RvS - 201906880/1/A3

From GDPRhub
Revision as of 11:41, 5 July 2021 by RRA (talk | contribs) (→‎Facts)
RvS - RvS - 201906880/1/A3
Courts logo1.png
Court: RvS (Netherlands)
Jurisdiction: Netherlands
Relevant Law: Article 5 GDPR
Article 6(1) GDPR
Decided: 30.06.2021
Published: 30.06.2021
Parties: Autoriteit Persoonsgegevens
National Case Number/Name: RvS - 201906880/1/A3
European Case Law Identifier: Zoekresultaat - inzien document ECLI:NL:RVS:2021:1420
Appeal from:
Appeal to: Not appealed
Original Language(s): Dutch
Original Source: de Rechtspraak (in Dutch)
Initial Contributor: n/a

In progress.

English Summary

talk about the necessity test here. and then the thing about how controllers have some control in determining the means.

Facts

AP imposed an order subject to a penalty payment on the college. The college infringed the then applicable Personal Data Protection Act (Wbp) because the data of persons who disposed of their waste in underground containers was stored and retained on the card readers attached to the containers. The order required the college to open all underground containers without the use of the waste card and to delete all personal data already stored and retained no later than 1 October 2017.

14 March 2019. Decision by AP to lift the order subject to a penalty imposed on the College of Mayor and Aldermen of Arnhem ('het college van burgemeester en wethousers van Arnhem'), at the request of the municipality. The request was made since the municipality wants the underground containers to be accessible only to residents and businesses of the municipality and therefore wants to open a new waste pass system. With the new system, the processing of personal data after the waste containers are opened consists of the process of converting this data. According to the AP, no personal data is processed on the card readers because the internal chip code of the waste pass, which is linked to a residential address, is immediately converted into the generic 9999 number after comparison with the authorisation list to to open the container. The AP does not see in advance that this processing is in conflict with the GDPR. It was also authorised to lift the decision under Article 5:34(2) of the General Administrative Law Act (de algemene wet bestuursrecht) since it had been in place for a year without the periodic penalty payment being forfeited.

16 July 2019. The AP dismissed the objection made by appellant against it as unfounded. Judgment 5 September 2019, District Court of Gelderland declared the appeal lodged by the appellant against the AP decision to be unfounded.

Appeal by appellant against judgment of the judge in preliminary relief proceedings of the District Court of Gelderland of 5 September 2019 in cases 19/4218 and 18/4217 in the proceedings between the appellant and the Dutch DPA (the Autoriteit Persoonsgegevens, or 'AP').

Appellant argues that the District Court erred in finding that there is a basis for the processing of the personal data and that the processing is necessary. The fact that with the new system, the data is stored for a shorter period of time is immaterial. The necessity for processing under Article 6(1) must arise from law in a formal sense, and must satisfy the

Dispute

In progress.

Holding

The starting point of the GDPR is not the prohibition of the processing of regular personal data. It regulates its processing. There is also no fundamental right of no data processing/ not to process regular personal data.

Short-term processing of data in the internal memory to open a waste bin is also processing within the meaning of the GDPR.

The specific data processing of a public authority does not have to be included in a law in the formal sense. Neither the GDPR nor Constitution nor the Charter require this. The processing only has to be traceable to a law. It may therefore also be a lower regulation. (NB article 6(3) speaks of 'right' not 'law'. The public interest task may also be contained in something as simple as the waste management plan of the municipality.

The purpose of the data processing must be in keeping with the public interest task.

"The legitimacy of the purpose of the processing may also be found in excluding others from the process". a data processing is not necessarily aimed at a certain group of data subjects; it can also be aimed at excluding another group.

"The necessity test in the European Convention on Human Rights is not stricter than the necessity test in the GDPR." *the necessity test which arises from Article 8 ECHR does not impose any requirements that are more onerous than the test that must be satisfied under Article 6 GDPR.

"The controller is not required to reach all possible alternatives. The fact that an alternative exists, does not in any by itself make the processing unnecessary, as controllers have some degree of freedom to decide how to carry out their tasks. Processing will only be unnecessary if the processing is also disproportionate. The controller does not have to consider all possible alternatives. However, the intensity with which the necessity test must be conducted is partly determined by the specificity of the alternatives proposed. (the intensity of evaluating the possible alternatives as part of the necessity test depends on the specificity of such alternatives.)

The extent of the processing plays a role in the consideration of the proportionality of the processing.



Comment

On necessity test part... "although the Council referred to this as an element of the investigation by the Data Protection Authority, it is also relevant for DPIAs." https://www.linkedin.com/posts/jeroenterstegge_zoekresultaat-inzien-document-activity-6817436353052065792-0XMS/

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.


                                
                            
        



    Body
    Council of State
    Date of judgment
    30-06-2021

    Date of publication
    
30-06-2021

    Case number
    
201906880/1/A3

    
    Jurisdictions
    
Administrative law
    
    Special characteristics
    
Appeal
    
    Content indication
    
By decision of 14 March 2019, the Dutch Data Protection Authority lifted the order subject to a penalty imposed on the Municipal Executive of Arnhem at its request. The AP has imposed a cease and desist order on the college. The Commission violated the then applicable Personal Data Protection Act (hereinafter: the Wbp) because the data of persons who disposed of their waste in underground containers were stored via the address-related waste card and stored on the card readers attached to the containers. The burden entails that the municipal executive must open all underground containers without the use of the waste pass being necessary and that it must have deleted all already stored and saved personal data by 1 October 2017 at the latest. The council wants the underground containers to be only accessible to residents and companies of the municipality and therefore wants to introduce a new waste pass system. The underground containers must be closed for this.

    Locations
    
Rechtspraak.nl
    
        
        
            Enhanced pronunciation
        





    
        Share pronunciation
        
    
    
        print
        Save as PDF
        Copy link

    


        
            Statement
        
        
  
    201906880/1/A3.
    Judgment date: June 30, 2021
    DEPARTMENT
    ADMINISTRATIVE JURISDICTION
    Decision on the appeal of:
    [appellant], living in [place of residence],
    against the decision of the preliminary relief judge of the Gelderland District Court (hereinafter: the District Court) of 5 September 2019 in cases no. 19/4218 and 18/4217 in the proceedings between:
    [appellant]
    and
    Authority Personal Data.
    Process sequence
    By decision of 14 March 2019, the AP lifted the order subject to a penalty imposed on the Municipal Executive of Arnhem at his request.
    By decision of 16 July 2019, the AP declared the objection lodged by [appellant] unfounded.
    By decision of 5 September 2019, the court dismissed the appeal lodged by [appellant] against it. This statement is attached.
    The appellant appealed against this decision.
    The AP has given a written explanation.
    The college has filed a response.
    [Appellant] has submitted further documents.
    The Division dealt with the case in court on 11 May 2021, where [appellant] via an audio connection and the AP, represented by E. Nijhof and O.S. Niveld, have appeared. Furthermore, the Board, represented by mr. M.B.J. Thijssen and mr. L.J. Gerritsen, both lawyers in Nijmegen, and C.A.M. Berntsen, heard.
    Considerations
    preface
    1.       The relevant legal framework is included in the appendix to this ruling. The appendix is part of the ruling.
    2.       The AP has imposed an order subject to a penalty on the municipal executive. The Commission violated the then applicable Personal Data Protection Act (hereinafter: the Wbp) because the data of persons who disposed of their waste in underground containers were stored via the address-related waste card and stored on the card readers attached to the containers. The burden entails that the municipal executive must open all underground containers without the use of the waste pass being necessary and that it must have deleted all already stored and saved personal data by 1 October 2017 at the latest.
    The council wants the underground containers to be only accessible to residents and companies of the municipality and therefore wants to introduce a new waste pass system. The underground containers must be closed for this. The Commission has therefore requested that the load be lifted or that the part of the load relating to the opening of the containers be changed in the sense that the containers may be closed. According to the AP, this is possible because the college has complied with the entire burden and no violations have occurred for a year. The data processing that takes place after the introduction of the new system is also in accordance with the regulations. [Appellant] disagrees.
    decide
    3.       The AP has taken the position maintained in the objection that, on the basis of Article 5:34, second paragraph, of the General Administrative Law Act (hereinafter: the Awb) it has the authority to suspend the order at the request of the Commission. because the decision has been in force for a year without the penalty payment being forfeited. With the new system, the processing of personal data after opening the waste containers consists of the process of converting this data. According to the AP, no personal data is processed on the card readers because the internal chip code of the waste card, which is linked to a residential address, is immediately converted into the generic 9999 number after comparison with the authorization list to open the container. The AP does not see in advance that this processing is in conflict with the successor to the Wbp, the General Data Processing Regulation (EU) 2016/679 (hereinafter: the GDPR).
    Attacked verdict
    4.       The court considered that the AP was in principle authorized to lift the order subject to a penalty. The AP was also able to make reasonable use of that power in this case. The processing is carried out in order to fulfill a task carried out in the public interest and is also necessary. The possible possibility that the software will be adjusted in the future and the introduction or not of the so-called Diftar system need not be included in this. Furthermore, the AP was allowed to take the position that the aim of the waste pass system cannot be achieved with the alternatives proposed by [appellant], according to the court.
    Appeal
    5.       [appellant] argues that the court wrongly ruled that there is a legal basis for the processing and that the processing is necessary, while the court previously ruled that there was not. The fact that the data is stored for a shorter period of time with the new system and therefore the infringement is less serious cannot be a reason for that difference, because in the digital world half a second is an eternity. Limited processing of personal data must also meet the requirements of the GDPR. According to [appellant], the necessity for the processing must arise from a law in the formal sense and meet the criteria referred to in Article 8, second paragraph, of the Convention for the Protection of Human Rights and Fundamental Freedoms (hereinafter: the ECHR). ). In addition, it must also be assessed whether there is a need for the method chosen by the municipality in performing its task of general interest, according to [appellant]. In this case, according to [appellant], the necessity has not been demonstrated because the question of whether the waste pass system is indeed necessary for the fulfillment of the task under the Environmental Management Act is wrongly ignored. Furthermore, [appellant] argues that the court should have assessed whether that task can also be performed without the processing of personal data. By failing to do so, the court has applied too light a review in violation of the GDPR and the ECHR. According to [appellant], it follows from the fact that the municipal council has decided to hold an advisory referendum on the question "Stop paying per waste bag, unlock containers and ensure that a normal waste bag fits in again", according to [appellant] that the necessity of the data processing is not there.
    The court wrongly placed the burden of proof for the necessity on him instead of on the municipality. [appellant] further argues that the court did not discuss a number of his grounds of appeal in the appealed decision. There is also a lack of proper balancing of interests and therefore effective legal protection.
    [appellant] requests the AP to instruct the AP to take effective enforcement action against any processing of personal data of residents of Arnhem, without their consent, when they correctly deposit their household waste, for example in underground waste containers.
    Assessment by the Department
    What is not or is no longer in dispute?
    6.       It is not in dispute that during one year after the order was imposed, no violation was established and no penalty was forfeited. It is therefore not in dispute that the AP was, in principle, authorized to decide to cancel the order pursuant to Article 5:34, second paragraph, of the Awb.
    It is also not in dispute that the assessment must be based on the new software program that is used for opening the container with the waste card and the new waste card system. It is therefore not necessary to assume the situation as it was before the imposition of the order subject to penalty. The court was therefore not bound by the judgment of the judge in preliminary relief proceedings of the court from 2017 about this old waste pass system.
    It is no longer in dispute that the burden relates to the storage and retention of personal data. Finally, it is no longer in dispute that the so-called Diftar system will not be introduced. The Division will therefore not discuss the grounds put forward by [appellant] in this regard.
    The scope of the request
    7.       [appellant] has requested the Department to instruct the AP to take enforcement action against any processing of personal data by the municipality.
    This procedure concerns the lifting of the order subject to periodic penalty payments in connection with the collection of household waste in underground waste containers. The request that [appellant] submitted to the Division on appeal to order the AP to take action against any processing of personal data by the municipality is significantly broader and falls outside the scope of the original request. The Division will not grant this request for that reason alone.
    What is in dispute?
    8.       It is in dispute whether the AP was allowed to take the position that the burden could be lifted because the new software program no longer violates the AVG with the processing of the data from the waste pass when opening the containers.
    What data is processed?
    9.       The data that is processed is the number that is stated on the waste pass. A waste pass is linked to each residential address with its own number, the so-called internal chip code. This number is processed when a holder holds his waste pass in front of the card reader on the waste container and the internal chip code of the waste pass is compared with an authorization list stored on the card reader. For this, the internal chip code is stored on the volatile memory of the card reader, the so-called whitelist. The internal chip code of a holder's waste card is then almost immediately converted into a generic 9999 number and removed from the whitelist again when the container closes. As soon as the number of the waste card has been anonymised, the address associated with that number can no longer be traced. The anonymized number is stored on the card reader along with the time when the container was opened and a number of technical aspects of the container.
    Insofar as [appellant] argues that fraud can be committed with this system, as a result of which data are processed more and longer, that does not play a role in determining the basis of the processing. The risk of misuse of the system relates to its security and is not important for determining the lawfulness of the processing.
    Should the task of public interest be in a formal law?
    10. According to the AP, the data can be processed in this case on the basis of Article 6, first paragraph, preamble and under e, of the GDPR. This paragraph provides that the processing, insofar as it is relevant, is lawful if it is necessary for the performance of a task carried out in the public interest. Pursuant to the third paragraph of Article 6, a task of general interest must be established by Union or Member State law.
    It follows from recitals 41 and 45 of the preamble that the GDPR does not require specific legislation for each individual processing. Legislation that serves as the basis for various processing operations will suffice. That legislation must be clear and precise and its application must be predictable for those to whom it applies. It does not follow from these considerations that the necessity for the processing must arise from a law in the formal sense, as [appellant] argues. Nor does such an obligation arise from the Charter of Fundamental Rights of the European Union (hereinafter: the EU Charter).
    Also according to the ECHR, contrary to what [appellant] argues, a formal law is not required. The requirement that interference must be provided for 'by law' within the meaning of Article 8(2) ECHR merely means that the contested measure must have a basis in national law and be in accordance with the requirements of the rule of law. That can also be lower regulations.
    Nor can it be inferred from Article 10(1) of the Constitution that each individual infringement must also be provided for by formal law. The term 'by or pursuant to the law' allows subordinate legislation to impose restrictions. In this case, the required law that must lay down rules for the protection of privacy pursuant to Article 10, second paragraph, of the Constitution is the GDPR and the Implementation Act of the General Data Protection Regulation (hereinafter: the UAVG).
    The argument fails.
    What is the assessment framework?
    11.     The processing of personal data may be lawful if it is necessary for the performance of a task carried out in the public interest. To this end, it must first be assessed whether the purpose for which the personal data are processed is well-defined and explicitly described. It must also be assessed whether the relevant purpose is also achieved with the processing of the personal data at issue. In doing so, the goal must fit within the task of general interest. In the event that the processing of the personal data is necessary for achieving the specific purpose in this sense, it must then be assessed whether the invasion of privacy is proportionate to the interests served by the processing of the personal data. As the Division previously ruled in the judgment of 20 September 2017, ECLI:NL:RVS:2017:2555, in the light of the EU Charter it must be assessed whether the invasion of privacy is limited to what is intended to achieve the purpose is strictly necessary. In particular, it must be assessed whether the purpose for which the personal data are processed cannot reasonably be achieved in another way that is less detrimental to the persons involved in the processing of personal data. The intensity with which this must be done is partly determined by the specificity of the proposed alternatives. In other words: the more detailed the person concerned describes the alternative, the more intrusive the investigation of the AP must be.
    With this assessment of the interests in the specific case, the GDPR is in accordance with Article 8 of the ECHR. Contrary to what [appellant] argues, that article does not entail that a separate, broader assessment should take place in addition to this test of interests.
    What is the public interest task?
