Court case ZWO 25/2142 – Court Ruling (Netherlands, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Dutch court ruled that a police department did not properly handle a request for personal data from a citizen. This ruling is significant because it highlights the need for public authorities to respond correctly to requests for personal information.
What happened
The court found that the police department failed to properly assess a request for access to personal data.
Who was affected
A citizen who requested information about their personal data held by the police.
What the authority found
The court concluded that the police department did not adequately process the access request as required by privacy laws.
Why this matters
This ruling underscores the obligation of public authorities to handle personal data requests properly. It serves as a reminder for all organizations, including government bodies, to be transparent and responsive to data access requests.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
On 5 January 2025, the data subject submitted an access request to the Chief of Police, the controller, concerning her personal data for the period between 1 January 2016 and 31 December 2017. In particular, she requested information about searches carried out using her Citizen Service Number in a Basic Register of Persons. On 10 February 2025, the controller extended the deadline for deciding on the request by eight weeks. Since the controller considered it unclear whether the request had been submitted under Article 15 GDPR or [https://wetten.overheid.nl/BWBR0022463/2025-07-01 Article 25 of the Police Data Act] (Wet politiegegevens (Wpg)), it contacted the data subject by telephone. On 14 April 2025, the controller assessed the request under Article 15 GDPR and rejected it on the ground that it had not processed the data subject’s personal data during the relevant period. The data subject lodged an objection against this decision. On 13 June 2025, the controller rejected the objection and upheld its initial decision. Since the decision did not contain information on the available legal remedies, the controller sent it again on 18 June 2025 with the relevant appeal clause. On 29 July 2025, the data subject appealed to the District Court of Overijssel. She argued that the controller should have understood from the content and context of her request that it had been submitted under [https://wetten.overheid.nl/BWBR0022463/2025-07-01 Article 25 Wpg] rather than Article 15 GDPR. In particular, the request referred to an earlier access request that the controller had processed under the Wpg. The Court held that the controller should have assessed the access request under [https://wetten.overheid.nl/BWBR0022463/2025-07-01 Article 25 Wpg] rather than Article 15 GDPR. The content and context of a request determine its legal classification, irrespective of the legal basis identified by the applicant. The request referred to an earlier request processed under the Wpg and so
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case ZWO 25/2142 in NL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case ZWO 25/2142 - Netherlands (2026). Retrieved from cookiefines.eu
Last updated: