Fg%3E%3C%2Fsvg%3E" class="ms-siteicon-img" alt="Logo van de rechtspraak"> --> <a href="https://www.rechtspraak.nl" title="Homepage Rechtspraak.nl"><span class="rs-logo-border"></span></a></div><p class="rs-skip-links"> <a class="rs-skip-link" href="#mainContent" title="Directly to search form">Direct to content</a> <a class="rs-skip-link" href="#mainNavigation" title="Directly to navigation menu">Direct to navigation menu</a></p><!-- div id="SearchBox" class="rs-search ms-srch-sb">
            <input type="text" value="" name="" id="" title="Voer uw zoekterm in" class="" placeholder="Zoeken...">
            <a href="javascript" title="Zoek" class="ms-srch-sb-searchLink"><img src="/SharedWebResources.axd?images/rs_header_search.png" alt="Rechtspraak.nl" width="14" height="15" /></a>
        </div --></div><!--/.container --></div><!--/.rs-header --><!-- div id="titlearea">
</div --><div class="toolbar"></div><!-- END HEADER --><div class="rs-main-contentarea" id="mainContent" data-target=".rs-main-contentarea"> <a class="rnl-button rnl-pagefeedbackform-button no-print" onclick="navigaToFeedbackForm();" href="javascript:undefined"><span>Feedback</span></a> <div class="rnl-content rnl-content-main"><div class="rnl-header-image-container"><div class="rnl-image-gradient"></div><img src="/SharedWebResources.axd?images/uitspraken-header-image-comp.jpg" alt="" /></div><div class="container"><div class="page-header rnl-page-header rnl-page-header-image"><div class="row"><div id="header" class="col-md-8"><h1> Pronunciations </h1></div></div><!--/.row --></div></div><div class="container"><div class="row"><div class="col-md-12"><div class="rs-panel zoektermen-wrapper"><div class="rs-panel-heading no-print"><h2> <a class="rs-accordion-title" data-toggle="collapse" href="#zoektermen" role="button" aria-expanded="true" aria-controls="zoektermen">Search terms found<span class="rs-collapse-icon-down"></span></a></h2></div><div class="row"><div class="col-md-12"> <label for="showhighlights" id="showhighlightslabel" class="label-highlights pull-left highlights-background"><input type="checkbox" id="showhighlights" name="showhighlights" checked><span id="markeringen-toggle-tekst">Turn markers off</span></label> </div></div><div class="collapse in rs-panel-body gevondenZoektermen no-print" id="zoektermen"><!-- --></div></div></div></div><div class="row opnieuw-zoeken-buttons"><div class="col-md-4"> <a href="/" class="rs-btn rs-btn-secondary search-btn-uitspraken" onclick="javascript:_paq.push(['trackEvent','uitspraken-pagina', 'button', 'opnieuw-zoeken']);">Search again</a></div><div class="col-md-4"> <a href="javascript:_paq.push(['trackEvent','uitspraken-pagina', 'button', 'terug-naar-resultaten']);history.back();" class="rs-btn rs-btn-primary search-btn-uitspraken">Back to the results</a></div></div><div class="row nieuwe-zoekopdracht-button"><div class="col-md-4"> <a href="/" class="rs-btn rs-btn-primary search-btn-uitspraken">New search</a> </div></div><div id="alert-region"><!-- --></div><div class="row"><div id="content" class="col-md-12"><div id="Main" class="rs-panel"><div class="rs-panel-heading rs-heading-inline"><h1 id="ZoekresultaatTekst" class="structural"> Search result - view document</h1><h2 class="left"> ECLI: NL: RBROT: 2021: 2306</h2><div class="btn-group rs-share rs-hide-mobile no-print"> <button class="rs-btn-secondary rs-btn dropdown-toggle" type="button" id="dropdownMenu1" data-toggle="dropdown" aria-haspopup="true" aria-expanded="true">Share pronunciation<span class="tri-down"></span></button><ul class="dropdown-menu rs-dropdown" aria-labelledby="dropdownMenu1"><li> <a href="javascript:window.print()" id="linkToPrint" class="printUitspraak" title="Print the document" onclick="javascript:_paq.push(['trackEvent','uitspraken-pagina', 'button', 'printen']);"><span>Print</span></a></li><li> <a class="pdfUitspraak no-print" href="/InzienDocument/GetPdf?ecli=ECLI%3ANL%3ARBROT%3A2021%3A2306" onclick="javascript:_paq.push([&#39;trackEvent&#39;,&#39;uitspraken-pagina&#39;, &#39;button&#39;, &#39;download-pdf&#39;]);">Save as PDF</a></li><li> <a href="javascript:undefined" id="copyUitspraak" class="no-print" data-clipboard-text="http://deeplink.rechtspraak.nl/uitspraak?id=ECLI:NL:RBROT:2021:2306" title="Copy link to statement" onclick="javascript:_paq.push(['trackEvent','uitspraken-pagina', 'button', 'kopieer']);"><span>Copy link</span></a></li></ul></div><div class="rs-copied-to-clipboard" id="clipboardInfo" style="display: none;"> Link copied to clipboard</div></div><div class="rs-panel-body"><dl class="dl-horizontal"><dt> Authority</dt><dd> <span>Court of Rotterdam</span></dd><dt> Date of judgment</dt><dd> 19-03-2021</dd><dt> Date of publication</dt><dd> 22-03-2021</dd><dt> Case number</dt><dd> <span>ROT 19/5030</span><br /></dd><dt> Jurisdictions</dt><dd> <span>Administrative law</span><br /></dd><dt> Special characteristics</dt><dd> <span>First instance - single</span><br /></dd><dt> Content indication</dt><dd><div class="inhoudsindicatie"><p> GDPR, no abuse of law, term &#39;processor&#39;, broad explanation of the term &#39;controller&#39;, well-founded</p></div></dd><dt> Locations</dt><dd> <span>Rechtspraak.nl</span><br /></dd><dt class="no-print"></dt><dd class="no-print"> <a href="https://linkeddata.overheid.nl/document/ECLI:NL:RBROT:2021:2306" id="linkToKoop" class="koopUitspraak" title="Enriched pronunciation"><span class="no-print">Enriched pronunciation</span></a></dd></dl><div class="btn-group rs-share rs-hide-desktop no-print"> <button class="rs-btn-secondary rs-btn dropdown-toggle" type="button" id="dropdownMenu1" data-toggle="dropdown" aria-haspopup="true" aria-expanded="true">Share pronunciation<span class="tri-down"></span></button><ul class="dropdown-menu rs-dropdown" aria-labelledby="dropdownMenu1"><li> <a href="javascript:printUitspraak()" id="linkToPrint" class="printUitspraak" title="Print the document" onclick="javascript:_paq.push(['trackEvent','uitspraken-pagina', 'button', 'printen']);"><span>Print</span></a></li><li> <a class="pdfUitspraak no-print" href="/InzienDocument/GetPdf?ecli=ECLI%3ANL%3ARBROT%3A2021%3A2306" onclick="javascript:_paq.push([&#39;trackEvent&#39;,&#39;uitspraken-pagina&#39;, &#39;button&#39;, &#39;download-pdf&#39;]);">Save as PDF</a></li><li> <a href="javascript:undefined" id="copyUitspraak" class="no-print" data-clipboard-text="http://deeplink.rechtspraak.nl/uitspraak?id=ECLI:NL:RBROT:2021:2306" title="Copy link to statement" onclick="javascript:_paq.push(['trackEvent','uitspraken-pagina', 'button', 'kopieer']);"><span>Copy link</span></a></li></ul></div><div class="uitspraakH3"><h3> Statement </h3></div><div><div class="uitspraak"><div class="uitspraak-info"><h2 name="ID0EJ" style="font-weight:bold;" class="bridgehead"> COURT ROTTERDAM</h2><div class="parablock"><p> Seat in Rotterdam</p></div><span class="linebreak1"> </span><div class="parablock"><p>Administrative law</p></div><span class="linebreak1"> </span><div class="parablock"><p>case number: ROT 19/5030</p></div><h2 name="ID0EBB" style="font-weight:bold;" class="bridgehead"><br /> Judgment of the single Judge of 19 March 2021 in the case inter</h2><h2 name="ID0EHB" style="font-weight:bold;" class="bridgehead"> [name of plaintiff], at [plaintiff&#39;s place of residence], plaintiff</h2><p> authorized representative: mr. FLM van Haren,<span class="linebreak1"> </span></p><div class="parablock"><p>and</p></div><span class="linebreak1"> </span><h2 name="ID0EVB" style="font-weight:bold;" class="bridgehead">Minister of Foreign Affairs, Legal Affairs Department, defendant</h2><p> authorized representative: mr. R. Geraedts.<span class="linebreak1"> </span><span class="linebreak1"> </span></p></div><div class="section procesverloop"><h2>Process course</h2><span class="linebreak1"> </span><div class="parablock"><p>By decision of 29 April 2019 (primary decision), the respondent rejected the claimant&#39;s request for access to the personal data processed by the respondent.</p></div><span class="linebreak1"> </span><div class="parablock"><p>By decision of 17 September 2019 (contested decision), the defendant declared the plaintiff&#39;s objection against the primary decision unfounded.</p></div><span class="linebreak1"> </span><div class="parablock"><p>The plaintiff has appealed against the contested decision.</p></div><span class="linebreak1"> </span><div class="parablock"><p>Respondent has lodged a statement of defense.</p></div><span class="linebreak1"> </span><div class="parablock"><p>The hearing took place on February 18, 2021. Plaintiff and his representative participated in the hearing via a Skype connection. Respondent was represented by his agent. The case has been joined with the case with case number ROT 19/4649. At the hearing, the court closed the investigation. After that, things were split up for making a decision.</p></div><span class="linebreak2"> </span></div><div class="section"><h2>Considerations</h2><span class="linebreak1"> </span><p>1. The relevant legislation and regulations are included in an appendix that forms part of this decision.<span class="linebreak1"> </span></p><p>2. On 28 March 2019 the plaintiff requested the defendant for information on the basis of articles 12 and 15, first paragraph, of Regulation 2016/679 of the European Parliament and of the Council of the European Union of 27 April 2016 on the protection of natural persons in connection with the processing of personal data and with regard to the free movement of such data and repealing Directive 95/46 / EC (the General Data Protection Regulation: GDPR). In his request, the plaintiff indicated that he had received an e-mail from the Repatriation and Departure Service (DT&amp;V) with information that would relate to him and that according to the DT&amp;V would come from the defendant. The respondent has rejected the aforementioned request of the plaintiff. The defendant based this rejection on the basis that he is not the controller within the meaning of Article 4 (7) of the GDPR, because the investigation by the Dutch embassy in Baku (Azerbaijan) in this case was carried out on behalf of the DT&amp;V. . The DT&amp;V has the file documents drawn up and collected by the respondent in the context of the assignment, so that the GDPR request to DT&amp;V concerns the same personal data. Moreover, the contact with the person who carried out the on-site investigation took place verbally, according to the defendant. Plaintiff has objected to this rejection.<span class="linebreak1"> </span></p><p>3. In the contested decision, the defendant declared the plaintiff&#39;s objection unfounded and maintained the primary decision. The defendant added to this that there was an abuse of rights by the plaintiff and referred to the decision of the Northern Netherlands District Court of 23 April 2019 (ECLI: NL: RBNNE: 2019: 3761). The respondent points out in this regard that the plaintiff has submitted a request for inspection to both the defendant and the DT&amp;V and that the plaintiff wishes to use the personal data in another procedure (an &#39;no-fault procedure&#39;), so that it is ultimately not about the correctness of the the actual personal data. The plaintiff is also already entitled to the documents relating to the case under the General Administrative Law Act (Awb) in the &#39;no-fault procedure&#39;.<span class="linebreak1"> </span></p><p>4. The court is first faced with the question of whether there has been an abuse of law.<span class="linebreak1"> </span></p><div class="paragroup"><span class="nr">4.1.</span><p> As the Administrative Jurisdiction Division of the Council of State (Division) has considered in, for example, its decision of 31 October 2018 (ECLI: NL: RVS: 2018: 3553), Article 13, read in conjunction with Article 15, of Book 3 of the Civil Code (BW), the power to appeal to the administrative court cannot be invoked insofar as this power is misused. These articles preclude the substantive handling of an appeal brought before the administrative court that involves abuse of law, and provide a legal basis for such an appeal to be declared inadmissible. To this end, compelling grounds are required, which are present, among other things, if rights or powers are clearly used without a reasonable purpose or for a purpose other than that for which they have been granted, that the use of those rights or powers is evidence of bad faith. In the opinion of the court, this cannot be established in this case. In that regard, the court considers the following.<span class="linebreak1"> </span></p></div><div class="paragroup"><span class="nr">4.2.</span><p> The GDPR is intended to give data subjects (natural persons) access to the way in which administrative bodies, among others, process their personal data. In his request, the plaintiff asked the defendant various questions, with the aim of obtaining the information referred to in Article 15, first and second paragraphs, of the GDPR. In view of this, it cannot be concluded that it is not actually possible for the plaintiff to become aware of the personal data processed by the respondent and the manner in which the respondent processes these personal data in accordance with the purpose of the GDPR. The fact that the plaintiff has also submitted a request for access to the DT&amp;V does not change this, all the more because the DT&amp;V has indicated that the respondent will not provide them with any underlying information, in order to protect the investigator engaged and the investigation methods engaged by him. The fact that the plaintiff will use any personal data obtained in another procedure does not lead the court to conclude that this constitutes an abuse of law. This in itself does not mean that the purpose of the request is no longer in line with the purpose of the GDPR. In that context, the court also refers to case law of the Division relating to the Government Information (Public Access) Act (Wob) (for example, the decision of 29 January 2020 (ECLI: NL: RVS: 2020: 265), from which it follows that a request for disclosure of information with a view to another procedure only constitutes an abuse of law in special circumstances. The court sees no reason to rule differently in this case. Such special circumstances have not become apparent to the court. The defendant&#39;s reference to the judgment of the court. Finally, the Northern Netherlands Court of 23 April 2019 cannot succeed, since there are no comparable cases, because in that case the applicant would have been provided with the requested documents and it had not become apparent that any other personal data had been processed.<span class="linebreak1"> </span></p></div><div class="paragroup"><span class="nr">4.3.</span><p> In view of the foregoing, the court sees no reason to declare the appeal inadmissible because of abuse of the law.<span class="linebreak1"> </span></p><div class="parablock"><p>5. In appeal, the plaintiff takes the position that the defendant is the controller. The DT&amp;V and the respondent implement parts of the policy in parallel. The fact that the investigation took place in Baku in the context of an identity investigation in response to a request for mediation from the DT&amp;V does not change that. Respondent passed on the data orally to an unknown / undisclosed confidential counselor who reported back verbally, which, according to Claimant, is a particularly irresponsible handling of personal data for which the Respondent himself is responsible. The DT&amp;V has indicated that it does not have the underlying documents of the file &#39;[filename 1] and [filename 2]&#39;, in which the oral report is filed and in which the existence of a &#39;death record registration&#39;, a &#39;marriage records registration&#39;. and is called of a passport. In view of the harmful consequences associated with this information, the claimant should be enabled to see on which this information is based.</p></div><span class="linebreak1"> </span></div><div class="paragroup"><span class="nr">5.1.</span><p> The court infers from Article 4, opening words and under 7 and under 8 of the GDPR that a processor has no control over the processing and may only act under the responsibility of the controller and according to his instructions. When the processor independently makes decisions about the purposes and means of the processing, he becomes responsible for those processing operations himself. Pursuant to Article 28 of the GDPR, where processing is carried out on behalf of a controller, the processing must be regulated by a processor in a contract or in another legal act under Union or Member State law binding the processor to the controller.<span class="linebreak1"> </span></p></div><div class="paragroup"><span class="nr">5.2.</span><p> In view of the purpose of the GDPR, as laid down in Article 1, second paragraph, of the GDPR, namely to protect the right of natural persons to the protection of personal data in particular, a broad interpretation should be given to the term &#39;controller&#39;. The court refers, for example, to the judgment of the Court of Justice of the European Union (Court of Justice) of 5 June 2018, Schleswig-Holstein, (C-210/16, ECLI: EU: C: 2018: 388), paragraph 26 -28. Although this judgment explains Directive 95/46 / EC, it is also important for the interpretation of the term &#39;controller&#39; in the GDPR. Indeed, it follows from recital 9 of the preamble to the GDPR that the objectives and principles of Directive 95/46 / EC remain intact. Also comes the content of the definitions of &#39;controller&#39; as included in Article 2 (d) of Directive 95/46 / EC and &#39;processor&#39; as included in Article 2 (e) of Directive 95/46 / EC, almost entirely corresponds to the definitions of &#39;processor&#39; and &#39;controller&#39; in the GDPR.<span class="linebreak1"> </span></p></div><div class="paragroup"><span class="nr">5.3.</span><p> In the court&#39;s opinion, in this case, the defendant should be regarded as the controller, in view of the foregoing. Although the respondent has taken the position that the Dutch embassy in Baku, on behalf of the DT&amp;V, had an investigation carried out on the spot by a confidential advisor, that the objective set by the DT&amp;V was an identity investigation and that he only acted as a mediator, This is not sufficiently substantiated (with documents) that the purposes and means of the processing by the defendant have been determined by the DT&amp;V and that he himself had no actual influence on the processing of the plaintiff&#39;s personal data. The statements of the respondent at the hearing that an identity investigation on behalf of DT&amp;V is always carried out by engaging a confidential advisor and that he only has a small role in passing on an investigation question to a confidential advisor, substantiate this - the broad interpretation of the term &#39;controller Mindful - don&#39;t finish. Nor has the defendant provided an agreement or explained in which other legal act the processing is regulated under Union or Member State law.<span class="linebreak1"> </span></p></div><div class="paragroup"><span class="nr">5.4.</span><p> Because the defendant wrongly took the position that he is a &#39;processor&#39; and not a controller, and therefore rejected the claimant&#39;s request under Articles 12 and 15 of the GDPR, the contested decision was taken in breach of these articles and insufficiently carefully prepared and motivated. The court will therefore declare the appeal well-founded and set aside the contested decision. The court sees no possibilities to uphold the legal consequences of the contested decision, to provide for the case itself or to apply an administrative loop. The respondent must therefore make a new decision on the objection with due observance of this ruling.<span class="linebreak1"> </span></p><p>6. Because the court declares the appeal to be well-founded, the defendant must reimburse the plaintiff for the court fee paid by him.<span class="linebreak1"> </span></p><p>7. The court orders the defendant to pay the costs incurred by the plaintiff. Pursuant to the Administrative Costs Decree, the court sets these costs for legal aid provided by a third party at € 1,068 (1 point for submitting the notice of appeal and 1 point for appearing at the hearing, with a value per point of € 534 and weighting factor 1). There is no reason for reimbursement of the legal costs in objection as requested, since the condition in Article 7:15, second paragraph, of the Awb, namely that there is a decision that has been revoked, has not been met.<span class="linebreak2"> </span></p></div></div><div class="section beslissing"><h2>Decision</h2><span class="linebreak1"> </span><div class="parablock"><p>The court:</p></div><p> - declares the appeal well-founded;</p><p> - annuls the contested decision;</p><p> - instructs the defendant to take a new decision on the objection, with due observance</p><p> of this statement;</p><p> - orders the defendant to reimburse the plaintiff the paid court fee of € 174;</p><p> - orders the defendant to pay the plaintiff&#39;s legal costs up to an amount of € 1,068.<span class="linebreak1"> </span></p><div class="parablock"><p>This judgment was made by mr. AMJ Adriaansen, judge, in the presence of mr. HL de Vries, registrar. The ruling was delivered in public on March 19, 2021.</p></div><span class="linebreak2"> </span><div class="parablock"><p><span class="emphasis" style="font-style:italic;">The registrar is out of state</span></p></div><span class="linebreak3"> </span><table cellspacing="0" cellpadding="2" class="frame_all pgwide_0 "><colgroup span="2"><col width="1*" /><col width="1*" /></colgroup><tbody class="top x bottom"><tr class=" first last"><td class="0 first align_left valign_top"><p> registrar</p></td><td class="0 last align_left valign_top"><p> judge</p></td></tr></tbody></table><div class="parablock"><p> A copy of this ruling is sent to the parties at:</p></div><span class="linebreak2"> </span></div><div class="section"><h2>Do you disagree with this statement?</h2><span class="linebreak1"> </span><div class="parablock"><p>An appeal against this decision can be lodged with the Administrative Jurisdiction Division of the Council of State within six weeks of the date on which it was sent.</p></div><span class="linebreak1"> </span><div class="parablock"><p>Annex - legal framework</p></div><span class="linebreak1"> </span><p>1. It follows from recital 9 of the preamble to the GDPR that the objectives and principles of Directive 95/46 / EC remain valid, (…).<span class="linebreak1"> </span></p><div class="parablock"><p>It follows from recital 74 of the preamble to the GDPR that the responsibility and liability of the controller must be established for any processing of personal data carried out by or on his behalf. In particular, the controller should be required to implement appropriate and effective measures and be able to demonstrate that any processing activity is carried out in accordance with this Regulation, including the effectiveness of the measures. Those measures should take into account the nature, scope, context and purpose of the processing and the risk to the rights and freedoms of natural persons.</p></div><span class="linebreak1"> </span><div class="parablock"><p>Pursuant to Article 4, opening words and under 7, of the GDPR, &#39;controller&#39; means: a natural or legal person, a public authority, a service or other body that, alone or together with others, fulfills the purpose of and determine the means of processing personal data; where the purposes and means of such processing are set out in Union or Member State law, they may determine who the controller is or by what criteria it is designated.</p></div><span class="linebreak1"> </span><div class="parablock"><p>Pursuant to Article 4, opening words and under 8 of the GDPR, &#39;processor&#39; is understood to mean: a natural or legal person, a public authority, a service or other body that processes personal data on behalf of the controller.</p></div><span class="linebreak1"> </span><div class="parablock"><p>Article 12 on transparent information, communication and detailed rules for exercising the rights of the data subject provides:</p></div><span class="linebreak1"> </span><p>1. The controller shall take appropriate measures to ensure that the data subject provides the information referred to in Articles 13 and 14 and the communication related to the processing referred to in Articles 15 to 22 and Article 34 in a concise, transparent, comprehensible and easily accessible form and receive it in plain and simple language, especially when the information is specifically for a child. The information shall be provided in writing or by other means, including, where appropriate, electronic means. If requested by the data subject, the information may be communicated orally, provided that the identity of the data subject is proven by other means.<span class="linebreak1"> </span></p><p>2. The controller shall facilitate the exercise of the data subject&#39;s rights under Articles 15 to 22. In the cases referred to in Article 11 (2), the controller may not refuse to comply with the data subject&#39;s request to to exercise his rights under Articles 15 to 22, unless the controller demonstrates that he is unable to identify the data subject.<span class="linebreak1"> </span></p><p>3. The controller shall provide the data subject with information on the action taken on the request without delay and in any case within one month of receipt of the request under Articles 15 to 22. Depending on the complexity of the requests and the number of requests, this period can be extended by another two months if necessary. The controller shall notify the data subject of such an extension within one month of receiving the request. When the data subject submits his request electronically, the information shall be provided electronically, if possible, unless the data subject requests otherwise.<span class="linebreak1"> </span></p><p>4. If the controller does not act on the request of the data subject, he shall immediately and at the latest within one month of receipt of the request inform the data subject why the request has not taken effect, and inform him of the possibility of lodging a complaint. should be brought before a supervisory authority and brought before a court.<span class="linebreak1"> </span></p><p>5. The provision of the information referred to in Articles 13 and 14 and the communication and the taking of the measures referred to in Articles 15 to 22 and Article 34 shall be free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular due to their repetitive nature, the controller may either:</p><p> a. charge a reasonable fee in light of the administrative costs associated with providing the requested information or communication and taking the requested action; either</p><p> b) refuse to act on the request. It is up to the controller to demonstrate the manifestly unfounded or excessive nature of the request.<span class="linebreak1"> </span></p><div class="parablock"><p>(…)</p></div><span class="linebreak1"> </span><div class="parablock"><p>Article 15 on the data subject&#39;s right of access provides:</p></div><span class="linebreak1"> </span><p>1. The data subject has the right to obtain from the controller a decision as to whether or not personal data concerning him / her is being processed and, where that is the case, to have access to such personal data and the following information:</p><p> a. a) the purposes of the processing;</p><p> b) the categories of personal data concerned;</p><p> (c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;</p><p> d) if possible, the expected period for which the personal data will be stored or, if that is not possible, the criteria for determining that period;</p><p> e) that the data subject has the right to request the controller to rectify or erase personal data, or to restrict the processing of personal data concerning him or her, as well as the right to object to such processing;</p><p> f) that the data subject has the right to lodge a complaint with a supervisory authority;</p><p> (g) where the personal data are not collected from the data subject, all available information about the source of that data;</p><p> (h) the existence of automated decision-making, including the profiling referred to in Article 22 (1) and (4), and, at least in those cases, useful information about the underlying logic, as well as the importance and expected consequences of that processing for the person concerned.<span class="linebreak1"> </span></p><div class="parablock"><p>(…)</p></div><span class="linebreak1"> </span><p>3. The controller shall provide the data subject with a copy of the personal data being processed. If the data subject requests additional copies, the controller may charge a reasonable fee based on the administrative costs. When the data subject submits his request electronically, and does not request other arrangements, the information shall be provided in a commonly used electronic form.<span class="linebreak1"> </span></p><p>4. The right to obtain a copy referred to in paragraph 3 is without prejudice to the rights and freedoms of others.<span class="linebreak1"> </span></p><div class="parablock"><p>Article 28 on the processor states:</p></div><p> 1. When processing is carried out on behalf of a controller, the controller shall only rely on processors who offer adequate guarantees regarding the application of appropriate technical and organizational measures to ensure that the processing complies with the requirements of this Regulation and the protection of rights of the data subject is guaranteed.<span class="linebreak1"> </span></p><p>2. The processor shall not employ any other processor without the prior specific or general written consent of the controller. In the case of general written consent, the processor shall inform the controller of any envisaged changes to add or replace other processors, giving the controller the opportunity to object to those changes.<span class="linebreak1"> </span></p><p>3. The processing by a processor shall be governed by a contract or other legal act under Union or Member State law binding the processor to the controller and which specifies the subject matter and duration of the processing, the nature and purpose of the processing. processing, the type of personal data and the categories of data subjects, and the rights and obligations of the controller are described. That agreement or other legal act provides in particular that the processor:</p><p> a) processes the personal data only on the basis of written instructions from the controller, including with regard to transfers of personal data to a third country or an international organization, unless a provision of Union or Member State law applicable to the processor requires him to process ; in such case, the processor shall notify the controller of that legal requirement prior to processing, unless such legislation prohibits such notice for important reasons of public interest;</p><p> (b) ensures that the persons authorized to process the personal data are committed to confidentiality or are bound by an appropriate legal obligation of confidentiality;</p><p> (c) takes all measures required in accordance with Article 32;</p><p> (d) meets the conditions referred to in paragraphs 2 and 4 for employing another processor;</p><p> e) taking into account the nature of the processing, assists the controller by appropriate technical and organizational measures, as far as possible, in fulfilling his duty to respond to requests for the exercise of the data subject&#39;s rights set out in Chapter III ;</p><p> (f) taking into account the nature of the processing and the information available to it, assists the controller in enforcing the obligations under Articles 32 to 36;</p><p> (g) after the end of the processing services, at the choice of the controller, deletes or returns all personal data to him, and deletes existing copies, unless storage of the personal data is required by Union or Member State law;</p><p> (h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and enables and contributes to audits, including inspections, by the controller or a controller authorized by the controller.</p><p> With regard to point (h) of the first subparagraph, the processor shall immediately notify the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions.<span class="linebreak1"> </span></p><p>4.Where a processor engages another processor to perform specific processing activities on behalf of the controller, a contract or other legal act under Union or Member State law imposes on that other processor the same data protection obligations as those set out in the Agreement or other legal act between the controller and the processor referred to in paragraph 3, in particular the obligation to provide adequate guarantees regarding the application of appropriate technical and organizational measures to ensure that the processing complies with the provisions of this Regulation. If the other processor fails to comply with its data protection obligations, the first processor shall remain fully liable to the controller for the performance of that other processor&#39;s obligations.<span class="linebreak1"> </span></p><div class="parablock"><p>(…)</p></div><span class="linebreak1"> </span><p>9. The agreement or other legal act referred to in paragraphs 3 and 4 shall be in written form, including electronic form.<span class="linebreak1"> </span></p><p>10. Where a processor determines the purposes and means of a processing in breach of this Regulation, that processor shall be considered the controller without prejudice to Articles 82, 83 and 84 in respect of that processing.<span class="linebreak1"> </span></p><p>2. Article 2 of Directive 95/46 / EC reads, where relevant:<span class="linebreak1"> </span></p><div class="parablock"><p>Definitions</p></div><span class="linebreak1"> </span><div class="parablock"><p>For the purposes of this Directive:</p></div><span class="linebreak1"> </span><p>(d) &quot;controller&quot; means the natural or legal person, public authority, agency or any other body which, alone or together with others, determines the purposes and means of the processing of personal data; where the purposes and means of the processing are determined by national or Community laws, regulations or administrative provisions, national or Community law may determine who is the controller or according to which criteria it is designated;<span class="linebreak1"> </span></p><p>(e) &quot;processor&quot; means the natural or legal person, public authority, agency or other body which processes or processes personal data on behalf of the controller;<span class="linebreak2"> </span></p></div></div></div></div></div></div></div><div class="row no-print"><div id="contentZoneTop" class="col-md-12 no-print"></div></div></div><!--/.row --></div><!--/.container --><!--/.rnl-content --><div class="rnl-content no-print"><div class="container"><div id="contentZoneBottom"></div></div></div><!--/.rnl-content --><div id="rnl-breadcrumb-container"><div class="rnl-content"><div class="container"><ul class="rs-breadcrumb"><li> <a href="https://www.rechtspraak.nl" title="Home">Home</a></li><li> <a href="https://www.rechtspraak.nl/Uitspraken-en-nieuws" title="Statements and news">Statements and news</a></li></ul></div></div></div><div class="noteref-holder"> <button class="rs-btn rs-btn-primary noteref-back" type="button">Back to text<span class="tri-down tri-up"></span></button> </div></div><!--/.rs-main-contentarea --></div><!--/.rs-wrapper --><div class="rs-footer"><div class="container"><div class="row"><div class="rs-footer-general-section"><ul class="rs-footer-menu"><li> <a href="https://www.rechtspraak.nl/english/" title="">English</a></li><li> <a href="https://www.rechtspraak.nl/privacy" title="">Privacy</a></li><li> <a href="https://www.rechtspraak.nl/cookies" title="">Cookies</a> </li></ul></div><div class="rs-footer-social-section" data-tag="MegaMenu" data-view="footersocialmenu" data-template="footer-social-menu-template"> <span class="rs-footer-heading">follow us</span><ul class="rs-footer-menu"><li class="twitter"> <a class="twitter" href="https://twitter.com/rechtspraaknl">twitter</a></li><li class="facebook"> <a class="facebook" href="https://nl-nl.facebook.com/Rechtspraak">facebook</a></li><li class="linkedin"> <a class="linkedin" href="https://www.linkedin.com/company/de-rechtspraak">linkedin</a></li><li class="youtube"> <a class="youtube" href="https://www.youtube.com/user/DeRechtspraak">youtube</a> </li></ul></div><div class="rs-footer-follow-section" data-tag="MegaMenu" data-view="footerfollowmenu" data-template="footer-follow-menu-template"> <span class="rs-footer-heading">Stay informed</span><ul class="rs-footer-menu"><li class="rss"> <a href="https://www.rechtspraak.nl/rss" class="rss">RSS</a></li><li class="email"> <a href="http://www.nieuwsbriefrechtspraak.nl/" class="email">e-mail</a> </li></ul></div></div><!--/.row --></div><!--/.container --></div><!--/.rs-footer --><script id="rnl-enquete-script" type="text/javascript" src="/SharedWebResources.axd?js/Rechtspraak/js/MWM2Popup.js"></script><script id="rnl-menu-script" type="text/javascript" src="/SharedWebResources.axd?js/Rechtspraak/js/rnlmenu.js"></script><!-- a href="#liquidcontent" class="skiplink">direct naar inhoud</a --><div class="navbar rs-navbar" role="navigation"><div class="container"><div class="row"><div class="navbar-header"> <button type="button" class="navbar-toggle rs-navbar-toggle collapsed" data-toggle="collapse" data-target=".navbar-collapse">Menu<span class="caret"></span></button> </div><div class="navbar-collapse collapse"><ul class="nav navbar-nav" id="mainNavigation" data-target=".navbar-collapse"><li class="dropdown "><a href="https://www.rechtspraak.nl/" title="Home" >Home</a></li><li class="dropdown rs-mega-menu"> <a href="https://www.rechtspraak.nl/Onderwerpen" title="subjects" >subjects</a><ul class="dropdown-menu rs-dropdown-menu"><li class="col-sm-6 htmlClassNoLink"><h3> Procedures</h3><ul><li class=""> <a href="https://www.rechtspraak.nl/Onderwerpen/Paginas/Belastingen-toeslagen-en-uitkeringen.aspx" title="Taxes, Fees and Benefits" >Taxes, Fees and Benefits</a></li><li class=""> <a href="https://www.rechtspraak.nl/Onderwerpen/Paginas/Consumenten.aspx" title="Consumers" >Consumers</a></li><li class=""> <a href="https://www.rechtspraak.nl/Onderwerpen/Paginas/Familie-en-relaties.aspx" title="Family and relationships" >Family and relationships</a></li><li class=""> <a href="https://www.rechtspraak.nl/Onderwerpen/Paginas/Gezondheid-en-zorg.aspx" title="Health and care" >Health and care</a></li><li class=""> <a href="https://www.rechtspraak.nl/Onderwerpen/Paginas/Huis-en-omgeving.aspx" title="House and surroundings" >House and surroundings</a></li><li class=""> <a href="https://www.rechtspraak.nl/Onderwerpen/Paginas/Maatregelen-en-straffen.aspx" title="Measures and punishments" >Measures and punishments</a></li><li class=""> <a href="https://www.rechtspraak.nl/Onderwerpen/Paginas/Schade-en-aansprakelijkheid.aspx" title="Damage and Liability" >Damage and Liability</a></li><li class=""> <a href="https://www.rechtspraak.nl/Onderwerpen/Paginas/Schulden-en-faillissement.aspx" title="Debts and bankruptcy" >Debts and bankruptcy</a></li><li class=""> <a href="https://www.rechtspraak.nl/Onderwerpen/Paginas/Vreemdelingen.aspx" title="Aliens" >Aliens</a></li><li class=""> <a href="https://www.rechtspraak.nl/Onderwerpen/Paginas/Werk-inkomen-en-ondernemen.aspx" title="Work, income and entrepreneurship" >Work, income and entrepreneurship</a></li><li class="col-sm-4"> <a href="https://www.rechtspraak.nl/Onderwerpen" title="More procedures" >More procedures</a></li></ul></li><li class="col-sm-6 htmlClassNoLink"><h3> To court</h3><ul><li class=""> <a href="https://www.rechtspraak.nl/Naar-de-rechter" title="What to Expect" >What to Expect</a></li><li class=""> <a href="https://www.rechtspraak.nl/Naar-de-rechter/In-de-rechtszaal" title="The session" >The session</a></li><li class=""> <a href="https://www.rechtspraak.nl/Naar-de-rechter/Rechtszaak-starten" title="Start lawsuit" >Start lawsuit</a></li><li class=""> <a href="https://www.rechtspraak.nl/Naar-de-rechter/Hoger-beroep" title="Go in appeal" >Go in appeal</a></li><li class=""> <a href="https://www.rechtspraak.nl/Naar-de-rechter/Paginas/Advocaat-wel-of-niet-verplicht.aspx" title="Lawyer required or not" >Lawyer required or not</a></li><li class=""> <a href="https://www.rechtspraak.nl/Organisatie-en-contact/Contact/Juridisch-advies" title="Legal advice" >Legal advice</a></li><li class=""> <a href="https://www.rechtspraak.nl/Naar-de-rechter/Kosten-rechtszaak" title="Costs of lawsuit" >Costs of lawsuit</a></li><li class=""> <a href="https://www.rechtspraak.nl/begrippen" title="Concepts" >Concepts</a></li><li class=""> <a href="https://www.rechtspraak.nl/Naar-de-rechter/Checklist" title="Checklist - what to bring" >Checklist - what to bring</a></li></ul></li><li class="col-sm-4"> <a href="https://www.rechtspraak.nl/Onderwerpen" title="All procedures" >All procedures</a></li></ul></li><li class="dropdown rs-mega-menu rs-mega-menu-bold"> <a href="https://www.rechtspraak.nl/Uitspraken-en-nieuws" title="Statements and news" >Statements and news</a><ul class="dropdown-menu rs-dropdown-menu"><li class="col-sm-3 rs-cta-container"> <a href="https://uitspraken.rechtspraak.nl/" title="Pronunciations" >Pronunciations</a></li><li class="col-sm-3 rs-news-item"> <a href="https://www.rechtspraak.nl/Nieuwsoverzicht" title="News overview" >News overview</a> <div class="rs-news-item-container"><img src="https://www.rechtspraak.nl/SiteCollectionImages/Wetboek%20van%20Strafvordering.JPG?width=50&amp;height=55" width="50" height="55" alt="News overview"> <span class="rs-news-item-header">News overview</span><div class="rs-news-item-text"> Stay up to date with the latest case law news and rulings.</div></div></li><li class="col-sm-3 rs-news-item"> <a href="https://www.rechtspraak.nl/Bekende-rechtszaken" title="Known lawsuits" >Known lawsuits</a> <div class="rs-news-item-container"><img src="https://www.rechtspraak.nl/SiteCollectionImages/In-de-rechtszaal.jpg?width=50&amp;height=55" width="50" height="55" alt="Known lawsuits"> <span class="rs-news-item-header">Known lawsuits</span><div class="rs-news-item-text"> On this special page you will find information about lawsuits that are getting a lot of attention in the media. For example: Marengo, Pulheim, the appeal of Willem Holleeder and the case against Jos B.</div></div></li><li class="col-sm-3 rs-news-item"> <a href="https://www.rechtspraak.nl/Themas" title="Themes" >Themes</a> <div class="rs-news-item-container"><img src="https://www.rechtspraak.nl/SiteCollectionImages/tbs.jpg?width=50&amp;height=55" width="50" height="55" alt="Themes"> <span class="rs-news-item-header">Themes</span><div class="rs-news-item-text"> On this special page you will find further information about subjects that are closely related to the judicial system, such as tbs, life imprisonment, community service and pre-trial detention.</div></div></li><li class="col-sm-3 rs-clear-left"> <a href="https://www.rechtspraak.nl/Persinformatie/Paginas/Rechtspraak-op-sociale-media.aspx" title="Justice on social media" >Justice on social media</a></li><li class="col-sm-3 rs-clear-left"> <a href="https://www.rechtspraak.nl/Persinformatie" title="For the press" >For the press</a></li></ul></li><li class="dropdown rs-mega-menu rs-mega-menu-col-9"> <a href="https://www.rechtspraak.nl/Registers" title="Registers" >Registers</a><ul class="dropdown-menu rs-dropdown-menu"><li class="col-sm-4"> <a href="https://ccbr.rechtspraak.nl" title="Trustee and administration register" >Trustee and administration register</a><ul><li class="hidden"> <a href="https://www.rechtspraak.nl/Registers/Paginas/Gebruik-Centraal-Curatele-en-bewindregister.aspx" title="Frequently asked questions Central Trustee and administration register" >Frequently asked questions Central Trustee and administration register</a></li><li class="hidden"> <a href="https://www.rechtspraak.nl/Registers/Paginas/Hulp-bij-zoeken-CCBR.aspx" title="Help with finding CCBR" >Help with finding CCBR</a></li></ul></li><li class="col-sm-4"> <a href="https://insolventies.rechtspraak.nl" title="Central insolvency register" >Central insolvency register</a><ul><li class="hidden"> <a href="https://insolventies.rechtspraak.nl/bekendmakingen.aspx" title="Insolvency Disclosures" >Insolvency Disclosures</a></li><li class="hidden"> <a href="https://www.rechtspraak.nl/Registers/Paginas/Termijnen-insolventies.aspx" title="Deadlines for insolvencies" >Deadlines for insolvencies</a></li><li class="hidden"> <a href="https://www.rechtspraak.nl/Registers/Paginas/Inhoudelijke-informatie-insolventies.aspx" title="Substantive information on insolvencies" >Substantive information on insolvencies</a></li><li class="hidden"> <a href="https://www.rechtspraak.nl/Registers/Paginas/Webservice-Centraal-Insolventieregister.aspx" title="Web service Central Insolvency Register" >Web service Central Insolvency Register</a></li><li class="hidden"> <a href="https://www.rechtspraak.nl/Registers/Paginas/Toelichting-insolventieregister.aspx" title="Explanation" >Explanation</a></li><li class="hidden"><a href="https://www.rechtspraak.nl/Registers/Paginas/EU-registratie.aspx" title="EU registration" >EU registration</a></li></ul></li><li class="col-sm-4"> <a href="https://www.rechtspraak.nl/Registers/centraal-register-voor-collectieve-vorderingen" title="Central register for collective actions" >Central register for collective actions</a></li><li class="col-sm-4"> <a href="https://www.rechtspraak.nl/Registers/Registratie-van-persoonsgegevens" title="Registration of personal data" >Registration of personal data</a></li><li class="col-sm-4"> <a href="https://hgr.rechtspraak.nl" title="Matrimonial property register" >Matrimonial property register</a><ul><li class="hidden"> <a href="https://www.rechtspraak.nl/Registers/Paginas/Hulp-bij-zoeken-Huwelijksgoederenregister.aspx" title="Help with searching Marriage Property Register" >Help with searching Marriage Property Register</a></li><li class="hidden"> <a href="https://www.rechtspraak.nl/Registers/Paginas/Toelichting-Huwelijksgoederenregister.aspx" title="Explanation of Marriage Property Register" >Explanation of Marriage Property Register</a></li></ul></li><li class="col-sm-4"> <a href="https://namenlijst.rechtspraak.nl" title="Ancillary positions of judges" >Ancillary positions of judges</a><ul><li class="hidden"> <a href="https://www.rechtspraak.nl/Registers/Paginas/Leidraad-onpartijdigheid-en-nevenfuncties-van-de-rechter.aspx" title="Guidelines for impartiality and ancillary positions of the judge" >Guidelines for impartiality and ancillary positions of the judge</a></li></ul></li><li class="col-sm-4"> <a href="https://www.rechtspraak.nl/Registers/Gezagsregister" title="Authority register" >Authority register</a></li><li class="col-sm-4"> <a href="https://www.rechtspraak.nl/Registers/Paginas/Boedelregister.aspx" title="Property register" >Property register</a></li><li class="col-sm-4"> <a href="https://www.rechtspraak.nl/Registers/Zaakverloopregister" title="Case history register" >Case history register</a></li></ul></li><li class="dropdown rs-mega-menu rs-mega-menu-col-9"> <a href="https://www.rechtspraak.nl/Organisatie-en-contact" title="the Judiciary" >the Judiciary</a><ul class="dropdown-menu rs-dropdown-menu"><li class="col-sm-8"> <a href="https://www.rechtspraak.nl/Organisatie-en-contact/Organisatie" title="Organization" >Organization</a><ul><li class="rs-mega-menu"><a href="https://www.rechtspraak.nl/Organisatie-en-contact/Organisatie/Rechtbanken" title="Courts" >Courts</a></li><li class=""> <a href="https://www.rechtspraak.nl/Organisatie-en-contact/Organisatie/Gerechtshoven" title="Courts of Justice" >Courts of Justice</a></li><li class=""> <a href="https://www.rechtspraak.nl/Organisatie-en-contact/Organisatie/Hoge-Raad-der-Nederlanden" title="Supreme Court of the Netherlands" >Supreme Court of the Netherlands</a></li><li class=""> <a href="https://www.rechtspraak.nl/Organisatie-en-contact/Organisatie/Centrale-Raad-van-beroep" title="Central Board of Appeal" >Central Board of Appeal</a></li><li class=""> <a href="https://www.rechtspraak.nl/Organisatie-en-contact/Organisatie/College-van-Beroep-voor-het-bedrijfsleven" title="Appeals Tribunal for Business" >Appeals Tribunal for Business</a></li><li class=""> <a href="https://www.rechtspraak.nl/Organisatie-en-contact/Organisatie/Raad-van-State" title="Council of State" >Council of State</a></li><li class=""> <a href="https://www.rechtspraak.nl/Organisatie-en-contact/Organisatie/Raad-voor-de-rechtspraak" title="Council for the Judiciary" >Council for the Judiciary</a></li><li class=""> <a href="https://www.rechtspraak.nl/Organisatie-en-contact/Organisatie/Landelijke-diensten" title="Rural services" >Rural services</a></li><li class=""> <a href="https://www.rechtspraak.nl/Organisatie-en-contact/Organisatie/Werken-en-opleiding" title="Work and training" >Work and training</a></li></ul></li></ul></li><li class="dropdown "> <a href="https://www.rechtspraak.nl/Voor-advocaten-en-juristen" title="Professionals" >Professionals</a></li><li class="dropdown "> <a href="https://www.rechtspraak.nl/Organisatie-en-contact/Contact" title="Contact" >Contact</a></li><li class="dropdown rs-mijn-zaak"> <a href="https://mijn.rechtspraak.nl" title="Forms and login" >Forms and login</a> </li></ul></div><!--/.nav-collapse --></div><!--/.row --></div><!--/.container --></div><!--/.navbar --><script type="text/javascript">window.NpiSettings = {"DeepLink":"http://deeplink.rechtspraak.nl/uitspraak?id=ECLI:NL:RBROT:2021:2306","Keywords":null};</script><script type="text/javascript" data-main="/Scripts/main-inziendocument.js" src="/Scripts/libs/require/require.js"></script><script type="text/javascript">


        $(window).load(function(){
            if(typeof(_paq) != 'undefined'){


                //Piwik site Id's
COURT ROTTERDAM
                var rechtBankList = {
                    "Rechtbank Amsterdam": 17,
                    "Rechtbank Den Haag": 19,
                    "Rechtbank Gelderland": 21,
                    "Rechtbank Limburg": 23,
                    "Rechtbank Midden-Nederland": 25,
                    "Rechtbank Noord-Holland": 27,
                    "Rechtbank Noord-Nederland": 29,
                    "Rechtbank Oost-Brabant": 31,
                    "Rechtbank Overijssel": 33,
                    "Rechtbank Rotterdam": 35,
                    "Rechtbank Zeeland-West-Brabant": 37,
                    "Gerechtshof Amsterdam": 53,
                    "Gerechtshof Leeuwarden": 55,
                    "Gerechtshof Arnhem": 55,
                    "Gerechtshof Den Haag": 57,
                    "Gerechtshof &#39;s-Hertogenbosch": 59
                };


                var instantieNaam='Rechtbank Rotterdam';
Seat in Rotterdam
                if (rechtBankList[instantieNaam] != null)
                {
                    var u = 'https://statistiek.rechtspraak.nl/';
                    _paq.push(['addTracker', piwikUrl = u+'piwik.php', rechtBankList[instantieNaam]]);
                }


                //Piwik
Administrative law
                _paq.push(['setCustomUrl', "UitspraakDetailView/ECLI:NL:RBROT:2021:2306"]);
                _paq.push(['trackPageView', "UIT " + document.title]);
            }


case number: ROT 19/5030


        });
Judgment of the single Judge of 19 March 2021 in the case inter
    </script><script type="text/javascript">
                (function (window, document, dataLayerName, id) {
                window[dataLayerName] = window[dataLayerName] || [], window[dataLayerName].push({ start: (new Date).getTime(), event: "stg.start" });
                    var scripts = document.getElementsByTagName('script')[0], tags = document.createElement('script');
                    function stgCreateCookie(a, b, c) { var d = ""; if (c) { var e = new Date; e.setTime(e.getTime() + 24 * c * 60 * 60 * 1e3), d = "; expires=" + e.toUTCString() } document.cookie = a + "=" + b + d + "; path=/" }
                    var isStgDebug = (window.location.href.match("stg_debug") || document.cookie.match("stg_debug")) && !window.location.href.match("stg_disable_debug"); stgCreateCookie("stg_debug", isStgDebug ? 1 : "", isStgDebug ? 14 : -1);
                    var qP = []; dataLayerName !== "dataLayer" && qP.push("data_layer_name=" + dataLayerName), isStgDebug && qP.push("stg_debug");
                    var qPString = qP.length > 0 ? ("?" + qP.join("&")) : ""; tags.async = !0, tags.src = "https://statistiek.rechtspraak.nl/containers/" + id + ".js" + qPString, scripts.parentNode.insertBefore(tags, scripts); !function (a, n, i) { a[n] = a[n] || {}; for (var c = 0; c < i.length; c++)!function (i) { a[n][i] = a[n][i] || {}, a[n][i].api = a[n][i].api || function () { var a = [].slice.call(arguments, 0); "string" == typeof a[0] && window[dataLayerName].push({ event: n + "." + i + ":" + a[0], parameters: [].slice.call(arguments, 1) }) } }(i[c]) }(window, "ppms", ["tm", "cm"]);
                })(window, document, 'dataLayer', '11b7c5ed-2b4c-406d-9d93-8e2bcf98a2dd');
            </script><noscript><iframe src="https://statistiek.rechtspraak.nl/containers/11b7c5ed-2b4c-406d-9d93-8e2bcf98a2dd/noscript.html" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript><script type="text/javascript">
        var rootWebAddress = "https://www.rechtspraak.nl";
        var uitspraakContentPage = "/Blocks/Uitspraken.detail.xml";
        var navigaToFeedbackForm = function () {
            window.location.href = rootWebAddress + '/Paginas/Feedback.aspx?a=Uitspraken&u=' + window.location.href;
        };
        </script><script>
            (function fillInzienContent() {
                var contentLoader = {
                    url: "",


                    load: function () {
[name of claimant], at [place of residence of claimant], claimant
                        $.ajax(
                            {
                                url: this.url,
                                method: "GET",
                                dataType: "xml",
                                global: false,
                                success: this.onSuccess,
                                error: this.onError
                            }
                        );
                    },
                    onSuccess: function (data) {
                        var htmlTop = "";
                        var htmlBottom = "";
                        var publishingPagecontent = data.getElementsByTagNameNS("*", "PublishingPageContent")
                        for (var i = 0; i < publishingPagecontent.length; i++) {
                            htmlTop += publishingPagecontent[i].textContent;
                        }
                        var publishingMiddleContent = data.getElementsByTagNameNS("*", "Rnl_PageMiddleContent")
                        for (var i = 0; i < publishingMiddleContent.length; i++) {
                            htmlBottom += publishingMiddleContent[i].textContent;
                        }


                                        htmlTop = htmlTop.replace(/href=\"\//gi, "href=\"" + window.rootWebAddress + "/");
authorized representative: mr. FLM van Haren,
                        htmlBottom = htmlBottom.replace(/href=\"\//gi, "href=\"" + window.rootWebAddress + "/");
 
                        $("#contentZoneTop").html(htmlTop);
and
                        $("#contentZoneBottom").html(htmlBottom);
 
                    },
Minister of Foreign Affairs, Legal Affairs Department, defendant
                    onError: function (request, status, error) {
 
                        console.error(error);
authorized representative: mr. R. Geraedts.
                    }
 
                };
Process course
                contentLoader.url = window.uitspraakContentPage;
 
                contentLoader.load();
By decision of April 29, 2019 (primary decision), the respondent rejected the claimant's request for access to the personal data processed by the respondent.
            })();
 
        </script></body></html>
By decision of September 17, 2019 (contested decision), the defendant declared the plaintiff's objection against the primary decision unfounded.
</pre>
 
The plaintiff has appealed against the contested decision.
 
Respondent has lodged a statement of defense.
 
The hearing took place on February 18, 2021. Plaintiff and his representative attended the hearing via a Skype connection. Respondent was represented by his agent. The case has been joined with the case with case number ROT 19/4649. At the hearing, the court closed the investigation. After that, things were split up for making a decision.
 
Considerations
 
1. The relevant legislation and regulations are included in an appendix that forms part of this decision.
 
2. On 28 March 2019, the plaintiff requested the defendant for information on the basis of articles 12 and 15, first paragraph, of Regulation 2016/679 of the European Parliament and of the Council of the European Union of 27 April 2016 on the protection of natural persons in connection with the processing of personal data and with regard to the free movement of such data and repealing Directive 95/46 / EC (the General Data Protection Regulation: GDPR). In his request, the plaintiff indicated that he had received an e-mail from the Repatriation and Departure Service (DT&V) with information that would relate to him and that, according to the DT&V, would come from the defendant. The respondent has rejected the aforementioned request of the plaintiff.The defendant based this rejection on the basis that he is not the controller within the meaning of Article 4 (7) of the GDPR, because the investigation by the Dutch embassy in Baku (Azerbaijan) in this case was carried out on behalf of the DT&V. . The DT&V has the file documents drawn up and collected by the respondent in the context of the assignment, so that the GDPR request to DT&V concerns the same personal data. Moreover, the contact with the person who carried out the on-site investigation took place verbally, according to the defendant. Plaintiff has objected to this rejection.V has the file documents drawn up and collected by the respondent in the context of the assignment, so that the GDPR request to DT&V concerns the same personal data. Moreover, the contact with the person who carried out the on-site investigation took place verbally, according to the defendant. Plaintiff has objected to this rejection.V has the file documents drawn up and collected by the respondent in the context of the assignment, so that the GDPR request to DT&V concerns the same personal data. Moreover, the contact with the person who carried out the on-site investigation took place verbally, according to the defendant. Plaintiff has objected to this rejection.
 
3. In the contested decision, the defendant declared the plaintiff's objection unfounded and maintained the primary decision. Respondent added that there was abuse of rights by the plaintiff and referred to the decision of the Northern Netherlands District Court of 23 April 2019 (ECLI: NL: RBNNE: 2019: 3761). Respondent points out in this regard that the plaintiff has submitted a request for inspection to both the defendant and the DT&V and that the plaintiff wishes to use the personal data in another procedure (an 'no-fault procedure'), so that he ultimately does not care about the correctness of the the actual personal data. The plaintiff is also already entitled to the documents relating to the case under the General Administrative Law Act (Awb) in the 'no-fault procedure'.
 
4. The court is first faced with the question of whether there has been an abuse of law.
 
4.1.
 
As the Administrative Jurisdiction Division of the Council of State (Division) considered in, for example, its decision of 31 October 2018 (ECLI: NL: RVS: 2018: 3553), Article 13, read in conjunction with Article 15, of Book 3 of the Civil Code (BW), the power to appeal to the administrative court cannot be invoked insofar as this power is misused. These articles preclude the substantive handling of an appeal brought before the administrative court that involves an abuse of law, and provide a legal basis for declaring such an appeal inadmissible. To this end, compelling grounds are required, which are present, among other things, if rights or powers are clearly used without a reasonable purpose or for a purpose other than that for which they have been granted,that the exercise of those rights or powers is evidence of bad faith. In the opinion of the court, this cannot be established in this case. In that regard, the court considers the following.
 
4.2.
 
The GDPR is intended to give data subjects (natural persons) access to the way in which administrative bodies, among others, process their personal data. In his request, the plaintiff asked the defendant various questions, with the aim of obtaining the information referred to in Article 15, first and second paragraphs, of the GDPR. In view of this, it cannot be concluded that it is not actually possible for the plaintiff to become acquainted with the personal data processed by the respondent and the manner in which the respondent processes these personal data in accordance with the purpose of the GDPR. The fact that the plaintiff has also submitted a request for access to the DT&V does not make this any different, all the more because the DT&V has indicated that the defendant does not provide any underlying information to them,to protect the researcher engaged and the research methods engaged by him. The fact that the plaintiff will use any personal data obtained in another procedure does not lead the court to conclude that this constitutes an abuse of law. This in itself does not mean that the purpose of the request is no longer in line with the purpose of the GDPR. In that context, the court also refers to case law of the Division relating to the Government Information (Public Access) Act (Wob) (for example, the decision of 29 January 2020 (ECLI: NL: RVS: 2020: 265), from which it follows that a request for disclosure of information with a view to a different procedure only constitutes an abuse of law in special circumstances.The court sees no reason to rule differently in this case.Such special circumstances have not become apparent to the court. Finally, the defendant's reference to the judgment of the Northern Netherlands District Court of 23 April 2019 cannot succeed, since there are no comparable cases. In that case, the applicant had been in possession of the requested documents and it had not become apparent that other personal data had been processed.
 
4.3.
 
In view of the foregoing, the court sees no reason to declare the appeal inadmissible because of abuse of the law.
 
5. In appeal, the plaintiff takes the position that the defendant is the controller. The DT&V and the respondent implement parts of the policy in parallel. The fact that the investigation took place in Baku in the context of an identity investigation in response to a request for mediation from the DT&V does not change that. Respondent passed on the data orally to an unknown / undisclosed confidential counselor who reported back verbally, which, according to Claimant, is a particularly irresponsible handling of personal data for which the Respondent himself is responsible. The DT&V has indicated that it does not have the underlying parts of the file '[filename 1] and [filename 2]',in which the oral report is filed and in which the existence of a 'death record registration', a 'marriage records registration' and a passport is mentioned. In view of the harmful consequences associated with this information, the Claimant should be enabled to see on which this information is based.
 
5.1.
 
The court infers from Article 4, opening words and under 7 and under 8 of the GDPR that a processor has no control over the processing and may only act under the responsibility of the controller and according to his instructions. When the processor independently makes decisions about the purposes and means of the processing, he becomes responsible for those processing operations himself. Pursuant to Article 28 of the GDPR, where processing is carried out on behalf of a controller, the processing must be regulated by a processor in a contract or in another legal act under Union or Member State law binding the processor to the controller.
 
5.2.
 
In view of the purpose of the GDPR, as laid down in Article 1, second paragraph, of the GDPR, namely to protect the right of natural persons to the protection of personal data in particular, a broad interpretation should be given to the term 'controller'. The court refers, for example, to the judgment of the Court of Justice of the European Union (Court of Justice) of 5 June 2018, Schleswig-Holstein, (C-210/16, ECLI: EU: C: 2018: 388), paragraph 26 -28. Although this judgment explains Directive 95/46 / EC, it is also important for the interpretation of the term 'controller' in the GDPR. Indeed, it follows from recital 9 of the preamble to the GDPR that the objectives and principles of Directive 95/46 / EC are maintained. Also comes the content of the definitions of 'controller',as included in Article 2 (d) of Directive 95/46 / EC and 'processor' as included in Article 2 (e) of Directive 95/46 / EC, almost entirely correspond to the definitions of 'processor' and ' controller 'in the GDPR.
 
5.3.
 
In the court's opinion, in this case, the defendant should be regarded as the controller, in view of the foregoing. Although the respondent has taken the position that the Dutch embassy in Baku, on behalf of the DT&V, had an on-site investigation carried out by a confidential advisor, that the objective set by the DT&V was an identity investigation and that he only acted as a mediator, This is not sufficiently substantiated (with documents) that the purposes and means of the processing by the defendant have been determined by the DT&V and that he himself had no actual influence on the processing of the plaintiff's personal data. The defendant's assertions at the hearing that an identity investigation commissioned by DT &V is always carried out by engaging a confidential adviser and the fact that he only plays a minor role in passing on a research question to a confidential adviser does not detract from this - bearing in mind the broad interpretation of the term 'controller'. Nor has the defendant provided an agreement or explained in which other legal act the processing is regulated under Union or Member State law.
 
5.4.
 
Since the defendant wrongly took the position that it is a 'processor' and not a controller, and therefore rejected the claimant's request under Articles 12 and 15 of the GDPR, the contested decision was taken in breach of these articles and insufficiently carefully prepared and motivated. The court will therefore declare the appeal well-founded and set aside the contested decision. The court sees no possibilities to uphold the legal consequences of the contested decision, to provide for the case itself or to apply an administrative loop. The respondent must therefore make a new decision on the objection with due observance of this ruling.
 
6. Because the court declares the appeal to be well-founded, the defendant must reimburse the plaintiff for the court fee paid by him.
 
7. The court orders the defendant to pay the costs incurred by the plaintiff. On the basis of the Administrative Costs Decree, the court sets these costs for the legal aid provided by a third party at € 1,068 (1 point for submitting the notice of appeal and 1 point for appearing at the hearing, with a value per point of € 534 and weighting factor 1). There is no reason for reimbursement of the legal costs in an objection as requested, since the condition in Article 7:15, second paragraph, of the Awb, namely that a decision has been revoked, has not been met.
 
Decision
 
The court:
 
- declares the appeal well-founded;
 
- annuls the contested decision;
 
- instructs the defendant to take a new decision on the objection, with due observance
 
of this statement;
 
- orders the defendant to reimburse the plaintiff the paid court fee of € 174;
 
- orders the defendant to pay the plaintiff's legal costs up to an amount of € 1,068.
 
This judgment was made by mr. AMJ Adriaansen, judge, in the presence of mr. HL de Vries, registrar. The ruling was delivered in public on March 19, 2021.
 
The clerk is out of state
 
registrar
 
judge
 
A copy of this ruling is sent to the parties at:
 
Do you disagree with this statement?
 
An appeal against this decision can be lodged with the Administrative Jurisdiction Division of the Council of State within six weeks of the date on which it was sent.
 
Annex - legal framework
 
1. It follows from recital 9 of the preamble to the GDPR that the objectives and principles of Directive 95/46 / EC remain valid, ().
 
It follows from recital 74 of the preamble to the GDPR that the responsibility and liability of the controller must be established for any processing of personal data carried out by or on his behalf. In particular, the controller should be required to implement appropriate and effective measures and be able to demonstrate that any processing activity is carried out in accordance with this Regulation, including the effectiveness of the measures. Those measures should take into account the nature, scope, context and purpose of the processing and the risk to the rights and freedoms of natural persons.
 
Pursuant to Article 4, opening words and under 7 of the GDPR, 'controller' means: a natural or legal person, a public authority, a service or other body that, alone or together with others, has the purpose of and determine the means of processing personal data; where the purposes and means of such processing are established in Union or Member State law, they may determine who the controller is or by what criteria it is designated.
 
Pursuant to Article 4, opening words and under 8 of the GDPR, 'processor' is understood to mean: a natural or legal person, a public authority, a service or other body that processes personal data on behalf of the controller.
 
Article 12 on transparent information, communication and detailed rules for exercising the rights of the data subject provides:
 
1. The controller shall take appropriate measures to ensure that the data subject provides the information referred to in Articles 13 and 14 and the communication related to the processing referred to in Articles 15 to 22 and Article 34 in a concise, transparent, comprehensible and easily accessible form and receive it in plain and simple language, especially when the information is specifically for a child. The information shall be provided in writing or by other means, including, where appropriate, electronic means. If requested by the data subject, the information may be communicated orally, provided that the identity of the data subject is proven by other means.
 
2. The controller shall facilitate the exercise of the data subject's rights under Articles 15 to 22. In the cases referred to in Article 11 (2), the controller may not refuse to comply with the data subject's request to to exercise his rights under Articles 15 to 22, unless the controller demonstrates that he is unable to identify the data subject.
 
3. The controller shall provide the data subject with information on the action taken on the request without undue delay and in any case within one month of receipt of the request under Articles 15 to 22. Depending on the complexity of the requests and the number of requests, this period can be extended by another two months if necessary. The controller shall notify the data subject of any such extension within one month of receipt of the request. When the data subject submits his request electronically, the information shall be provided electronically, if possible, unless the data subject requests otherwise.
 
4. If the controller does not act on the request of the data subject, he shall inform the data subject without delay and at the latest within one month of receipt of the request why the request has not been followed up and inform him of the possibility of lodging a complaint. should be brought before a supervisory authority and appeal to the courts.
 
5. The provision of the information referred to in Articles 13 and 14 and the communication and the taking of the measures referred to in Articles 15 to 22 and Article 34 shall be free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular due to their repetitive nature, the controller may either:
 
a. charge a reasonable fee in light of the administrative costs associated with providing the requested information or communication and taking the requested action; either
 
b) refuse to act on the request. It is up to the controller to demonstrate the manifestly unfounded or excessive nature of the request.
 
(…)
 
Article 15 on the data subject's right of access provides:
 
1. The data subject has the right to obtain from the controller a decision as to whether or not personal data concerning him / her is being processed and, where that is the case, to have access to such personal data and the following information:
 
a. a) the purposes of the processing;
 
b) the categories of personal data concerned;
 
(c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
 
d) if possible, the expected period for which the personal data will be stored or, if that is not possible, the criteria for determining that period;
 
e) that the data subject has the right to request the controller to rectify or erase personal data, or to restrict the processing of personal data concerning him or her, as well as the right to object to such processing;
 
f) that the data subject has the right to lodge a complaint with a supervisory authority;
 
(g) where the personal data are not collected from the data subject, all available information about the source of that data;
 
(h) the existence of automated decision-making, including the profiling referred to in Article 22 (1) and (4), and, at least in those cases, useful information about the underlying logic, as well as the importance and expected consequences of that processing for the person concerned.
 
(…)
 
3. The controller shall provide the data subject with a copy of the personal data being processed. If the data subject requests additional copies, the controller may charge a reasonable fee based on the administrative costs. When the data subject submits his request electronically, and does not request other arrangements, the information shall be provided in a commonly used electronic form.
 
4. The right to obtain a copy referred to in paragraph 3 is without prejudice to the rights and freedoms of others.
 
Article 28 on the processor states:
 
1. When processing is carried out on behalf of a controller, the controller shall only rely on processors who offer adequate guarantees regarding the application of appropriate technical and organizational measures to ensure that the processing complies with the requirements of this Regulation and the protection of rights of the data subject is guaranteed.
 
2. The processor shall not employ any other processor without the prior specific or general written consent of the controller. In the case of general written consent, the processor shall notify the controller of any envisaged changes to add or replace other processors, giving the controller the opportunity to object to those changes.
 
3.The processing by a processor shall be governed by a contract or other legal act under Union or Member State law binding the processor to the controller, and which sets out the subject matter and duration of the processing, the nature and purpose of the processing. processing, the type of personal data and the categories of data subjects, and the rights and obligations of the controller are described. That agreement or other legal act provides in particular that the processor:
 
a) processes the personal data only on the basis of written instructions from the controller, including in relation to transfers of personal data to a third country or an international organization, unless a provision of Union or Member State law applicable to the processor requires him to process ; in that case, the processor shall notify the controller of that legal requirement prior to processing, unless such legislation prohibits such notice for important reasons of public interest;
 
(b) ensures that the persons authorized to process the personal data are committed to confidentiality or are bound by an appropriate legal obligation of confidentiality;
 
(c) takes all measures required in accordance with Article 32;
 
(d) meets the conditions referred to in paragraphs 2 and 4 for employing another processor;
 
(e) taking into account the nature of the processing, assists the controller by appropriate technical and organizational measures, as far as possible, in fulfilling his duty to respond to requests for the exercise of the data subject's rights set out in Chapter III ;
 
(f) taking into account the nature of the processing and the information available to it, assists the controller in enforcing the obligations under Articles 32 to 36;
 
(g) after the end of the processing services, at the choice of the controller, deletes or returns all personal data and deletes existing copies, unless storage of the personal data is required by Union or Member State law;
 
(h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and enables and contributes to audits, including inspections, by the controller or a controller authorized by the controller.
 
With regard to point (h) of the first subparagraph, the processor shall immediately notify the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions.
 
4.Where a processor engages another processor to carry out specific processing activities on behalf of the controller, a contract or other legal act under Union or Member State law imposes on that other processor the same data protection obligations as those set out in the The agreement or other legal act referred to in paragraph 3 between the controller and the processor is included, in particular the obligation to provide adequate guarantees with regard to the application of appropriate technical and organizational measures to ensure that the processing complies with the provisions of this Regulation. If the other processor fails to fulfill its data protection obligations,the first processor remains fully liable to the controller for the fulfillment of the obligations of that other processor.
 
(…)
 
9. The agreement or other legal act referred to in paragraphs 3 and 4 shall be in written form, including electronic form.
 
10. Where a processor determines the purposes and means of a processing in breach of this Regulation, that processor shall be considered the controller without prejudice to Articles 82, 83 and 84 in respect of that processing.
 
2. Article 2 of Directive 95/46 / EC reads, where relevant:
 
Definitions
 
For the purposes of this Directive:
 
(d) "controller" means the natural or legal person, public authority, agency or other body which, alone or together with others, determines the purposes and means of the processing of personal data; where the purposes and means of the processing are determined by national or Community laws, regulations or administrative provisions, national or Community law may determine who is the controller or according to which criteria it is designated;
 
(e) "processor" means the natural or legal person, public authority, agency or other body which processes or processes personal data on behalf of the controller;</pre>

Revision as of 09:57, 7 April 2021

Rb. Rotterdam - ROT 19/5030
Courts logo1.png
Court: Rb. Rotterdam (Netherlands)
Jurisdiction: Netherlands
Relevant Law: Article 4(7) GDPR
Article 4(8) GDPR
Article 12 GDPR
Article 15(1) GDPR
Article 15(2) GDPR
Decided: 19.03.2021
Published: 22.03.2021
Parties: Minister van Buitenlandse Zaken, Directie Juridische Zaken
National Case Number/Name: ROT 19/5030
European Case Law Identifier: ECLI:NL:RBROT:2021:2306
Appeal from:
Appeal to: Unknown
Original Language(s): Dutch
Original Source: de Rechtspraak (in Dutch)
Initial Contributor: n/a

The Rotterdam Court of First Instance ruled that the Directorate of Legal Affairs of the Dutch Ministry of Foreign Affairs was wrong in rejecting a DSAR because it didn’t view itself as controller. It also ruled that a DSAR where another procedure is concerned only constitutes an abuse of rights in certain circumstances none of which were resent in this case.

English Summary

Facts

On 28 March 2019, the complainant submitted a DSAR to the Directorate of Legal Affairs of the Ministry of Foreign Affairs (The Directorate). The complainant has previously received an email from the Repatriation and Departure Service (DT&V), containing data about the claimant. According the DT&V, that data originated from the Directorate.

On 29 April 2019, the Directorate rejected the complainant’s request of access to his personal data. On 17 September 2019, complainant’s objection to this decision was rejected as unfounded.

The complainant appeals against this decision.

Dispute

The Directorate claims that the complainant’s DSAR cannot be granted because the Ministry is not controller of the affected personal data: the identity investigation in question was ordered by the Repatriation and Departure Service (DT&V).

In addition, after rejecting the complainant’s objection, the Directorate claimed that the complainant was abusing his rights. The Directorate pointed out that complainant has submitted access requests to both DT&V and the Directorate, and that he wanted to use this data in other process, so access to personal data was not the end goal of the request.

Holding

The Court considered that it was not obvious that the complainant’s wish to access his data was contrary to the purpose of the GDPR. The fact that these data could be used in another procedure also did not not lead the Court to believe that there was an abuse of rights. The Court also pointed to the case law, from which it follows that the access request where another procedure is concerned only constitutes an abuse of rights in special circumstances. For example, if rights or powers have been used so manifestly without reasonable purpose or for a purpose other than that for which they were granted. The Court saw no reason to rule that there had been an abuse of rights by the complainant.

When deciding whether the Directorate was a controller or a processor, the Court considered the following. The Directorate failed to provide the documents to demonstrate that the purposes and means of processing were determined by the DT&V and that the Directorate had no factual influence over the key elements of the personal data processing. Considering that the term “controller” must be interpreted broadly, the Court ruled that the Directorate was wrong in assuming that it was a data processor.

The Court declared the appeal against the Directorate’s decision well founded.

Comment

The Court referred to this judgement to rule on the abuse of rights question:

https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RVS:2020:265

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.



COURT ROTTERDAM

Seat in Rotterdam

Administrative law

case number: ROT 19/5030

Judgment of the single Judge of 19 March 2021 in the case inter

[name of claimant], at [place of residence of claimant], claimant

authorized representative: mr. FLM van Haren,

and

Minister of Foreign Affairs, Legal Affairs Department, defendant

authorized representative: mr. R. Geraedts.

Process course

By decision of April 29, 2019 (primary decision), the respondent rejected the claimant's request for access to the personal data processed by the respondent.

By decision of September 17, 2019 (contested decision), the defendant declared the plaintiff's objection against the primary decision unfounded.

The plaintiff has appealed against the contested decision.

Respondent has lodged a statement of defense.

The hearing took place on February 18, 2021. Plaintiff and his representative attended the hearing via a Skype connection. Respondent was represented by his agent. The case has been joined with the case with case number ROT 19/4649. At the hearing, the court closed the investigation. After that, things were split up for making a decision.

Considerations

1. The relevant legislation and regulations are included in an appendix that forms part of this decision.

2. On 28 March 2019, the plaintiff requested the defendant for information on the basis of articles 12 and 15, first paragraph, of Regulation 2016/679 of the European Parliament and of the Council of the European Union of 27 April 2016 on the protection of natural persons in connection with the processing of personal data and with regard to the free movement of such data and repealing Directive 95/46 / EC (the General Data Protection Regulation: GDPR). In his request, the plaintiff indicated that he had received an e-mail from the Repatriation and Departure Service (DT&V) with information that would relate to him and that, according to the DT&V, would come from the defendant. The respondent has rejected the aforementioned request of the plaintiff.The defendant based this rejection on the basis that he is not the controller within the meaning of Article 4 (7) of the GDPR, because the investigation by the Dutch embassy in Baku (Azerbaijan) in this case was carried out on behalf of the DT&V. . The DT&V has the file documents drawn up and collected by the respondent in the context of the assignment, so that the GDPR request to DT&V concerns the same personal data. Moreover, the contact with the person who carried out the on-site investigation took place verbally, according to the defendant. Plaintiff has objected to this rejection.V has the file documents drawn up and collected by the respondent in the context of the assignment, so that the GDPR request to DT&V concerns the same personal data. Moreover, the contact with the person who carried out the on-site investigation took place verbally, according to the defendant. Plaintiff has objected to this rejection.V has the file documents drawn up and collected by the respondent in the context of the assignment, so that the GDPR request to DT&V concerns the same personal data. Moreover, the contact with the person who carried out the on-site investigation took place verbally, according to the defendant. Plaintiff has objected to this rejection.

3. In the contested decision, the defendant declared the plaintiff's objection unfounded and maintained the primary decision. Respondent added that there was abuse of rights by the plaintiff and referred to the decision of the Northern Netherlands District Court of 23 April 2019 (ECLI: NL: RBNNE: 2019: 3761). Respondent points out in this regard that the plaintiff has submitted a request for inspection to both the defendant and the DT&V and that the plaintiff wishes to use the personal data in another procedure (an 'no-fault procedure'), so that he ultimately does not care about the correctness of the the actual personal data. The plaintiff is also already entitled to the documents relating to the case under the General Administrative Law Act (Awb) in the 'no-fault procedure'.

4. The court is first faced with the question of whether there has been an abuse of law.

4.1.

As the Administrative Jurisdiction Division of the Council of State (Division) considered in, for example, its decision of 31 October 2018 (ECLI: NL: RVS: 2018: 3553), Article 13, read in conjunction with Article 15, of Book 3 of the Civil Code (BW), the power to appeal to the administrative court cannot be invoked insofar as this power is misused. These articles preclude the substantive handling of an appeal brought before the administrative court that involves an abuse of law, and provide a legal basis for declaring such an appeal inadmissible. To this end, compelling grounds are required, which are present, among other things, if rights or powers are clearly used without a reasonable purpose or for a purpose other than that for which they have been granted,that the exercise of those rights or powers is evidence of bad faith. In the opinion of the court, this cannot be established in this case. In that regard, the court considers the following.

4.2.

The GDPR is intended to give data subjects (natural persons) access to the way in which administrative bodies, among others, process their personal data. In his request, the plaintiff asked the defendant various questions, with the aim of obtaining the information referred to in Article 15, first and second paragraphs, of the GDPR. In view of this, it cannot be concluded that it is not actually possible for the plaintiff to become acquainted with the personal data processed by the respondent and the manner in which the respondent processes these personal data in accordance with the purpose of the GDPR. The fact that the plaintiff has also submitted a request for access to the DT&V does not make this any different, all the more because the DT&V has indicated that the defendant does not provide any underlying information to them,to protect the researcher engaged and the research methods engaged by him. The fact that the plaintiff will use any personal data obtained in another procedure does not lead the court to conclude that this constitutes an abuse of law. This in itself does not mean that the purpose of the request is no longer in line with the purpose of the GDPR. In that context, the court also refers to case law of the Division relating to the Government Information (Public Access) Act (Wob) (for example, the decision of 29 January 2020 (ECLI: NL: RVS: 2020: 265), from which it follows that a request for disclosure of information with a view to a different procedure only constitutes an abuse of law in special circumstances.The court sees no reason to rule differently in this case.Such special circumstances have not become apparent to the court. Finally, the defendant's reference to the judgment of the Northern Netherlands District Court of 23 April 2019 cannot succeed, since there are no comparable cases. In that case, the applicant had been in possession of the requested documents and it had not become apparent that other personal data had been processed.

4.3.

In view of the foregoing, the court sees no reason to declare the appeal inadmissible because of abuse of the law.

5. In appeal, the plaintiff takes the position that the defendant is the controller. The DT&V and the respondent implement parts of the policy in parallel. The fact that the investigation took place in Baku in the context of an identity investigation in response to a request for mediation from the DT&V does not change that. Respondent passed on the data orally to an unknown / undisclosed confidential counselor who reported back verbally, which, according to Claimant, is a particularly irresponsible handling of personal data for which the Respondent himself is responsible. The DT&V has indicated that it does not have the underlying parts of the file '[filename 1] and [filename 2]',in which the oral report is filed and in which the existence of a 'death record registration', a 'marriage records registration' and a passport is mentioned. In view of the harmful consequences associated with this information, the Claimant should be enabled to see on which this information is based.

5.1.

The court infers from Article 4, opening words and under 7 and under 8 of the GDPR that a processor has no control over the processing and may only act under the responsibility of the controller and according to his instructions. When the processor independently makes decisions about the purposes and means of the processing, he becomes responsible for those processing operations himself. Pursuant to Article 28 of the GDPR, where processing is carried out on behalf of a controller, the processing must be regulated by a processor in a contract or in another legal act under Union or Member State law binding the processor to the controller.

5.2.

In view of the purpose of the GDPR, as laid down in Article 1, second paragraph, of the GDPR, namely to protect the right of natural persons to the protection of personal data in particular, a broad interpretation should be given to the term 'controller'. The court refers, for example, to the judgment of the Court of Justice of the European Union (Court of Justice) of 5 June 2018, Schleswig-Holstein, (C-210/16, ECLI: EU: C: 2018: 388), paragraph 26 -28. Although this judgment explains Directive 95/46 / EC, it is also important for the interpretation of the term 'controller' in the GDPR. Indeed, it follows from recital 9 of the preamble to the GDPR that the objectives and principles of Directive 95/46 / EC are maintained. Also comes the content of the definitions of 'controller',as included in Article 2 (d) of Directive 95/46 / EC and 'processor' as included in Article 2 (e) of Directive 95/46 / EC, almost entirely correspond to the definitions of 'processor' and ' controller 'in the GDPR.

5.3.

In the court's opinion, in this case, the defendant should be regarded as the controller, in view of the foregoing. Although the respondent has taken the position that the Dutch embassy in Baku, on behalf of the DT&V, had an on-site investigation carried out by a confidential advisor, that the objective set by the DT&V was an identity investigation and that he only acted as a mediator, This is not sufficiently substantiated (with documents) that the purposes and means of the processing by the defendant have been determined by the DT&V and that he himself had no actual influence on the processing of the plaintiff's personal data. The defendant's assertions at the hearing that an identity investigation commissioned by DT &V is always carried out by engaging a confidential adviser and the fact that he only plays a minor role in passing on a research question to a confidential adviser does not detract from this - bearing in mind the broad interpretation of the term 'controller'. Nor has the defendant provided an agreement or explained in which other legal act the processing is regulated under Union or Member State law.

5.4.

Since the defendant wrongly took the position that it is a 'processor' and not a controller, and therefore rejected the claimant's request under Articles 12 and 15 of the GDPR, the contested decision was taken in breach of these articles and insufficiently carefully prepared and motivated. The court will therefore declare the appeal well-founded and set aside the contested decision. The court sees no possibilities to uphold the legal consequences of the contested decision, to provide for the case itself or to apply an administrative loop. The respondent must therefore make a new decision on the objection with due observance of this ruling.

6. Because the court declares the appeal to be well-founded, the defendant must reimburse the plaintiff for the court fee paid by him.

7. The court orders the defendant to pay the costs incurred by the plaintiff. On the basis of the Administrative Costs Decree, the court sets these costs for the legal aid provided by a third party at € 1,068 (1 point for submitting the notice of appeal and 1 point for appearing at the hearing, with a value per point of € 534 and weighting factor 1). There is no reason for reimbursement of the legal costs in an objection as requested, since the condition in Article 7:15, second paragraph, of the Awb, namely that a decision has been revoked, has not been met.

Decision

The court:

- declares the appeal well-founded;

- annuls the contested decision;

- instructs the defendant to take a new decision on the objection, with due observance

of this statement;

- orders the defendant to reimburse the plaintiff the paid court fee of € 174;

- orders the defendant to pay the plaintiff's legal costs up to an amount of € 1,068.

This judgment was made by mr. AMJ Adriaansen, judge, in the presence of mr. HL de Vries, registrar. The ruling was delivered in public on March 19, 2021.

The clerk is out of state

registrar

judge

A copy of this ruling is sent to the parties at:

Do you disagree with this statement?

An appeal against this decision can be lodged with the Administrative Jurisdiction Division of the Council of State within six weeks of the date on which it was sent.

Annex - legal framework

1. It follows from recital 9 of the preamble to the GDPR that the objectives and principles of Directive 95/46 / EC remain valid, (…).

It follows from recital 74 of the preamble to the GDPR that the responsibility and liability of the controller must be established for any processing of personal data carried out by or on his behalf. In particular, the controller should be required to implement appropriate and effective measures and be able to demonstrate that any processing activity is carried out in accordance with this Regulation, including the effectiveness of the measures. Those measures should take into account the nature, scope, context and purpose of the processing and the risk to the rights and freedoms of natural persons.

Pursuant to Article 4, opening words and under 7 of the GDPR, 'controller' means: a natural or legal person, a public authority, a service or other body that, alone or together with others, has the purpose of and determine the means of processing personal data; where the purposes and means of such processing are established in Union or Member State law, they may determine who the controller is or by what criteria it is designated.

Pursuant to Article 4, opening words and under 8 of the GDPR, 'processor' is understood to mean: a natural or legal person, a public authority, a service or other body that processes personal data on behalf of the controller.

Article 12 on transparent information, communication and detailed rules for exercising the rights of the data subject provides:

1. The controller shall take appropriate measures to ensure that the data subject provides the information referred to in Articles 13 and 14 and the communication related to the processing referred to in Articles 15 to 22 and Article 34 in a concise, transparent, comprehensible and easily accessible form and receive it in plain and simple language, especially when the information is specifically for a child. The information shall be provided in writing or by other means, including, where appropriate, electronic means. If requested by the data subject, the information may be communicated orally, provided that the identity of the data subject is proven by other means.

2. The controller shall facilitate the exercise of the data subject's rights under Articles 15 to 22. In the cases referred to in Article 11 (2), the controller may not refuse to comply with the data subject's request to to exercise his rights under Articles 15 to 22, unless the controller demonstrates that he is unable to identify the data subject.

3. The controller shall provide the data subject with information on the action taken on the request without undue delay and in any case within one month of receipt of the request under Articles 15 to 22. Depending on the complexity of the requests and the number of requests, this period can be extended by another two months if necessary. The controller shall notify the data subject of any such extension within one month of receipt of the request. When the data subject submits his request electronically, the information shall be provided electronically, if possible, unless the data subject requests otherwise.

4. If the controller does not act on the request of the data subject, he shall inform the data subject without delay and at the latest within one month of receipt of the request why the request has not been followed up and inform him of the possibility of lodging a complaint. should be brought before a supervisory authority and appeal to the courts.

5. The provision of the information referred to in Articles 13 and 14 and the communication and the taking of the measures referred to in Articles 15 to 22 and Article 34 shall be free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular due to their repetitive nature, the controller may either:

a. charge a reasonable fee in light of the administrative costs associated with providing the requested information or communication and taking the requested action; either

b) refuse to act on the request. It is up to the controller to demonstrate the manifestly unfounded or excessive nature of the request.

(…)

Article 15 on the data subject's right of access provides:

1. The data subject has the right to obtain from the controller a decision as to whether or not personal data concerning him / her is being processed and, where that is the case, to have access to such personal data and the following information:

a. a) the purposes of the processing;

b) the categories of personal data concerned;

(c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;

d) if possible, the expected period for which the personal data will be stored or, if that is not possible, the criteria for determining that period;

e) that the data subject has the right to request the controller to rectify or erase personal data, or to restrict the processing of personal data concerning him or her, as well as the right to object to such processing;

f) that the data subject has the right to lodge a complaint with a supervisory authority;

(g) where the personal data are not collected from the data subject, all available information about the source of that data;

(h) the existence of automated decision-making, including the profiling referred to in Article 22 (1) and (4), and, at least in those cases, useful information about the underlying logic, as well as the importance and expected consequences of that processing for the person concerned.

(…)

3. The controller shall provide the data subject with a copy of the personal data being processed. If the data subject requests additional copies, the controller may charge a reasonable fee based on the administrative costs. When the data subject submits his request electronically, and does not request other arrangements, the information shall be provided in a commonly used electronic form.

4. The right to obtain a copy referred to in paragraph 3 is without prejudice to the rights and freedoms of others.

Article 28 on the processor states:

1. When processing is carried out on behalf of a controller, the controller shall only rely on processors who offer adequate guarantees regarding the application of appropriate technical and organizational measures to ensure that the processing complies with the requirements of this Regulation and the protection of rights of the data subject is guaranteed.

2. The processor shall not employ any other processor without the prior specific or general written consent of the controller. In the case of general written consent, the processor shall notify the controller of any envisaged changes to add or replace other processors, giving the controller the opportunity to object to those changes.

3.The processing by a processor shall be governed by a contract or other legal act under Union or Member State law binding the processor to the controller, and which sets out the subject matter and duration of the processing, the nature and purpose of the processing. processing, the type of personal data and the categories of data subjects, and the rights and obligations of the controller are described. That agreement or other legal act provides in particular that the processor:

a) processes the personal data only on the basis of written instructions from the controller, including in relation to transfers of personal data to a third country or an international organization, unless a provision of Union or Member State law applicable to the processor requires him to process ; in that case, the processor shall notify the controller of that legal requirement prior to processing, unless such legislation prohibits such notice for important reasons of public interest;

(b) ensures that the persons authorized to process the personal data are committed to confidentiality or are bound by an appropriate legal obligation of confidentiality;

(c) takes all measures required in accordance with Article 32;

(d) meets the conditions referred to in paragraphs 2 and 4 for employing another processor;

(e) taking into account the nature of the processing, assists the controller by appropriate technical and organizational measures, as far as possible, in fulfilling his duty to respond to requests for the exercise of the data subject's rights set out in Chapter III ;

(f) taking into account the nature of the processing and the information available to it, assists the controller in enforcing the obligations under Articles 32 to 36;

(g) after the end of the processing services, at the choice of the controller, deletes or returns all personal data and deletes existing copies, unless storage of the personal data is required by Union or Member State law;

(h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and enables and contributes to audits, including inspections, by the controller or a controller authorized by the controller.

With regard to point (h) of the first subparagraph, the processor shall immediately notify the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions.

4.Where a processor engages another processor to carry out specific processing activities on behalf of the controller, a contract or other legal act under Union or Member State law imposes on that other processor the same data protection obligations as those set out in the The agreement or other legal act referred to in paragraph 3 between the controller and the processor is included, in particular the obligation to provide adequate guarantees with regard to the application of appropriate technical and organizational measures to ensure that the processing complies with the provisions of this Regulation. If the other processor fails to fulfill its data protection obligations,the first processor remains fully liable to the controller for the fulfillment of the obligations of that other processor.

(…)

9. The agreement or other legal act referred to in paragraphs 3 and 4 shall be in written form, including electronic form.

10. Where a processor determines the purposes and means of a processing in breach of this Regulation, that processor shall be considered the controller without prejudice to Articles 82, 83 and 84 in respect of that processing.

2. Article 2 of Directive 95/46 / EC reads, where relevant:

Definitions

For the purposes of this Directive:

(d) "controller" means the natural or legal person, public authority, agency or other body which, alone or together with others, determines the purposes and means of the processing of personal data; where the purposes and means of the processing are determined by national or Community laws, regulations or administrative provisions, national or Community law may determine who is the controller or according to which criteria it is designated;

(e) "processor" means the natural or legal person, public authority, agency or other body which processes or processes personal data on behalf of the controller;