The municipality of Venlo – Court Ruling (Netherlands, 2021)

Controller is the municipality of Venlo. Data subject worked for the municipality as administrative assistant until March 2017, on a temporary basis via an employment agency. During this period, the data subject made several reports of suspected wrongdoing, one of which was investigated externally by Ernst and Young, on request of the municipality executive. The data subject was reprimanded two times in 2016, for certain remarks they had made. As of 1 April 2017, the hiring of data subject was prematurely terminated. On 10 July 2018, data subject made two requests. One access request pursuant to Article 15 GDPR, and one for the disclosure of documents under the Government Information (Public Access) Act (hereafter: Wob-request). On 3 September 2018, the data subject filed another access request. In the Wob-request, the data subject asked to provide him with copies of, or to allow him to inspect, documents that directly or indirectly refer to reports he made of suspected wrongdoing, to the whistleblower process that followed two of these reports, to the two warnings he received and to the termination of his contract of employment as of 1 April 2017. In both access requests, data subject asked to provide him with copies of all documents containing personal data relating to him, or to provide him with an overview listing all documents containing his personal data and to allow him to inspect these documents. By decision of 9 October 2018, controller dismissed both access requests, but granted the Wob-request. After data subject objected to the rejection, and this objection was dismissed, the data subject brought the action before court. In their judgment of 13 February 2020, the District Court considered that an access request pursuant to Article 15 GDPR does not provide a claim to a copy of the document in which personal data are contained, insofar as the purpose of this right can be fully satisfied in another way. Moreover, it held that this provision does not give the data subject the right to receive a copy of the documents which contain his personal data, or the right to inspect these documents. The data subject appealed to this judgement. The Council of State considered that Article 15(3) GDPR is not intended to ensure access to administrative documents. It stated that this this interpretation follows the CJEU’s logic as expressed in paragraph 46 of their [https://curia.europa.eu/juris/document/document.jsf?text=&docid=155114&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=715318 judgment of the of 17 July 2014, Y.S.] The Council stated that “although this judgment deals with the right of access in Article 12 of the Privacy Directive (95/46/EC), which has been replaced by the GDPR, the purpose of the Privacy Directive corresponds to the purpose of the GDPR, namely to ensure the protection of the applicant's right to privacy with respect to the processing of data relating to him”. The Council therefore concluded that “the obligation to provide a 'copy of the personal data' pursuant to Article 15(3) GDPR does therefore not mean that an administrative body is obliged to provide a copy of the documents in which those personal data are contained”, although it may decide to do so.