Autoriteit Persoonsgegevens – Court Ruling (Netherlands, 2023)

The data subject requested the Dutch DPA enforce the GDPR against the Council of State. In particular, the data subject asked the DPA to review whether giving journalists access to procedural documents was in accordance with the GDPR. The DPA declared itself not competent to decide on the processing operations undertaken by a court in its "judicial capacity". The data subject appealed this decision before the District Court Midden-Nederland. Among others, the data subject argued that if the DPA lacked competence to decide on their enforcement request, it should have forwarded it to an independent supervisory authority. The GDPR committee of the Council of State, mentioned by the DPA, did not qualify as independent. The court referred preliminary questions to the CJEU on the interpretation of 'judicial capacity' in the sense of Article 55(3) GDPR. The CJEU decided on 24 March 2022 (C-245/20) that it is part of a court's exercise of its "judicial tasks" within the meaning of Artilce 55(3) GDPR to temporarily provide journalists with documents containing personal data that originate from a judicial procedure, in order to enable them to report more effectively on the progress of that procedure. The Court implemented the CJEU decision and held that the DPA was right in declaring itself not competent. As a matter of fact, under Article 55(3) GDPR a DPA does not have the competence to oversee processings such as the ones at issue in the present case. The Court mentioned Recital 20 GDPR, which allows to specific bodies within the judicial organisation of each Member State to supervise data processing by courts and other judicial authorities. The Dutch legislator intentionally left the organisation of judicial supervision to the judiciary itself. The Council of State created a specific GDPR committee to handle such supervision. The committee is competent to overview processing operations undertaken within the Council of State's judicial tasks, according to GDPR in Article 55(3). Thus, the court declared that the DPA dealt with the competence matter appropriately by forwarding the data subject's complaint to the GDPR committee. The data subject's argument that the internal Committee was not indipendent was rejected.