NDC MEDIA GROUP E.G – Court Ruling (Netherlands, 2020)

The first complainant is a company that is engaged, inter alia, in the purchase and sale, rental and leasing of real estate. The second plaintiff is the sole shareholder of the first complainant. The defendant is a journalist working for the group NDC MEDIA GROUP E.G, a newspaper publisher. The plaintiffs submitted a civil action before the District Court of the Northern Netherlands against NDC MEDIA GROUP E.G regarding an online press article concerning their company. This article has been published also via the Facebook's page of the journalist who wrote the article. In support of the newspaper publisher, the journalist counterclaimed that the first plaintiff processed his personal data and disclosed them to a third-party, without his consent. Indeed, the first plaintiff disclosed through a Facebook message the data subject municipality’s Personal Record databased (BRP) extract to a third party for the purpose of initiated the proceedings against the publisher. The Court had to pronounce itself mainly on the lawwfulness of disclosure of personal data through social network. The Court went through the balancing test to assess whether the conditions laid down in Article 10(2) of the ECHR for a restriction of the right to freedom of expression have been met. The Court recalled that the right for freedom of expression can only be restricted if this is provided for by law and is necessary in a democratic society. For example, a restriction provided by law exists if the court comes to the opinion that the publications, are unlawful within the meaning of Section 6:162 of the Civil Code - this article is the general basis for claims for damages that arise from torts. The District Court found that there has been a violation of a fundamental right which, by its nature and in view of its seriousness, leads to a claim for damages. Regarding the violation of the GDPR, the Court found that the first plaintiff - the data controller - has an independent obligation to process personal date with an appropriate level of security. In the case at hand, the first plaintiff should not have obtained the personal data of the journalist without his consent and should not have disclose to a third-party for the sole purpose of initiating the proceedings. Thus, the first plaintiff violated Articles 5(1)(f), 6 and 32(2) GDPR. In addition, the Court ruled that the first plaintiff had to give a compensation of € 250.00 for fear and stress. Although the Court declared it was not clear what the negative consequence resulting from the disclosure have consisted of, the concept of damages had to be interpreted broadly.