Nauta Dutilh – Court Ruling (Netherlands, 2021)

The controller is Nauta Dutilh, a law firm. The data subject is a former advisor of a government institution, the “House for Whistleblowers” (the House), which is a public organisation where whistleblowers can report “societal abuses” and which investigates the treatment of whistleblowers. Between September 2018 and May 2019, the data subject reported several suspicions of wrongdoings, concerning the general functioning of the House, and the appointment procedure of their chairman. On 2 May 2019, the data subject reported internal (confidential) suspicions of wrongdoings to two newly appointed board members of the House. On 21 May 2019, the data subject was suspended, after which he was formally fired on 26 July 2019. The data subject suspected that the chairman and two board members which he contacted, had been advised by the law firm Nauta Dutilh, the controller in this case. On 25 July 2019, the data subject made an access request with the controller, and requested a copy of his personal data pursuant to Article 15 GDPR. The controller confirmed that they processed his personal data (name, last name, address, email-address, and picture), but also stated that they cannot provide all information due to professional confidentiality. The data subject brought the case before Court, requesting the Court to order the controller to provide him and the Dutch DPA with a copy of all personal data relating to him and all processing thereof processed by Nauta, and all information listed in Articles 13, 14, and 15 GDPR. However, the Court considered that the controller’s professional confidentiality limits the data subject’s right of access pursuant to Article 23 GDPR, and did not find any violations. The data subject then filed an appeal. The Court of Appeal rejected the appeal. First, it confirmed the argumentation of the Court of first instance. The Court of first instance stated that the right of access can be restricted by a legislative measure pursuant to Article 2