RvS - 201902417/1/A2: Difference between revisions

From GDPRhub
(Created page with "{{COURTdecisionBOX <!--Information about the Court--> |Jurisdiction=Netherlands |Court-BG-Color=background-color:#ffffff; |Courtlogo=courtsNL.png |Court_Abbrevation=RvS |Cour...")
 
No edit summary
 
(5 intermediate revisions by 3 users not shown)
Line 9: Line 9:


<!--Information about the decision-->
<!--Information about the decision-->
|Case_Number_Name=201901006/1/A2
|Case_Number_Name=201902417/1/A2
|ECLI=ECLI:NL:RVS:2020:898
|ECLI=ECLI:NL:RVS:2020:901


|Original_Source_Name_1=de Rechtspraak
|Original_Source_Name_1=de Rechtspraak
|Original_Source_Link_1=https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RVS:2020:898&showbutton=true&keyword=avg
|Original_Source_Link_1=http://deeplink.rechtspraak.nl/uitspraak?id=ECLI:NL:RVS:2020:901
|Original_Source_Language_1=Dutch
|Original_Source_Language_1=Dutch
|Original_Source_Language_Code_1=NL
|Original_Source_Language_Code_1=NL
Line 27: Line 27:


<!--Information about the applied law-->
<!--Information about the applied law-->
|GDPR_Article_1=Article 79 GDPR
|GDPR_Article_1=Article 6(1)(e) GDPR
|GDPR_Article_Link_1=Article 79 GDPR
|GDPR_Article_Link_1=Article 6 GDPR#1e
|GDPR_Article_2=Article 82 GDPR
|GDPR_Article_2=Article 82(1) GDPR
|GDPR_Article_Link_2=Article 82 GDPR  
|GDPR_Article_Link_2=Article 82 GDPR#1
|GDPR_Article_3=
|GDPR_Article_3=
|GDPR_Article_Link_3=
|GDPR_Article_Link_3=
Line 152: Line 152:
|Party_Name_1=Anonymous
|Party_Name_1=Anonymous
|Party_Link_1=
|Party_Link_1=
|Party_Name_2=Minister for Legal Protection
|Party_Name_2=College van burgemeester en wethouders van Harderwijk
|Party_Link_2=
|Party_Link_2=
|Party_Name_3=
|Party_Name_3=
Line 162: Line 162:


<!--Information about a possible appeal-->
<!--Information about a possible appeal-->
|Appeal_From_Body=Rb. Gelderland (Netherlands)
|Appeal_From_Body=
|Appeal_From_Case_Number_Name=18/3073
|Appeal_From_Case_Number_Name=
|Appeal_From_Status=Unknown
|Appeal_From_Status=Unknown
|Appeal_From_Link=
|Appeal_From_Link=
Line 174: Line 174:


<!--Here the main article starts-->
<!--Here the main article starts-->
The Council of State awarded appellant with 500 EUR compensation for the unlawful sharing of his sensitive personal data. The amount was raised from 300 EUR to 500 EUR. Sensitive data in question contained strictly confidential medical information which was shared between forensic psychiatric observation clinic Pieter Baan Centrum and Regional Disciplinary Board for Healthcare in Zwolle.
On 1 April 2020, the Council of State rejected the claim of the plaintiff asking for damage compensation for the violation of the GDPR by the local authorities considering the lack of proof of an actual damage caused by the lack of information. To be compensated, claimant must be able to prove that the damage is real and certain.


==English Summary==
==English Summary==
===Facts===
===Facts===
Appellant’s strictly confidential medical data was shared by a forensic psychiatric observation clinic with the Regional Disciplinary Board for Healthcare. The appellant was not informed about this. His subsequent objection and request for compensation was rejected by the Minister for Legal Protection on the basis that the Appellant’s honor or reputation has not been affected, nor has he suffered otherwise. The Court of Gelderland, which heard the dispute, ruled that sensitive personal data has indeed been shared unlawfully and awarded 300 EUR in damages to the Appellant.  
The Dutch Council of State ruled on a claim for damages filed by a citizen whose data (name, address and residence) were processed on a forum accessed by the local authorities. This Internet forum was intended to exchange data between municipalities to prevent abuse of the Public Administration Act. The applicant involved, who filed several request to access documents, had not given his/her consent to the processing of her/his personal data on the forum and received information on the processing of these data only at a late stage of the procedure.  


===Dispute===
===Dispute===
The Appellant claims that he is entitled to a higher compensation. The State Council had to assess whether that is the case.
The Council of State had to determine whether the processing of information on the internet forum access by the local authorities had a legal ground under Article 6 of the GDPR, and whether the lack of information before such processing was in line with the transparency obligations of the controller (the municipal executive of Harderwijk).  
The Council of State also had to rule as to whether it is competent to grant a compensation for the damage suffered by the individual and under which circumstances.


===Holding===
===Holding===
The State Council agreed with the Court of Gelderland that the appellant was intitled to compensation of non-material damage according to the Dutch Civil Code and increased the amount awarded to 500 EUR. In deciding this, the Council considered the nature, duration and seriousness of the breach:
The Council of State ruled that the mention the name of the applicants on the internet forum at the request of another municipality (to ensure the proper implementation of the access to document legislation and to prevent abuse of such legislation) was legitimate and allowed under Article 6 (1) (e) of the GDPR.  
• Nature: sensitive data was processed without consent or any other applicable legal basis;
 
• Seriousness: sensitive data was shared with a small group of professionals and members of the Board have a duty of confidentiality by virtue of their position;
However, the Council of State (CoS) rules that the municipality did not inform the data subject in good time, which is a violation of the GDPR.
• Duration: the breach occurred on the 15th of January 2018. On 22nd of January the Board confirmed that they would disregard the information.
 
The Council took into account that the Appellant did not demonstrate any negative consequences of the breach.
As to the claim for damages, the CoS notes that though Article 82(1) of the GDPR states that full compensation for actual non-material damage resulting from breaches of the GDPR must take place in a manner that does justice to the objectives of the Regulation, the GDPR does not specify how the non-material damage is to be determined and calculated. However, the Court of Justice has consistently held that the damage to be compensated must be real and certain.


==Comment==
==Comment==
Line 200: Line 201:
<pre>
<pre>


201901006/1/A2.
 
Authority
Council of State
Date of pronunciation
01-04-2020
Date of publication
01-04-2020
Case number
201902417/1/A2
Jurisdictions
Administrative law
Special features
First instance - multiple
Content indication
By decision of 17 October 2016, the Municipal Executive of Harderwijk announced, in response to the request made by [the appellant] pursuant to the Personal Data Protection Act, that the name, address and place of residence details of [the appellant] had been processed in the postal registration system. The Board attached copies of the letters for which those details had been processed to the decision. The Board also stated that the name and address details of [the appellant] had not been provided to anyone else and that his personal data had not been processed in any other way either.
 
Locations
Rechtspraak.nl
Enriched pronunciation
Ruling
Ruling
201902417/1/A2.


Date of judgment: 1 April 2020
Date of judgment: 1 April 2020
Line 208: Line 230:
ADMINISTRATIVE LAW
ADMINISTRATIVE LAW


Ruling on the appeal of:
Judgment in the dispute between:


[appellant], residing at [residence],
[appellant], residing at [residence],
against the judgment of the District Court of Gelderland of 19 December 2018 in Case No 18/3073 in the proceedings between:
[appellant]


and
and


the Minister for Legal Protection.
the municipal executive of Harderwijk,


Process Process
defendant.


By decision of 13 March 2018, the Minister rejected a request for compensation from [the appellant].
Litigation


By decision of 17 May 2018, the Minister dismissed [the appellant's] objection.
By decision of 17 October 2016, in response to the request made by [the Appellant] pursuant to the Personal Data Protection Act (referred to below as 'the Wbp'), the Board announced that [the Appellant's] name and address had been included in the post registration system. The Board attached copies of the letters for which those details had been processed to the decision. The Board also stated that the name and address details of [the appellant] had not been provided to anyone else and that his personal data had not been processed in any other way either.


On 6 June 2018, [the appellant] appealed against the decision of 17 May 2018 and asked the court to order the Minister to pay damages.
By decision of 19 February 2019, the Board again dismissed [the appellant's] objection to this decision as unfounded.


By decision of 19 December 2018, the court upheld the appeal lodged by [the appellant] against the decision of 17 May 2018, annulled the decision of 17 May 2018, revoked the decision of 13 March 2018, ordered the Minister to pay damages of € 300 to [the appellant] and ordered that this decision replace the annulled decision. This decision is attached.
This decision was appealed against by [the appellant], who applied for damages.


The [appellant] has lodged an appeal against this decision.
By decision of 29 May 2019, the Board amended the decision of 19 February 2019 and upheld the [appellant's] objection.


The Minister has given a written explanation.
The Board submitted a statement of defence.


The Division heard the case on 1 August 2019, where [the appellant] and the Minister, represented by F. Boone, appeared.
The Division heard the case on 15 January 2020, where [the appellant], represented by [the agent], and the Board, represented by M. Huisman, appeared.


The Division reopened the investigation pursuant to Section 8:68(1) of the General Administrative Law Act (Awb) and referred the case to a multiple chamber.
Considerations
 
[Appellant] submitted a further document.
 
The Division heard the case on 15 January 2020, where [the appellant] and the Minister, represented by F. Boone, appeared.


Considerations
1.    At the end of this judgment (under 53), the Division will indicate what this judgment means more generally and what will be decided in this case.


    Introduction
2.    On 25 May 2018, Regulation 2016/679 of the European Parliament and the Council of the European Union of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (the General Data Protection Regulation, hereinafter: AVG) became applicable. The AVG will be directly applicable in each Member State as of 25 May 2018 (Article 99(3) of the AVG). The Wbp was repealed on 25 May 2018. The AVG has immediate effect. The transitional law contained in Section 48(10) of the AVG Implementation Act does not apply in this case.


1.    On January 15, 2018, the director of the Pieter Baan Centre submitted documents containing medical information about him to the Regional Health Care Disciplinary Board in Zwolle (hereinafter referred to as: the Disciplinary Board) in a complaint procedure against him, without [the appellant's] consent and without his knowledge. The draft versions of the psychological and psychiatric sections of Pro Justitia reports sent included strictly confidential personal details of [the appellant]. On 17 January 2018, [the Appellant] was informed by the Disciplinary Board of the disclosure of the sensitive personal data and was provided with copies of the reports. On 19 January 2018, [the appellant] asked the Disciplinary Board to disregard the documents when considering his complaint against the Director. On 22 January 2018, the Disciplinary Board informed [the appellant] that his personal details would be disregarded in the complaints procedure.
3.    The AVG applies to the claim for damages. On 13 June 2019, i.e. after the AVG came into effect, [the appellant] requested the Division to order the Minister to pay damages. To assess the unlawfulness of the act, which in this case occurred in part before 25 May 2018, the old law, i.e. the Wbp, applies.


At the end of this decision (under 39), the Section briefly set out what this decision means in more general terms and what is to be decided in this case.
4.    The Division is of the opinion that in this transitional phase, during which a request for compensation was made after 25 May 2018 for damages in connection with acts that took place partly before that date and that were contrary to the Wbp and would now also be contrary to the AVG, and in which the substantive assessment framework was therefore already the same, the legal protection set out below under 27 must also be offered.


    Decision-making
Judgment of 23 January 2019


2.    By letter dated 4 February 2018, [the appellant] objected to the Minister's submission of the reports and applied for compensation. In the proceedings that led to the court's ruling, the Minister stated that the Disciplinary Board was contacted immediately after the sensitive personal data were sent with a request to destroy the documents as soon as they were received. The Minister also took the position that the reports were not provided deliberately in order to influence the Disciplinary Board or to damage [the appellant]. In the decision of 17 May 2018, the Minister referred to the opinion of the Disciplinary Board of 9 March 2018 that the reports should not have been provided:
5.    In its ruling of 23 January 2019, ECLI:NL:RVS:2019:184, the Section considered, in so far as relevant, that the Board did not provide access to whether and which personal data of [the appellant] had been processed at the VNG Forum. Insofar as such data have been processed, the Board has not provided an overview of the data, nor a description of the purpose(s) of the processing, the categories of data to which the processing relates and the recipients or categories of recipients, as well as the available information about the origin of the data.


"In the opinion of the Board, the appendices, which evidently contain medical information, were indeed wrongly provided without the complainant's consent and without his knowledge. The appendices have no relevance for the present case and (therefore) do not serve to defend the defendant. The circumstances invoked by the defendant that a clerical error has been made, or that the lawyer of the RPP, after sending the documents - and therefore too late - advised not to send the annexes, should remain at the defendant's expense. The part of the complaint is well-founded'.
6.    The Division rejected the [Appellant's] request for compensation because it could not yet be established whether the Board had processed personal data in violation of the Personal Data Protection Act.


The Division is of the opinion that it should be held that the Minister took the position that the processing of [appellant's] personal data was unlawful. In addition, the Minister stated that he saw no grounds for compensation because [the appellant] had not been harmed in his honour or reputation or otherwise in his person.
7.    The Division annulled the decision of 23 February 2017, by which the Board declared the objection made by [the appellant] to the decision of 17 October 2016 to be unfounded, and decided that the Board should take a new decision on the objection.


    Court ruling
8.    The Division has further determined that an appeal may only be lodged with the Division against the new decision on the objection.


3.    The court found in the judgment that the transmission of the personal data was unlawful. [the appellant] rightly objected to the disclosure, on the grounds that he did not consent to the forwarding of his personal data as referred to in Article 8, opening words and under a, of the Personal Data Protection Act (Wet bescherming persoonsgegevens, Wbp). According to the court, [the appellant] is entitled to damages to be determined on a fair basis. With regard to the amount of the damages to be determined, the court considered it important that the privacy-sensitive personal data ended up with a small group of professionals, i.e. employees and members of the Disciplinary Board, and that they were bound by a duty of confidentiality by virtue of their duties. According to the District Court, this does not detract from the fact that [the appellant's] privacy was violated and that this was understandably perceived by the appellant as harmful and harmful. The court therefore considered compensation of € 300 to be fair and ruled that the Minister should pay this amount to [the appellant].
The decision of 19 February 2019


    Dispute on appeal
9.    In its decision of 19 February 2019, the College again declared the objection to the decision of 17 October 2016 unfounded. To that end, the Municipal Executive stated, among other things, that it had not posted any personal data on the VNG Forum. The data posted in 2016 have since been removed from the forum and can no longer be retrieved.


4.    The Minister has not appealed the court's decision. In that ruling, the court ruled that the decision of 17 May 2018 was unlawful and annulled that decision, in so far as it did not award any compensation.
The decision of 29 May 2019


5.    5. [Appellant] claims to be entitled to higher compensation than € 300.00.
10.    By decision of 29 May 2019, the Board amended the decision of 19 February 2019, upheld [the appellant's] objection to the decision of 17 October 2016 and revoked the decision of 17 October 2016. The Board provided [the appellant] with a summary of the data processed by the Board on the VNG Forum. The Board claims to have obtained access to these data via the VNG, which has retained the data in connection with legal proceedings. Finally, the Municipal Executive has awarded compensation for the costs in objection of €512.00.


    Ex officio judgement
Interim conclusion


6.    The District Court did not acknowledge that with the introduction of Title 8.4 in the Awb on the basis of Article 8:4, paragraph 1, opening words and under f of the Awb, the possibility to appeal against a decision regarding compensation for loss on account of unlawful management actions has lapsed. It follows from this that the District Court has annulled the decision of 17 May 2018, although rightly so, but on incorrect grounds. The court should have declared the objection against the decision of 31 March 2018 inadmissible instead of revoking this decision. Pursuant to Section 8:88 of the General Administrative Law Act, the court should have assessed whether [the appellant] was entitled to compensation.
11.    The action against the decision of 19 February 2019 is inadmissible for lack of any legal interest in bringing proceedings. Pending the appeal against the decision of 19 February 2019 in the decision of 29 May 2019, the Board has fully complied with the grounds of appeal put forward by [the appellant]. At that time, the Board upheld the appeal against the decision of 17 October 2016, revoked that decision and awarded compensation for the costs of the appeal. In view of the fact that the Board amended its decision of 19 February 2019 in favour of [the appellant] as a result of the appeal, the Division sees reason to order the Board to pay the costs of the appeal proceedings.


7.    The court's ruling qualifies for set aside, insofar as the court has revoked the 31 March 2018 decision, has determined that the Minister will pay damages of €300 to [the appellant] and has determined that this ruling will replace the annulled decision. The Division will declare the objection to this decision inadmissible after all.
12.    Since the decision of 29 May 2019 was fully in favour of [the appellant], no appeal against this decision arose by operation of law.


8.    The Division will assess the application for damages below.
13.    In these proceedings, only the request for compensation made by [the appellant] is at issue.


    Applicable law
Claim for compensation


9.    On 25 May 2018, Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (the General Data Protection Regulation, hereinafter AVG) became applicable. The AVG will be directly applicable in each Member State as of 25 May 2018 (Article 99(3) of the AVG). The Wbp was repealed on 25 May 2018. The AVG has immediate effect. The transitional law contained in Section 48(10) of the AVG Implementation Act does not apply in this case.
14.    [Appellant] applied for damages under Article 82 of the AVG. He claims to have suffered non-material damage because he lost control of his personal data and it was not until the decision of 29 May 2019 that he provided the College with an overview of the personal data that he considered had been wrongly processed. In his view, the concept of damage should be interpreted broadly in accordance with the objective of the AVG. [Appellant] claimed that he was entitled to compensation of €10,000 and referred, among other things, to the punitive nature, in his view, of the compensation under the AVG.


10.    The AVG applies to the claim for damages. On 4 June 2018, i.e. after the AVG came into effect, [the appellant] requested the court to order the Minister to pay damages.
Position of the Board


11.    The old law, i.e. the Wbp, applies to the assessment of the unlawfulness of the act as it occurred prior to 25 May 2018. It is not disputed on appeal that the Minister acted contrary to Section 8(a) of the Wbp and that this would also be contrary to the AVG.
15.    The Municipal Executive states that Article 82 of the AVG does not provide an independent basis for compensation for damage. The Board also takes the position that [the appellant] has not made it plausible that he has suffered such personal injury as a result of the publication of his personal data on the VNG Forum that there is mental injury, which can be regarded as affecting his person to such an extent that any compensation is appropriate.


    Article 82 of the AVG
Article 82 of the AVG


12.    Article 82 of the AVG reads as follows:
16.    Article 82 of the AVG reads as follows:


1.    Any person who has suffered material or non-material damage as a result of a breach of this Regulation shall be entitled to receive compensation for the damage suffered from the controller or processor.
1.    Any person who has suffered material or non-material damage as a result of a breach of this Regulation shall be entitled to receive compensation for the damage suffered from the controller or processor.
Line 292: Line 306:
2.    Any controller involved in processing shall be liable for any damage caused by processing operations in breach of this Regulation. A processor shall be liable for damage caused by processing only where the processing does not comply with the obligations laid down in this Regulation specifically addressed to processors or was carried out outside or in breach of the lawful instructions of the controller.
2.    Any controller involved in processing shall be liable for any damage caused by processing operations in breach of this Regulation. A processor shall be liable for damage caused by processing only where the processing does not comply with the obligations laid down in this Regulation specifically addressed to processors or was carried out outside or in breach of the lawful instructions of the controller.


13.    The Minister has not disputed the competence of the administrative courts and has also declared, on request, that he is in agreement with them. As also considered by the Division in today's judgments with numbers ECLI:NL:RVS:2020:899, ECLI:NL:RVS:2020:900 and ECLI:NL:RVS:2020:901, the Administrative Court is, in its opinion, competent to adjudicate an application for compensation for material or immaterial damage resulting from an act in violation of the AVG by an administrative body pursuant to Section 8:88 of the General Administrative Law Act. The Division derives arguments for this from the AVG and the AVG Implementation Act.
Jurisdiction of administrative courts


14.    The AVG is directly applicable in each Member State (Article 99(3) of the AVG). Claims for compensation in the event of acts contrary to the AVG derive directly from the AVG. Article 82(6) of the AVG provides that legal proceedings for the exercise of the right to compensation are to be conducted before the courts of the Member State referred to in Article 79(2). More generally, Article 79(1) lays down the right to an effective remedy.
17.    As the Division has also considered in today's judgments with numbers ECLI:NL:RVS:2020:898, ECLI:NL:RVS:2020:899 and ECLI:NL:RVS:2020:900, in its opinion the administrative court is competent to assess an application for compensation for material or immaterial damage resulting from an act in violation of the General Administrative Law Act by an administrative body on the basis of Article 8:88 of the General Administrative Law Act. The Division derives arguments for this from the AVG and the AVG Implementation Act.


15.    The AVG does not determine which courts within a Member State have jurisdiction to rule on the right to compensation. In the absence of procedural rules of Union law, it is settled case-law of the Court of Justice of the European Union (hereinafter 'the Court of Justice') that it is for the Member States to designate the competent courts and to apply their national procedural law in cases where Union law is enforced. However, such national rules must satisfy the conditions of equivalence and effectiveness (compare the judgment of 16 December 1976, C-33/76, Rewe, ECLI:EU:C:1976:188, and the judgment of 13 July 2006, C-295/04 - 298/04, Manfredi, ECLI:EU:C:2006:461, paragraph 62). These conditions require that a national procedural rule protecting the rights which individuals derive from Union law must not be less favourable than that governing similar domestic actions (principle of equivalence) and that a procedural rule must not render the exercise of rights conferred by the Union impossible or excessively difficult in practice (principle of effectiveness). A procedural rule must also comply with the principle of effective judicial protection, as currently enshrined in Article 47 of the Charter (judgments of the Court of Justice of 18 March 2010, C-317/08, C-318/08, C-319/08 and C-320/08, Alassini and others, ECLI:EU:C:2010:146).
18.    The AVG is directly applicable in each Member State (Article 99(3) of the AVG). Claims for compensation in the event of acts contrary to the AVG arise directly from the AVG. Article 82(6) of the AVG provides that legal proceedings for the exercise of the right to compensation shall be conducted before the courts of the Member State referred to in Article 79(2). More generally, Article 79(1) lays down the right to an effective remedy.


This means that, under these conditions, national law must determine which court has jurisdiction to rule on applications for compensation.
19. The AVG does not determine which courts within a Member State have jurisdiction to rule on the right to compensation. In the absence of procedural rules of Union law, it is settled case-law of the Court of Justice of the European Union (hereinafter 'the Court of Justice') that it is for the Member States to designate the competent courts and to apply their national procedural law in cases where Union law is enforced. However, such national rules must satisfy the conditions of equivalence and effectiveness (compare the judgment of 16 December 1976, C-33/76, Rewe, ECLI:EU:C:1976:188, and the judgment of 13 July 2006, C-295/04 - 298/04, Manfredi, ECLI:EU:C:2006:461, paragraph 62). These conditions require that a national procedural rule protecting the rights which individuals derive from Union law must not be less favourable than that governing similar domestic actions (principle of equivalence) and that a procedural rule must not render the exercise of rights conferred by the Union impossible or excessively difficult in practice (principle of effectiveness). A procedural rule must also comply with the principle of effective judicial protection, as currently enshrined in Article 47 of the Charter (judgments of the Court of Justice of 18 March 2010, C-317/08, C-318/08, C-319/08 and C-320/08, Alassini and others, ECLI:EU:C:2010:146).


16.    Pursuant to Section 8:88(1)(a) of the General Administrative Law Act in conjunction with Section 34 of the Implementing Act, the administrative court has the power to order an administrative body, at the request of an interested party, to pay compensation for damage that an interested party has suffered or will suffer in connection with a written decision as referred to in Section 34 of the Implementing Act. To this end, it is envisaged as follows.
20.    This means that, under these conditions, national law must determine which court has jurisdiction to rule on applications for damages.


17.    In paragraph 3.3. Legal Protection' of the AVG Implementation Act, Article 34 reads as follows:
21.    Pursuant to Section 8:88(1)(a) of the General Administrative Law Act in conjunction with Section 34 of the Implementing Act, the administrative court has the power to order an administrative body, at the request of an interested party, to pay compensation for damage that an interested party has suffered or will suffer in connection with a written decision as referred to in Section 34 of the Implementing Act. To this end, it is envisaged as follows.
 
22.    In paragraph 3.3. Legal Protection' of the AVG Implementation Act, Article 34 reads as follows:


Article 34. Applicability of the General Administrative Law Act by decision of administrative bodies
Article 34. Applicability of the General Administrative Law Act by decision of administrative bodies
Line 308: Line 324:
A written decision on a request as referred to in Articles 15 to 22 of the Regulation shall be taken within the time limits referred to in Article 12(3) of the Regulation and, insofar as it has been taken by an administrative body, shall be deemed to be a decision within the meaning of the General Administrative Law Act.
A written decision on a request as referred to in Articles 15 to 22 of the Regulation shall be taken within the time limits referred to in Article 12(3) of the Regulation and, insofar as it has been taken by an administrative body, shall be deemed to be a decision within the meaning of the General Administrative Law Act.


18.    Articles 15 to 22 of the AVG offer interested parties, among other things, the right of access to personal data, the right to rectification or erasure of personal data, the right to limit the processing of personal data concerning them, as well as the right to object to the processing of personal data, the right to data portability and the right not to be subjected exclusively to automated data processing.
23.    Articles 15 to 22 of the AVG offer interested parties, among other things, the right of access to personal data, the right to rectification or erasure of personal data, the right to limit the processing of personal data concerning them, as well as the right to object to the processing of personal data, the right to data portability and the right not to be subjected exclusively to automated data processing.


19. These rights are inextricably linked to the control of the processing of personal data and enable interested parties to ascertain whether personal data have been processed lawfully and, inter alia, to seek compensation for unlawful processing.
24.   These rights are inextricably linked to the control of the processing of personal data and enable interested parties to ascertain whether personal data have been processed lawfully and, inter alia, to claim compensation for unlawful processing.


20.    For the ways in which the right to compensation can be realised, the Explanatory Memorandum (Parliamentary Papers II 2017-2018, 34851 no. 3) to the AVG Implementation Act is included in the implementation table under Section 82, "Current Title 8.4 of the General Administrative Law Act or Civil Court". The Division deduces from this that it must be possible to bring a claim for compensation for damage resulting from an infringement of the AVG by an administrative body before both the administrative courts and the civil courts.
25.    For the ways in which the right to compensation can be realised, the Explanatory Memorandum (Parliamentary Papers II 2017-2018, 34851 no. 3) to the AVG Implementation Act is included in the implementation table under Section 82, "Current Title 8.4 of the General Administrative Law Act or Civil Court". The Division deduces from this that it must be possible to bring a claim for compensation for damage resulting from an infringement of the AVG by an administrative body before both the administrative courts and the civil courts.


21.    The Section therefore concludes from Article 8:88 of the General Administrative Law Act in conjunction with Article 34 of the AVG Implementation Act that it is in line with the intention of the national legislator that the same court that adjudicates on, inter alia, decisions of administrative bodies at a request as referred to in Articles 15 to 22 of the AVG may also be requested to pay compensation for related damage. The Division considers this to be in the interests of the concentration of legal protection and thus also in the interests of effective and efficient legal protection (principle of effectiveness and Article 47 of the Charter of Fundamental Rights of the European Union). By way of comparison, the Section refers to the judgment of the Court of Justice of the European Union of 15 April 2008, C-268/06, EU:C:2008:223, paragraph 51 (Impact), from which it can be inferred that a concentration of legal protection is in line with the principle of effectiveness. In the view of the Division, the principle of equivalence is also satisfied because the opening up of the administrative procedure is not a procedural rule which treats claims under Union law less favourably than comparable claims under national law.
26.    The Division therefore concludes from Article 8:88 of the General Administrative Law Act in conjunction with Article 34 of the AVG Implementation Act that it is in line with the intention of the national legislator that the same court that adjudicates on, inter alia, decisions of administrative bodies at a request as referred to in Articles 15 to 22 of the AVG may also be requested to pay compensation for related damage. The Division considers this to be in the interest of the concentration of legal protection and thus also in the interest of effective and efficient legal protection (principle of effectiveness and Article 47 of the Charter of Fundamental Rights of the European Union). By way of comparison with the judgment of the Court of Justice of 15 April 2008 in Case C-268/06 EU:C:2008:223, paragraph 51 (Impact), the Section points out that a concentration of legal protection is in line with the principle of effectiveness. In the view of the Division, the principle of equivalence is also fulfilled because opening up the administrative route is not a procedural rule that treats claims under Union law less favourably than comparable claims under national law.


22.    This means that a person who, on the basis of Article 82 of the AVG, claims compensation for damage resulting from the unlawful processing of personal data by an administrative body, has the freedom of choice, in accordance with Article 8:88 of the Awb, to submit his request to the administrative court in connection with a decision as referred to in Article 34 of the AVG Implementation Act, or to realise his claim for compensation through the civil law channels. Article 8:88 of the General Administrative Law Act is interpreted as meaning that the power of the administrative court is less strictly limited to the requirement of an unlawful decision, because although there must be a connection with a decision as referred to in Article 34 of the AVG Implementation Act, this decision, for example on a request for inspection, does not have to be unlawful as such. In such a case, therefore, the administrative court may, in the application procedure pursuant to Section 8:88 of the General Administrative Law Act, give an opinion on the unlawfulness of the processing of the data to which the decision on the request for information relates. The latter decision does not have to be unlawful for this purpose, nor does it have to contain an opinion on the lawfulness of the processing of the data. The Division notes that if the request exceeds € 25,000.00, the application of Section 8:88 of the General Administrative Law Act entails that the civil court has exclusive jurisdiction to hear such a request.
27.    This means that a person who, on the basis of Article 82 of the AVG, claims compensation for damage resulting from the unlawful processing of personal data by an administrative body, has the freedom of choice, in accordance with Article 8:88 of the Awb, to submit his request to the administrative court in connection with a decision as referred to in Article 34 of the AVG Implementation Act, or to realise his claim for compensation through the civil law channels. Article 8:88 of the General Administrative Law Act is interpreted as meaning that the power of the administrative court is less strictly limited to the requirement of an unlawful decision, because although there must be a connection with a decision as referred to in Article 34 of the AVG Implementation Act, this decision does not have to be unlawful as such, e.g. in response to an application for inspection. In such a case, therefore, the administrative court may, in the application procedure pursuant to Section 8:88 of the Awb, give an opinion on the unlawfulness of the processing of the data to which the decision on the request for information relates. The latter decision does not have to be unlawful for this purpose, nor does it have to contain an opinion on the lawfulness of the processing of the data. The Division notes that if the request exceeds € 25,000.00, the application of Section 8:88 of the General Administrative Law Act entails that the civil court has exclusive jurisdiction to take cognisance of such a request.


23.    The Division is of the opinion that in this transitional phase, in which a request was made after 25 May 2018 for compensation for damage in connection with acts that took place in whole or in part before that date and that were contrary to the Wbp and would now also be contrary to the AVG, and in which the substantive assessment framework was therefore already the same, the legal protection set out under 22 must also be offered. This is in line with the views of the parties.
Assessment of the request for compensation


    Rejection of request for a preliminary ruling
28.    [Appellant] claims that it is entitled to compensation because the Board wrongly posted his personal data on the VNG Forum and because the Board informed him too late about the data processing.


24.    [Appellant] asked the Division to refer a preliminary question to the Court of Justice of the European Union with a view to clarifying the answer to the question whether, and if so to what extent, article 82 of the AVG constitutes an independent basis for the award of damages by the administrative courts.
(Un)lawful processing of personal data


25.    The Division rejects this request. Article 82 of the AVG has direct effect and makes it possible for interested parties to realise the claim for damages for unlawful processing in the national legal order. According to settled case law of the Court of Justice (see paragraph 15 above), the organisation of the judicial procedure and the manner of legal protection are in principle matters of national law, if the EU legal preconditions are met. To this end, the Division has ruled that, in addition to the civil court, the administrative court has jurisdiction to assess a claim for damages on the basis of Section 82 of the General Administrative Law Act (AVG) by applying Section 8:88 of the General Administrative Law Act (Awb). There is no reason to ask a preliminary question, because there can be no reasonable doubt as to the answer to the question (see the judgment of the Court of Justice of 6 October 1982, Cilfit, ECLI:EU:C:1982:335, points 13, 14 and 16).
29.    The Division is of the opinion that in this case the processing of personal data is not unlawful. To this end, it envisages the following.


    Assessment of the claim for damages
30.    Pursuant to the Government Information (Public Access) Act (Wet Openbaarheid van Bestuur (Wob)), a request may be submitted to the Board for disclosure and provision of information on an administrative matter. The implementation of the Wob is a public law task of the Municipal Executive. It is important for the proper functioning of the Wob that investigations are conducted into abuse of the Wob and that any abuse is established. By means of the VNG Forum, the VNG has set up a digital platform to enable municipalities to consult with each other on how to approach and deal with the many Wob requests that have been submitted, often only for the collection of periodic penalty payments. On 1 October 2016, the legislator abolished the periodic penalty payments for Wob requests. In 2017, VNG cleaned up the Wob/Municipalities section of the VNG Forum by taking all discussions offline. Personal data posted before 1 April 2017 can no longer be retrieved (see, among other things, the judgment of the District Court of The Hague of 18 May 2017, ECLI:NL:RBDHA:2017:5404).


26.    26. [Appellant] submits that the Court erred in its application of Section 6:106 of the Civil Code, because the amount of compensation determined on an equitable basis was set too low. He claims that he is entitled to higher damages than €300.00.
31.    The purpose of the Board's mentioning the name of [the appellant] on the VNG Forum at the request of another municipality was to ensure the proper implementation of the Wob and to prevent the Wob from being misused for the purpose of collecting penalty payments in the event that a decision on a request was not made in good time. This purpose is in accordance with Section 8(e) of the Wbp and Section 6(1)(e) of the AVG. Contrary to the arguments put forward by [the appellant], this data processing does not conflict with the requirements of proportionality and subsidiarity as set out in the two provisions referred to above. The purpose of the processing was proportionate to the invasion of [the appellant's] privacy and could not be achieved by less intrusive means. Mentioning the name of [the appellant] was necessary, because only in this way could it be ascertained whether he had submitted Wob requests to several municipal councils that may have been aimed at collecting a penalty payment. Nor was it excessive to share this information on the VNG Forum. As the Municipal Executive explained at the hearing, only those who had a specific function related to the processing of Wob requests had access to the Wob/Municipalities section of the VNG Forum. There were no grounds for [the appellant's] assertion that the entire governing body of the Netherlands had been able to take note of his name. If asked, [the appellant] also failed to disclose the concrete adverse consequences of mentioning his name on the VNG Forum.


27.    Although Article 82(1) of the AVG states that full compensation for actual non-material damage resulting from infringements of the AVG must take place in a manner that does justice to the objectives of the Regulation, the AVG does not stipulate how the non-material damage must be determined and calculated. The Court of Justice has consistently held that, in the absence of Community rules, it is for the domestic legal order of each Member State to determine the rules governing the exercise of the right to compensation, subject to compliance with the principles of equivalence and effectiveness (see Manfredi judgment, paragraph 64).
32.    Because the Board did not act unlawfully in naming [appellant's] name on the VNG Forum, the request for compensation will be rejected to that extent.


    However, recital 146 in the preamble to the AVG must be taken into account when exercising the right to compensation laid down in Article 82 of the AVG. This states, inter alia, that the controller or processor must compensate any damage which a person may suffer as a result of a processing operation infringing this Regulation. The concept of damage should be interpreted broadly in the light of the case law of the Court of Justice of the European Union, in a way that fully meets the objectives of this Regulation. It is also stated that data subjects should receive full and effective compensation for any damage suffered by them.
Failure to inform in good time


28.    The Court of Justice has not yet provided any explanation specifically on the concept of damages or on the compensable immaterial damages in case of unlawful processing of personal data, including under the (repealed) Privacy Directive (Directive 95/46/EC). However, the Court of Justice has consistently held that the damage to be compensated must be real and certain (see judgment of the Court of Justice of 4 April 2017, ECLI:EU:C:2017:256, paragraph 91, C- 337/15 P, European Ombudsman v. Staelen, ECLI:EU:C:2017:256, paragraph 91).
33.    In view of the Section's decision of 23 January 2019 and the decision of 5 March 2019, it is established that the [Appellant's] Board did not provide an overview of the personal data posted on the VNG Forum in good time. This information was not provided until the decision of 29 May 2019.


29.    In the light of the above case-law of the Court of Justice and of Article 146 in the preamble, national law is therefore relevant in determining whether the alleged damage is eligible for compensation.
34.    Although Article 82(1) of the AVG states that full compensation for actual non-material damage resulting from breaches of the AVG must take place in a manner that does justice to the objectives of the Regulation, the AVG does not specify how the non-material damage is to be determined and calculated. The Court of Justice has consistently held that, in the absence of Community rules, it is for the domestic legal order of each Member State to determine the rules governing the exercise of the right to compensation, subject to compliance with the principles of equivalence and effectiveness (see Manfredi judgment, paragraph 64).


30.   According to the settled case law of the Division (see, for example, ECLI:NL:RVS:2010:BN4952 of 25 August 2010), the assessment of an application for compensation for non-material damage is based on a connection with civil compensation law.
However, the exercise of the right to compensation laid down in Article 82 of the AVG must take account of recital 146 in the preamble to the AVG. This states, inter alia, that the controller or processor must compensate any damage which a person may suffer as a result of a processing operation infringing this Regulation. The concept of damage should be interpreted broadly in the light of the case law of the Court of Justice, in a way that fully meets the objectives of this Regulation. It is also stated that data subjects should receive full and effective compensation for any damage suffered by them.


31.    Article 6:106 of the Dutch Civil Code reads:
35.    The Court of Justice has not yet given an interpretation specifically on the concept of damages or on the compensable immaterial damages in case of unlawful processing of personal data, including under the (repealed) Privacy Directive (Directive 95/46/EC). However, the Court of Justice has consistently held that the damage to be compensated must be real and certain (see judgment of the Court of Justice of 4 April 2017, ECLI:EU:C:2017:256, paragraph 91, C- 337/15 P, European Ombudsman v. Staelen, ECLI:EU:C:2017:256, paragraph 91).


For damage that does not consist of pecuniary loss, the injured party is entitled to compensation to be determined in accordance with fairness:
36.    Taking into account the above mentioned case law of the Court of Justice and Article 146 in the preamble, national law is therefore relevant when answering the question whether the alleged damage is eligible for compensation.
 
37.    For the assessment of an application for compensation for non-material damage, in accordance with the settled case law of the Division (see, for example, ECLI:NL:RVS:2010:BN4952 of 25 August 2010), connection is sought with civil compensation law.
 
38.    Article 6:106 of the Dutch Civil Code reads:
 
For loss that does not consist of pecuniary loss, the injured party is entitled to compensation to be determined in accordance with equity:


[…]
[…]
Line 350: Line 372:
[…]"
[…]"


32.    The impairment referred to in Section 6:106(1)(b) of the Civil Code in person 'otherwise' shall in any case be deemed to have occurred if the injured party has suffered mental injury. The party who invokes this will have to provide sufficient concrete data from which it can be deduced that psychological damage has occurred in connection with the circumstances of the case. This requires that the existence of mental injury can be established according to objective standards. Even if the existence of mental injury in the aforementioned sense cannot be assumed, it cannot be excluded that the nature and seriousness of the breach of the standards and of the consequences thereof for the injured party will mean that the impairment referred to in Section 6:106, opening words and under b, of the Civil Code is present in his person 'in a different way'. In such a case, the party invoking this will have to substantiate the impairment in his person with concrete data. This will only be different if the nature and seriousness of the breach of the standards mean that the relevant adverse consequences for the injured party are so obvious that an impairment in the person can be assumed. An impairment in the person 'in any other way' as referred to in Section 6:106(b) of Book 6 of the Dutch Civil Code does not already exist in the case of the mere violation of a fundamental right. (See the judgments of the Supreme Court of 15 March 2019, ECLI:NL:HR:2019:376, paragraph 4.2.2, of 28 May 2019, ECLI:NL:HR:2019:793, paragraph 2.4.5, and of 19 July 2019, ECLI:NL:HR:2019:1278, paragraph 2.13.2).
39.    The impairment referred to in Section 6:106(1)(b) of the Civil Code in person 'otherwise' shall in any case be deemed to have occurred if the injured party has suffered mental injury. The party who invokes this will have to provide sufficient concrete data from which it can be deduced that psychological damage has occurred in connection with the circumstances of the case. This requires that the existence of mental injury can be established according to objective standards. Even if the existence of mental injury in the aforementioned sense cannot be assumed, it cannot be excluded that the nature and seriousness of the breach of the standards and of the consequences thereof for the injured party will mean that the impairment referred to in Section 6:106, opening words and under b, of the Civil Code is present in his person 'in a different way'. In such a case, the party invoking this will have to substantiate the impairment in his person with concrete data. This will only be different if the nature and seriousness of the breach of the standards mean that the relevant adverse consequences for the injured party are so obvious that an impairment in the person can be assumed. An impairment in the person 'in any other way' as referred to in Section 6:106(b) of Book 6 of the Dutch Civil Code does not already exist in the case of the mere violation of a fundamental right. (See the judgments of the Supreme Court of 15 March 2019, ECLI:NL:HR:2019:376, paragraph 4.2.2, of 28 May 2019, ECLI:NL:HR:2019:793, paragraph 2.4.5, and of 19 July 2019, ECLI:NL:HR:2019:1278, paragraph 2.13.2).
 
40.    The Section is of the opinion that the framework outlined under 39 can meet the requirements of the AVG and the case law of the Court of Justice as outlined under 35.
 
41.    [appellant] has not stated that he has suffered mental injury as a result of the unlawful conduct of the Municipal Executive, which can be established on objective grounds.


33.    The Section is of the opinion that the framework outlined in section 32 can meet the requirements of the AVG and the case law of the Court of Justice as set out in section 27.
42.    According to [appellant], the immaterial damage consists of a legal infringement of the AVG (failure to provide full and timely information), which according to [appellant] must be regarded as an impairment in the person within the meaning of Section 6:106(1)(b) of the Civil Code. He claims that he is therefore entitled to compensation to be determined in accordance with fairness.


34.    [appellant] did not argue that he suffered mental injury as a result of the Minister's unlawful conduct, which can be established on objective grounds.
43.    The Municipal Executive disputes that the nature and seriousness of the breach of the standards are such that immaterial damage eligible for compensation has arisen as a result. According to the Board, the [appellant] also failed to substantiate his claim for compensation with concrete data.


35.    (appellant) claims that he has been harmed in person. He claims that his privacy has been violated because the reports contain strictly confidential and sensitive personal data and he has not given permission for the data to be processed.
44.    The Division is of the opinion that [the appellant] cannot be followed in his argument that the judgment of the Supreme Court of 15 March 2019 has no significance for the assessment of an application for compensation for immaterial damage, because that judgment does not address the question of whether immaterial damage qualifies for compensation under the AVG. The general principle that the alleged damage must be substantiated also applies here. There is no ground for the opinion that an infringement of the AVG simply affects the integrity of a person and therefore leads to compensable damage. Contrary to what [the appellant] argues, this cannot be deduced from recitals 85 and 146 of the AVG. The fact that an infringement of the AVG may result in material or immaterial damage and that a person concerned must receive full and actual compensation for the damage he has suffered does not mean that a breach of the AVG by definition results in damage and that damage must not have been 'real and certain'. See conclusion of 35 and comparison ECLI:EU:6 November 2012, C-199/11, ECLI:EU:C:2012:684, (Otis) and ECJ EU 4 April 2017, C-337/15, ECLI:EU:C:2017:256 (European Ombudsman).


36.    The Division agrees with the court that [the appellant] is entitled to compensation for non-material damage. The Minister acted in violation of Section 16 of the Wbp) and thereby violated [the appellant's] right to respect for his privacy. An infringement of [the appellant's] privacy may be regarded as an infringement in the person referred to in Section 6:106(1) and (b) of the Dutch Civil Code which entitles him to compensation for immaterial damage.
45.    In this case, the adverse consequences of the breach of the standards are not obvious. The initial incomplete provision of the requested information and the late provision of all personal data processed is not comparable to the circumstances which led to the judgments of the Supreme Court of 18 March 2005, ECLI:NL:HR:2005:AR5213 (Baby Kelly), and of 9 July 2004, ECLI:NL:HR:2004:AO7721 (Groninger Oudejaarsrellen). This is not serious culpable behaviour with consequences so serious as to constitute an infringement of a fundamental right.


In view of the circumstances of this case, including the nature, duration and seriousness of the infringement, the Division will fairly determine this damage at € 500. To this end, the Division will take into account the special sensitivity of the nature of the personal data processed in this case without the consent of [the appellant]. For the processing of special (sensitive) personal data as referred to in Article 9 of the AVG, a higher level of protection has been laid down in the AVG than for ordinary personal data. The adverse consequences of the provision of the sensitive personal data are obvious. It is also important to note that the data were submitted by the director as part of a complaint procedure against him, without there being any justification as referred to in Article 9(2) of the AVG. With regard to the seriousness of the breach, the Division considers that the privacy-sensitive personal data ended up with a small group of professionals and that the members of the Disciplinary Board who have a duty of confidentiality by virtue of their position. With regard to the duration of the breach, it is important to note that the Pieter Baan Centre took action to undo the provision of the sensitive data following the submission of the data on 15 January 2018. Subsequently, in a letter dated 22 January 2018, the Disciplinary Board indicated that it would disregard the reports sent and not add them to the file. To the extent that [the appellant] disputes that this was done, in view of the questions put to the director during the hearing at the Disciplinary Board, it is important that [the appellant], if asked at the hearing, did not make it plausible that this had led to adverse consequences.
46.    In so far as [the appellant] argues in support of his argument that compensation under the AVG is punitive in nature, it is important that this case concerns the possibility of obtaining compensation for (im)material damage as a result of incorrect culpable conduct. The purpose of compensation is to repair or offer compensation for an unlawful invasion of privacy. The imposition of a punitive sanction as a fine that must be distinguished from it is not at issue here and is intended to add suffering to the violator of the violated standard. Contrary to what [the appellant] argues, recital 146 of the AVG does not state that compensation must be effective and 'sufficiently deterrent'. Recital 146 states that damages resulting from unlawful processing of personal data must be actually and fully compensated. It cannot be inferred from this that, in the event of an infringement of the AVG, there is an obligation to award damages that go beyond full compensation for the actual damage suffered (compare the judgment of the Court of Justice of 17 December 2015, ECLI:EU:C:2015:831).


    Conclusion
47.    The starting point is therefore that [the appellant] must make a plausible case for the damage suffered by him and substantiate the damage with concrete evidence. Prior to the hearing on appeal, the [appellant] was asked to specify and substantiate the loss alleged by him.


37.    In doing what the court should do, the Division will still decide on the application for damages. In so doing, the Division will determine that the Minister will pay [the appellant] damages of € 500.
48.    48. [Appellant] did not make it plausible that the breach of the duty to provide information led to the person's being harmed and that the consequences of the breach directly affected him. He did not submit any concrete data to substantiate the damage he allegedly suffered.


38.    The Minister must be ordered to pay the costs of the proceedings (travel costs of public transport) on appeal and appeal in a manner to be reported.
49.    The Section rejects the request for compensation on account of the failure to provide the personal data posted on the VNG Forum in good time.


    What does this judgment entail in brief?
Conclusion


39.    In these and three other judgments today, the Division discusses the possibilities of claiming compensation for damages before the administrative courts if someone claims that an administrative body has processed personal data in violation of the applicable privacy legislation (since 25 May 2018 the General Data Protection Regulation (AVG) and the AVG Implementation Act). Before the AVG and the AVG Implementation Act entered into force, the case law of the Division offered fewer possibilities, which meant that the citizen was then directed to the civil courts. This route remains open, but in a larger number of cases it is now also possible to approach the administrative courts for requests for compensation up to € 25,000. For the answer to the question as to when this is possible, see in particular above under 22. This is therefore a procedural question of legal protection, i.e. when, in the event of unlawful processing of personal data, the administrative court can be approached.  
50.    The appeal by [the appellant] against the decision of 19 February 2019 is inadmissible.


    In terms of content, the Division then decides that in order to be eligible for compensation, the requirements of Section 6:106 of the Dutch Civil Code must be met. For these cases, this means that the honour or good name of the person concerned must be affected, or that the person must be affected in some other way. In this respect, the Division is in line with the case law of the Supreme Court. In this case, the Division decided that [the appellant] may claim damages of € 500; the court awarded € 300 in the first instance. In doing so, the Division takes into account, on the one hand, the unlawful processing of personal data with a special sensitivity and, on the other hand, the fact that these data only ended up with a small group of professionals (see above under 36).
51.    The application for damages was dismissed.
 
52.    The College should be ordered to reimburse the costs of the proceedings in a manner to be indicated.
 
What does this decision contain in brief?
 
53.    In this judgment and in three other judgments delivered today, the Division discusses the possibilities of claiming compensation for damages before the administrative courts if someone claims that an administrative body has processed personal data in violation of the applicable privacy legislation (since 25 May 2018 the General Data Protection Regulation (AVG) and the AVG Implementation Act). Before the AVG and the AVG Implementation Act entered into force, the case law of the Division offered fewer possibilities, which meant that the citizen was then directed to the civil courts. This route remains open, but in a larger number of cases it is now also possible to approach the administrative courts for requests for compensation up to € 25,000. For the answer to the question as to when this can be done, see above under 26. In other words, it concerns a procedural question of legal protection, namely when, in the event of unlawful processing of personal data, the administrative courts can be approached.
 
In terms of content, the Division then decides that in order to be eligible for compensation, the requirements of Section 6:106 of the Dutch Civil Code must be met. For these cases, this means that the honour or good name of the person concerned must be affected, or that the person must be affected in some other way. In this respect, the Division is in line with the case law of the Supreme Court. In this case the Division decides that [the appellant] cannot claim compensation. The Board did not act unlawfully in stating [appellant's] name on the VNG Forum. The alleged loss resulting from the failure to provide full and timely information about the processing of personal data was not substantiated by [the appellant].


Decision
Decision
Line 378: Line 412:
The Administrative Jurisdiction Division of the Council of State:
The Administrative Jurisdiction Division of the Council of State:


I. declares the appeal well-founded;
I. declares the appeal against the decision of 19 February 2019 inadmissible;


II. annuls the decision of the District Court of Gelderland of 19 December 2018 in case no. 18/3073; in so far as it revoked the decision of 13 March 2018, it is stipulated that the Minister for Legal Protection will pay compensation and it is stipulated that this decision will replace the decision of 17 May 2018;
II. dismisses the application for damages;


III. declares the objection lodged by [the appellant] against the decision of 17 May 2018 inadmissible in so far as it decides on the application for compensation made by [the appellant];
III. orders the Municipal Executive of Harderwijk to pay the costs of the proceedings incurred by [the appellant] in connection with the hearing of the appeal up to an amount of € 525.00 (in words: five hundred and twenty-five euros), to be allocated in full to legal aid granted by a third party on a professional basis;


IV. orders the Minister for Legal Protection to pay [the appellant] compensation of € 500.00 (in words: five hundred euros);
IV. orders the Municipal Executive of Harderwijk to reimburse to [the appellant] the court fee paid by him for the handling of the appeal in the amount of € 174.00 (in words: one hundred and seventy-four euros).
 
V. orders the Minister for Legal Protection to pay the costs of the proceedings incurred by [the appellant] in connection with the hearing of the appeal and the appeal up to an amount of € 46.71 (in words: forty-six euros and seventy-one cents).


Thus determined by J.E.M. Polak, chairman, and E.A. Minderhoud and E.J. Daalder, members, in the presence of M.A.E. Planken, registrar.
Thus determined by J.E.M. Polak, chairman, and E.A. Minderhoud and E.J. Daalder, members, in the presence of M.A.E. Planken, registrar.


The chairman is prevented from signing the decision.  
The chairman is prevented from signing the decision.


The Registrar is prevented from signing the decision.
The Registrar is prevented from signing the decision.
Line 399: Line 431:


Annex
Annex
</pre>
</pre>

Latest revision as of 12:41, 16 September 2021

RvS - 201902417/1/A2
CourtsNL.png
Court: RvS (Netherlands)
Jurisdiction: Netherlands
Relevant Law: Article 6(1)(e) GDPR
Article 82(1) GDPR
Decided: 1.4.2020
Published: 1.4.2020
Parties: Anonymous
College van burgemeester en wethouders van Harderwijk
National Case Number/Name: 201902417/1/A2
European Case Law Identifier: ECLI:NL:RVS:2020:901
Appeal from:
Appeal to:
Original Language(s): Dutch
Original Source: de Rechtspraak (in Dutch)
Initial Contributor: n/a

On 1 April 2020, the Council of State rejected the claim of the plaintiff asking for damage compensation for the violation of the GDPR by the local authorities considering the lack of proof of an actual damage caused by the lack of information. To be compensated, claimant must be able to prove that the damage is real and certain.

English Summary

Facts

The Dutch Council of State ruled on a claim for damages filed by a citizen whose data (name, address and residence) were processed on a forum accessed by the local authorities. This Internet forum was intended to exchange data between municipalities to prevent abuse of the Public Administration Act. The applicant involved, who filed several request to access documents, had not given his/her consent to the processing of her/his personal data on the forum and received information on the processing of these data only at a late stage of the procedure.

Dispute

The Council of State had to determine whether the processing of information on the internet forum access by the local authorities had a legal ground under Article 6 of the GDPR, and whether the lack of information before such processing was in line with the transparency obligations of the controller (the municipal executive of Harderwijk). The Council of State also had to rule as to whether it is competent to grant a compensation for the damage suffered by the individual and under which circumstances.

Holding

The Council of State ruled that the mention the name of the applicants on the internet forum at the request of another municipality (to ensure the proper implementation of the access to document legislation and to prevent abuse of such legislation) was legitimate and allowed under Article 6 (1) (e) of the GDPR.

However, the Council of State (CoS) rules that the municipality did not inform the data subject in good time, which is a violation of the GDPR.

As to the claim for damages, the CoS notes that though Article 82(1) of the GDPR states that full compensation for actual non-material damage resulting from breaches of the GDPR must take place in a manner that does justice to the objectives of the Regulation, the GDPR does not specify how the non-material damage is to be determined and calculated. However, the Court of Justice has consistently held that the damage to be compensated must be real and certain.

Comment

Add your comment here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.



Authority
Council of State
Date of pronunciation
01-04-2020
Date of publication
01-04-2020
Case number
201902417/1/A2
Jurisdictions
Administrative law
Special features
First instance - multiple
Content indication
By decision of 17 October 2016, the Municipal Executive of Harderwijk announced, in response to the request made by [the appellant] pursuant to the Personal Data Protection Act, that the name, address and place of residence details of [the appellant] had been processed in the postal registration system. The Board attached copies of the letters for which those details had been processed to the decision. The Board also stated that the name and address details of [the appellant] had not been provided to anyone else and that his personal data had not been processed in any other way either.

Locations
Rechtspraak.nl
Enriched pronunciation
Ruling
Ruling
201902417/1/A2.

Date of judgment: 1 April 2020

SECTION

ADMINISTRATIVE LAW

Judgment in the dispute between:

[appellant], residing at [residence],

and

the municipal executive of Harderwijk,

defendant.

Litigation

By decision of 17 October 2016, in response to the request made by [the Appellant] pursuant to the Personal Data Protection Act (referred to below as 'the Wbp'), the Board announced that [the Appellant's] name and address had been included in the post registration system. The Board attached copies of the letters for which those details had been processed to the decision. The Board also stated that the name and address details of [the appellant] had not been provided to anyone else and that his personal data had not been processed in any other way either.

By decision of 19 February 2019, the Board again dismissed [the appellant's] objection to this decision as unfounded.

This decision was appealed against by [the appellant], who applied for damages.

By decision of 29 May 2019, the Board amended the decision of 19 February 2019 and upheld the [appellant's] objection.

The Board submitted a statement of defence.

The Division heard the case on 15 January 2020, where [the appellant], represented by [the agent], and the Board, represented by M. Huisman, appeared.

Considerations

1.    At the end of this judgment (under 53), the Division will indicate what this judgment means more generally and what will be decided in this case.

2.    On 25 May 2018, Regulation 2016/679 of the European Parliament and the Council of the European Union of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (the General Data Protection Regulation, hereinafter: AVG) became applicable. The AVG will be directly applicable in each Member State as of 25 May 2018 (Article 99(3) of the AVG). The Wbp was repealed on 25 May 2018. The AVG has immediate effect. The transitional law contained in Section 48(10) of the AVG Implementation Act does not apply in this case.

3.    The AVG applies to the claim for damages. On 13 June 2019, i.e. after the AVG came into effect, [the appellant] requested the Division to order the Minister to pay damages. To assess the unlawfulness of the act, which in this case occurred in part before 25 May 2018, the old law, i.e. the Wbp, applies.

4.    The Division is of the opinion that in this transitional phase, during which a request for compensation was made after 25 May 2018 for damages in connection with acts that took place partly before that date and that were contrary to the Wbp and would now also be contrary to the AVG, and in which the substantive assessment framework was therefore already the same, the legal protection set out below under 27 must also be offered.

Judgment of 23 January 2019

5.    In its ruling of 23 January 2019, ECLI:NL:RVS:2019:184, the Section considered, in so far as relevant, that the Board did not provide access to whether and which personal data of [the appellant] had been processed at the VNG Forum. Insofar as such data have been processed, the Board has not provided an overview of the data, nor a description of the purpose(s) of the processing, the categories of data to which the processing relates and the recipients or categories of recipients, as well as the available information about the origin of the data.

6.    The Division rejected the [Appellant's] request for compensation because it could not yet be established whether the Board had processed personal data in violation of the Personal Data Protection Act.

7.    The Division annulled the decision of 23 February 2017, by which the Board declared the objection made by [the appellant] to the decision of 17 October 2016 to be unfounded, and decided that the Board should take a new decision on the objection.

8.    The Division has further determined that an appeal may only be lodged with the Division against the new decision on the objection.

The decision of 19 February 2019

9.    In its decision of 19 February 2019, the College again declared the objection to the decision of 17 October 2016 unfounded. To that end, the Municipal Executive stated, among other things, that it had not posted any personal data on the VNG Forum. The data posted in 2016 have since been removed from the forum and can no longer be retrieved.

The decision of 29 May 2019

10.    By decision of 29 May 2019, the Board amended the decision of 19 February 2019, upheld [the appellant's] objection to the decision of 17 October 2016 and revoked the decision of 17 October 2016. The Board provided [the appellant] with a summary of the data processed by the Board on the VNG Forum. The Board claims to have obtained access to these data via the VNG, which has retained the data in connection with legal proceedings. Finally, the Municipal Executive has awarded compensation for the costs in objection of €512.00.

Interim conclusion

11.    The action against the decision of 19 February 2019 is inadmissible for lack of any legal interest in bringing proceedings. Pending the appeal against the decision of 19 February 2019 in the decision of 29 May 2019, the Board has fully complied with the grounds of appeal put forward by [the appellant]. At that time, the Board upheld the appeal against the decision of 17 October 2016, revoked that decision and awarded compensation for the costs of the appeal. In view of the fact that the Board amended its decision of 19 February 2019 in favour of [the appellant] as a result of the appeal, the Division sees reason to order the Board to pay the costs of the appeal proceedings.

12.    Since the decision of 29 May 2019 was fully in favour of [the appellant], no appeal against this decision arose by operation of law.

13.    In these proceedings, only the request for compensation made by [the appellant] is at issue.

Claim for compensation

14.    [Appellant] applied for damages under Article 82 of the AVG. He claims to have suffered non-material damage because he lost control of his personal data and it was not until the decision of 29 May 2019 that he provided the College with an overview of the personal data that he considered had been wrongly processed. In his view, the concept of damage should be interpreted broadly in accordance with the objective of the AVG. [Appellant] claimed that he was entitled to compensation of €10,000 and referred, among other things, to the punitive nature, in his view, of the compensation under the AVG.

Position of the Board

15.    The Municipal Executive states that Article 82 of the AVG does not provide an independent basis for compensation for damage. The Board also takes the position that [the appellant] has not made it plausible that he has suffered such personal injury as a result of the publication of his personal data on the VNG Forum that there is mental injury, which can be regarded as affecting his person to such an extent that any compensation is appropriate.

Article 82 of the AVG

16.    Article 82 of the AVG reads as follows:

1.    Any person who has suffered material or non-material damage as a result of a breach of this Regulation shall be entitled to receive compensation for the damage suffered from the controller or processor.

2.    Any controller involved in processing shall be liable for any damage caused by processing operations in breach of this Regulation. A processor shall be liable for damage caused by processing only where the processing does not comply with the obligations laid down in this Regulation specifically addressed to processors or was carried out outside or in breach of the lawful instructions of the controller.

Jurisdiction of administrative courts

17.    As the Division has also considered in today's judgments with numbers ECLI:NL:RVS:2020:898, ECLI:NL:RVS:2020:899 and ECLI:NL:RVS:2020:900, in its opinion the administrative court is competent to assess an application for compensation for material or immaterial damage resulting from an act in violation of the General Administrative Law Act by an administrative body on the basis of Article 8:88 of the General Administrative Law Act. The Division derives arguments for this from the AVG and the AVG Implementation Act.

18.    The AVG is directly applicable in each Member State (Article 99(3) of the AVG). Claims for compensation in the event of acts contrary to the AVG arise directly from the AVG. Article 82(6) of the AVG provides that legal proceedings for the exercise of the right to compensation shall be conducted before the courts of the Member State referred to in Article 79(2). More generally, Article 79(1) lays down the right to an effective remedy.

19. The AVG does not determine which courts within a Member State have jurisdiction to rule on the right to compensation. In the absence of procedural rules of Union law, it is settled case-law of the Court of Justice of the European Union (hereinafter 'the Court of Justice') that it is for the Member States to designate the competent courts and to apply their national procedural law in cases where Union law is enforced. However, such national rules must satisfy the conditions of equivalence and effectiveness (compare the judgment of 16 December 1976, C-33/76, Rewe, ECLI:EU:C:1976:188, and the judgment of 13 July 2006, C-295/04 - 298/04, Manfredi, ECLI:EU:C:2006:461, paragraph 62). These conditions require that a national procedural rule protecting the rights which individuals derive from Union law must not be less favourable than that governing similar domestic actions (principle of equivalence) and that a procedural rule must not render the exercise of rights conferred by the Union impossible or excessively difficult in practice (principle of effectiveness). A procedural rule must also comply with the principle of effective judicial protection, as currently enshrined in Article 47 of the Charter (judgments of the Court of Justice of 18 March 2010, C-317/08, C-318/08, C-319/08 and C-320/08, Alassini and others, ECLI:EU:C:2010:146).

20.    This means that, under these conditions, national law must determine which court has jurisdiction to rule on applications for damages.

21.    Pursuant to Section 8:88(1)(a) of the General Administrative Law Act in conjunction with Section 34 of the Implementing Act, the administrative court has the power to order an administrative body, at the request of an interested party, to pay compensation for damage that an interested party has suffered or will suffer in connection with a written decision as referred to in Section 34 of the Implementing Act. To this end, it is envisaged as follows.

22.    In paragraph 3.3. Legal Protection' of the AVG Implementation Act, Article 34 reads as follows:

Article 34. Applicability of the General Administrative Law Act by decision of administrative bodies

A written decision on a request as referred to in Articles 15 to 22 of the Regulation shall be taken within the time limits referred to in Article 12(3) of the Regulation and, insofar as it has been taken by an administrative body, shall be deemed to be a decision within the meaning of the General Administrative Law Act.

23.    Articles 15 to 22 of the AVG offer interested parties, among other things, the right of access to personal data, the right to rectification or erasure of personal data, the right to limit the processing of personal data concerning them, as well as the right to object to the processing of personal data, the right to data portability and the right not to be subjected exclusively to automated data processing.

24.    These rights are inextricably linked to the control of the processing of personal data and enable interested parties to ascertain whether personal data have been processed lawfully and, inter alia, to claim compensation for unlawful processing.

25.    For the ways in which the right to compensation can be realised, the Explanatory Memorandum (Parliamentary Papers II 2017-2018, 34851 no. 3) to the AVG Implementation Act is included in the implementation table under Section 82, "Current Title 8.4 of the General Administrative Law Act or Civil Court". The Division deduces from this that it must be possible to bring a claim for compensation for damage resulting from an infringement of the AVG by an administrative body before both the administrative courts and the civil courts.

26.    The Division therefore concludes from Article 8:88 of the General Administrative Law Act in conjunction with Article 34 of the AVG Implementation Act that it is in line with the intention of the national legislator that the same court that adjudicates on, inter alia, decisions of administrative bodies at a request as referred to in Articles 15 to 22 of the AVG may also be requested to pay compensation for related damage. The Division considers this to be in the interest of the concentration of legal protection and thus also in the interest of effective and efficient legal protection (principle of effectiveness and Article 47 of the Charter of Fundamental Rights of the European Union). By way of comparison with the judgment of the Court of Justice of 15 April 2008 in Case C-268/06 EU:C:2008:223, paragraph 51 (Impact), the Section points out that a concentration of legal protection is in line with the principle of effectiveness. In the view of the Division, the principle of equivalence is also fulfilled because opening up the administrative route is not a procedural rule that treats claims under Union law less favourably than comparable claims under national law.

27.    This means that a person who, on the basis of Article 82 of the AVG, claims compensation for damage resulting from the unlawful processing of personal data by an administrative body, has the freedom of choice, in accordance with Article 8:88 of the Awb, to submit his request to the administrative court in connection with a decision as referred to in Article 34 of the AVG Implementation Act, or to realise his claim for compensation through the civil law channels. Article 8:88 of the General Administrative Law Act is interpreted as meaning that the power of the administrative court is less strictly limited to the requirement of an unlawful decision, because although there must be a connection with a decision as referred to in Article 34 of the AVG Implementation Act, this decision does not have to be unlawful as such, e.g. in response to an application for inspection. In such a case, therefore, the administrative court may, in the application procedure pursuant to Section 8:88 of the Awb, give an opinion on the unlawfulness of the processing of the data to which the decision on the request for information relates. The latter decision does not have to be unlawful for this purpose, nor does it have to contain an opinion on the lawfulness of the processing of the data. The Division notes that if the request exceeds € 25,000.00, the application of Section 8:88 of the General Administrative Law Act entails that the civil court has exclusive jurisdiction to take cognisance of such a request.

Assessment of the request for compensation

28.    [Appellant] claims that it is entitled to compensation because the Board wrongly posted his personal data on the VNG Forum and because the Board informed him too late about the data processing.

(Un)lawful processing of personal data

29.    The Division is of the opinion that in this case the processing of personal data is not unlawful. To this end, it envisages the following.

30.    Pursuant to the Government Information (Public Access) Act (Wet Openbaarheid van Bestuur (Wob)), a request may be submitted to the Board for disclosure and provision of information on an administrative matter. The implementation of the Wob is a public law task of the Municipal Executive. It is important for the proper functioning of the Wob that investigations are conducted into abuse of the Wob and that any abuse is established. By means of the VNG Forum, the VNG has set up a digital platform to enable municipalities to consult with each other on how to approach and deal with the many Wob requests that have been submitted, often only for the collection of periodic penalty payments. On 1 October 2016, the legislator abolished the periodic penalty payments for Wob requests. In 2017, VNG cleaned up the Wob/Municipalities section of the VNG Forum by taking all discussions offline. Personal data posted before 1 April 2017 can no longer be retrieved (see, among other things, the judgment of the District Court of The Hague of 18 May 2017, ECLI:NL:RBDHA:2017:5404).

31.    The purpose of the Board's mentioning the name of [the appellant] on the VNG Forum at the request of another municipality was to ensure the proper implementation of the Wob and to prevent the Wob from being misused for the purpose of collecting penalty payments in the event that a decision on a request was not made in good time. This purpose is in accordance with Section 8(e) of the Wbp and Section 6(1)(e) of the AVG. Contrary to the arguments put forward by [the appellant], this data processing does not conflict with the requirements of proportionality and subsidiarity as set out in the two provisions referred to above. The purpose of the processing was proportionate to the invasion of [the appellant's] privacy and could not be achieved by less intrusive means. Mentioning the name of [the appellant] was necessary, because only in this way could it be ascertained whether he had submitted Wob requests to several municipal councils that may have been aimed at collecting a penalty payment. Nor was it excessive to share this information on the VNG Forum. As the Municipal Executive explained at the hearing, only those who had a specific function related to the processing of Wob requests had access to the Wob/Municipalities section of the VNG Forum. There were no grounds for [the appellant's] assertion that the entire governing body of the Netherlands had been able to take note of his name. If asked, [the appellant] also failed to disclose the concrete adverse consequences of mentioning his name on the VNG Forum.

32.    Because the Board did not act unlawfully in naming [appellant's] name on the VNG Forum, the request for compensation will be rejected to that extent.

Failure to inform in good time

33.    In view of the Section's decision of 23 January 2019 and the decision of 5 March 2019, it is established that the [Appellant's] Board did not provide an overview of the personal data posted on the VNG Forum in good time. This information was not provided until the decision of 29 May 2019.

34.    Although Article 82(1) of the AVG states that full compensation for actual non-material damage resulting from breaches of the AVG must take place in a manner that does justice to the objectives of the Regulation, the AVG does not specify how the non-material damage is to be determined and calculated. The Court of Justice has consistently held that, in the absence of Community rules, it is for the domestic legal order of each Member State to determine the rules governing the exercise of the right to compensation, subject to compliance with the principles of equivalence and effectiveness (see Manfredi judgment, paragraph 64).

However, the exercise of the right to compensation laid down in Article 82 of the AVG must take account of recital 146 in the preamble to the AVG. This states, inter alia, that the controller or processor must compensate any damage which a person may suffer as a result of a processing operation infringing this Regulation. The concept of damage should be interpreted broadly in the light of the case law of the Court of Justice, in a way that fully meets the objectives of this Regulation. It is also stated that data subjects should receive full and effective compensation for any damage suffered by them.

35.    The Court of Justice has not yet given an interpretation specifically on the concept of damages or on the compensable immaterial damages in case of unlawful processing of personal data, including under the (repealed) Privacy Directive (Directive 95/46/EC). However, the Court of Justice has consistently held that the damage to be compensated must be real and certain (see judgment of the Court of Justice of 4 April 2017, ECLI:EU:C:2017:256, paragraph 91, C- 337/15 P, European Ombudsman v. Staelen, ECLI:EU:C:2017:256, paragraph 91).

36.    Taking into account the above mentioned case law of the Court of Justice and Article 146 in the preamble, national law is therefore relevant when answering the question whether the alleged damage is eligible for compensation.

37.    For the assessment of an application for compensation for non-material damage, in accordance with the settled case law of the Division (see, for example, ECLI:NL:RVS:2010:BN4952 of 25 August 2010), connection is sought with civil compensation law.

38.    Article 6:106 of the Dutch Civil Code reads:

For loss that does not consist of pecuniary loss, the injured party is entitled to compensation to be determined in accordance with equity:

[…]

b. if the injured party has suffered bodily injury, damage to his honour or good name or any other harm to his person;

[…]"

39.    The impairment referred to in Section 6:106(1)(b) of the Civil Code in person 'otherwise' shall in any case be deemed to have occurred if the injured party has suffered mental injury. The party who invokes this will have to provide sufficient concrete data from which it can be deduced that psychological damage has occurred in connection with the circumstances of the case. This requires that the existence of mental injury can be established according to objective standards. Even if the existence of mental injury in the aforementioned sense cannot be assumed, it cannot be excluded that the nature and seriousness of the breach of the standards and of the consequences thereof for the injured party will mean that the impairment referred to in Section 6:106, opening words and under b, of the Civil Code is present in his person 'in a different way'. In such a case, the party invoking this will have to substantiate the impairment in his person with concrete data. This will only be different if the nature and seriousness of the breach of the standards mean that the relevant adverse consequences for the injured party are so obvious that an impairment in the person can be assumed. An impairment in the person 'in any other way' as referred to in Section 6:106(b) of Book 6 of the Dutch Civil Code does not already exist in the case of the mere violation of a fundamental right. (See the judgments of the Supreme Court of 15 March 2019, ECLI:NL:HR:2019:376, paragraph 4.2.2, of 28 May 2019, ECLI:NL:HR:2019:793, paragraph 2.4.5, and of 19 July 2019, ECLI:NL:HR:2019:1278, paragraph 2.13.2).

40.    The Section is of the opinion that the framework outlined under 39 can meet the requirements of the AVG and the case law of the Court of Justice as outlined under 35.

41.    [appellant] has not stated that he has suffered mental injury as a result of the unlawful conduct of the Municipal Executive, which can be established on objective grounds.

42.    According to [appellant], the immaterial damage consists of a legal infringement of the AVG (failure to provide full and timely information), which according to [appellant] must be regarded as an impairment in the person within the meaning of Section 6:106(1)(b) of the Civil Code. He claims that he is therefore entitled to compensation to be determined in accordance with fairness.

43.    The Municipal Executive disputes that the nature and seriousness of the breach of the standards are such that immaterial damage eligible for compensation has arisen as a result. According to the Board, the [appellant] also failed to substantiate his claim for compensation with concrete data.

44.    The Division is of the opinion that [the appellant] cannot be followed in his argument that the judgment of the Supreme Court of 15 March 2019 has no significance for the assessment of an application for compensation for immaterial damage, because that judgment does not address the question of whether immaterial damage qualifies for compensation under the AVG. The general principle that the alleged damage must be substantiated also applies here. There is no ground for the opinion that an infringement of the AVG simply affects the integrity of a person and therefore leads to compensable damage. Contrary to what [the appellant] argues, this cannot be deduced from recitals 85 and 146 of the AVG. The fact that an infringement of the AVG may result in material or immaterial damage and that a person concerned must receive full and actual compensation for the damage he has suffered does not mean that a breach of the AVG by definition results in damage and that damage must not have been 'real and certain'. See conclusion of 35 and comparison ECLI:EU:6 November 2012, C-199/11, ECLI:EU:C:2012:684, (Otis) and ECJ EU 4 April 2017, C-337/15, ECLI:EU:C:2017:256 (European Ombudsman).

45.    In this case, the adverse consequences of the breach of the standards are not obvious. The initial incomplete provision of the requested information and the late provision of all personal data processed is not comparable to the circumstances which led to the judgments of the Supreme Court of 18 March 2005, ECLI:NL:HR:2005:AR5213 (Baby Kelly), and of 9 July 2004, ECLI:NL:HR:2004:AO7721 (Groninger Oudejaarsrellen). This is not serious culpable behaviour with consequences so serious as to constitute an infringement of a fundamental right.

46.    In so far as [the appellant] argues in support of his argument that compensation under the AVG is punitive in nature, it is important that this case concerns the possibility of obtaining compensation for (im)material damage as a result of incorrect culpable conduct. The purpose of compensation is to repair or offer compensation for an unlawful invasion of privacy. The imposition of a punitive sanction as a fine that must be distinguished from it is not at issue here and is intended to add suffering to the violator of the violated standard. Contrary to what [the appellant] argues, recital 146 of the AVG does not state that compensation must be effective and 'sufficiently deterrent'. Recital 146 states that damages resulting from unlawful processing of personal data must be actually and fully compensated. It cannot be inferred from this that, in the event of an infringement of the AVG, there is an obligation to award damages that go beyond full compensation for the actual damage suffered (compare the judgment of the Court of Justice of 17 December 2015, ECLI:EU:C:2015:831).

47.    The starting point is therefore that [the appellant] must make a plausible case for the damage suffered by him and substantiate the damage with concrete evidence. Prior to the hearing on appeal, the [appellant] was asked to specify and substantiate the loss alleged by him.

48.    48. [Appellant] did not make it plausible that the breach of the duty to provide information led to the person's being harmed and that the consequences of the breach directly affected him. He did not submit any concrete data to substantiate the damage he allegedly suffered.

49.    The Section rejects the request for compensation on account of the failure to provide the personal data posted on the VNG Forum in good time.

Conclusion

50.    The appeal by [the appellant] against the decision of 19 February 2019 is inadmissible.

51.    The application for damages was dismissed.

52.    The College should be ordered to reimburse the costs of the proceedings in a manner to be indicated.

What does this decision contain in brief?

53.    In this judgment and in three other judgments delivered today, the Division discusses the possibilities of claiming compensation for damages before the administrative courts if someone claims that an administrative body has processed personal data in violation of the applicable privacy legislation (since 25 May 2018 the General Data Protection Regulation (AVG) and the AVG Implementation Act). Before the AVG and the AVG Implementation Act entered into force, the case law of the Division offered fewer possibilities, which meant that the citizen was then directed to the civil courts. This route remains open, but in a larger number of cases it is now also possible to approach the administrative courts for requests for compensation up to € 25,000. For the answer to the question as to when this can be done, see above under 26. In other words, it concerns a procedural question of legal protection, namely when, in the event of unlawful processing of personal data, the administrative courts can be approached.

In terms of content, the Division then decides that in order to be eligible for compensation, the requirements of Section 6:106 of the Dutch Civil Code must be met. For these cases, this means that the honour or good name of the person concerned must be affected, or that the person must be affected in some other way. In this respect, the Division is in line with the case law of the Supreme Court. In this case the Division decides that [the appellant] cannot claim compensation. The Board did not act unlawfully in stating [appellant's] name on the VNG Forum. The alleged loss resulting from the failure to provide full and timely information about the processing of personal data was not substantiated by [the appellant].

Decision

The Administrative Jurisdiction Division of the Council of State:

I. declares the appeal against the decision of 19 February 2019 inadmissible;

II. dismisses the application for damages;

III. orders the Municipal Executive of Harderwijk to pay the costs of the proceedings incurred by [the appellant] in connection with the hearing of the appeal up to an amount of € 525.00 (in words: five hundred and twenty-five euros), to be allocated in full to legal aid granted by a third party on a professional basis;

IV. orders the Municipal Executive of Harderwijk to reimburse to [the appellant] the court fee paid by him for the handling of the appeal in the amount of € 174.00 (in words: one hundred and seventy-four euros).

Thus determined by J.E.M. Polak, chairman, and E.A. Minderhoud and E.J. Daalder, members, in the presence of M.A.E. Planken, registrar.

The chairman is prevented from signing the decision.

The Registrar is prevented from signing the decision.

Pronounced in public on 1 April 2020

299.

Annex