Rijkeboer – CJEU Judgment (European Union, 2009)

Mr. Rijkeboer requested the Board of Aldermen of Rotterdam (“the College”) to notify him of all the personal data related to him that the local authority disclosed to third parties in the two years prior. It also asked to have access to the identity of these third parties and to the content of the data disclosed to them. In particular, he wanted to know who had access to his address. The College complied only partially with this request by notifying him only of the data processed within the last year from his request. This was done in compliance with [https://wetten.overheid.nl/BWBR0006723/2014-01-01 Article 103(1) Wet GBA]. Always according to [https://wetten.overheid.nl/BWBR0006723/2014-01-01 Article 110 Wet GBA], the data related to Mr. Rijkeboer dating prior to the ones disclosed to him were erased. The question referred to the CJEU was whether the restriction laid out in the Wet GBA on the communication of data to one year prior to the relevant request compatible with [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 12(a) Dir.95/46] whether or not read in conjunction with [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 6(1)(e) Dir.95/46] and the principle of proportionality?’ [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 6(1)(e) Dir.95/46] requires Member States to ensure that personal data is kept for no longer than necessary for the purpose for which the data were collected. [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 12(a) Dir.95/46] provides data subjects with the right to access their personal data and to information on the recipients of those data, without setting a time-limit. THE CJEU considered that Mr. Rijkeboer’s claims concerns two different categories of data: 1. Personal data kept by local authority on a person, such as name and address, which is “basic data”; 2. Information on recipients or categories of recipients to whom those basic data are disclosed and on the content thereof, and thus relates to the processing of personal data. While for the first category, Dutch law imposes no limitation on storage, for the second category, the time limit for storage is 1 year. To determine whether [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 12(a) Dir.95/46] authorises such time limit, the CJEU shall interpret such a provision in light of the purposes of [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Dir.95/46], which is to protect the fundamental rights and freedoms of individuals. [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 12(a) Dir.95/46] is instrumental to protecting such right as it allows the practical effect of the rights laid out in [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Dir.95/46]. Thus, the CJEU considers that the right of access laid out in [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 12(a) Dir.95/46] must of necessity related to the past. If that was not the case, the data subject would not be in a position to effectively to exercise his right to have data presumed unlawful or incorrect rectified, erased or blocked or to bring legal proceedings and obtain compensation for the damage suffered. The question that arises concerns the scope of this right in the past. The CJEU considered that Member States have some freedom of action when implementing [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Dir.95/46] (C-101/01 Lindqvist §84), which is however not unlimited. More specifically, [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 12(c) Dir.95/46] expressly provides for an exception to the obligation on the controller to notify third parties to whom the data have been disclosed of any correction, erasure or blocking, namely, where this proves impossible or involves a disproportionate effort. Thus it is for the Member States to fix a time-limit for storage of information on the recipients or categories of recipient of personal data and on the content of the data disclosed and to provide for access to that information which constitutes a fair balance between the interest of the data subject in protecting his privacy and the burden which the obligation to store that information represents for the controller. The CJEU held that, in the case at hand, rules limiting the storage of information on the recipients or categories of recipient of personal data and on the content of the data disclosed to a period of one year and correspondingly limiting access to that information, while basic data is stored for a much longer period, do not constitute a fair balance of the interest and obligation laid out in [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 12(a) Dir.95/46.] Thus, the time limit of one year imposed by [https://wetten.overheid.nl/BWBR0006723/2014-01-01 Article 110 Wet GBA] is not in line with the objective and purposes of [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Dir.95/46].