Royal Dutch Aviation Association – Court Ruling (Netherlands, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Dutch court partially granted a person's request to access an incident report related to their injury during a parachute jump. The court ruled that while the person could see some personal data, the detailed incident information was confidential. This case shows the balance between personal data rights and confidentiality in sensitive situations.
What happened
A person requested access to an incident report about their injury but was denied detailed information due to confidentiality.
Who was affected
The individual who was injured during a parachute jump while training with the Royal Dutch Aviation Association.
What the authority found
The court decided that the individual could access their personal data on the cover page of the incident report but denied access to the detailed incident information due to confidentiality rules.
Why this matters
This ruling highlights the complexities of accessing personal data when confidentiality is involved. Companies should be aware of how to handle access requests while balancing privacy and confidentiality.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
On 14 May 2025 the data subject suffered an injury during a parachute jump in the context of a training programme with the Royal Dutch Aviation Association (the controller). The data subject submitted an access request under Article 15 GDPR, asking the controller to receive the incident report regarding his injury. The controller rejected this request on the grounds of confidentiality. The data subject then submitted a request to the civil court, requesting access to the incident report. He claimed that information about how the incident happened is his personal data, as it described his behaviour, and as such Article 15 applied. The controller, on the other hand, affirmed that information about the accident did not amount to personal data. It also stated the that incident report was covered by confidentiality, and it amounted to a lawful restriction of data subject rights and obligations under Article 23 GDPR. The controller further specified that if, after a thorough analysis of the report, it will deem it necessary to conduct deeper investigations on the event, then the report will be published. For the time being, it could only submit to the data subject an account of his direct personal data which is present on the cover page of the incident report, including his full name, surname, age, residence, height and weight. The court partially upheld the data subject’s request, but only as far as it concerns the direct personal data on the cover page on the incident report. It rejected the access request to the detailed information about the incident. First, it confirmed that incident data is personal data, and thus the right of access under Article 15 applied. As for the question on confidentiality, the court agreed with the argument of the controller regarding restrictions to rights and obligations under Article 23. The national GDPR implementation act (UAVG), in Article 41, specifies that access requests (among other rights) may be refused on the grounds of pr
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Royal Dutch Aviation Association in NL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Royal Dutch Aviation Association - Netherlands (2025). Retrieved from cookiefines.eu
Last updated: