Court case UTR 20/268 – Court Ruling (Netherlands, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Dutch court decided that a person's alias is considered personal data under GDPR. This means companies must include aliases when responding to data access requests. The ruling clarifies what counts as personal data, helping businesses understand their obligations.
What happened
A court ruled that a person's alias is part of their personal data under GDPR.
Who was affected
Individuals who use aliases and request access to their personal data.
What the authority found
The court found that the alias used by the claimant is personal data because it can be directly linked to the individual.
Why this matters
This decision helps clarify that aliases are personal data, which could affect how businesses handle data access requests. Companies should ensure they include aliases when responding to such requests to comply with GDPR.
GDPR Articles Cited
This matter concerns a claimant’s access request which was only partially addressed. The data subject objected to the controller’s decision and argued that his request should have included information linked to his name, his alias, and internal correspondence between the defendant and its organisational unit (TOELT) relating to the processing of his asylum application. On the one side, the complainant relied on Article 12 GDPR and Article 15(1) GDPR, and referred to a judgment of [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:GHDHA:2019:2398 the Court of Appeal in The Hague] and the Nowak judgment by the CJEU in support of his interpretation of the notion of personal data. The controller, on the other side, maintained that the definition of personal data does not include internal correspondence nor the claimant’s alias. The court turned to the definition contained in Article 4 GDPR to determine whether an alias forms part of one’s personal data and declared the controller’s understanding as incorrect. The court held that “[t]his alias was used by the claimant... and can therefore be directly linked to the claimant himself.” Hence, the scope of personal data includes someone's alias. In its assessment of whether this was also the case for internal correspondence between the controller and TOELT, the court distinguished the present matter from the case law referred to by the complainant. It further noted that a CJEU judgment relied on by the controller predates the GDPR but maintains its relevance to the interpretation of the right of access and rectification. The court considered the CJEU’s reasoning, that if the applicant’s right of access were to be extended to the legal analysis of the residence permit process, it would no longer serve the purpose of the GDPR and would ensure the applicant access to administrative documents, which the GDPR does not provide for. Thus, the internal correspondence between the controller and TOELT was excluded fr
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case UTR 20/268 in NL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case UTR 20/268 - Netherlands (2021). Retrieved from cookiefines.eu
Last updated: