Authoriteit Persoonsgegevens – Court Ruling (Netherlands, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Dutch court reviewed a case where the Dutch Tax Authority delayed responding to a person's request for their personal data. The court found that the Tax Authority didn't meet the GDPR's time limit for responding to data access requests. This case underscores the importance of timely responses to data access requests under GDPR.
What happened
The Dutch Tax Authority delayed responding to a person's request for access to their personal data.
Who was affected
A person who requested access to their personal data from the Dutch Tax Authority.
What the authority found
The court found that the Tax Authority violated GDPR by not responding to the data access request within the required time limit.
Why this matters
This ruling highlights the importance of meeting GDPR deadlines for data access requests. Organizations should ensure they have processes in place to respond promptly to such requests.
GDPR Articles Cited
On 17 May 2020, the data subject exercised their right of access (Article 15 GDPR) at the Dutch Tax Authority, de belastingdienst (controller). The controller refused to provide access to the relevant files, which lead the data subject to file a complaint with the Dutch DPA on 17 June 2020. On 25 March 2021, the DPA rejected the complaint of the data subject. The reason for the rejection was not specified in this decision. On 2 November 2021, the data subject appealed the decision. According to Dutch administrative law, the DPA itself had to assess this appeal (in Dutch: bezwaar). On 3 May 2022, the DPA requested the controller to provide information regarding the data subject to assess this appeal. The controller replied on the same day and provided details about ongoing financial procedures between the controller and the data subject. On 2 June 2022, the controller made a decision regarding the data subject's access request. It is not clear from this ruling if the controller provided access and if so, in what from. On 11 July 2022, the DPA agreed with the appeal of the data subject and warned the controller for not answering the access request within the time limit, in violation of Article 12(3) GDPR. The data subject, who was apparently not satisfied, appealed this decision to the District court of Den Haag (in Dutch: Beroep). On 18 October 2022, the data subject filed another complaint with the DPA against the controller because it provided information to the DPA on 3 May 2022. In his appeal, the data subject filed claims against both the DPA and the tax authority. Regarding his claim against the controller, the data subject stated that the controller never informed him about its decision of 2 June 2022 regarding the access request. The data subject claimed a compensation of €25,000. Regarding his claim against the DPA, he stated that the DPA did not properly execute its tasks under the GDPR. For this, the data subject requested €25,000 for imma
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Authoriteit Persoonsgegevens in NL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Authoriteit Persoonsgegevens - Netherlands (2023). Retrieved from cookiefines.eu
Last updated: