Regional Public Health Service (RDOG) Hollands Midden – Court Ruling (Netherlands, 2021)

The controller is the managing board of the Regional Public Health Service (RDOG) Hollands Midden. The data subject is a person who was reported anonymously to the Care and Nuisance Reporting Centre of the Municipal Health Service (GGD) Hollands Midden. This Reporting Centre discussed the report in their meeting, and decided that this was not a task for them, so they closed the file. However, controller also received a notification of this report, and registered this notification in their system by mistake. Moreover, the controller did not inform data subject about this notification. After the data subject became aware of the existence of the notification at the beginning of 2020, they wanted to find out who reported them. Hence, they filed an access request pursuant to Article 15 GDPR, after which they received a copy of the report that was made. However, because the report was anonymous, a passage containing personal data of the person who reported them, was omitted. Data subject wanted to know the identity of this person, so they could pursue further legal claims against them, and brought the action before court. The Court rejected the appeal. First, it stated that the controller wrongfully did not inform the data subject regarding the notification, violating Article 13(1) GDPR. The controller, however, had already acknowledged this, apologised to the data subject and adjusted the work process to avoid a similar situation in the future. Second, the Court considered data subject’s claim to know the identity of the person who reported them. It stipulated that the GDPR is not intended for this purpose, since the purpose of the right to access is to enable the data subject to inform themselves of the processing of their personal data and to check the lawfulness thereof. According to the Court, it is not the controller’s task to enable the data subject to improve their legal claim against another entity, via the GDPR. Moreover, the Court stated that, pursuant to Article 15(4) GDPR, the right of access cannot infringe the rights and freedoms of others, and, pursuant to Article 23(1)(i) GDPR, this right may be restricted (in brief) on account of the rights and freedoms of others. Hence, the Court found that the removal of personal data of the third parties was justified for the sake of their privacy. It even stated that the controller supplied more information than needed under the GDPR, since the mere notification that data subject’s personal data was processed, would have been sufficient.