Royal Dutch Aviation Association – Court Ruling (Netherlands, 2025)

On 14 May 2025 the data subject suffered an injury during a parachute jump in the context of a training programme with the Royal Dutch Aviation Association (the controller). The data subject submitted an access request under Article 15 GDPR, asking the controller to receive the incident report regarding his injury. The controller rejected this request on the grounds of confidentiality. The data subject then submitted a request to the civil court, requesting access to the incident report. He claimed that information about how the incident happened is his personal data, as it described his behaviour, and as such Article 15 applied. The controller, on the other hand, affirmed that information about the accident did not amount to personal data. It also stated the that incident report was covered by confidentiality, and it amounted to a lawful restriction of data subject rights and obligations under Article 23 GDPR. The controller further specified that if, after a thorough analysis of the report, it will deem it necessary to conduct deeper investigations on the event, then the report will be published. For the time being, it could only submit to the data subject an account of his direct personal data which is present on the cover page of the incident report, including his full name, surname, age, residence, height and weight. The court partially upheld the data subject’s request, but only as far as it concerns the direct personal data on the cover page on the incident report. It rejected the access request to the detailed information about the incident. First, it confirmed that incident data is personal data, and thus the right of access under Article 15 applied. As for the question on confidentiality, the court agreed with the argument of the controller regarding restrictions to rights and obligations under Article 23. The national GDPR implementation act (UAVG), in Article 41, specifies that access requests (among other rights) may be refused on the grounds of protecting public safety. Reference was also made to Regulation 376/2014 on aviation safety, requiring the strict application of the rules on confidentiality in the reporting of incidents. Information collected on incidents cannot be used for purposes other than improving aviation safety, and not to determine faults or liability. Based on this, the court agreed that confidentiality interests outweighed the data subject’s right to access. The court ordered the controller to provide access to the personal data of the data subject that is present on the cover page of the report. The remaining part of the data subject’s request was rejected.