Autoriteit Persoonsgegevens – Court Ruling (Netherlands, 2024)

Due to a bankruptcy the data subject was represented by a bankruptcy trustee. The bankruptcy was lifted on 7 July 2022, ending the trustee’s authorization to represent the data subject. However, on 19 July 2022, an employee of a Dutch bank, ABN AMRO Bank (the controller), shared the data subject’s personal data with the former bankruptcy trustee of the data subject on the phone. The data subject lodged a complaint with the Dutch DPA (“Autoriteit Persoonsgegevens) for an unreported data breach by the controller (i.e. sharing his personal data with his former bankruptcy trustee). The controller admitted to the DPA that the bankruptcy trustee of the data subject should only have been informed that they were no longer appointed due to the discharge from bankruptcy of the data subject, and that therefore information of the data subject would not be shared anymore with them. The DPA interpreted the data subject's complaint as not directly referring to the data breach, but to the unlawful processing of sensitive personal data. To determine whether unlawful processing took place, further investigation would have been required. However, in this case, the DPA refrained from conducting further investigation. The DPA explained why it was not investigating the data subject’s complaint, referring to the [https://www.autoriteitpersoonsgegevens.nl/een-tip-of-klacht-indienen-bij-de-ap/behandeling-van-klachten-door-de-ap criteria on their website]. On their website the DPA states that to be efficient and effective, they have to make choices and therefore use the following criteria to determine whether the complaint qualifies for further investigation: the complaint is about a violation that is still ongoing, has a broader societal interest, there are no other proceedings pending, the complaint is specifically about a GDPR issue, and the subject of the complaint has not previously been investigated by the DPA. Taking into account the data subject's complaint, the DPA held that the alleged violation did not last long and the phone call took place quite some time ago. There was also no broader social significance and only the data subject was affected and the subject of the complaint did not fall within any of the DPA’s central themes of 2024. Lastly, the DPA held that the dispute between the data subject and the former bankruptcy trustee was not primarily a GDPR violation. The data subject appealed the DPA’s decision to not further investigate at the District Court of The Hague (“Rechtbank Den Haag”). The DPA argued that further investigation was not needed to establish wrongdoing. The controller’s sharing of the data subject’s personal data with the former bankruptcy trustee was unlawful. However, the DPA stated that the controller acknowledged the violation and mistakenly did not report the breach to the data subject. The court found that the DPA could refrain from conducting further investigation. According to Article 57(1)(f) GDPR, the DPA must deal with complaints to the extent appropriate. The court therefore held that the DPA has discretion to determine case by case whether to take corrective measures. The court found that based on the available information, the DPA could not yet determine whether there was a violation as for example it was not clear what personal data was shared during the phone call. The fact that the controller should have informed the former bankruptcy trustee that they were no longer appointed and that information should not be shared with them anymore, does not mean that there was a GDPR violation. Therefore, further investigation was required. However, the court stated it could follow the DPA’s reasoning for not further investigating the complaint based on the DPA's criteria. Therefore, the court held that the DPA could refrain from further investigating and thus dismissed the appeal.