    12.     Together with the court, the Division is of the opinion that the responsibility of the municipality to ensure the collection of household waste must be regarded as a task of general interest. This task arises from Article 10.21 of the Environmental Management Act, the National Waste Management Plan drawn up on the basis thereof and the 2012-2020 municipal waste plan based on it. The Environmental Management Act not only instructs the municipality to collect waste, but also to take into account the applicable waste management plan and the preferential order included therein. In view of this, the AP rightly takes the position that the prevention of residual waste and the separate collection of household waste also fall under this task of general interest of the municipality. The municipal authorities are given a certain amount of leeway to fulfill this task. The principles of the municipal waste plan are to minimize residual waste and to provide as much as possible separated reusable materials such as paper, glass, plastic, etc., so that they can be reused.
    What are the purposes?
    13.     The purposes served by the processing of the personal data concern the prevention of use of the containers by companies and by non-Arnhemmers, determining which collection routes are followed and determining in which districts information is required about the separation of waste.
    In the opinion of the Division, these goals are well-defined and explicitly defined. The Division is also of the opinion that those purposes are achieved with the processing of the data. After all, the containers can only be opened with waste passes that have been issued to people who live at an address in Arnhem. Furthermore, the waste pass system can keep track of when and how quickly a container for residual waste is full. This makes it possible to determine which containers must be emptied and in which districts information about the separation of waste is necessary to further reduce the amount of residual waste.
    Is the processing necessary for the performance of a task carried out in the public interest?
    14.     As explained above, the necessity assessment involves weighing up alternatives and interests. The fact that the processing of the data must be necessary within the meaning of Article 6(1)(e) of the GDPR does not therefore mean that the processing is only lawful if the task of public interest cannot be fulfilled without data being collected. are processed. In other words, as [appellant] rightly states, the collection of household waste can take place without data being processed. This does not mean, however, that for that reason alone there is no need for data processing when collecting household waste in containers that must be opened with an address-bound waste card. This is only the case if there are other ways of fulfilling the task of general interest that can achieve the same purpose or if the processing is disproportionate.
    The freedom that the Municipal Executive has in fulfilling its task in the public interest also means that the mere fact that the Municipal Executive has held an advisory referendum does not mean that processing is therefore not necessary, as [appellant] argues.
    The Division does not follow [appellant] in his argument that this method of testing is contrary to the principle of minimal data processing as referred to in Article 5, first paragraph, opening words and under c, of the GDPR. The basic principle of the GDPR is not that the processing of so-called ordinary personal data, such as an address, is prohibited. The GDPR aims to regulate the processing of this data. There is also no fundamental right not to process this type of personal data.
    15.     As [appellant] rightly argues, even if only a single piece of data is processed for a short period of time, that processing must comply with the GDPR. Contrary to what [appellant] argues, the extent of the processing does, however, play a role in considering whether the processing is proportional. In this case, the data of the waste card is briefly stored on the volatile memory of the card reader in order to be able to check it with the data on the authorization list. The data is anonymized immediately afterwards and is therefore not stored. The Division is of the opinion that this processing is small and limited to what is necessary to achieve the objectives of the municipality. The AP was therefore allowed to take the position that the infringement for [appellant] is proportionate to the purpose to be served by the processing.
    16.     Like the court, the Division is of the opinion that the AP could take the position that the Commission has sufficiently demonstrated that the proposed alternatives do not achieve the intended goals.
    The controller must demonstrate that processing is necessary for the achievement of a particular purpose. However, the controller does not have to think of all possible alternatives. Contrary to what [appellant] argues, the fact that he has to present alternatives does not mean that the burden of proof is reversed.
    It is plausible that if the containers were opened again, it would not be possible to prevent non-residents of Arnhem and companies from dumping their waste there. At the hearing on appeal, the representative of the Board stated that 7% more residual waste was deposited in the containers during the period in which the containers were opened. The purpose of preventing misuse cannot be achieved by using a waste pass that is not linked to an address. After all, in that case the circulation of the waste cards cannot be controlled by the municipality and there is a chance that waste cards will end up with companies or non-residents of Arnhem. Finally, the Commission has made it plausible that with the introduction of garbage bags with a price surcharge, the objectives of the municipal waste plan 2012-2020 will not be achieved because the waste will be separated less well and will lead to more nuisance in public spaces.
    17. From the necessity criterion, which results from Article 8 of the ECHR, no stricter requirements arise in a case such as this one than the test that must be carried out on the basis of Article 6 of the GDPR. Now that the processing of the data complies with (Article 6 of) the GDPR, the AP was allowed to take the position that the data processing does not violate Article 8 of the ECHR.
    18. In view of the foregoing, the Division agrees with the District Court that the purpose cannot reasonably be achieved in a different manner that is less detrimental to the person involved in the processing of personal data. The court has therefore rightly ruled that the AP was allowed to take the position that the board will no longer violate the GDPR if the burden is lifted. The court has also sufficiently substantiated this judgment. The fact that the court does not explicitly mention all the grounds of appeal of [appellant] does not mean that it has not taken them into account in its decision. [Appellant's] argument fails.
    Conclusion
    19.     The appeal is unfounded. The impugned verdict must be affirmed.
    20.     The AP does not have to reimburse legal costs.
    Decision
    The Administrative Jurisdiction Division of the Council of State
    confirms the attacked statement.
    Adopted by mr. J.A.W. Scholten-Hinloopen, chairman, and mr. B.P. Vermeulen and mr. E.J. Daalder, members, in the presence of mr. S.C. van Tuyll van Serooskerken, clerk of the court.
    The chairman is unable to sign the decision.
    The clerk is unable to sign the decision.
    Pronounced in public on June 30, 2021
    290
    
    APPENDIX
    
    ECHR
    Article 8:
    1. Everyone has the right to respect for his private and family life, his home and his correspondence.
    2. No interference by any public authority is permitted in the exercise of this right, except to the extent provided for by law and necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country , the prevention of disorder and crime, the protection of health or morals or the protection of the rights and freedoms of others.
    charter
    Article 8:
    1. Everyone has the right to the protection of their personal data.
    2. This data must be processed fairly, for specified purposes and with the consent of the data subject or on any other legitimate basis provided for by law. Everyone has the right to inspect the data collected about him and to rectify it.
    3. An independent authority ensures that these rules are observed.
    GDPR
    Article 5 Principles regarding the processing of personal data
    1. Personal data must:
    (a) processed in a manner that is lawful, fair and transparent towards the data subject ("lawfulness, fairness and transparency");
    (b) collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research or statistical purposes shall not be considered incompatible with the original purposes in accordance with Article 89(1) ("purpose limitation");
    (c) adequate, relevant and limited to what is necessary for the purposes for which they are processed ('minimum data processing');
    d) are accurate and updated if necessary; all reasonable steps must be taken to delete or rectify without undue delay any personal data that are inaccurate in view of the purposes for which they are processed ("accuracy");
    e) be kept in a form that makes it possible to identify data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods to the extent that the personal data are processed solely for the purpose of archiving in the public interest, scientific or historical research or statistical purposes in accordance with Article 89(1), provided that the appropriate technical and organizational measures required by this Regulation are applied. taken to protect the rights and freedoms of the data subject ("storage restriction");
    f) processed by appropriate technical or organizational measures in such a way as to ensure appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage ("integrity and confidentiality ").
    2. The controller is responsible for and can demonstrate compliance with paragraph 1 ("accountability").
    Article 6 Lawfulness of the processing
    1. Processing is only lawful if and insofar as at least one of the following conditions is met:
    a) the data subject has consented to the processing of his/her personal data for one or more specific purposes;
    b) the processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract;
    c) the processing is necessary for compliance with a legal obligation to which the controller is responsible;
    d) the processing is necessary to protect the vital interests of the data subject or of another natural person;
    e) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority conferred on the controller;
    f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where the interests or fundamental rights and freedoms of the data subject which require the protection of personal data outweigh those interests, in particular when the person concerned is a child.
    Point (f) of the first subparagraph shall not apply to processing by public authorities in the performance of their duties.
    2. Member States may maintain or introduce more specific provisions to adapt the way in which the rules of this Regulation with regard to processing for the purposes of compliance with paragraph 1(c) and (e) are applied; to this end, they may further specify specific processing rules and other measures to ensure lawful and proper processing, including for other specific processing situations as referred to in Chapter IX.
    3. The legal basis for the processing referred to in points (c) and (e) of paragraph 1 shall be determined by:
    a) Union law; or
    b) Member State law applicable to the controller.
    The purpose of the processing shall be determined in that legal basis or, in relation to the processing referred to in point (e) of paragraph 1, it is necessary for the performance of a task carried out in the public interest or for the exercise of official authority conferred on the controller . That legal basis may contain specific provisions to adapt the application of the rules of this Regulation, including the general conditions on the lawfulness of processing by the controller; the types of data processed; The involved; the entities to which and the purposes for which the personal data may be provided; the target limitation; the storage periods; and the processing activities and procedures, including measures to ensure lawful and fair processing, such as those for other specific processing situations referred to in Chapter IX. Union or Member State law must meet an objective of public interest and must be proportionate to the legitimate aim pursued.
    4. […].
    awb
    Article 5:34
    1. The administrative authority that has imposed an order subject to a penalty may, at the request of the offender, cancel the order, suspend its duration for a specified period or reduce the penalty in the event of permanent or temporary total or partial impossibility for the offender to fulfill his obligations. comply.
    2. The administrative authority that has imposed an order subject to a penalty may, at the request of the offender, lift the order if the order has been in force for a year without the penalty being forfeited.
    Laws of environmental Conservation
    Article 10.21
    1. The municipal council and the mayor and aldermen, whether or not in collaboration with the municipal council and mayor and aldermen of other municipalities, shall ensure that at least once a week the household waste, with the exception of coarse household waste, is collected from each within its territory. site where such waste can regularly be generated.
    2. In addition to the first paragraph, in the interest of efficient waste management, rules may be laid down by Order in Council on the responsibility of the municipal council and mayors and aldermen for the collection of waste materials to be designated in this regard that are of nature and composition are comparable to household waste and come from designated sources.
    3. If the second paragraph has been applied, those waste materials are regarded as household waste.
    4. The municipal council may decide to collect other components of household waste separately.