Executive board of the municipality of Haarlem – Court Ruling (Netherlands, 2020)

Complainant has submitted a data subject access request to the executive board of the municipality of Haarlem on 24th of July 2019. On 26th of October 2019 complainant lodged an appeal in connection with a failure to take action on his request. On 20th of December 2019 the municipality made a decision on the request. On 7th of February 2020 the District Court of the Northern Netherlands declared the appeal well founded and ordered the municipality to pay a penalty of EUR 1 442 to the complainant and cover the court fee of EUR 174. The municipality has opposed to this judgement. The Court must decide whether the appeal of the complainant can be considered well-founded without a reasonable doubt. The municipality is of the opinion that the judgement of the 7th of February 2020 did not take into account the argument that the claimant was abusing his rights in order to get paid for the delayed decision on the right of access. Complainant completely ignored requests to provide additional information necessary to action the access request, such as a request for a copy of an ID. Furthermore, the complainant's letter sent to the municipality on 24th of August 2019 cannot be viewed as a penalty payment notice under Article 6:2 of the Dutch Administrative Law Act because the content of that letter doesn't make it clear what request it refers to, the municipality is not requested to make a decision within a certain period of time and the letter does not clearly state that a penalty payment will be required in the absence of such decision. The claimant is of the opinion that there was no abuse of rights; the letter constitutes a valid penalty payment notice of because the municipality hasn't disputed its validity in the previous proceedings and because penalty payment notices were allowed to be submitted in free form. The Court established that the parties were not disputing the fact that the decision on the complainant's access request under GDPR should have been take