Stichting Eega Plus – Court Ruling (Netherlands, 2022)

The data subject used to work for Eega (controller), a company that guides disabled people towards employment. After termination of the data subject's employment, her employer restricted her access to the laptop as it was still in the data subject's possession. The controller filed a claim in interim relief proceedings demanding the return of the laptop. The data subject did not object to the laptop being returned. However she wanted to delete her personal data from the laptop first and invoked her right to privacy. The data subject filed a counterclaim to demand that she would be given the chance to erase her personal data from the laptop. The controller did not consider this a reasonable demand because (1) the laptop was meant for work-related purposes only (so not for storing personal information). In addition, (2) access to the laptop would give the data subject unauthorised access to its confidential work environment. The controller thus also invoked its right to protection of privacy-sensitive information. The District Court of Overijssel (Rechtbank Overijssel - Rb. Overijssel) concluded that both claims were partly justified. The controller’s claim was not fully justified, as the controller did not dispute that the laptop contained personal data of the data subject. The fact that the data subject was not allowed to put these data on the laptop was irrelevant. It was still personal data within the meaning of the GDPR and therefore protected by this Regulation. The data subject’s counterclaim was not fully justified, as granting her access to the laptop would give her access to the controller’s digital work-environment. This contained personal data for which the controller was responsible (other employees, clients). The Court held that the solution must be found in the middle. The Court proposed that laptop would be taken to the controller. Someone other than the data subject or the controller could then erase the data subject's personal data from the laptop. The data subject may be present during this process.