Court case 9436020 \ CV EXPL 21-30289 – Court Ruling (Netherlands, 2022)

The data controller is a company that is building new houses in Zevenhuizen. People who were interested in buying these new houses could register as a candidate-buyer via the website of the controller. About 1100 people, including the data subject, signed up. During the registration, the controller collected confidential personal information of the data subjects (such as the first- and last name; place- and date of birth; email address; phone number; maximum amount they could borrow for the mortgage; yearly income etc.). In April 2021, the controller sent an email to everyone who registered for the project with an unencrypted Excel file attached, which contained the personal information of everyone who registered for the project. Following up on this mistake, the controller sent an email in which they acknowledge the data breach and an apologised for the violation of the privacy and security of the 1100 registered potential buyers. The data subject brought the issue before court and claimed immaterial damages from controller for unlawful processing of their personal data. The Court acknowledged that a substantial amount of personal data was leaked to all of the registered potential buyers. This is a form of processing (Article 4 GDPR) and it is unlawful since there is no ground for this processing (Article 6 GDPR). The controller had thus unlawfully processed the personal data of the data subject in breach of the GDPR. The Court explained that the loss of control over your personal data is a form of damage (Recital 85 GDPR). It also considered that the meaning of 'damage' has to be explained in line with the jurisprudence of the Court of Justice. While the controller claimed that the plaintiff had not suffered any legally relevant damages in line with Dutch civil law, the Court pointed out that Article 82 GDPR has to be interpreted in the context of EU law: the fact that the damages can't be directly quantified do not prevent the allocation of damages. The Court p