Claimant – Court Ruling (Netherlands, 2024)

The data subject filed an access request for their personal data related to a legal dispute. The municipality of Utrecht ("controller") published the data online, including the addresses of the data subject and his neighbours. The data subject lodged a complaint with the Dutch Data Protection Authority (AP) on 24 July 2021. Following the complaint, the controller removed some of the personal data, making the infringement of privacy minor. The AP concluded that there was no violation of the GDPR and emphasized that the controller had discretion under Article 5(1) of the Woo (Wet open overheid) to disclose information contained in public documents. The data subject appealed the AP's decision on both procedural and substantive grounds. While the initial claim concerned the AP’s failure to decide on time, he also raised legal arguments, including that the authority had not investigated sufficiently, that the publication of address data violated the GDPR, and that the AP should have conducted an independent GDPR assessment separate from the Woo framework. The appeal was found manifestly inadmissible, and the court issued its judgment without a hearing. The court pointed out that the matter at hand had already been decided in a previous judgment (ECLI:NL:RBMNE:2023:6538). That case, decided under the Woo, had already balanced privacy interests against the public interest in transparency, concluding that disclosure of the address data was lawful. In the present case, the court declined to re-examine the issue because the data subject requested the same balancing to be repeated under the GDPR, without introducing any new facts or legal grounds. As the Woo is recognised as applicable national law under Article 86 GDPR, the previous assessment sufficed. The AP was therefore entitled to rely on the prior Woo-based judgments, and no separate GDPR investigation was required. The court ordered the AP to pay the €437,50 procedural costs because the AP had issued the decision too