Yards Deurwaardersdiensten B.V – Court Ruling (Netherlands, 2022)

The Dutch financial regulator, Bureau Financieel Toezicht (BFT), provided a journalist with a copy of a decision and an accompanied letter. The decision and letter had been issued by the Chamber of Bailiffs (kamer voor gerechtsdeurwaarders) in a disciplinary proceeding against a company. The BFT provided the journalist with the documents without anonymizing them. The company and two individuals (the plaintiffs) complained that this was a data breach under the GDPR. The plaintiffs demanded that it should be reported to the Dutch DPA Autoriteit Persoonsgegevens (AP). In December 2019, the BFT informed the plaintiffs that there was no need to report the incident as a data breach under the GDPR. The plaintiffs complained. In January 2020, the BFT ruled that the complaint was inadmissible, meaning that the plaintiffs didn't have the right to have the action reviewed by a court. The plaintiffs appealed the BFTs decision to declare the complaint inadmissible. In June 2020, the District Court of Midden-Nederland ruled on the appeal. The District Court reversed the BFT's January 2020 decision and ordered the BFT to issue a new decision on the objection. In addition, the District Court ruled that, as an administrative court, it didn't have jurisdiction to decide on compensation issues. The applicants appealed the District Court's decision to the Supreme Administrative Court (Raad van State). BFT filed an incidential appeal, which is an appeal filed after an opposing party has already filed an appeal. The Supreme Administrative Court held a hearing in October 2021. At the hearing, it became clear that the plaintiffs and BFT now agree that it was wrong to disclose the documents to the journalist without anonymizing them. The Supreme Administrative Court now had to answer three questions: 1) Were there any legal remedies against the BFT's decision? 2) Does an administrative court have jurisdiction to decide on applications for compensation? 3) Should the request for compensation be granted? = First, the Supreme Administrative Court examined whether the GDPR gives the company any rights on which to base its claims. The court examined the definition of personal data in Article 4(1) and Recital 14. The Supreme Administrative Court found that the GDPR only applies to natural persons and that the company, as a legal person, cannot assert any rights for data subjects. However, since the two plaintiffs were natural persons with rights as data subjects, this didn't affect the admissibility of the case. = First, the Supreme Administrative Court addressed BFT's claim that the decision was inadmissible because it wasn't a decision within the meaning of Section 1(3) of the Dutch General Administrative Act (Awb). The court held that under Article 34 of the Dutch GDPR implementation act (UAVG), the BFT's measure can only be considered an administrative decision that can be challenged in court if it's a decision concerning a data subject exercising his or her rights under Article 15 GDPR - Article 22 GDPR. The court also recalled that it's important to distinguish between the data subject's right to object to data processing under Article 21 GDPR and the citizen's right to object to an administrative decision under Article 6(4)(1) Awb. It then concluded that the BFT measures cannot be considered as an administrative decision on the exercise of the data subject's rights. The court then considered whether the BFT's actions constituted an administrative decision under other laws. It considered whether it could be an administrative decision under the Dutch Freedom of Information Act, Wet openbaarheid van bestuur (Wob). The court ruled that the action couldn't be considered a disclosure under the Wob. The journalist had never filed a formal freedom of information request. The court also found that it wasn't a publication on the initiative of the BFT, since the journalist had stated that they didn't want to publish the decision itself, but only to use the information in an article. The court then considered whether BFT had violated the Trade Secrets Act (Wet bescherming bedrijfsgeheimen). The Supreme Court ruled that this law only protects the company from lawsuits filed by its competitors, not actions that are based on administrative law. The Supreme Administrative Court ruled that BFT's decision not to report the incident as a data breach wasn't an administrative decision that could be challenged in court. The Supreme Court reversed the district court's decision. = The Supreme Administrative Court referred to previous case law and concluded that the administrative courts have jurisdiction to decide on compensation claims. The Supreme Administrative Court recalled that according to Article 8(88) Awb, the administrative courts may decide on compensation claims below €25,000. As long as the claim is below this amount, the claimant/plaintiff can choose whether to bring the case before a civil court or an administrative court. In this case, the plaintiffs estimated their damages at more than €25,000. However, they'd limited the amount of compensation they sought in court to €25,000 per person. The Supreme Administrative Court found that it was wrong for the district court to add up the plaintiffs' claims and conclude that the upper limit had been exceeded. For this reason, the Supreme Administrative Court ruled that the district court had jurisdiction to decide the issue of compensation. The Supreme Administrative Court also clarified that it's not necessary for a data subject to have exercised any of his/her rights before he/she can claim damages in court under Article 82 GDPR. = The Supreme Administrative Court found that the claimants hadn't sufficiently demonstrated the psychological injury they'd suffered as a result of the disclosure. For example, the claimants hadn't made it plausible to the administrative court that the costs were caused by the unlawful processing of their names when the documents were handed over to the journalist without anonymization. The Supreme Administrative Court also weighed that the judgment of the court case to which the documents belonged was public. Therefore, only the names of the applicants and their company had been wrongfully disclosed to the journalist. BTF had also asked the journalist not to publish the names, and they were never mentioned in the published article. Therefore, the Supreme Administrative Court rejected the request for compensation.