Ministry of Finance – Court Ruling (Netherlands, 2023)

On 15 June 2019, the data subject made an access request under Article 15 GDPR to the Dutch Fiscal Intelligence and Investigation Service (FIOD). The FIOD is a government agency in the Netherlands responsible for investigating financial crimes, and is under the administration of the Ministry of Finance. On 7 August 2019, the FIOD responded to the data subject, stating that no personal data which the GDPR applied to was being processed by them. Instead, the data subject’s data was processed under the Police Data Act, which offered no equivalent right of access as under the GDPR. The data subject challenged the FIOD’s response at a District Court. In a judgment dated 22 November 2022, the District Court dismissed the data subject’s claims on the grounds that the FIOD’s activity’s fell under Article 2(1)(d) GDPR. This Article provides that the GDPR does not apply to the processing of personal data ‘by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’ Consequently, the data subject had no right of access as the GDPR did not apply to the FIOD’s processing activities. The data subject appealed the District Court’s decision to the Council of State (Raad van State), the Netherlands’ highest administrative court. On 11 October 2023, the Council of State heard the data subject’s appeal. In the appeal, the data subject submitted that the District Court had erred in its reading of Article 2(1)(d) GDPR and should not have interpreted the Article as applying to the FIOD, as the FIOD was under the administration of the Ministry of Finance and was not a police body. As a result, the data subject argued that their data held by the FIOD fell under the GDPR’s material scope, and thus, they had a right of access to the data. The Council of State held that the District Court had correctly