Rb. Zeeland-West-Brabant - AWB - 19 1554
From GDPRhub
| Rb. Zeeland-West-Brabant - AWB - 19_1554 | |
|---|---|
 | |
| Court: | Rb. Zeeland-West-Brabant (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 4(7) GDPR Article 12(1) GDPR |
| Decided: | 19.06.2020 |
| Published: | 06.07.2020 |
| Parties: | |
| National Case Number/Name: | AWB - 19_1554 |
| European Case Law Identifier: | ECLI:NL:RBZWB:2020:2658 |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | Uitspraken (in Dutch) |
| Initial Contributor: | n/a |
The court decided that the fact that even if the name of the applicant was not mentioned in the Forum used by several cities to exchange information, it was identifiable and therefore the GDPR was applicable. However, the processing was compliant with the GDPR.
English Summary
Facts
An applicant asked to erase all data on him to the municipality. After having investigated, it appeared that a conversation between two municipal agents could reveal the identity of the applicant. The applicant considered the processing was illegal and therefore claimed for damages to the city.
Dispute
Are the data where the name of the data subject still personal data ? is the processing in line with the GDPR ?
Holding
The Court decided that the discussion made it possible to identity the applicant and therefore the GDPR was applicable. However, the processing was compliant with the GDPR since the aim was to prevent abuse of the law by applicants, which is the legitimate interest of the municipalities. No damages were granted.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
Court of Zeeland West Brabant Date of pronunciation 19-06-2020 Date of publication 06-07-2020 Case number AWB - 19_1554 Jurisdictions Administrative law Special features First instance - single Content indication FOR Sites Rechtspraak.nl Enriched pronunciation Ruling SEAS-WEST BRABANT COURT Administrative law Case number: BRE 19/1554 judgment of 19 June 2020 of the single chamber in the case between [name plaintiff] , at [place name] , plaintiff, Agent: Mr. N.G.A. Voorbach, and the College of Mayor and Aldermen of the Municipality of Sluis, defendant. Proceedings The plaintiff has appealed against the defendant's decision of 26 February 2019. (contested decision) on three applications under the General Data Protection Regulation (AVG). The hearing took place on 20 May 2020 via Skype. The claimant was represented by his representative. The defendant was represented by [representative] . Recitals 1. Facts On 16 September 2018, the plaintiff requested the defendant to remove all his personal data from all systems of the municipality of Sluis (request 1). In addition, the plaintiff asks to investigate whether the Municipality of Sluis has processed his personal data by publication on the VNG Forum and/or by forwarding his personal data by e-mail to other administrative bodies (request 2). If it emerges from this investigation that the Municipality of Sluis has carried out one of the aforementioned forms of data processing, the claimant will claim compensation of € 1000 (request 3). By decision of 4 October 2018 (primary decision), the defendant states that the personal data of the plaintiff in the archives of the municipality are all related to requests pursuant to the Government Information (Public Access) Act (Wob) and the Personal Data Protection Act (Wbp). Wob requests must be kept for at least 1 year. The defendant indicates that it intends to destroy all documents containing plaintiffs' personal data that are dated before 1 January 2018 in 2019. These data will also be deleted from the other systems (decision 1). Furthermore, the defendant states that the plaintiff's personal data have not been shared by the Municipality of Sluis at the VNG Forum or with other administrative bodies (decision 2). The claim for compensation is therefore rejected (decision 3). The claimant's objection is directed against decisions 2 and 3. In the contested decision, the defendant declared the objection unfounded and maintained the primary decision. According to the defendant, the plaintiff has not demonstrated that his personal data have been processed by the Municipality of Sluis on the VNG Forum or otherwise passed on to other administrative bodies. Therefore, according to the defendant, there can be no question of damage. The plaintiff has lodged an appeal against this decision. 2. Grounds of appeal In summary, the plaintiff argues that [representative], working as a civil servant in the service of the municipality of Sluis, processed personal data traceable to the plaintiff on 1 August 2017 at 09:45 a.m. by posting the following message on the VNG Forum: "Sluis has received the same request from the 'old acquaintance'. The enclosed proof of identity is no longer valid (30 December 2015 will expire), so I tend not to process (...)". The plaintiff is of the opinion that the defendant should have investigated the activities of [representative] at the VNG Forum. Now that this has not been done, the contested decision has been prepared carelessly. Furthermore, the plaintiff claims that he lost control of his personal data through the defendant's actions. He therefore claims immaterial damages from € 5.000,-. 3. Legal framework The relevant legal provisions are set out in an annex, which forms part of this ruling. 4. Processing of personal data (decision 2) 4.1 Introduction The parties agree - and the court is also of the opinion - that the request to clarify whether, and if so in what way, officials of the municipality have processed personal data of the claimant on the VNG Forum should be regarded as a request within the meaning of Article 15(1) of the AVG. Pursuant to Article 34 of the AVG Implementation Act, the written decision on a request pursuant to Article 15 of the AVG is a decision within the meaning of the General Administrative Law Act (Awb). This means that objections and appeals may be lodged against this decision. 4.2 Sufficient investigation? The plaintiff is of the opinion that the defendant should have investigated the activities of [representative] on the VNG Forum. At the hearing, [representative] stated that as an official of the municipality of Sluis, he was charged with processing applications on the grounds of the AVG, the Wob and the Wbp. He stated that, apart from the discussion on 1 August 2017 at the VNG Forum, he had not sent any e-mails or other messages to the Forum or other administrative bodies relating to the claimant. The forum was and is only intended for officials dealing with Wob requests. In the light of this statement by [representative], the District Court is of the opinion that further investigation into the possible use of personal data of the plaintiff by officials of the municipality of Sluis on the VNG Forum is not necessary. The District Court sees no reason to doubt the correctness of the statement of [representative]. Nor has the plaintiff made it plausible that (a request from) him was discussed at any other time than 1 August 2017 at the VNG Forum. In view of the statement of [representative] at the hearing, the District Court rejected the claimant's request to hear [representative] as a witness. The District Court also rejected the claimant's request to hear an employee of the VNG as a witness, because the District Court is of the opinion that this cannot reasonably contribute to the assessment of the case. The appeal ground that the contested decision was prepared carelessly does not serve any purpose. 4.3 Have personal data been processed on 1 August 2017? The plaintiff claims that the defendant processed his personal data on 1 August 2017 at the VNG Forum. He supported his appeal by submitting screenshots of the discussion at the VNG Forum. The defendant claims that on 1 August 2017 no information was exchanged on the forum that can be traced back directly or indirectly to the claimant. The words "the same request was also received here", "old acquaintance" and "attached proof of identity is no longer valid (15 December 2015)" cannot be traced back to plaintiff. Plaintiff claims that this topic is about him, but does not substantiate this. This information does not concern personal data. According to the defendant, there are many persons who have submitted national Wob applications in recent years. At the hearing, the defendant's representative acknowledged, upon request, that the discussion of 1 August 2017 related to plaintiff. The District Court considered the following. First of all, the District Court finds that the AVG entered into force on 25 May 2018 and has immediate effect. However, the immediate effect of the AVG does not mean that facts that took place before its entry into force should also be assessed under the AVG. In this case, the question of whether the data processed are personal data must be assessed on the basis of the Wbp, as this Act applied in 2017. The court notes that the material assessment framework has not changed as a result of the AVG entering into force.1 Article 1 of the Personal Data Protection Act defines personal data as any data relating to an identified or identifiable natural person. Data can be identifiable if they are so unique due to their combination that they can only relate to one person. The ability of the third party to whom the data is provided to achieve identification must be taken into account when assessing whether it is identifiable. It may therefore be the case that an item of data one recipient may have personal data, but not the other.2 In the District Court's opinion, the question of whether personal data is involved must therefore be assessed in context. From the screenshots submitted by the plaintiff, the District Court deduces that the defendant at the VNG Forum is talking about a person (man) who is a member of the VNG Forum: - is an old acquaintance of the municipality, - made the same request under the Wbp, - whose ID has expired since 30 December 2015. In view of these data, the District Court is of the opinion that these data, viewed in mutual coherence and in context, can be traced back to the plaintiff without a disproportionate effort on the part of the recipients of these data. From the text contributions of others on the screenshots submitted, it can be concluded that participants in the forum know exactly which person is involved.3 This leads the court to the conclusion that [representative], then and now working as an official of the municipality of Sluis, processed personal data of the plaintiff on 1 August 2017. The defendant was and is the (processing) controller within the meaning of Section 1, opening words and under d, of the Wbp and Section 4, opening words and under 7, of the AVG.4 For this reason, the District Court will declare the appeal well-founded. It will annul the contested decision in so far as it upholds decision 2 and declare the objection well-founded in so far as it relates to decision 2. The Court will itself provide for the case, in the sense that it will revoke decision 2 and will establish that on 1 August 2017 the defendant processed the claimant's personal data on the VNG Forum. This gives the plaintiff the clarity he wanted during these proceedings. 5. Compensation (decision 3) Pursuant to Article 82(1) of the AVG, any person who has suffered material damage as a result of a breach of this Regulation is entitled to receive compensation for the damage suffered from the controller or the processor. On 1 April 2020, the Administrative Jurisdiction Division of the Council of State (hereinafter: AbRS) ruled that Title 8.4 of the General Administrative Law Act applies to requests for compensation as referred to in Article 82, first paragraph, of the AVG that are made after 1 July 2013.5 Therefore, no appeal - and therefore no objection - can be lodged. made - against decision 3.6 This leads the court to the conclusion that the defendant wrongly assessed the content of the objection to decision 3. For this reason, too, the District Court will declare the appeal well-founded. It will annul the contested decision in so far as it upholds decision 3. The court will provide for the case itself by declaring the objection, in so far as it is directed against decision 3, inadmissible. 6. Registrar's fees and costs of the proceedings Now that the court will declare the appeal (partly) well-founded, the defendant must reimburse the court fee paid to the plaintiff for the handling of this dispute. The court will order the defendant to reimburse the costs incurred by the plaintiff for conducting these proceedings, with due observance of the Decree on Administrative Law Costs. The court will set these costs at an amount of € 1,050, due to the legal assistance provided by the claimant's agent (1 point for the submission of the appeal and 1 point for the appearance at the hearing, with a value per point of € 525 and a weighting of 1). Since the claimant's objection will also be declared (partly) well-founded, he will also be eligible for reimbursement of the costs incurred by him in respect of legal assistance in objection up to an amount of € 501 (1 point for filing the notice of objection, with a value per point of € 501 (= fee 2018) and weighting factor 1). 7. The application for compensation The Court considers the notice of objection, insofar as it is directed against decision 3, as a claim for damages within the meaning of Section 8:90(1) of the General Administrative Law Act (Awb). It qualifies the contested decision, insofar as it relates to decision 3, as a statement of defence, and the notice of appeal as a written supplement to the claim for compensation. The parties have indicated at the hearing that they can agree to this, if it means that the court can give a substantive opinion on the request for compensation. Mr [name of plaintiff] will be referred to in this context as 'applicant'. The applicant is of the opinion that the processing of his personal data on the VNG Forum was unlawful. The defendant does not agree. The first question to be answered is therefore whether the processing of the applicant's personal data on 1 August 2017 at the VNG Forum was unlawful. Here too, the question whether the personal data processed was unlawful must be assessed on the basis of the Personal Data Protection Act, because this Act was applicable in 2017. Section 8(e) of the Personal Data Protection Act provides that personal data may be processed if this is necessary for the proper performance of a task under public law by the administrative body in question or the administrative body to which the data is provided. In its aforementioned ruling of 1 April 2020, the AbRS noted the following in recital 30: "A request to disclose and provide information on an administrative matter may be made to the Municipal Executive pursuant to the Wob. The implementation of the Wob is a public duty of the Municipal Executive. It is important for the proper functioning of the Wob that investigations are conducted into abuse of the Wob and that any abuse is established. By means of the VNG Forum, the VNG has set up a digital platform to enable municipalities to consult with each other on how to approach and deal with the many Wob requests that have been submitted, often only for the collection of periodic penalty payments. (…).” Recital 31 reads as follows: "Mentioning the name of [the appellant] on the VNG Forum at the request of another municipality was intended to ensure the proper implementation of the Wob and to prevent the Wob from being misused for the purpose of collecting penalty payments in the event of failure to make a decision on a request in good time. This aim is in accordance with Section 8(e) of the Wbp (and Section 6(1) and (e) of the GC). Contrary to the arguments put forward by [the appellant], there are no grounds for considering that the data processing is not in accordance with the requirements of proportionality and subsidiarity. The purpose of the processing is proportionate to the invasion of [the appellant's] privacy and could not be achieved by less intrusive means. It was necessary to state the name of [the appellant], because only in this way could it be ascertained whether he had submitted Wob requests to several municipal councils that might have been aimed at collecting a penalty payment. Nor was it excessive to share this information on the VNG Forum. As the Municipal Executive explained at the hearing, only those with a specific function related to the processing of Wob requests had access to the Wob/Municipalities section of the VNG Forum. There were no grounds for [the appellant's] assertion that the entire governing body of the Netherlands had been able to take note of his name. Nor did [the appellant], if asked, make it clear what concrete adverse consequences had resulted from mentioning his name on the VNG Forum. The District Court shares the opinion of the AbRS and the underlying reasoning as stated above. It is true that the discussion of 1 August 2017 at the VNG Forum was not about a Wob request as in the AbRS judgment, but about a Wbp request, but here, too, the same problem applies about the national submission of many requests in order to subsequently be able to collect penalty payments if administrative bodies fail to decide on the requests in time. The District Court sees no reason to ask any further preliminary questions on this subject or to doubt the correctness of the opinion of the AbRS. This leads the District Court to rule that the processing of the applicant's personal data at the VNG Forum on 1 August 2017 by an official of the Municipality of Sluis is not unlawful. In doing so, the District Court takes into account that the applicant's name has not been mentioned, and that an arbitrary outsider cannot directly deduce from the general description who exactly is involved. The defendant's conduct therefore infringes the privacy of the applicant less than the conduct that led to the decision of the AbRS of 1 April 2020. The request for compensation is therefore rejected. Decision The court: - declares the appeal well-founded; - Annuls the contested decision in so far as it relates to the processing of personal data on the VNG Forum and the refusal to award damages; - with respect to the processing of personal data on the VNG Forum: declares the objection well-founded, revokes the primary decision and establishes that the claimant's personal data were processed on the VNG Forum on 1 August 2017 at 09:45; - as regards the refusal to award damages, declares the objection inadmissible; - provides that that judgment is to replace the annulled part of the contested decision; - orders the defendant to reimburse to the plaintiff the court fee paid for the handling of this dispute, i.e. an amount of € 174; - Order the defendant to pay the costs incurred by the plaintiff for the conduct of these proceedings, up to an amount of € 1,551; - rejects the claim for compensation. This decision was made by Mr. L.P. Hertsig, judge, in the presence of Mr. L.M. Koenraad, registrar. The decision was publicly pronounced on 19 June 2020. registrar judge Copy sent to parties on: Legal remedy An appeal may be lodged with the Administrative Jurisdiction Division of the Council of State against this decision within six weeks of the date on which it was sent.
