- Enforcing jurisdiction
- Netherlands · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Autoriteit Persoonsgegevens – Court Ruling (Netherlands, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Dutch DPA ordered the municipality of Arnhem to stop storing personal data from people using waste disposal containers. This matters because it highlights the importance of protecting personal information and following data protection laws.
What happened
The municipality of Arnhem stored personal data from users of underground waste containers without proper justification.
Who was affected
Residents of Arnhem who used the underground waste containers and had their personal data stored.
What the authority found
The DPA ruled that the municipality must delete the stored personal data and allow access to the containers without a card.
Why this matters
This ruling emphasizes that local governments must adhere to data protection rules and ensures that personal data is not retained unnecessarily. Other municipalities should review their data handling practices to avoid similar issues.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 20 March 2026.
Processing notes: articles corrected, national law identified, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Dutch DPA (the Autoriteit Persoonsgegevens, or 'AP') imposed an order subject to a periodic penalty payment on the municipality of Arnhem ('the Municipality'). The Municipality had infringed the then applicable Personal Data Protection Act (Wet bescherming persoonsgegevens or 'Wbp') by storing and retaining the personal data of individuals who disposed their waste in underground containers on the card readers attached to the containers. The order required the Municipality to open all underground containers without the use of a card, and to delete all personal data already stored and retained no later than 1 October 2017. On 14 March 2019, the AP decided to lift the order subject to penalty payments imposed on the Municipality at the request of the Municipality. The Municipality wanted the underground containers to be accessible only to residents and businesses of the Municipality, and therefore wanted to open a new waste card system. With the new system, residents are given a card with an internal chip code which is linked to their residential address. When the card is held in front of the card reader, the chip code is processed and compared to a whitelist of chip codes. To do this, the chip code is stored on the card reader's volatile memory. It is then converted almost instantly into a generic 9999 number, and removed from the whitelist when the container is closed. The AP could not foresee any violation of the GDPR by this new system, namely because data may be processed on the basis of Article 6(1)(e) GDPR, which states that a controller may process personal data which is lawful and necessary for the performance of a task carried out in the public interest. In a decision of 16 July 2019, the AP dismissed an objection made by an appellant against the decision to lift the order as unfounded as unfounded. In a judgment of 5 September 2019, the District Court of Gelderland ('the District Court') declared an appeal lodged by the appellant against the decision
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (3)
Other cases involving Autoriteit Persoonsgegevens in NL
Court Ruling
Details
Ruling Date
30 June 2021
Authority
DPA RVS
About this data
Cite as: Cookie Fines. Autoriteit Persoonsgegevens - Netherlands (2021). Retrieved from cookiefines.eu
Last updated: