The Board of Mayor and Aldermen of the Municipality of Amsterdam, Education, Youth and Care – Court Ruling (Netherlands, 2022)

The data subject was an undocumented immigrant who lived in a shelter. He invoked his right to access and requested a copy of all his personal data processed by the municipality (controller), including internal emails and messages regarding the data subject (Articles 12 and 15(1) GDPR). He also requested access to personal data which was processed by the controller's employees using certain services, for example Microsoft (Office 365 and Exchange), Facebook (Whatsapp, Messenger), Telegram and Signal. His goal was to get insight in how the controller was monitoring and assessing him, to determine, among other things, which shelter should be offered to him. The controller asked the data subject to specify his access request, to which the latter did not reply (more precisely, the data subject stated that he was not able to specify his request any further because he did not know the specifics of the processing). The controller answered the request by providing a general overview of the personal data processed and three partially anonymized copies of documents. Being not satisfied with the controller's response, the data subject filed an action before the competent court. During the procedure, the court also revealed that the data subject had already send multiple similar access requests to the same controller in the past. The court concluded that the controller's answer to the access request was sufficient. The court found that the data subject had not sufficiently specified his access request. The general nature of his request would have placed a disproportionate burden on the controller, considering the large amount of personal data processed, which would result in disproportionate amount of time and financial resources spent by the controller to search for the requested personal data. The court also considered here that the data subject had already filed multiple similar requests in the past. Also, the controller had asked the data subject to specify his requ