Court case ROT 19/3036 – Court Ruling (Netherlands, 2021)

The controller engaged DEX Online Services to automate its membership administration, which contained personal data of the plaintiff. He also offered its members the opportunity to use the Yogibit app to gain access to their own data, so that they can, for example, deregister and register for lessons. On January 30, 2019, the plaintiff filed a complaint with the Dutch DPA against the controller. The DPA rejected the complaint by decision of 27 February 2019, because it found no obvious violation of the GDPR . Plaintiff has objected to this rejection. According to the DPA, both the controller and DEX Online Services have complied with the claimant's request for removal within the meaning of Article 17 of the GDPR. The controller has a valid basis for the processing of the plaintiff's personal data and it has not been shown that his personal data has been processed in the YogiBit app. In appeal, the plaintiff argues that the controller should have first explicitly requested permission from him before his personal data would be provided to DEX Online Services. According to the plaintiff, the defendant has forgotten to look at the definition of 'consent', as set out in Article 4 (11) of the GDPR . Additionally, it was not necessary for the controller to enable DEX Online Services for its student administration. According to the plaintiff, the controller could also have chosen to hire a secretary. In addition, the plaintiff stated that as a free EU citizen he has the right to choose whether he wants to go along with the choice of the controller for that third party. Plaintiff argued that it was up to DEX Online Services to ascertain that the controller complied with the conditions set out in Article 6 of the GDPR . In his view, on the basis of Article 5(2) GDPR the controller has an accountability obligation and must be able to demonstrate compliance with Article 5, first paragraph, of the GDPR . The plaintiff argued that the decision did not provide evidence of such com