Minister of Health, Welfare, and Sport – Court Ruling (Netherlands, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
In 2021, two data subjects requested the deletion of their personal data related to their Covid-19 vaccination records and Covid-19 personal data held at the National Institute of Public Health and the Environment. The controller, the Minister of Public Health, Welfare and Sport, provided them with two options to confirm their identity: by sending either a scan of their passport or by physically identifying themselves before the Ministry. The data subjects did not use either option and the controller subsequently rejected their requests. The data subjects filed a complaint before the court of first instance. The court ruled that the minister was justified in dismissing the objections as unfounded. It ruled that the minister was entitled to disregard the requests on the ground that the identity of the persons concerned could not be established. Plus, while the Covid-19 measures were still in effect, deletion of the vaccination data would make it impossible for an individual to prove that they where vaccinated via the government application for Covid-19. The data subjects appeal the decision of the court of first instance before the Council of State. The data subjects argued that the identification options given by the minister were unreasonable since by sharing a copy of their passports they incurred many risks. Second, physical identification at the Ministry unreasonably burdens the data subject. Third, they proposed the alternative to be identified with the last three digits of their BSN, combined with telephone verification. First, the court stated that the controller should take all reasonable measures to verify the identity of a data subject who is making a request referred to in Articles 15 to 21 GDPR and can request further information regardless of whether he has doubts about the identity (Article 12(6) GDPR and https://gdpr-info.eu/recitals/no-64/ Recital 64). Furthermore, the court ruled that the minister had discretion to the manner in which it es
GDPR Articles Cited
In 2021, two data subjects requested the deletion of their personal data related to their Covid-19 vaccination records and Covid-19 personal data held at the National Institute of Public Health and the Environment. The controller, the Minister of Public Health, Welfare and Sport, provided them with two options to confirm their identity: by sending either a scan of their passport or by physically identifying themselves before the Ministry. The data subjects did not use either option and the controller subsequently rejected their requests. The data subjects filed a complaint before the court of first instance. The court ruled that the minister was justified in dismissing the objections as unfounded. It ruled that the minister was entitled to disregard the requests on the ground that the identity of the persons concerned could not be established. Plus, while the Covid-19 measures were still in effect, deletion of the vaccination data would make it impossible for an individual to prove that they where vaccinated via the government application for Covid-19. The data subjects appeal the decision of the court of first instance before the Council of State. The data subjects argued that the identification options given by the minister were unreasonable since by sharing a copy of their passports they incurred many risks. Second, physical identification at the Ministry unreasonably burdens the data subject. Third, they proposed the alternative to be identified with the last three digits of their BSN, combined with telephone verification. First, the court stated that the controller should take all reasonable measures to verify the identity of a data subject who is making a request referred to in Articles 15 to 21 GDPR and can request further information regardless of whether he has doubts about the identity (Article 12(6) GDPR and https://gdpr-info.eu/recitals/no-64/ Recital 64). Furthermore, the court ruled that the minister had discretion to the manner in which it es
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Minister of Health, Welfare, and Sport in NL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Minister of Health, Welfare, and Sport - Netherlands (2025). Retrieved from cookiefines.eu
Last updated: