Minister of Finance – Court Ruling (Netherlands, 2021)

The claimant's request for access to his personal data was rejected by the Minister of Finance (the defendant), and the claimant appealed this decision. The Minister of Finance considered the request to be too general, comparing it to a 'fishing expedition.' It argued that where a controller processes a large amount of data about a data subject (such as in this case), the data subject must specify to which information or which processing activity the request relates. The defendant draws on case law, as well as Recital 63 GDPR, which at sentence seven states: "Where the controller processes a large quantity of information concerning a data subject, the controller should be able to request that, before the information is delivered, the data subject specify the information or processing activities to which the request relates." With regard to the statutory tasks of the tax authorities, the defendant argued that the claimant can largely view and change his personal data himself by logging in to 'my tax authority' or 'my benefits' (web portals). The claimant argues that the defendant is wrong to ask him to specify his request, because this would make it impossible for him to verify what personal data is being processed. According to the claimant, there is a possibility that personal data may be processed incorrectly, incompletely and/or unlawfully without the ability to verify and rectify. The Court declared the claimant's appeal well-founded, and annulled the Minister of Finance's decision. It held that, in general, a controller may request clarification from a data subject on an access request if it processes a large amount of data. However, this does not mean that a controller can in all cases demand clarification before performing a search. In the opinion of the Court, even where a controller processes a large amount of data, it is reasonable to expect the data controller to perform a search for the "most common" personal data in the case of a generally formulated request (e.g., on the basis of a name, address, or social security number), in the "most common" data files and/or computer systems or applications. During the hearing, the defendant had argued that to search the many systems in which the Minister of Finance processes personal data, employees must log-in separately and that only a limited number of employees are authorized for some systems, such as the Fraud Signaling Facility (FSV) system. In this regard, the Court found that the defendant had insufficiently substantiated that it would not be possible to perform a search for the most common personal data in a number of the larger applications or systems. The fact that an employee must log in per system or application, or that not every tax employee has access to a system or an application, does not justify the conclusion that this requires a disproportionate effort from the Minister of Finance, without further substantiation. Accordingly, the contested decision lacks a proper statement of reasons. The Court ordered the defendant to reach a new decision in line with its ruling. The defendant therefore now either has to: further substantiate that a search for the most common personal data is not possible; or, will have to perform a search and respond to the data subject's access request accordingly. The Court denied the claimant's request to impose a penalty on the defendant, because there is no reason to assume that the defendant will not comply with the decision.