Enforcing jurisdiction
Netherlands · Geography does not establish applicable law.
Confirmed applicable legislation
Privacy topics

Court case UTR 20/268 – Court Ruling (Netherlands, 2021)

Court Ruling
DPA RbMidden-Nederland12 January 2021Netherlands
final
Court Ruling

Privacy enforcement record

This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.

A Dutch court ruled that a company did not fully address a person's request for access to their personal data, including their alias. This is important because it clarifies that aliases are considered personal data and must be included in access requests.

What happened

The court found that the company only partially fulfilled a person's request for access to their personal data.

Who was affected

A person who requested access to their personal data was affected by the company's incomplete response.

What the authority found

The court decided that the company's definition of personal data was incorrect, stating that an alias is part of personal data.

Why this matters

This ruling reinforces that companies must include all relevant personal data, including aliases, in access requests. It helps clarify the scope of personal data under GDPR.

Recorded legal citations
Automatically processed
Art. 4 GDPR
Art. 12 GDPR
Art. 15 GDPR
View original scraped data
Art. 4(GDPR)
Art. 12(GDPR)
Art. 15(GDPR)

Original imported citations before automated processing; the processing history does not establish independent verification.

Decision AuthorityRb. Midden-Nederland

Source checks

Secondary-source text retrieved.

Automated check recorded — 21 March 2026.

No issues were reported by that automated check.

Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources

Full Legal Summary
Detailed

This matter concerns a claimant’s access request which was only partially addressed. The data subject objected to the controller’s decision and argued that his request should have included information linked to his name, his alias, and internal correspondence between the defendant and its organisational unit (TOELT) relating to the processing of his asylum application. On the one side, the complainant relied on Article 12 GDPR and Article 15(1) GDPR, and referred to a judgment of [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:GHDHA:2019:2398 the Court of Appeal in The Hague] and the Nowak judgment by the CJEU in support of his interpretation of the notion of personal data. The controller, on the other side, maintained that the definition of personal data does not include internal correspondence nor the claimant’s alias. The court turned to the definition contained in Article 4 GDPR to determine whether an alias forms part of one’s personal data and declared the controller’s understanding as incorrect. The court held that “[t]his alias was used by the claimant... and can therefore be directly linked to the claimant himself.” Hence, the scope of personal data includes someone's alias. In its assessment of whether this was also the case for internal correspondence between the controller and TOELT, the court distinguished the present matter from the case law referred to by the complainant. It further noted that a CJEU judgment relied on by the controller predates the GDPR but maintains its relevance to the interpretation of the right of access and rectification. The court considered the CJEU’s reasoning, that if the applicant’s right of access were to be extended to the legal analysis of the residence permit process, it would no longer serve the purpose of the GDPR and would ensure the applicant access to administrative documents, which the GDPR does not provide for. Thus, the internal correspondence between the controller and TOELT was excluded fr

Outcome

Court Ruling

A ruling by a national court on a data-protection matter.

Related Cases (0)

No other cases found for Court case UTR 20/268 in NL

This is the only recorded case for this entity in this jurisdiction.

Details

Ruling Date

12 January 2021

Authority

DPA RbMidden-Nederland

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
Automatically normalized and classified

Cite as: Cookie Fines. Court case UTR 20/268 - Netherlands (2021). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: