[plaintiff] BV – Court Ruling (Netherlands, 2023)

The data subject, an asset management professional, undertook an agreement with PME Investment Services. The agreement was that the data subject would take over a housing project mediated by PME, and in return PME would be awarded a fee and a minor percentage of the subsequent sale of the apartments. However, the data subject failed to uphold the agreement. As a result, on 9 May 2018, PME filed a suit against the data subject. After a first decision, on 27 January 2021, the case was brought to the attention of the Court of Appeal of Den Haag. In those proceedings, in an attempt to avoid liability, the data subject relied on the GDPR to anonymise and redact deeds which were key to the proceedings, on the basis of Article 5(1)(c) GDPR (data minimisation). In a judgment dated 4 October 2022, the Court of Appeal of Den Haag ignored the anonymised deeds and ruled in favour of PME and made a compensation order based on calculations which did not take into account the anonymised deeds. As a result, the compensation order was significantly higher than it would have been if the anonymised deeds were taken into account. On 3 January 2023, the data subject filed an appeal against the Court of Appeal's decision to the Supreme Court of the Netherlands. The Supreme Court of the Netherlands dismissed the appeal. In their ruling, the Supreme Court clarified the relationship between the GDPR and domestic evidentiary rules in civil proceedings. The Court held that it was possible to give evidence in a manner compliant with the GDPR and confirmed the CJEU case of Norra Stockholm Bygg AB ([https://gdprhub.eu/index.php?title=CJEU_-_C-268/21_-_Norra_Stockholm_Bygg Case C‑268/21]). In that case, the CJEU held that the GDPR does not contain an absolute ban on sharing personal data in civil proceedings as that would be in conflict with the right to a fair trial in Article 6 ECHR. However, in doing so, the national court must take into account the principle of proportionality and balance the right to a fair trial and Article 5(1)(c) GDPR (data minimisation). The CJEU concluded that it is for the national courts to determine whether the provision of personal data is sufficient and pertinent to achieve the objective pursued by the applicable provisions of national law and whether that objective could not be achieved by using less intrusive evidence in order to protect the personal data of data subjects. The Supreme Court relied on the CJEU's case to determine the issue at hand and found that the plaintiff's anonymisation of the deeds were not proportionate and veered on an abuse of rights. As a result, their purported reliance on the principle of data minimisation (Article 5(1)(c) GDPR) was unfounded. The plaintiff had the opportunity to provide the relevant evidence in a GDPR-compliant manner for the calculation of compensation, and chose not to. Furthermore, the Court of Appeal had a legal basis in Dutch Law to estimate the compensation without the relevant evidence that the plaintiff decided to not provide. Accordingly, the Supreme Court dismissed the appeal.