Court case 202100213/1/A3 – Court Ruling (Netherlands, 2022)

Controller is the municipality of Eindhoven. The data subject found out that an email that they sent to the municipality on 15 January 2017 (in which they complained about their neighbours), had been forwarded and had ended up with their neighbours, without blacking out their email-address. Because they had not given consent for this, and the processing for personal data was not necessary to fulfil a public interest, the data subject requested the municipality to (1) rectify personal data mentioned in letters of 7 April 2016 and 14 November 2018, and (2) compensation for damages caused by forwarding their personal data without a legal basis. After the municipality had rejected the request, the data subject [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBOVE:2019:1827 brought the issue before court]. The District Court of Oost-Brabant dismissed this appeal, after which the data subject appealed this judgement before the Council of State. On appeal, the data subject argued that (1) The municipality had exceeded the decision period of one month as per Article 12(3) GDPR for their request to rectify the personal data, (2) the municipality should have also rectified personal data in the letter of 14 November 2018, and (3) The District Court had wrongly considered that the data subject was not entitled to compensation. The Council of State rejected the appeal. First, the Council stated that the municipality complied with the data subject's access request within the decision time of one month as per Article 12(3) GDPR. Second, the Council of State held that the right to rectification of personal data pursuant to Article 16 GDPR only applies to inaccuracies that can be easily and objectively ascertainable. Since the letter of 14 Novemer 2018 concerned impressions and conclusions with which data subject did not agree, the Council found that the rejection of the request for rectification was well-founded. Lastly, although it is not disputed between parties that the forwarding of email of 13 January 2017 without removing data subject's email address was unlawful, [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RVS:2020:899&showbutton=true&keyword=ECLI%3aNL%3aRVS%3a2020%3a899 the Council of State had previously considered] that a violation of the GDPR does not automatically entitle the data subject to compensation. Because the data subject could not plausibly demonstrate that the infringement caused damages, this ground of appeal was also rejected.