Court case 22/4916 – Court Ruling (Netherlands, 2023)

A data subject had submitted an access request to the Board of Public Prosecutor’s office seeking to obtain information about any personal data about him being processed by the Board. The Board, as a defendant, treated his request as a general access request under Article 15 GDPR and [https://wetten.overheid.nl/BWBR0014194/2023-11-01 Article 39(i) Judicial and Criminal Records Act (Wet justitiële en strafvorderlijke gegevens - WJSG]). Under [https://wetten.overheid.nl/BWBR0014194/2023-11-01 Article 39(i) of the WJSG], data subjects have the right to request the Board to obtain confirmation as to whether criminal records about them is being processed and, if so, to obtain information about the processing thereof. On 31 August 2022, the Board thus provided the data subject with two separate documents, one regarding the criminal records about him that were being processed under the WJSG and the other containing all other personal data about him being processed under the GDPR. The data subject, the plaintiff claimed that the response was incomplete. The defendant thus asked him to substantiate his request and the data subject answered that he wished to receive all data concerning him that was being processed. The defendant then added additional personal data and criminal records of the plaintiff that were found in its database. Still unsatisfied with the response, the plaintiff appealed against the judgment. The court issued its final judgment on 20 September 2023 and held that, since the access request by the data subject was drafted in general terms and had a broad scope, the defendant correctly replied with a general overview of the personal data and criminal records about him being processed. The plaintiff objected to this response and the defendant asked him to specify his request in line with Recital 63 GDPR. As the plaintiff again answered in general terms, claiming he requested access to all his personal data, the court held that the defendant was right in replying in broad terms too. When the plaintiff substantiated his request at the appeal hearing, mentioning specific data he wished to have access to, the court held that it was too late and he should have mentioned this at the time of objection or submit a new request. Further, upon hearing the defendant on its search operations, the court held that the defendant did carry out a sufficiently complete research when looking for the plaintiff’s personal data in its possession. As regards the provision of copies of personal data of the plaintiff under Article 15(3) GDPR, making reference to CJEU C-487/21, the court specified that a right to obtain a copy of one’s personal data does not constitute an obligation for an administrative body to provide copies of documents entailing the data subject’s personal data. The latter can choose to provide an understandable reproduction of such data as long as a copy of the documents is not indispensable for the data subject to exercise his rights under the GDPR. The court held in this respect, that the plaintiff did not make it clear in his request that the data was indispensable for him to exercise his rights, hence the defendant was not bound to provide him with a copy of his personal data. As regards the plaintiff’s criminal records, the court also held that he had no right to obtain a copy thereof under the WJSG. In light of the above, the court declared the appeal to be unfounded as the defendant had answered in a complete and clear manner to the plaintiff’s access request.