Veilig Thuis – Court Ruling (Netherlands, 2022)

Controller is Stichting Veilig Thuis, a public organisation that deals with cases or suspicions of (suspected) domestic violence or child abuse. The data subject is a 11-year-old child that had been missing school several times. After Veilig Thuis received reports from the data subject’s school regarding truancy, it sent the mother an email, in which it stated (among other things) that “Veilig Thuis has made the agreement with the obligatory education officer that she will contact Veilig Thuis if the safety of the child is jeopardised again or continues to be so (e.g. when you do not accept the help that is offered)”. The mother did not agree with the wording and requested to rectify the dossier, pursuant to Article 16 GDPR, by removing the word “again”. Moreover, she requested to have the whole dossier erased, pursuant to Article 17 GDPR. Veilig Thuis rejected both requests, which led the mother to [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBZWB:2021:1970&showbutton=true&keyword=C%2f02%2f381362+%2f+HA+RK+21-16 bring the matter before court]. The District Court of Zeeland-West-Brabant, however, rejected the appeal. Regarding the deletion request, it decided that it cannot be assumed that the interests of the child’s legal representative (the mother) and the child will always coincide. Moreover, it noted that Veilig Thuis had been involved with the family for some time, had concerns about the child’s school negligence. Thus, it found that Veilig Thuis had a reasonable chance to judge that the substantial interest of the child required that Veilig Thuis saved the data, and that this substantial interest of saving the data outweighed the interest of the mother to erase the data. Regarding the rectification request, the Court considered that the right to rectification is not meant to correct or remove impressions, opinions, research results and conclusions with which the person concerned does not agree. The District Court, however, did not order the mother to bear the cost of proceedings. Both the mother and Veilig Thuis appealed this judgement: the mother on the grounds that the erasure request must be honoured, and Veilig Thuis on the grounds that they should not pay their own costs of proceeding since they won the case. First, the Court of Appeal rejected the appeal. It considered that Veilig Thuis processes personal data and carries out a task in the public interest and for reasons of public health, as follows from the Dutch Social Support Act 2015 (Wmo). Therefore, Article 13(3)(b) and Article 17(3)(c) GDPR apply, and the deletion request must be assessed on basis of the Wmo. After the assessment, the Court confirmed District Court’s Decision, since it considered that the substantial interest of Veilig Thuis outweighed the interest of the mother. Second, the Court of Appeal did not order the mother to pay the cost of proceedings made both in the first instance and in the appeal proceedings. It considered that the right to an effective remedy, pursuant to Article 79 GDPR, entails that “irrespective of the outcome of the substantive side of the appeal, if a difference of opinion regarding the implementation of the [GDPR] is actually at issue.” The Court considered the height of the costs (€ 5,856.00) and found that it was disproportionate to order the mother to pay the costs of proceedings because this would preclude her right to an effective remedy.