Data Subject versus The State Secretary for Justice and Security, on behalf of the Child Protection Council – Court Ruling (Netherlands, 2025)

On 24 January 2023, the data subject made a rectification request to the State Secretary for Justice and Security (controller), regarding a report drafted by the Dutch Child Protection Board (Raad voor de Kinderbescherming, RvdK). The report contained the results of a professional assessment of the data subject’s parenting capacity, contributing to the subsequent placement of the child under the supervision of child protection services and out of the data subject’s custody. The data subject argued that the report contained factual inaccuracies, misleading terminology (such as “psychiatric issues”, “substance use”), and painted an incorrect picture of her due to the absence of important events in the timeline of the report. In 16 November 2023, the controller rejected the rectification request. It claimed that the contested data did not qualify as personal data under the GDPR because they were impressions and opinions that had been received in connection with the RvdK's investigation. The data subject made an objection to the decision of the controller. After the reassessment of the request, some terms were adjusted, e.g. “psychiatric issues” was replaced with “psychological issues”. However, the controller rejected the request in part, maintaining that much of the content reflected professional impressions or third-party statements, mainly the opinion of the father of the child, not subject to rectification under Article 16 GDPR. The data subject filed an appeal before the court of first instance (District Court of Midden-Nederland) against the controller regarding the partial rejection of his request. The court found that the disputed data did not meet the threshold for rectification. It held that, from settled case law by the highest administrative court, it follows that not all inaccuracies are eligible for correction under Article 16 GDPR. The inaccuracies must be easy and objective to determine to qualify for rectification. The court held that the controller was not obliged to amend the report to include certain events mentioned by the data subject or make adjustments to the timeline of the report, because part of the data did not constitute personal data (whether letters/emails have been sent) or others were personal data of third parties (the father's). For the rest, the court found that the desired adjustments regarded impressions, opinions, research results and conclusions of the father, the RvdK and other professionals, which are not eligible for rectification under Article 16 GDPR. The court also found that the term “substance use” is not incorrect, even though the data subject claimed that it was a one-time use and there has been no addiction at this time, because the inaccuracy of this third-party statement is not easy and objective to determine. The court dismissed the appeal as unfounded and found the controller’s refusal to correct other parts of the report lawful, under Article 16 GDPR.