Court case C/05/404834 / HA ZA 22-245 – Court Ruling (Netherlands, 2022)

The controller advises and guides companies on matters such as brand positioning, corporate identity, business models and revenue models. The data subject had a business that facilitates spaces for retreats, trainings and workshops. The controller believed that the data subject wrongfully failed to pay its invoice, and it claimed payment of the invoice, among other things. The data subject disputed this and refused to pay the additional invoices. Therefore, the controller took the matter to court. To substantiate their defence, the data subject requested the Court to order the controller to provide digital copies of all recordings it made of conversations and (Zoom) video conferences between them, pursuant to article 843a of the Code of Civil Procedure (CCP) and/or Article 15 GDPR. The data subject stated that during the Zoom-calls, they were notified by an on-screen notification at the beginning of the call that it would be recorded. Concerning the data subject's claim under Article 15 GDPR, the Court noted that the controller stated, with reasons, that a significant portion of the requested recordings could not be provided, because they did not exist. The Court held that it was the data subject's responsibility to assert and provide evidence that the controller actually had these recordings available. The data subject, however, did not provide such evidence. The Court deemed it not plausible that the controller had more recordings at its disposal than it claimed to have, and rejected the claim under Article 15 GDPR on this point. Regarding the residual recordings, the Court pointed out that Article 15(3) GDPR gives the data subject the right to be provided with a copy of the personal data being processed. The Court followed that this right does not automatically entitle a data subject to access a copy or transcript of the original document on which their data is recorded. For example, a data subject is not entitled to the latter, in so far as the objective pursued by that right of access can be fully satisfied by another form of provision (CJEU 17 July 2014, [https://curia.europa.eu/juris/document/document.jsf;jsessionid=631861F6D8464B82ECD05BDA33A08736?text=&docid=155114&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=1904724 ECLI:EU:C:2014:2081]). The Court recalled that, in its defence against the counterclaim, the controller stated that if the data subject wanted to know if and what personal information it stored relating to them, they could have sent an access request to the controller. The Court came to the conclusion that the data subject did not request such access to their data prior to their claim. Moreover, the data subjects did not substantiate that they were not able to check whether their personal data was correct and lawfully processed by relying on the rules in Article 15 GDPR. In addition, the court concluded that the data subject did not clarify their intent to safeguard the rights of others whose personal data was also processed in the conversation. Hence, the controller could not provide the data subjects access to the full Zoom conversations. In other words, the Court held that the GDPR does not oblige the controller to provide the defendants with access to the records to the extent claimed by the data subjects. The Court thus also rejected this claim. Therefore, The Court denied the data subjects’ claim based on Article 15(3) for the access to the Zoom-call recordings. The Court did grant the data subject's claim under article 843a CCP for two Zoom calls.