RvS - 202100165/1/A3
From GDPRhub
| RvS - 202100165/1/A3 | |
|---|---|
 | |
| Court: | RvS (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 17(3)(e) GDPR Article 17(3)(e) AVG Article 17(3)(e) DSGVO Article 17(3)(e) RGPD |
| Decided: | 20.07.2022 |
| Published: | 20.07.2022 |
| Parties: | Municipal Executive of Bladel |
| National Case Number/Name: | 202100165/1/A3 |
| European Case Law Identifier: | ECLI:NL:RVS:2022:2065 |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | RvS (in Dutch) |
| Initial Contributor: | Jette |
The Administrative Division of the Council of State held that the exception to the "right to be forgotten" in Article 17(3)(e) AVG included retention for defence against legal claims even though the Dutch text did not explicitly use the word "defence."
English Summary
Facts
The controller is the Municipal Executive of Bladel (an administrative body). The data subject is a dog trader (and her partner).
In 2013, the police started an investigation to combat malicious dog trading. The data subjects were included in a report that was drawn up regarding this investigation. The investigation resulted in an enforcement action in 2016. The data subjects started administrative and civil proceedings on the (lawfulness of the) enforcement action.
In March 2018, the data subjects submitted a request for erasure at the controller, concerning their personal data laid down in said report. The controller denied this request by decision of October 2018. The data subjects appealed this decision up until the Administrative Division of the Council of State. The Division found that the controller's decision lacked substantive reasoning and ordered it to issue a new one.
The controller denied the data subjects request again by decision of November 2020. It held that retention of the personal data was necessary pursuant to Article 17(3)(e) AVG, to substantiate it's defense in the civil proceedings started by the data subjects.
The data subject appealed this decision, stating that the controller cannot invoke the exception of Article 17(3)(e). She argued that the Article specifically refers to the establishment, exercise or substantiation of a legal claim, however it does not include the defense against one.
Holding
The Division noted that not only the wording, but also the context and purpose should be considered when interpreting EU legislation (HvJ Tarola). This required a comparison of the different language versions (HvJ Consorzio).
The Division found that the English, German and French version of Article 17(3)(e) all had a much broader scope than the Dutch text. They contained some translation of the word 'defense,' (defence; Verteidigung; défense) while the Dutch version merely used the word 'substantiation' (onderbouwing).
The Division further noted that in case of these differences in translations, it must consider the objective and purpose of the legislation for a uniform interpretation (CJEU Kraaijveld). The objective is the protection of natural persons when processing personal data (Recital 1&2), however this must be balanced with other fundamental rights recognized in the Charter (Recital 4). In particular, the Division followed, Article 47 of the Charter, which included the right of defense (CJEU Otis). Thus, the German, English and French versions of Article 17(3)(e) were more consistent with the purpose of the AVG.
The Division held that, contrarily to what the data subject argued, Article 17(3)(e) AVG does include the defense against a legal claim. Therefore, the appeal was unfounded.
Comment
This case is about the Dutch translated version of the GDPR: the Algemene Verordering Gegevensbescherming (AVG). As this language version is important for the decision, The summary also refers to the AVG, and not to the GDPR.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
20100165/1/A3.
Judgment date: July 20, 2022
DEPARTMENT
ADMINISTRATIVE JURISDICTION
Judgment in the dispute between:
[appellant], living in Hapert, municipality of Bladel,
and
the college of mayor and aldermen of Bladel,
defendant.
Process sequence
By decision of 23 November 2020, the Board again decided on the objection made by [appellant] and partially granted her request for the erasure of her personal data.
The appellant appealed against this decision.
The college has issued a written statement.
The Division heard the case on November 22, 2021, where [appellant], represented by [partner], and the Board, represented by mr. M.W.C. Schreurs, lawyer in Venlo, appeared.
Considerations
Introduction
1. In 2013, a so-called pre-weighing document was drawn up by the Police National Unit of Expertise Center for Animal Welfare in the context of the integrated approach to mala fide dog trade. That document contains data from dog traffickers for which sufficient indicators are considered to be present to justify a further investigation. The dog traffickers included in the pre-weighing document are included in the general script 'Canitas project' (hereinafter: script) that has been drawn up for a national enforcement action day. Section 1.4 of the script contains a diagram with data from dog traders. Personal data of [appellant] and her [partner] were then included in this scheme. The project was carried out in collaboration with the Netherlands Food and Consumer Product Safety Authority (hereinafter: the NVWA).
In the context of integral enforcement, the scenario has been shared with the administrative bodies that are members of the Regional Information and Expertise Center East Brabant (hereinafter: RIEC East Brabant) as covenant partners. The investigation, in which the data was exchanged in the context of the RIEC, ultimately resulted in an enforcement action on 11 April 2016.
Administrative and civil proceedings have been conducted by [appellant] and [partner] about the (lawfulness of the) enforcement action, and other acts and decisions of the above-mentioned administrative bodies, including this procedure.
Decision
2. On 19 March 2018, [appellant] and [partner] requested the Board on the basis of the Personal Data Protection Act (hereinafter: Wbp) to delete their personal data from the pre-weighing document and from the scenario. By decision of April 18, 2018, the Board rejected this request. [appellant] and [partner] appealed against that decision. The objection was declared unfounded by the Board by decision of 16 October 2018. The [appellant] and [partner] have appealed against this. The court rendered its decision on March 25, 2019. The court upheld the appeal, annulled the contested decision insofar as it concerns the personal data of [partner] and instructed the Board to rectify the data of [partner]. The court has also ruled that the judgment supersedes the contested decision to the extent that it has been annulled.
Decision of the Department of September 30, 2020
3. By decision of 30 September 2020, ECLI:NL:RVS:2020:2316, the Division upheld the appeal lodged by [appellant] because the decision of 16 October 2018 contained a lack of motivation. Pursuant to Article 8:113, second paragraph, of the General Administrative Law Act (hereinafter: Awb), the Division has determined that an appeal against the new decision to be taken can only be lodged with the Division (the so-called judicial loop).
New decision of November 23, 2020
4. In the new decision of 23 November 2020, the Board again decided on the objection made by [appellant]. In doing so, the Commission again rejected the request to delete its personal data from the pre-weighing document and from the scenario. According to the Board, [appellant] is not entitled to erasure of her personal data from these documents, because the processing of these personal data is necessary for the substantiation of a legal claim within the meaning of Article 17, third paragraph, opening words and under e, of the GDPR. [appellant] and [partner] have initiated civil compensation proceedings against the municipal executive, because they do not agree that the personal details of [appellant] are stated in the pre-weighing document and the scenario. It is therefore necessary for the Board to have access to these documents containing the personal data of [appellant] in order to substantiate the defense in those civil proceedings and thus to process these personal data. The Board also processes this personal data for the purpose of this procedure.
Assessment framework
5. On 25 May 2018, the General Data Protection Regulation (hereinafter: AVG) came into effect and the Wbp was repealed. The GDPR applies to this dispute, because the new decision, like the first decision on objection, dates from after May 25, 2018.
6. The relevant laws and regulations are included in the appendix. This appendix forms part of this ruling.
[Appellant's] appeal
7. [appellant] argues that during the handling of the appeal, which led to the decision of the Division of 30 September 2020, Article 17, third paragraph, preamble and under e, of the GDPR as the basis for the processing of its personal data. That is why, according to [appellant], in the new decision the Board wrongly invokes Article 17, third paragraph, preamble and under e, of the GDPR.
In addition, the Board cannot successfully invoke the ground for exception included in Article 17, paragraph 3, under e, of the GDPR. That article specifically refers to the establishment, exercise or substantiation of a legal claim. However, the defense against a legal claim is not mentioned as such in the GDPR. In addition, it is also not necessary for the defense that the Commission processes its personal data in the pre-weighing document and in the scenario.
Insofar as the Board invokes Article 17, paragraph 3, opening words and under b, of the GDPR, this requires that the data is up-to-date, correct and has been compiled in a careful manner. According to the appellant, that is not the case. Insofar as the Board invokes Article 17, paragraph 3, preamble and under d, of the GDPR, the GDPR takes precedence over the Archives Act. This means that personal data may only be stored under the Archives Act if they have been collected in accordance with the GDPR, according to [appellant].
Assessment of the profession
8. In the decision of September 30, 2020, the Division annulled the decision on the objection of October 16, 2018 due to a lack of motivation. This means that the Board had to decide again on the objection lodged by [appellant] against the decision of 18 April 2018. It follows from Article 7:11(1) of the Awb that a reconsideration will take place on the basis of the objection. As the Division has previously considered (judgment of 16 June 2010, ECLI:NL:RVS:2010:BM7744), the objection procedure is intended for complete reconsideration. Even if an administrative body has to take a new decision after annulment by the court, it must also take a decision taking into account all the facts and circumstances as they are at the time of the reconsideration (the so-called ex nunc review).
In the new decision, the Commission has included all facts and circumstances as they existed at the time of reconsideration. The Commission stated in this regard that it processes the personal data of [appellant] in the pre-weighing document and the scenario, because it needs those personal data for the defense in the civil proceedings. The Board also processes the personal data for this procedure.
Should the Board invoke the ground for exception of Article 17, paragraph 3, preamble and under e, of the GDPR?
9. In the case of a request for erasure within the meaning of Article 17 of the GDPR, a controller may first assess, in view of the system and the text of that Article, whether the exception in Article 17(3)(e) of the GDPR applies. occurs. See l.r. 10.1 of the decision of the Division of 30 September 2020. If this exception applies, the controller may process the personal data and the first paragraph of Article 17 of the GDPR does not apply.
Pursuant to Article 17(3), preamble and under e, of the GDPR, a data subject has no right to erasure of personal data insofar as the processing is necessary for the establishment, exercise or defense of legal claims. The question is whether a controller, in this case the Board, can invoke this exception if the processing of personal data is necessary for the defense against a legal claim of the data subject.
It is settled case law of the Court of Justice of the European Union that, in interpreting a provision of European Union law, it is necessary to take into account not only its wording, but also its context and the objectives pursued. pursued by the scheme of which it forms part and the genesis of the scheme (see judgment of 11 April 2019, Tarola, ECLI:EU:C:2019:309, paragraph 37). Therefore, the Division will discuss below the wording, the context and the purpose of Article 17, third paragraph, preamble and under e, of the GDPR.
- What's in other language versions?
9.1. Since the texts of EU law are drafted in different languages and the different language versions are equally authentic, an interpretation of a provision of EU law also requires a comparison of the different language versions (cf. judgment of the Court of Justice of 6 October 2021, ECLI: EU:C:2021:799, Consorzio, paras 42-44). The German, English and French text of Article 17, paragraph 3, preamble and under e, of the GDPR reads:
- zur Geltendmachung, Ausübung oder Verteidigung von Rechtsansprüchen;
- for the establishment, exercise or defense of legal claims;
- à la constatation, à l'exercice ou à la defense de droits en justice.
In the German, English and French language versions of Article 17, paragraph 3, preamble and under e, of the GDPR, the words 'Verteidigung', 'defence', and 'la defense' appear. In the German, English and French language versions of Article 17(3), preamble and (e) of the GDPR, data processing is therefore also permitted for defense in legal context. It must be deduced from these language versions that not only the bringing of a legal claim but also the defense falls under the exception of Article 17(3), preamble and under e, of the GDPR. The English, German and French language versions therefore have a much broader scope than the Dutch text, from which, by using the word 'substantiation', it seems to be concluded that the defense against a legal claim does not fall under the exception.
- Which explanation fits the purpose of the GDPR?
9.2. The provision in question must be interpreted in the light of the need for a uniform interpretation of different language versions, where differences exist between them, having regard to the general scheme and purpose of the legislation of which it forms part (see paragraph 28 of the judgment of the Court of Justice of 24 October 1996, Kraaijeveld, ECLI:EU:C:1996:404).
9.3. The purpose of the GDPR, as reflected in recitals 1 and 2 in the preamble to the GDPR, is the protection of natural persons with regard to the processing of personal data. Under Article 8(1) of the Charter of Fundamental Rights of the European Union and Article 16(1) of the Treaty on the Functioning of the European Union, everyone has the right to the protection of his/her personal data.
It follows from recital 4 in the preamble to the GDPR, however, that the right to the protection of personal data is not absolute, but must be considered in relation to its function in society and must be weighed against other fundamental rights through the principle of proportionality. The GDPR respects all fundamental rights and the freedoms and principles recognized in the Charter. One of those rights is the right to an effective remedy and to a fair trial, as enshrined in Article 47 of the Charter. As is apparent from paragraph 48 of the judgment of the Court of Justice of 6 November 2021, Otis, ECLI:EU:C:2012:684, the principle of effective judicial protection enshrined in Article 47 of the Charter consists of several elements, in particular the rights of the defence, the principle of 'equality of arms', the right of access to justice and the right to be advised, defended and represented. Article 47 of the Charter therefore also includes the principle of defense. Article 17(3), preamble and under e, of the GDPR, the right to erasure is therefore set off against the right to an effective remedy and to a fair trial, for which data processing may be necessary, for example in procedural documents. of Article 17, paragraph 3, preamble and under e, as given in the German, English and French language versions of the GDPR, does the most justice to the balance between the protection of natural persons in the processing of personal data on the one hand and the right to an effective remedy and the right to a fair trial on the other. This interpretation is therefore in line with the purpose of the GDPR, as it appears from the preamble.
- Explanation Department taking into account other language versions and GDPR objective
9.4. In view of what has been considered under 9.1 to 9.3 inclusive, Article 17, paragraph 3, preamble and under e, of the GDPR, must therefore be interpreted as meaning that this provision applies to the claimant and to the defendant, who participate to legal proceedings. Any other interpretation of this provision would mean that the defendant may be frustrated in its defense capabilities. This is contrary to the right to an effective remedy and a fair trial, enshrined in Article 47 of the Charter. It is also contrary to the defense principle enshrined in Article 47 of the Charter. In the context of an effective dispute settlement, it is also important that the claimant, defendant and judge have access to the complete case files.
- Application of the explanation of the Department in this case
9.5. In the new decision on the objection, the Board rightly took the position that it was necessary for the Board as a defendant in the civil proceedings that [appellant] had instituted to process her personal data. That procedure related to the question whether the personal data of [appellant] had rightly been included in the pre-weighing document and in the scenario. It is also necessary for the Board as a defendant in these proceedings to process its personal data. In the new decision on the objection, the Board therefore rightly invoked the exceptional ground of Article 17, paragraph 3, opening words and under e, of the GDPR. Otherwise, the Board would have had to delete [appellant]'s personal data from documents that are part of a lawsuit file. This would have the unacceptable consequence that the Commission should have erased personal data from documents that both parties needed at the time of the decision to defend their position in the civil law case. In that case, it was assessed, among other things, whether [appellant] was right to state that her personal data are incorrectly stated in the pre-weighing document and in the scenario. Erasing personal data from court files would not only have made it impossible to substantiate the position of both parties, but it would also have made it more difficult and difficult for the court to find the truth.
9.6. The argument fails.
Can the personal data of [appellant] be kept on the basis of Article 17, paragraph 3, opening words and under b, of the GDPR and the Archives Act?
10. It follows from Article 17, third paragraph, preamble and under b, of the GDPR that the Board cannot delete personal data if the processing is necessary due to a legal processing obligation (see also the decision of the Division of 14 October 2020, ECLI: NL:RVS:2020:2419). As ruled under 9, a controller must in that case not (first) assess with application of Article 17, first paragraph, preamble and under d, of the GDPR with a request for erasure within the meaning of Article 17 of the GDPR, whether the processing is lawful.
10.1. Pursuant to Article 3 of the Archives Act 1995, the Commission is obliged to bring and keep the archive documents held by it in a good, ordered and accessible state. The Board must also ensure the destruction of the relevant archive documents. According to the Selection List for Municipalities and Intermunicipal Bodies 2020 (Government Gazette 2020, 11143), which has been established pursuant to Article 5 of the Archives Act, documents available to the Board for the handling of disputes must be completed after five years after the dispute has been settled. will be destroyed. It follows from chapter 1.3 that the retention periods in this selection list have been determined after careful consideration of interests, including those of the privacy of those involved in the processes, the risks to business operations and accountability, and the cultural-historical interest. In view of this, the Board has rightly taken the position that the processing is necessary, because it is mandatory to keep the personal data of [appellant] with due observance of the applicable retention period.
10.2. The argument fails.
Conclusion
11. The appeal is unfounded. This means that the new decision of the college of 23 November 2020 stands.
12. The Board does not have to reimburse legal costs.
Decision
The Administrative Jurisdiction Division of the Council of State:
declares the appeal unfounded.
Adopted by mr. C.H.M. van Altena, chairman, and mr. C.M. Wissels and mr. J. Gundelach, members, in the presence of mr. A.M.E.A. Neuwahl, clerk.
w.g. from Altena
chair
w.g. Neuwahl
clerk
Pronounced in public on July 20, 2022
280-973
APPENDIX
REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ( general data protection regulation)
Article 5 Principles regarding the processing of personal data
1. Personal data must:
d) are accurate and updated if necessary; all reasonable steps must be taken to delete or rectify without undue delay any personal data that are inaccurate in view of the purposes for which they are processed ("accuracy");
[…]
Article 6 Lawfulness of the processing
1. Processing is only lawful if and insofar as at least one of the following conditions is met:
[…]
e) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority conferred on the controller;
[…]
4. Where the processing for a purpose other than that for which the personal data were collected is not based on the consent of the data subject or on a provision of Union or Member State law which, in a democratic society, constitutes a necessary and proportionate measure to ensure the protection referred to in Article 23 , paragraph 1, when assessing whether processing for another purpose is compatible with the purpose for which the personal data were initially collected, the controller shall take into account, inter alia:
a) any connection between the purposes for which the personal data were collected and the purposes of the intended further processing;
(b) the framework in which the personal data have been collected, in particular as regards the relationship between the data subjects and the controller;
(c) the nature of the personal data, in particular whether special categories of personal data are processed, in accordance with Article 9, and whether personal data related to criminal convictions and offenses are processed, in accordance with Article 10;
d) the possible consequences of the intended further processing for the data subjects;
e) the existence of appropriate safeguards, which may include encryption or pseudonymisation.
Article 9 Processing of special categories of personal data
1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and processing of genetic data, biometric data for the purpose of uniquely identifying a person, or health data , or data relating to a person's sexual behavior or sexual orientation is prohibited.
2. Paragraph 1 does not apply where one of the following conditions is met:
[…]
f) the processing is necessary for the establishment, exercise or defense of legal claims or when courts act within their jurisdiction;
[…].
Article 16 Right to rectification
The data subject has the right to obtain from the controller the rectification of incorrect personal data concerning him/her without undue delay. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by providing a supplementary statement.
Article 17 Right to erasure ("right to be forgotten")
1. The data subject shall have the right to obtain from the controller without undue delay the erasure of personal data concerning him or her and the controller shall be required to erase personal data without undue delay where one of the following applies:
[…]
3. Paragraphs 1 and 2 do not apply to the extent that processing is necessary:
[…]
(b) for the fulfillment of a legal processing obligation laid down in Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority conferred on the controller;
(d) for archiving purposes in the public interest, scientific or historical research or statistical purposes in accordance with Article 89(1), to the extent that the right referred to in paragraph 1 threatens to make the achievement of the purposes of such processing impossible or seriously impairs the achievement of the purposes of such processing. threatens to compromise;
e) for the establishment, exercise or defense of legal claims.
Archives Act
Article 3
The government bodies are obliged to bring and keep the archive records held by them in a good, orderly and accessible state, as well as to ensure the destruction of the relevant records.
Article 5
1 The caretaker is obliged to design selection lists in which it is at least indicated which archive documents are eligible for destruction.
[…]
