Google LLC – Court Ruling (Netherlands, 2020)

The applicant asked Google to remove search results for his name, under the "right to be forgotten". Google decided not to take action on certain URLs. Two months later, the applicant submitted a new (repeated) request, which was rejected by Google for the same reasons. The applicant then lodged a complaint in front of the Dutch civil courts. In Netherlands, the instigation of legal proceedings against a data controller on the basis of the GDPR has been further regulated by the "GDPR Implementation Act". According to Article 35(2) of this local law, data subjects who wish to challenge a data controller' decision on a request made on the basis of Articles 15 to 22 of the GDPR, shall lodge their petition in front of the civil courts within six weeks of receipt of the decision. According to the Dutch case law, exceeding this six-week period leads, in principle, to inadmissibility. Consequently, Google was of the opinion that the applicant's petition was inadmissible as it was submitted later than six weeks after Google's first reply, and therefore not within the period prescribed by Article 35(2) of the GDPR Implementation Act. On the contrary, the applicant was of the opinion that his second (repeated) request started a new time-limit. According to the applicant, neither the GDPR nor its Implementation Act limits the number of applications which may be submitted. In that regard, the applicant refers to the text of Article 21(1) of the GDPR, which states that requets for removal can be made "at any time". Should the applicant's complaint be declared inadmissible for not respecting the time limits as set out to in Article 12(5) of the GDPR and Article 35(2) of the Dutch GDPR Implementation Act? According to the court, the exercise of the rights granted to the data subjects by the GDPR is not unlimited. In order to protect the legitimate interests of the data controller (not to have to decide continuously on repeated requests and be subjected to lengthy litigation, but to know, within a workable period, whether its decision can still be submitted to the courts or not), there are limits to the frequency with which data subjects can make use of their rights. Article 12(5) of the GDPR provides in this respect that a controller may refuse to comply with a data subject request where that request is manifestly unfounded or excessive, in particular because of its repetitive nature. However, Article 12(5) of the GDPR does not contain a clear answer as to when a request may be dismissed as repetitive, nor whether, as in the present case, this can be done after only one repeated request within two months of receiving the negative answer. In addition, it is not clear to the court how Article 12(5) relates to the right to object deriving from Article 21(1), which the data subjects can exercise "at any time", neither how the submission of a repeated request relates to the situation where the national law sets a period of six weeks for lodging an appeal and where such period has expired. The domestic court therefore proposes to ask the following questions to the European Court of Justice: 1) Do the words "at any time" in Article 21(1) of the GDPR mean that data subjects, following receipt of a negative decision in response to a request for removal, are entitled to submit a repeated request (when there is not any change in the facts or circumstances relating to the data subject's situation)? 2) If yes, is the data controller nevertheless allowed, under Article 12(5)(b) of the GDPR, to refuse to comply with the request because of its repetitive nature? 3) Is it relevant how much time elapsed between receipt of the controller's decision rejecting the previous request and the submission of the new (repeated) request by the data subjects? If so, how much time must have elapsed as a minimum before the data subject can submit a new (repeated) request? 4) Does it make any difference if the national law lays down a time-limit within which the data subjects must lodge their appeal against a (negative) decision of a controller, and that time limit has expired at the time when the repeated request is lodged? Is it possible, immediately after the expiry of the time-limit, to submit a new identical request to which the controller would have to reply as to the substance and against which - according to the letter of Article 35(2) - an appeal could (still) be lodged? 5) Does it make any difference if, when the original (rejected) request was made, the data subject was assisted by a professional legal adviser, such as a lawyer?