The Board of the Eindhoven University of Technology – Court Ruling (Netherlands, 2021)

The dispute is between the data subject and the Board of the Eindhoven University of Technology (the controller). In December 2017, the data subject requested access to his personal data pursuant to Article 35 of the Personal Data Protection Act, the predecessor of the GDPR. The controller provided an overview of all personal data concerning the data subject that it had processed. According to the data subject, however, this overview was not complete. After objecting to the decision, the case ultimately ended up in Court. However, the case was suspended to provide the controller the opportunity to carry out a further search for the data subject’s personal data. On 7 January 2021, the controller submitted an additional list containing 101 emails. According to the data subject, however, this list was provided too late, and was not sorted in a way to provide a coherent overview. Moreover, the data subject claimed that a mere overview of the emails was not enough, since it was plausible that the content of these emails contained more personal data, especially considering that opinions regarding the data subject by the authors of these emails must also be regarded as personal data. In order to be able to exercise his other rights (such as rectification, erasure, or restriction of processing) he wanted copies of these emails. First, the Court considered the data subject's claim that the overview was too vague and provided too late. It stated that the formulation of the access request determines the scope of the search to be performed by the administrative body: if the request is (very) general (and not too specific), the administrative body can facilitate the request by searching for the most commonly used personal data (such as name and address details). Because the data subject formulated his request very generally and did not specify it during the objection procedure but waited until the procedure in Court, the Court concluded that the controller’s initial search for the data subject’s personal data was sufficient, and the additional list was not provided too late. Second, the Court considered that it did not follow from Article 15(3) GDPR that the data subject had a right of to access to a copy of the actual physical/digital documents in which his personal data were processed. An overview of the processed data sufficed, if this allowed the data subject to verify the accurateness and whether the processing had been compliant with the GDPR. Because the controller mainly processed name and address details of the data subject, the Court found that an overview of these personal data was enough to comply with Article 15 GDPR. In this regard, the Court noted that it did not follow from the provided overview that it was likely that the emails contained facts and opinions regarding the data subject. Hence, the Court concluded that the controller did not have to provide copies of the respective emails. Lastly, because the data subject waited until the procedure in Court to explain that he needed the copies to potentially exercise his other rights, the controller could not include this in his search and the general overview provided sufficed to comply with the access request.