College van burgemeester en wethouders van Harderwijk – Court Ruling (Netherlands, 2020)

The Dutch Council of State ruled on a claim for damages filed by a citizen whose data (name, address and residence) were processed on a forum accessed by the local authorities. This Internet forum was intended to exchange data between municipalities to prevent abuse of the Public Administration Act. The applicant involved, who filed several request to access documents, had not given his/her consent to the processing of her/his personal data on the forum and received information on the processing of these data only at a late stage of the procedure. The Council of State had to determine whether the processing of information on the internet forum access by the local authorities had a legal ground under Article 6 of the GDPR, and whether the lack of information before such processing was in line with the transparency obligations of the controller (the municipal executive of Harderwijk). The Council of State also had to rule as to whether it is competent to grant a compensation for the damage suffered by the individual and under which circumstances. The Council of State ruled that the mention the name of the applicants on the internet forum at the request of another municipality (to ensure the proper implementation of the access to document legislation and to prevent abuse of such legislation) was legitimate and allowed under Article 6 (1) (e) of the GDPR. However, the Council of State (CoS) rules that the municipality did not inform the data subject in good time, which is a violation of the GDPR. As to the claim for damages, the CoS notes that though Article 82(1) of the GDPR states that full compensation for actual non-material damage resulting from breaches of the GDPR must take place in a manner that does justice to the objectives of the Regulation, the GDPR does not specify how the non-material damage is to be determined and calculated. However, the Court of Justice has consistently held that the damage to be compensated must be real and certain.