Enforcing jurisdiction
Netherlands · Geography does not establish applicable law.
Confirmed applicable legislation

Stichting BREIN – Court Ruling (Netherlands, 2022)

Court Ruling
DPA RbMidden-Nederland2 February 2022Netherlands
final
Court Ruling

Privacy enforcement record

This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.

A Dutch court ruled against a foundation that wanted an internet service provider to send warning letters to users suspected of copyright infringement. The court decided that the provider did not have permission to process the users' personal data for this purpose. This case is significant because it reinforces the need for proper legal grounds when handling personal data.

What happened

The court rejected a request for an ISP to forward copyright infringement warning letters to users.

Who was affected

Users of the ISP who were suspected of uploading copyright-infringing material.

What the authority found

The court found that the ISP lacked the necessary permit to process the users' IP addresses for sending warning letters.

Why this matters

This ruling underscores the importance of having a valid legal basis for processing personal data. Companies must ensure they comply with data protection laws when dealing with user information.

Recorded legal citations
Automatically processed
Art. 10 GDPR
Art. 35 GDPR
Art. 4(1) GDPR
Art. 5(1)(b) GDPR
Art. 6(4) GDPR
Art. 23(1)(d) GDPR
View original scraped data
Art. 4(1) GDPR
Art. 5(1)(b) GDPR
Art. 6(4) GDPR
Art. 10(GDPR)
Art. 23(1)(d) GDPR
Art. 35(GDPR)

Original imported citations before automated processing; the processing history does not establish independent verification.

National Law Articles
AI-identified
Article 1 Dutch GDPR Implementation Act (UAVG)
Article 31 Dutch GDPR Implementation Act (UAVG)
Article 32 Dutch GDPR Implementation Act (UAVG)
Article 33(2)(b) Dutch GDPR Implementation Act (UAVG)
Article 33(4)(c) and 33(5) Dutch GDPR Implementation Act (UAVG)
Decision AuthorityRb. Midden-Nederland

Source checks

Linked-source text retrieved.

Automated check recorded — 17 March 2026.

Processing notes: articles corrected, national law identified, authority corrected.

Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources

Full Legal Summary
Detailed

Stichting Brein is a foundation involved in collectively counteracting and preventing copyright infringements. Ziggo is one of the largest internet service providers (ISPs) in the Netherlands. In december 2020, Brein started the "FLU-warning campaign". The aim of this campaign was to send warning letters to holders of IP addresses of which Brein, using special software, had found that they had uploaded copyright infringing material via BitTorrent for at least two times in a span of four weeks. Since Brein only had the IP address of these uploaders, and not their name and address details, it needed the cooperation of ISPs to link an IP address to name and address details. Ziggo, however, did not want to cooperate voluntarily. Hence, in this interim relief proceeding, Brein requested the Court to order Ziggo to forward Brein's warning letters to the relevant Ziggo customers. The interim relief judge rejected Brein's request because Ziggo does not (yet) have a permit as listed in Article 33(4)(c) Implementation Act, to process the IP addresses. First, the Court noted that the IP-addresses are personal data for both Ziggo and Brein, referring to CJEU-cases Breyer and Mircom, since Brein has the legal means to force Ziggo to hand over name and address details related to a specific IP-address. Secondly, the Court considered that the IP addresses are personal relating to criminal offences, Article 10 GDPR, because copyright infringement is a criminal offence according to Article 31-33 Dutch Copyright Act. Even though there is barely any prosecution on the basis of these offences, [https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/ontwerpbesluit_dutch_filmworks.pdf the Dutch DPA has previously held] that processing of personal data of persons against whom there is a more or less well-founded suspicion of acts that infringe a copyright, must be regarded as the processing of personal data regarding criminal offences. Third, the Court marginally assessed

Outcome

Court Ruling

A ruling by a national court on a data-protection matter.

Related Cases (0)

No other cases found for Stichting BREIN in NL

This is the only recorded case for this entity in this jurisdiction.

Details

Ruling Date

2 February 2022

Authority

DPA RbMidden-Nederland

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
Automatically normalized and classified

Cite as: Cookie Fines. Stichting BREIN - Netherlands (2022). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: