College van burgemeester en wethouders van Leeuwarden – Court Ruling (Netherlands, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A court in the Netherlands ruled that the Municipality of Leeuwarden was right to ask a resident to verify his identity before processing his data access request. The resident had refused to provide proper identification, leading the court to support the Municipality's decision to deny the request. This case highlights the importance of identity verification in protecting personal data.
What happened
The Municipality of Leeuwarden refused to process a data access request because the resident did not verify his identity as requested.
Who was affected
A resident who wanted access to data collected by a chip card reader at his home address.
What the authority found
The court decided that the Municipality could reasonably ask for identity verification before processing the request, following GDPR guidelines.
Why this matters
This ruling underscores the need for proper identity checks when handling personal data requests, ensuring that data is not disclosed to unauthorized individuals. It serves as a reminder for organizations to have clear procedures for verifying identities in data access requests.
GDPR Articles Cited
A data subject submitted an an access request to the Municipality of Leeuwaarden concerning information on the collection, processing, and storage of data by the chip card reader attached to the waste container at his home address. The request included the following words: "Yours faithfully but with kind regards,: [appellant name]: I AM Without Prejudice UCC 1-308 Beneficiary, Authorized Agent and Representative for the legal fiction [appellant name]" In response, the Municipality asked the data subject to submit his request online and signed with his DigiD within 14 days, or to identify himself at the town hall with a valid identification document. DigiD is an identity management platform used by government agencies in the Netherlands. The Municipality explained that the request concerns personal data, which must not be provided to the wrong person, and it is therefore important to properly establish the data subject's identity. Indeed, Recital 64 GDPR states that the controller should take all reasonable steps to verify the identity of a data subject requesting access. And, following Article 12(6) GDPR, if there is reason to doubt the identity, additional information may be requested that is necessary to confirm the identity of the data subject. When the data subject did not identify himself in the way it requested, the Municipality issued a decision stating it would not consider his request. The data subject lodged an objection to this decision, which the Municipality declared unfounded. On 2 October 2020, the District Court of Northern Netherlands dismissed an appeal by the data subject regarding the Municipality's decision to reject his request. The data subject ('appellant') then appealed to the Council of State. The appellant argued that the District Court erroneously ruled that the Municipality could reasonably doubt his identity and could therefore ask him to identify himself. In particular, this is because the Municipality had previ
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for College van burgemeester en wethouders van Leeuwarden in NL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. College van burgemeester en wethouders van Leeuwarden - Netherlands (2021). Retrieved from cookiefines.eu
Last updated: