The Board of Mayor and Aldermen of the Municipality of Amsterdam, Education, Youth and Care – Court Ruling (Netherlands, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An undocumented immigrant in Amsterdam asked for all his personal data from the municipality but didn't specify his request enough. The court decided the municipality's response was adequate because the request was too broad and burdensome. This case shows the importance of clearly specifying data requests to avoid overwhelming organizations.
What happened
An undocumented immigrant requested all his personal data from the Amsterdam municipality without sufficient detail.
Who was affected
The undocumented immigrant living in a shelter who requested access to his personal data.
What the authority found
The court found that the municipality's response was sufficient because the data request was too broad and would have been too burdensome to fulfill.
Why this matters
This ruling highlights the need for individuals to clearly specify their data requests to avoid placing an undue burden on organizations. It underscores the balance between data access rights and practical limitations for data controllers.
GDPR Articles Cited
The data subject was an undocumented immigrant who lived in a shelter. He invoked his right to access and requested a copy of all his personal data processed by the municipality (controller), including internal emails and messages regarding the data subject (Articles 12 and 15(1) GDPR). He also requested access to personal data which was processed by the controller's employees using certain services, for example Microsoft (Office 365 and Exchange), Facebook (Whatsapp, Messenger), Telegram and Signal. His goal was to get insight in how the controller was monitoring and assessing him, to determine, among other things, which shelter should be offered to him. The controller asked the data subject to specify his access request, to which the latter did not reply (more precisely, the data subject stated that he was not able to specify his request any further because he did not know the specifics of the processing). The controller answered the request by providing a general overview of the personal data processed and three partially anonymized copies of documents. Being not satisfied with the controller's response, the data subject filed an action before the competent court. During the procedure, the court also revealed that the data subject had already send multiple similar access requests to the same controller in the past. The court concluded that the controller's answer to the access request was sufficient. The court found that the data subject had not sufficiently specified his access request. The general nature of his request would have placed a disproportionate burden on the controller, considering the large amount of personal data processed, which would result in disproportionate amount of time and financial resources spent by the controller to search for the requested personal data. The court also considered here that the data subject had already filed multiple similar requests in the past. Also, the controller had asked the data subject to specify his requ
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for The Board of Mayor and Aldermen of the Municipality of Amsterdam, Education, Youth and Care in NL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. The Board of Mayor and Aldermen of the Municipality of Amsterdam, Education, Youth and Care - Netherlands (2022). Retrieved from cookiefines.eu
Last updated: