Zakelijk Energie Beheer B.V. – Court Ruling (Netherlands, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Dutch court ruled that Zakelijk Energie Beheer B.V. did not properly handle a person's request to access their personal data. This case is important because it shows companies must directly respond to data access requests and be transparent about data sharing.
What happened
Zakelijk Energie Beheer B.V. failed to directly respond to a person's request to access their personal data, instead a third party replied.
Who was affected
A person who requested access to their personal data and received a response from a third party instead of the original company.
What the authority found
The court found that the company did not fulfill its obligation to directly respond to the data access request, violating GDPR requirements.
Why this matters
This case highlights the necessity for companies to directly address data access requests and maintain transparency about data sharing practices. It serves as a reminder to businesses to ensure compliance with GDPR access rights.
GDPR Articles Cited
The controller is Zakelijk Energie Beheer B.V., a company that (claims to) offer(s) customers to find the right energy provider. On 19 March 2021, the data subject was called by controller with an offer to join an “energy collective”, which he refused. On the same day, he requested the controller access to his personal information pursuant to Article 15, and to restrict the processing of his personal data pursuant to Article 18 GDPR. On 29 July 2021, the data subject received a reply to his access request. However, he received this reply from a third party, namely Regionaal Energie Beheer, which stated that it “obtained the personal data of [data subject] from marketing partners, through market research, surveys, etc.” and that, “in order to be able to offer its products and services, it needs the personal data of [data subject], for example in order to establish and maintain a relationship with him or to comply with legal obligations.” Moreover, this third party explained they share his personal data with (other) third parties and that they collected his personal data from the website https://www.enqueteloket.nl on 28 January 2021. The data subject then brought the issue before Court, and, among other things, requested the Court to order the controller to comply with the access request, to fulfil their information obligations under Article 14 GDPR, to erase his personal data, and to notify which recipients have received a notification pursuant to Article 19 GDPR. Moreover, he requested € 10,000 as compensation for his damages and the Court to refer preliminary questions to the CJEU regarding the notion of ‘damage’ in Article 82 GDPR. The District Court partially acknowledged the data subject’s claims. First, the Court considered that the data subject filed an access request with the controller, but got a response from a third party (Regionaal Energie Beheer), and not from the controller. Hence, the Court granted the data subject’s request to order the controlle
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Violations (1)
Third-party tracking cookies or scripts are loaded without obtaining prior user consent.
Art. 13, 14 GDPR
Related Cases (0)
No other cases found for Zakelijk Energie Beheer B.V. in NL
This is the only recorded case for this entity in this jurisdiction.
Similar Cases
Enforcement actions with similar violations
Details
About this data
Cite as: Cookie Fines. Zakelijk Energie Beheer B.V. - Netherlands (2022). Retrieved from cookiefines.eu
Last updated: