Staatssecretaris van Justitie en Veiligheid (State Secretary for Justice and Security) – Court Ruling (Netherlands, 2024)

The data subject has an Iranian nationality and applied for asylum in the Netherlands in 2016. After two applications and two appeals, the State Secretary for Justice and Security (the controller) granted the data subject asylum on 25 August 2021 and provided the data subject with a temporary asylum residence permit. On 22 September 2021, the data subjected requested access under Article 15 GDPR to their personal data that the controller processed and stored. On 22 October 2021, the controller replied to the access request and, amongst other things, provided the data subject with an overview of the disclosures of the data subject’s personal data. This showed that the controller transmitted the data subject’s personal data to, among others, the Central Agency for the Reception of Asylum Seekers (“Centraal Orgaan opvang asielzoekers - COA”) and the Repatriation and Departure Service (“Dienst Terugkeer & Vertrek - DT&V”). The data subject then objected to the processing of their personal data (specifically personal data belonging to special categories under Article 9 GDPR), namely the sharing of those data with the COA and DT&V. The controller rejected the objection of the processing on 7 December 2021. The data subject appealed this decision at the District Court of Northern Holland (“Rechtbank Noord-Holland”), and also sought damages under Article 82 GDPR for the unlawful processing of their (special categories of) personal data. The controller argued that there was no unlawful processing of (special categories of) personal data of the data subject and that the sharing of the personal data with the COA and DT&V was necessary under Article 6(1)(e) GDPR for the performance of a task carried out in the public interest or in the exercise of official authority of these agencies. The COA's tasks include providing guidance and accommodation to asylum seekers. The controller argued that this task also requires the processing of special categories of personal data under Article 9 GDPR to identify at the earliest possible stage whether the asylum seeker is a vulnerable person and needs specific support and guidance. The data subject argued that the sharing of personal data for the purpose of carrying out its duties and providing appropriate support could also be achieved by sharing no or less personal data with the COA. The controller could have also shared with the COA that the subject may need appropriate support and leave the COA to inquire what support is desired from the data subject to leave the data subject in control of what information it wants to share with the COA. The DT&V's task include implementing the return policy by customising a careful and humane departure strategy. The controller argued that it is therefore therefore of great importance that the DT&V is involved at the earliest possible stage, receiving as much (complete and verifiable) information about the foreign national as possible. Every piece of information, including special categories of personal data under Article 9 GDPR, can be important for deporting a foreign national efficiently and effectively. The data subject argued that the sharing of (sensitive) personal data with the DT&V even before a rejection decision becomes irrevocable would be unnecessary and premature. The data subject also argued that sharing of personal data with the DT&V after the data subject's asylum application was granted, was wrong as the DT&V had nothing to do with the data subject from then on as they were no longer under an obligation to leave. Unlawful processing The court found that the controller shared a large quantity of documents with the COA and the DT&V that contained both “normal” and special categories of personal data under Article 9 GDPR of the data subject. This included judgements, court rulings, a medical opinion and records of hearings. The court stated that it could follow that the tasks assigned to COA and the DT&V can be regarded as a task of (substantial) public interest as referred to in Article 6(1)(e) GDPR and Article 9(2)(g) GDPR. However, it could not understand why it was necessary for the controller to share the (special categories of) personal data with the COA and the DT&V in its entirety. The court held that the purpose for which the controller processed this data could be reasonably achieved in another, less detrimental manner. The court further held that in view of the principle of data minimisation under Article 5(1)(c) GDPR, the controller failed to substantiate why the COA’s purpose of careful reception of asylum seekers and DT&V’s purpose of the departure of aliens not eligible for residency, could only be achieved by sharing these documents with the data subject's personal data in its entirety. The court specifically took into account the sharing of personal data with the DT&V, stating that it could not understand why the sharing was necessary even before it was irrevocably established that a foreign national must leave the Netherlands. With regard to the sharing of the special personal data under Article 9 GDPR, the court held that it appeared nowhere that the controller weighed up whether the sharing of those data was proportionate in relation to the objective pursued by the sharing of those data, whether the right to the protection of personal data was respected and whether it was necessary to take appropriate and specific measures to protect the fundamental rights and interests of the data subject, as required under Article 9(2)(g) GDPR. The court therefore held that controller did not sufficiently observe the safeguards for the data processing of both 'ordinary' (Article 6 GDPR) and special categories of personal data (Article 9 GDPR). The controller’s sharing of large quantity of documents containing the data subject’s (sensitive) personal data with COA and DT&V was therefore unlawful, as there was no sufficient legal basis for this under Article 6 GDPR. This also violated the principle of data minimisation under Article 5(1)(c) GDPR. Non-material damages The court found that the data subject was entitled to compensation for non-material damages. The controller violated Articles 5, 6 and 9 GDPR and thereby violated the data subject’s right to privacy. The court found that the data subject could not substantiate the amount asked for non-material damages. Considering the circumstances of the case, including the nature, duration and seriousness of the infringement, the court set the amount of non-material damages to €500. The court saw no reason to award a higher amount in view of the fact that the sensitive personal data ended up with a group of professionals, who have a duty of confidentiality by virtue of their position, and the duration of the breach. Conclusion Thus, the court found that the controller violated Articles 5, 6 and 9 GDPR by unnecessarily sharing the data subject's personal data in its entirety with the COA and the DT&V. The court therefore ordered the controller to pay €500 in non-material damages to the data subject, and to pay the data subject’s costs of € 1.750 for the legal proceedings.