The City Government of the Municipality Maastricht – Court Ruling (Netherlands, 2022)

The controller is the City Government of the Municipality of Maastricht. The data subject used to work for the controller. The data subject filed an access request but found the controller’s response insufficient. After the controller rejected her objection, the case was brought to the Court. The Court found that the controller violated general principles of good administration. The Court gave the controller the opportunity to rectify its mistakes and ordered the controller to make a new substantive decision on the data subject’s access request within six weeks. If the controller were to refuse access, it must explain why refusal was necessary and proportionate. The Court extended the deadline in a second interlocutory decision. In the new substantive decision, the controller provided an overview of each specific processing of the data subject‘s personal data. However, it omitted several details about the data subject, in particular about her as a former employee. The controller weighed the interests of the employee and the rights and freedoms of others and based this omission on Article 15(4) GDPR in combination with [https://wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=4&artikel=41&z=2018-05-25&g=2018-05-25 Article 41(1)(i) Implementation Act GDPR]. The controller provided the information it omitted to the Court. The Court justified the omission in an interim decision of 20 December 2021. This judgement builds on those interlocutory judgements. The Court upheld the data subject’s appeal from the contested decision because of violations of the principles of good administration, and it annulled the decision. However, it also upheld the legal consequences of the annulled part of the contested decision, as the defects of the contested decision had been remedied. Then, the Court considered the data subject’s appeal to the new substantive decision. First, the Court stipulated that Article 15(1) GDPR does not include a right to access every specific processing of personal data. An overview of the specific processing operations can be sufficient. It must, however, specify which information is processed, for which purpose, who receives the data, where it comes from, and, if possible, the envisaged storage period. Moreover, the Court considered that controllers might need to investigate the processing operations to provide all of the requested information. The Court held that this particular does not have to be reflected in the overview provided to the data subject. Second, the Court rejected the data subject's arguments that (1) a specific list was missing from the overview of processing operations, (2) the controller’s investigation was incomplete, and (3) that the controller should have kept emails which contained her personal data. The Court stated that the list the data subject referred to was legitimately omitted. Moreover, it did not follow the data subject in her argument that the controller’s investigation was insufficient because the receipt of personal data had not been registered. In this regard, the Court stipulated that the controller did not have to keep the emails it sent to its attorney that contained the data subject's personal data. Hence, the Court rejected the appeal to the new substantive decision.