Staatssecretaris van Justitie en Veiligheid (State Secretary for Justice and Security) – Court Ruling (Netherlands, 2024)

The data subject has an Iranian nationality and applied for asylum in the Netherlands in 2016. After two applications and two appeals, the State Secretary for Justice and Security (the controller) granted the data subject asylum on 25 August 2021 and provided the data subject with a temporary asylum residence permit. On 22 September 2021, the data subjected requested access under Article 15 GDPR to their personal data that the controller processed and stored. On 22 October 2021, the controller replied to the access request and, amongst other things, provided the data subject with an overview of the disclosures of the data subject’s personal data. This showed that the controller transmitted the data subject’s personal data to, among others, the Central Agency for the Reception of Asylum Seekers (“Centraal Orgaan opvang asielzoekers - COA”) and the Repatriation and Departure Service (“Dienst Terugkeer & Vertrek - DT&V”). The data subject then objected to the processing of their personal data (specifically personal data belonging to special categories under Article 9 GDPR), namely the sharing of those data with the COA and DT&V. The controller rejected the objection of the processing on 7 December 2021. The data subject appealed this decision at the District Court of Northern Holland (“Rechtbank Noord-Holland”), and also sought damages under Article 82 GDPR for the unlawful processing of their (special categories of) personal data. The controller argued that there was no unlawful processing of (special categories of) personal data of the data subject and that the sharing of the personal data with the COA and DT&V was necessary under Article 6(1)(e) GDPR for the performance of a task carried out in the public interest or in the exercise of official authority of these agencies. The COA's tasks include providing guidance and accommodation to asylum seekers. The controller argued that this task also requires the processing of special categories of personal data under Arti