UWV – Court Ruling (Netherlands, 2026)

UWV, the controller, is the Dutch employee insurance agency. In February 2023, the data subject requested the rectification of a medical report drafted by an insurance physician in August 2012. She argued that the report inaccurately described statements allegedly made during a consultation, including information concerning her treatment, an upcoming medical appointment, contact with a personal coach and her employment. The controller rejected the request because it had not identified inaccuracies or omissions in the report. Instead, it added the rectification request to the medical file as a patient statement. In June 2023, the controller rejected the data subject’s objection and maintained its initial decision. A court dismissed the subsequent appeal. The data subject then appealed to the high court. She argued, in particular, that her rectification request should have been substantively assessed by an insurance physician under Article 10 of the controller’s internal objections regulation. She also relied on an earlier medical report which, in her view, demonstrated that the 2012 report contained inaccuracies. The high court dismissed the appeal and upheld the lower court’s judgment. It recalled that Article 16 GDPR entitles a data subject to obtain the rectification or completion of personal data where those data are inaccurate or incomplete. However, the alleged inaccuracies must be capable of being established easily and objectively. The right to rectification is not intended to alter or remove impressions, opinions, research results or conclusions merely because the data subject disagrees with them. Nor does Article 16 GDPR provide a general right to supplement existing documents. In the present case, the disputed information formed part of an insurance physician’s record of what, according to that physician, had been discussed during the consultation. The data subject did not substantiate in concrete terms why that account was incorrect and acknowledged during the hearing that, due to the time that had elapsed, she could no longer remember the conversation precisely. The high court therefore considered that the disputed statements were not inaccuracies that could be objectively established for the purposes of Article 16 GDPR. Consequently, the controller was not required to rectify the report, and the lower court had correctly upheld the rejection of the rectification request.