Court case C/13/770276 / HA ZA 25-1129 – Court Ruling (Netherlands, 2025)

The controller is a national newspaper that published an article reporting on the criminal conviction of the data subject for the sexual exploitation of two underage girls. The article included information about the criminal proceedings and identified the data subject by name, while omitting his surname. The data subject initiated civil proceedings against the controller, arguing that the publication unlawfully interfered with his right to privacy and data protection, in particular under Article 10 GDPR. He claimed that the disclosure of his identity and professional background made him easily identifiable and caused disproportionate reputational harm. He further argued that the offence was relatively minor and did not justify such intrusive reporting. The controller argued that it had acted within its journalistic freedom and fulfilled its duty to inform the public about serious criminal offences. It maintained that sufficient care had been taken to limit identification by omitting the data subject’s surname and that the reporting was accurate, balanced, and in the public interest. The Court rejected the data subject’s claims and held that the publication was lawful. The Court carried out a balancing exercise between the data subject’s right to respect for private life under Article 8 ECHR and the controller’s freedom of expression under Article 10 ECHR, as required when applying Article 10 GDPR. It found that the balance weighed in favour of the controller. In particular, the Court held that the article was based on accurate and established facts, namely a criminal conviction. The disclosure contributed to a debate of general public interest, as sexual exploitation of minors, especially in the context of online platforms, raises serious societal concerns, regardless of the data subject’s characterisation of the offence as “light”. The Court further considered the data subject’s professional background and found that mentioning his profession was justified, as it had been relevant in the criminal sentencing and omitting it could have led to unwarranted suspicion of others in the same profession. The Court emphasised that the right to protection of reputation cannot be relied upon where reputational damage is a foreseeable consequence of one’s own criminal conduct. Finally, the Court found that the controller had acted proportionately, that sufficient steps had been taken to limit identification, and that the overall content, form, and consequences of the publication did not require rectification or compensation.