College van burgemeester en wethouders van Harderwijk – Court Ruling (Netherlands, 2020)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Dutch Council of State found that a municipality's sharing of a citizen's data on a forum was lawful, but they failed to inform the citizen in time. No damages were awarded because the breach did not cause real harm. This case shows the importance of timely communication about data use.
What happened
A municipality processed a citizen's data on a forum without timely notification, but the processing was deemed lawful.
Who was affected
The citizen whose name and address were shared on an internet forum by local authorities.
What the authority found
The Council of State ruled that the data processing was lawful under GDPR, but the failure to inform the citizen promptly was a violation.
Why this matters
This ruling underscores the need for transparency and timely communication in data processing activities. It also clarifies that lawful processing does not negate the requirement to inform individuals about their data use, even if no damages result from the delay.
GDPR Articles Cited
The Dutch Council of State ruled on a claim for damages filed by a citizen whose data (name, address and residence) were processed on a forum accessed by the local authorities. This Internet forum was intended to exchange data between municipalities to prevent abuse of the Public Administration Act. The applicant involved, who filed several request to access documents, had not given his/her consent to the processing of her/his personal data on the forum and received information on the processing of these data only at a late stage of the procedure. The Council of State had to determine whether the processing of information on the internet forum access by the local authorities had a legal ground under Article 6 of the GDPR, and whether the lack of information before such processing was in line with the transparency obligations of the controller (the municipal executive of Harderwijk). The Council of State also had to rule as to whether it is competent to grant a compensation for the damage suffered by the individual and under which circumstances. The Council of State ruled that the mention the name of the applicants on the internet forum at the request of another municipality (to ensure the proper implementation of the access to document legislation and to prevent abuse of such legislation) was legitimate and allowed under Article 6 (1) (e) of the GDPR. However, the Council of State (CoS) rules that the municipality did not inform the data subject in good time, which is a violation of the GDPR. As to the claim for damages, the CoS notes that though Article 82(1) of the GDPR states that full compensation for actual non-material damage resulting from breaches of the GDPR must take place in a manner that does justice to the objectives of the Regulation, the GDPR does not specify how the non-material damage is to be determined and calculated. However, the Court of Justice has consistently held that the damage to be compensated must be real and certain.
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Violations (1)
The cookie banner or cookie policy provides vague, incomplete, or unclear information about what cookies are used and why.
Art. 12, 13 GDPR
Related Cases (0)
No other cases found for College van burgemeester en wethouders van Harderwijk in NL
This is the only recorded case for this entity in this jurisdiction.
Similar Cases
Enforcement actions with similar violations
Details
About this data
Cite as: Cookie Fines. College van burgemeester en wethouders van Harderwijk - Netherlands (2020). Retrieved from cookiefines.eu
Last updated: