Autoriteit Persoonsgegevens – CJEU Judgment (Netherlands, 2022)
CJEU judgment — not a DPA enforcement action
This is a Court of Justice ruling, not an enforcement action by a data protection authority. It is not included in cookie statistics or the Risk Calculator.
The Court of Justice ruled that the Dutch Data Protection Authority could not handle a complaint about journalists accessing personal data in court documents. The court decided that this type of processing falls outside the authority's oversight. This case shows the limits of data protection authorities in judicial matters.
What happened
The Dutch Data Protection Authority refused to investigate a complaint about journalists accessing personal data from court files.
Who was affected
Individuals whose personal data was accessed by journalists during a court case.
What the authority found
The Court held that the Data Protection Authority was not competent to supervise processing operations of courts acting in their judicial capacity.
Why this matters
This ruling clarifies that data protection authorities cannot intervene in judicial processes. Businesses should be aware that legal proceedings may have different privacy rules.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
In October 2018, the data subject, who was being represented by their attorney, were together approached by a journalist inside the courtroom. The journalist had certain documents from the case file which showed the data subject’s name, address and national identification number. Upon being asked by the data subject for the source of the documents, the journalist replied that they “were made available to him under the right of access to the case file” which the Administrative Jurisdiction Division of Council of State grants to journalists. Subsequently, the President of the Administrative Jurisdiction Division of Council of State confirmed to the data subject that certain documents were being given to journalists “to enable them to follow hearings, namely a copy of the notice of appeal, a copy of the response and, where appropriate, a copy of the contested judicial decision” and “those documents being destroyed at the end of the day.” The data subject and their attorney then approached the Dutch Data Protection Authority (DPA) and claimed that “allowing journalists to have access to personal data concerning them” amounted to a violation of GDPR. However, the DPA said that it was not competent to decide on the same due to Article 55(3) GDPR, which bars supervising authorities from supervising “processing operations of courts acting in their judicial capacity.” Thereafter, the DPA forwarded the request to the President of the Administrative Jurisdiction Division of Council of State. The President of the Administrative Jurisdiction Division of Council of State took note of the complaint and in consultation with the Data Protection Commission for Administrative Law Tribunals, Netherlands “formulated a new policy on access to documents from court files”. However, the DPA’s decision to not hear the matter, and to refer it to the President of the Administrative Jurisdiction Division of Council of State, was challenged by the data subject and his attorney before the Distri
Outcome
CJEU Judgment
A judgment by the Court of Justice of the European Union, typically on a preliminary reference from a national court.
Related Cases (10)
Other cases involving Autoriteit Persoonsgegevens in NL
CJEU Judgment
Details
Judgment Date
24 March 2022
Authority
Court of Justice of the European Union
GDPRhub ID
gdprhub-cjeu-4796About this data
Cite as: Cookie Fines. Autoriteit Persoonsgegevens - Netherlands (2022). Retrieved from cookiefines.eu
Last updated: