The chief of police – Court Ruling (Netherlands, 2020)

The claimant was previously involved in several proceedings regarding the police's treatment towards herself and the disclosure of her personal data to the public. To know more about the processing of her personal data by the Chief of Police, she submitted a subject access request. The Chief of Police provided her with a summary of the personal data processed with the information requested with undue delay, in June 2017. Thus, the Chief of Police set a penalty payment. Following the first answer, the Chief of Police completed with another decision in October 2017 which has been challenged by the applicant before the Court Rb. Zeeland-West-Brabant (Netherlands). The Court Rb. Zeeland-West-Brabant annulled the decision of October 2017 as it found it incomplete. However, based on the new Chief of Police supplementing decision submitted in January 2018 during the proceedings, it also ruled that the data controller does not have to take any other decision regarding the subject access request. Indeed, the lower court considered that the supplementing decision, so-called the "new overview" decision provided enough information and was, thus, complete. The claimant's appeal the Court Rb. Zeeland-West-Brabant's judgement before the Dutch State Council (Raad Van Staten). The applicant claimed mainly that the new overview decision has not been provided in comprehensible form. Especially, she argued that the information related to the purpose(s) of the processing, the recipients or categories of recipients and the origin were not stated clearly. Also, she argued that the new overview decision was still incomplete, as some of the personal data were missing. The Raad Van Staten had to decide on whether the information provided in the proceeding were sufficient enough to comply with Article 15 GDPR and the National data protection law. The Raad Van Staten considered that the data controller had to search another time and find all the personal data about the data subject to