Royal Dutch Aviation Association – Court Ruling (Netherlands, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
On 14 May 2025 the data subject suffered an injury during a parachute jump in the context of a training programme with the Royal Dutch Aviation Association (the controller). The data subject submitted an access request under Article 15 GDPR, asking the controller to receive the incident report regarding his injury. The controller rejected this request on the grounds of confidentiality. The data subject then submitted a request to the civil court, requesting access to the incident report. He claimed that information about how the incident happened is his personal data, as it described his behaviour, and as such Article 15 applied. The controller, on the other hand, affirmed that information about the accident did not amount to personal data. It also stated the that incident report was covered by confidentiality, and it amounted to a lawful restriction of data subject rights and obligations under Article 23 GDPR. The controller further specified that if, after a thorough analysis of the report, it will deem it necessary to conduct deeper investigations on the event, then the report will be published. For the time being, it could only submit to the data subject an account of his direct personal data which is present on the cover page of the incident report, including his full name, surname, age, residence, height and weight. The court partially upheld the data subject’s request, but only as far as it concerns the direct personal data on the cover page on the incident report. It rejected the access request to the detailed information about the incident. First, it confirmed that incident data is personal data, and thus the right of access under Article 15 applied. As for the question on confidentiality, the court agreed with the argument of the controller regarding restrictions to rights and obligations under Article 23. The national GDPR implementation act (UAVG), in Article 41, specifies that access requests (among other rights) may be refused on the grounds of pr
GDPR Articles Cited
National Law Articles
On 14 May 2025 the data subject suffered an injury during a parachute jump in the context of a training programme with the Royal Dutch Aviation Association (the controller). The data subject submitted an access request under Article 15 GDPR, asking the controller to receive the incident report regarding his injury. The controller rejected this request on the grounds of confidentiality. The data subject then submitted a request to the civil court, requesting access to the incident report. He claimed that information about how the incident happened is his personal data, as it described his behaviour, and as such Article 15 applied. The controller, on the other hand, affirmed that information about the accident did not amount to personal data. It also stated the that incident report was covered by confidentiality, and it amounted to a lawful restriction of data subject rights and obligations under Article 23 GDPR. The controller further specified that if, after a thorough analysis of the report, it will deem it necessary to conduct deeper investigations on the event, then the report will be published. For the time being, it could only submit to the data subject an account of his direct personal data which is present on the cover page of the incident report, including his full name, surname, age, residence, height and weight. The court partially upheld the data subject’s request, but only as far as it concerns the direct personal data on the cover page on the incident report. It rejected the access request to the detailed information about the incident. First, it confirmed that incident data is personal data, and thus the right of access under Article 15 applied. As for the question on confidentiality, the court agreed with the argument of the controller regarding restrictions to rights and obligations under Article 23. The national GDPR implementation act (UAVG), in Article 41, specifies that access requests (among other rights) may be refused on the grounds of pr
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Royal Dutch Aviation Association in NL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Royal Dutch Aviation Association - Netherlands (2025). Retrieved from cookiefines.eu
Last updated: