Minister for Legal Protection – Court Ruling (Netherlands, 2022)

The controller was the Minister for Legal Protection. The 2 data subjects have been in a relationship since 2020 and are expecting a baby. On February 2021, they were investigated because they were expecting a baby by the Child Care and Protection Board (RvdK), after a Request for Investigation (VTO) from Child Protection Overijssel (JBOV). The RvdK made a report following this request. The report included two attachments, containing a timeline from June 2013 to November 2020, and a forensic psychological investigation of data subject 1. On March 2021, the data subjects requested the controller to erase the attachments, as they were in their view no longer relevant. They concerned information on data subject 1, her ex-partner and the children they have together. They argued that this was separate from the investigation regarding the baby they were expecting. Moreover, they stated that the JBOV promised them orally to leave the past alone. The controller denied this request, as the RvdK needed the information for the exercise of its statutory task of public interest. The data subjects objected this decision, which the controller declared unfounded. The data subjects then filed an appeal at the court. In the appeal, the data subjects stated that there were no compelling legitimate grounds to process the attachments, that outweigh their interests. They argued that processing cannot be necessary, as the information is seriously outdated and obsolete. They also argued that retention of the data is not important with respect to the RvdK's task of public interest. They felt that it was disproportionately invasive of their privacy for the purpose served. The controller contested these arguments and stated that the importance of conducting a proper investigation outweighed the invasion of the data subjects' privacy. The Court stated that while the attachments relate to the past, this did not make them outdated. It followed that they contained information on data subject 1's parenting skills, which may be of importance to the current investigation. The fact that they also contained information about her ex-partner did not change this. The Court held that processing the personal data in question was necessary for fulfilling the task of public interest of the RvdK (Article 17(3) GDPR). Therefore, the controller did not have to comply with the request for erasure (Article 17(1) GDPR). The Court held that the appeal was unfounded and upheld the challenged decision.