Nederlands Instituut voor Forensische Psychiatrie en Psychologie (Netherlands Institute for Forensic Psychiatry and Psychology) – Court Ruling (Netherlands, 2024)

A data subject underwent psychiatrist examination within a court proceeding. The court assigned that task to Netherlands Institute for Forensic Psychiatry and Psychology (Nederlands Instituut voor Forensische Psychiatrie en Psychologie). During the examination, the Institute created the final report and additional documents, including the feedback report, which was not shared with the court. The feedback report contained, inter alia, the notes and comments of doctors performing patient's examination. The data subject filed an access request in reference to the feedback report with the Minister of Legal Protection. The Minister excluded the application of the GDPR and didn’t disclosed the data. The appeal proceedings, initiated by the data subject resulted in the dismissal of the Minister’s decision. The District Court of First Instance of Gelderland (Rechtbank Gelderland) examining the appeal found the GDPR applied to the case. However, the access request didn’t cover the personal data within the meaning of the GDPR. The data subject lodged an appeal with the Dutch Council of State (Raad van State; the Supreme Administrative Court). The court rejected the appeal. The court explained that under Article 2(2)(d) GDPR the GDPR doesn’t apply to processing of personal data within criminal proceedings. The feedback report was drafted as a part of criminal proceedings against the data subject. The purpose of the feedback report was to monitor the quality of the final report, disclosed to the court. For the court, the feedback report served then as the prosecution the criminal proceedings. Consequently, the GDPR, including Article 15, didn’t apply to the data subject’s request and the Minister was entitled to reject that request.