Child Protection Board – Court Ruling (Netherlands, 2025)

The data subject requested the deletion of all his proceedings-related data stored by the child protection council. The council granted the request as to criminal investigations, but not to child protection investigations. The data subject filed a lawsuit with the Court, affirming the controller did not provide sufficient grounds for not deleting child protection investigation data. Moreover, this was accompanied by a claim for damages for deleting criminal investigation data with too big of a delay. The Court partially upheld the complaint. It agreed with the controller that child protection related data fell within the exception of Article 17(3)(b) GDPR, as it amounted to processing carried out in the public interest or in the exercise of official authority under Article 6(1)(e) GDPR. Provisions of national law sufficiently demonstrate the controller’s necessity to process personal data for the performance of its tasks in the public interest. Moreover, the controller adequately demonstrated that they were timely in the deletion of the criminal files, within a month from the request by the data subject. As such, no administrative fine was imposed by the Court. Still, the removal took place more than one year after proceedings, allowing for other government entities to consult the documents, thus causing distress in the data subject. Essentially, the controller was not proactive in the deletion of data about the criminal proceedings. Due to this, the data subject was entitled to symbolic compensation of €125.