Minister of Finance (Dutch Tax Administration) – Court Ruling (Netherlands, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Dutch court ordered the Tax Administration to provide a complete response to a person's data access request. The court found that the Tax Administration's limited search of its systems was not enough to meet the request. This decision highlights the importance of thorough searches for personal data when responding to access requests.
What happened
The Dutch Tax Administration failed to fully respond to a person's data access request by only searching its general system.
Who was affected
Individuals requesting access to their personal data held by the Dutch Tax Administration.
What the authority found
The court ruled that the Tax Administration did not provide a complete response to the data access request, as it failed to search all relevant systems and provide detailed information.
Why this matters
This ruling emphasizes that organizations must conduct thorough searches across all systems to fulfill data access requests. It serves as a reminder for businesses to ensure their data handling processes are robust and transparent.
GDPR Articles Cited
A data subject made an access request with the Dutch Tax Administration (the controller). The controller decided to deny the request. The data subject raised several objections against this decision, but the controller declared it unfounded. The data subject appealed this decision. The Court considered the appeal grounded and ordered the controller to fulfill the access request. Following this first decision, the controller answered the request with a general indication of the personal data it processed and for what purpose (information usually available in privacy policies). It also provided the data subject with their most commonly processed personal data. Last, the controller generally referred to Article 13(4), Article 14(5) and Article 23 GDPR for possible non-disclosure. The data subject found the answer incomplete and lodged a further appeal to the Court. In an attempt to explain why some information had not been included in the response, the controller argued that the response was based on what it could find on its general system. The other IT systems had not been searched, because there were too many and this would therefore constitute a disproportionate burden. The District Court of Rotterdam held that searching a general system was not sufficient. The Court found that the controller's view that there were too many systems was not supported by evidence, unsubstantiated, and insufficient reasoning to suffice with the limited search it conducted and that the controller's general reference to grounds for exemption in the GDPR was insufficient. The controller had therefore not complied with the data subject's request. Furthermore, the Court held that the controller should have specified purposes, recipients and sources per Article 15(1). The mere listing of the personal data found, followed with a general explanation of how the Tax Administration handles personal data was not enough. The Court held that this did not allow the data subject to verify the law
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Minister of Finance (Dutch Tax Administration) in NL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Minister of Finance (Dutch Tax Administration) - Netherlands (2023). Retrieved from cookiefines.eu
Last updated: