Stichting Ondersteuning Provinciale Fractie Overijssel Partij voor de Vrijheid – €7,500 Fine (Netherlands, 2021)

The Dutch DPA, Autoriteit Persoonsgegevens (AP) launched an investigation into a possible breach of the GDPR against the provincial political party PVV Overijsssel after an individual filed a complaint. PVV is an acronym for Partij voor de Vrijheid, which means Party for Freedom. PVV Overijsssel, whose legal form is a foundation, is a provincial political party that participates in elections in the Dutch province of Overijssel. On 10 January 2019, the PVV Overijssel sent out an invitation to an event for the party's constituency evening ("achterbanavond"). At this event, the party planned to present its list of candidates for the provincial elections in March 2019. The PVV members of the national parliament would also be present and the participants would have the opportunity to talk to representatives of the party. The invitation was sent by email with the introductory phrase "Dear friends of the PVV". Each recipient was able to view the entire mailing list of 101 email addresses. On 11 January 2019, the complainant who had received the invitation sent an email to the PVV asking the party to remove him/her from the list and confirming that this had been done. In addition, the recipient expressed that the publication of the e-mail addresses was questionable from a data protection point of view. On the same day, a PVV employee confirmed that the person had been removed from the email list and apologised for the incident. Just a few days later, on January 15, 2019, the complainant again received an email inviting him/her to the same event, but this time the recipient list was not visible. The complainant again tried to get PVV to remove him/her from the list. When the AP investigated the matter, it found that at least some of the email addresses in the recipient list made the owners of the email addresses directly or indirectly identifiable. The AP also considered this as a special category (sensitive) of personal data concerning political opinions under Article 9(1) GDPR. = PVV Overijssel doubted that the email addresses were indeed sensitive personal data about political opinions. According to PVV Overijssel, people have different reasons for registering to receive information about the party's activities. According to PVV Overijssel, registering to receive information does not automatically mean that the person sympathizes with the views of the PVV. The fact that someone wanted to receive invitations to party events could not in itself constitute personal data revealing a political opinion. = PVV Overijssel questioned that it was obliged to report the data breach. According to the WP29 guidance on notifying data breaches, the obligation to report occurs only when one of the following legal thresholds is reached: if the breach is unlikely to pose a (normal) risk to rights and freedoms; and if the breach is likely to pose a high risk to rights and freedoms. As PVV Overijssel considered that it was processing normal personal data (not sensitive data), it considered that these thresholds were not met. PVV Overijssel also argued that the breach was unlikely to result in physical, material or non-material harm. = PVV Overijssel considered that no fine should be imposed on it because it had provided an explanation and justification as to why it did not consider that it was obliged to report the data breach. = The AP disagreed with how the PVV Overijssel concluded that email addresses were not sensitive personal data revealing political opinions. The AP claimed that it could not be excluded that at least some of the individuals had registered because of their political views. The AP therefore decided that the e-mail addresses constituted sensitive personal data. = First, the AP found that the disclosure of the list of email recipients constituted a personal data breach under Article 4(12) GDPR. Second, the AP found that PVV Overijssel was obliged to notify the data breach to the AP within 72 hours pursuant to Article 33(1) GDPR. The AP recalled that the main purpose of this obligation is to encourage a data controller to take immediate action to mitigate the data breach, to recover compromised personal data if possible, and to seek advice from the DPA. Third, the AP considered that, in all the circumstances, PVV Overijssel knew about the data breach at least on 11 January 2019, the day on which they apologized to the complainant. The AP concluded that PVV Overijssel was obliged to report the incident without delay, but no later than 14 January 2019. The AP found that PVV Overijssel failed to report the breach within the required timeframe. Fourth, the AP considered that the breach did in fact pose a high risk to individual rights and freedoms and should have been reported. The AP clarified that whenever sensitive personal data revealing a political opinion is involved, it must hypothetically be considered that the data subject is likely to be at risk of suffering harm, which may be material, reputational or discriminatory in nature. The AP explained that political parties process sensitive personal data, which poses a greater risk to an individual whose personal data is breached. Therefore, the AP clarified that a political party has a greater responsibility to maintain a high level of data protection. Fifth, the AP considered the context of the email. The AP considered the subject and intended audience of the email, that it was an invitation to a constituency meeting of a political party, and what was to happen at the event. When considering all these circumstances, the AP concluded that it was very likely that at least some of these 101 email addresses belonged to people who signed up because they sympathized with the ideas of the PVV. = The AP based its fine on two events. First, PVV Overijssel breached its obligation to notify the breach in a timely manner under Article 33 GDPR. Second, PVV Overijssel unauthorizedly disclosed sensitive personal data revealing political opinions of individuals identifiable through email addresses in the mailing list. When PVV Overijssel made the mailing list visible, it violated the privacy of a large number of individuals who lost control over their personal data. The AP also made it clear that it was irrelevant to the case that the data breach concerned individuals who had themselves indicated that they wanted to receive the information. In deciding on the amount of the fine, AP took into account the nature, gravity and duration of the infringement, whether the act was intentional or negligent and the measures taken by PVV Overijssel to limit the damage caused. Finally, the proportionality of the fine was assessed, also taking into account the economic situation of the PVV Overijssel. The AP took note of the economic contributions that the party received from the Province of Overijssel for the operation of its parliamentary group in the States of Overijssel (the elected body of the province). At that time, each party in the States of Overijssel received a basic contribution of € 26 460 and an additional contribution of € 3570 per elected member. The AP found that the standard fine of €525,000 for this type of infringement would be disproportionate for PVV Overijssel. The AP therefore decided that the fine should be €7,500.