- Enforcing jurisdiction
- Netherlands · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Court case UTR 20/268 – Court Ruling (Netherlands, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Dutch court ruled that a company did not fully address a person's request for access to their personal data, including their alias. This is important because it clarifies that aliases are considered personal data and must be included in access requests.
What happened
The court found that the company only partially fulfilled a person's request for access to their personal data.
Who was affected
A person who requested access to their personal data was affected by the company's incomplete response.
What the authority found
The court decided that the company's definition of personal data was incorrect, stating that an alias is part of personal data.
Why this matters
This ruling reinforces that companies must include all relevant personal data, including aliases, in access requests. It helps clarify the scope of personal data under GDPR.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 21 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
This matter concerns a claimant’s access request which was only partially addressed. The data subject objected to the controller’s decision and argued that his request should have included information linked to his name, his alias, and internal correspondence between the defendant and its organisational unit (TOELT) relating to the processing of his asylum application. On the one side, the complainant relied on Article 12 GDPR and Article 15(1) GDPR, and referred to a judgment of [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:GHDHA:2019:2398 the Court of Appeal in The Hague] and the Nowak judgment by the CJEU in support of his interpretation of the notion of personal data. The controller, on the other side, maintained that the definition of personal data does not include internal correspondence nor the claimant’s alias. The court turned to the definition contained in Article 4 GDPR to determine whether an alias forms part of one’s personal data and declared the controller’s understanding as incorrect. The court held that “[t]his alias was used by the claimant... and can therefore be directly linked to the claimant himself.” Hence, the scope of personal data includes someone's alias. In its assessment of whether this was also the case for internal correspondence between the controller and TOELT, the court distinguished the present matter from the case law referred to by the complainant. It further noted that a CJEU judgment relied on by the controller predates the GDPR but maintains its relevance to the interpretation of the right of access and rectification. The court considered the CJEU’s reasoning, that if the applicant’s right of access were to be extended to the legal analysis of the residence permit process, it would no longer serve the purpose of the GDPR and would ensure the applicant access to administrative documents, which the GDPR does not provide for. Thus, the internal correspondence between the controller and TOELT was excluded fr
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case UTR 20/268 in NL
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
12 January 2021
Authority
DPA RbMidden-Nederland
About this data
Cite as: Cookie Fines. Court case UTR 20/268 - Netherlands (2021). Retrieved from cookiefines.eu
Last updated: