Plaintiff 1, Plaintiff 2, and Clara Wichmann Bureau Foundation – Court Ruling (Netherlands, 2024)

Two data subjects wanted to register as street sex workers in the prostitution zone of the municipality Nijmegen. This registration is mandatory for offering sexual services as the General Municipal Ordinance Nijmegen (“Algemene Plaatselijke Verordening Nijmegen - APV”) prohibits street prostitution in the municipality, except in designated areas. On 22 March 2022, the municipal executive (“het college”) designated a section of a street as an area where street prostitution was permitted, provided certain conditions are met. This was the designation decree (”aanwijzingsbesluit"). The conditions included mandatory registration with the mayor for street sex workers, who had to be at least 18 years old, and could either demonstrate that they were working as street sex workers in the city since 2020, or that they utilised healthcare services for street sex workers in the city since that date. On 27 and 28 April 2022, the data subjects submitted their application for registration in the new designated area to the mayor of the municipality (the controller). On 4 July 2022, the controller told the data subjects it would reject their application, to which the data subjects submitted a statement with their views to the controller. On 1 August 2022, the controller still rejected both applications, because the data subjects failed to adhere to the conditions for the registration. On 9 September 2022, the data subjects objected to the rejections together with Bureau Clara Wichmann (“Stichting Bureau Clara Wichmann – BCW”), a legal entity advocating for women's rights and combating gender discrimination. On 10 July 2023, the controller dismissed the objection. Following this, the data subjects together with BCW filed an appeal against the controller's decision at the District Court of First Instance of Gelderland ("Rechtbank Gelderland"). The data subjects argued that the registration requirement, along with the conditions attached to it, was in conflict with the GDPR and [https://eur-lex.europa.eu/eli/dir/2006/123/oj Directive 2006/123/EC on services in the internal market (Services Directive)], which regulates the provision of services within the EU. The data subjects argued that the fact that a person works as a sex worker should be considered special personal data under Article 9 GDPR. Therefore, the registration requirement processes special categories of personal data under Article 9 GDPR, which is not allowed. Moreover, the data subjects argued that the condition imposed by the mayor, which required street sex workers to demonstrate prior work experience or healthcare service usage in the municipality since 2020 was unlawful in light of the [https://eur-lex.europa.eu/eli/dir/2006/123/oj Services Directive]. The controller argued that the registration requirement complied with the GDPR, because the data subjects explicitly consented to the processing of their special personal data under Article 9 GDPR by submitting their application. The controller further argued that the registration requirement complied with the GDPR, because there was a compelling public interest that made the processing necessary, amongst other public order and the safety and well-being of street sex workers. Admissibility of the appeal The court held that BCW's appeal was inadmissible in the data subject’s appeal, because it was not directly affected by the decisions in question. The court distinguished this case from a previous ruling where BCW was considered an interested party, emphasizing that the current case involved individual decisions affecting specific individuals rather than a broader policy affecting a general or collective interest. Review of the Registration Requirement under the GDPR The court held that the registration requirement violated the GDPR for several reasons. The court dismissed the controller's argument that the data subjects explicitly consented to the processing of their special personal data under Article 9 GDPR. The court found that an application to register as street sex worker did not equate to explicit consent because the application form did not clearly indicate that such consent was given by the data subjects. Taking into account Article 4(11) GDPR, consent could not be freely given if the data subject did not have a genuine or free choice, or could not refuse or withdraw without adverse consequences. The court thus held that by requiring registration as a condition for offering sexual services as a street sex worker, street sex workers could not refuse or withdraw their consent to the processing of special categories of personal data without adverse consequences. Thus, submitting an application to be registered as street sex workers could not be regarded as providing explicit consent to the processing of special categories of personal data under Article 9 GDPR. The court also rejected the controller’s argument that the registration was lawful as there was a compelling public interest. The court found that these objectives did not necessitate the processing of special personal data, as there were alternative ways to address public order issues and provide care for street sex working without requiring registration. Compliance with the Services Directive The court agreed with the data subjects that the requirement for street sex workers to demonstrate prior work in the municipality or use of healthcare services since January 2020 was in conflict with the [https://eur-lex.europa.eu/eli/dir/2006/123/oj Services Directive]. The court held that the registration requirement amounted to a licensing system under the [https://eur-lex.europa.eu/eli/dir/2006/123/oj Services Directive]. The court further held that the condition was unjustified because it was based on the municipality’s extinction policy, which aimed to phase out street sex work. The court found that this policy objective did not constitute an "overriding reason of general interest" under the [https://eur-lex.europa.eu/eli/dir/2006/123/oj Services Directive] and was not sufficiently substantiated by concerns for public order or safety. Conclusion The court concluded that the registration requirement was non-binding because it conflicted with the GDPR. However, the court did not declare the entire Designation Decree non-binding, particularly the part that designated the location for the red-light district. The court emphasised that the decision to open the prostitution zone without a registration requirement was a policy matter for the municipal council. Thus, the the designation of the prostitution zone itself remained valid.