Ministry of Finance, the Minister – Court Ruling (Netherlands, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The data subject, a former employee of the Dutch Tax and Customs Administration, requested access to his personal data under Article 15 GDPR. In response, the Ministry of Finance sent an overview of the processed data. Considering it incomplete, the data subject lodged an objection, further specifying his request. He requested email correspondence containing the user IDs of team members, the purposes for which the personal data was used, and its recipients. In its new decision dated 30 May 2024, the Ministry of Finance identified an email message containing the data subject's personal data. It partially complied by granting access to the personal data within it, but did not specify the purpose of processing and the recipients of the data. The data subject appealed the part of the decision concerning the email to the District Court. He argued that merely providing the processed personal data was insufficient and that the access right under Article 15(1) GDPR entitled him to receive information on the purpose of the processing and the recipients of this data. The controller justified its decision by arguing that the data subject asked more than what was required under Article 15(1) GDPR. It also supported its decision by referring to the restrictions under Article 23 GDPR in conjunction with Article 41 UAVG. It further contended that the information requested might not be available or reproducible to begin with. The court annulled the contested decision and ordered the Ministry to adopt a new decision. The court first distinguished between the "right of access under Article 15" and the "right of access to administrative documents". The former does not require the controller to disclose the underlying administrative documents, provided that the controller fulfils the purpose of Article 15 GDPR. The purpose of Article 15 is to enable the data subject to verify the lawfulness of the processing of their personal data. Information about the purposes of the processing
GDPR Articles Cited
National Law Articles
The data subject, a former employee of the Dutch Tax and Customs Administration, requested access to his personal data under Article 15 GDPR. In response, the Ministry of Finance sent an overview of the processed data. Considering it incomplete, the data subject lodged an objection, further specifying his request. He requested email correspondence containing the user IDs of team members, the purposes for which the personal data was used, and its recipients. In its new decision dated 30 May 2024, the Ministry of Finance identified an email message containing the data subject's personal data. It partially complied by granting access to the personal data within it, but did not specify the purpose of processing and the recipients of the data. The data subject appealed the part of the decision concerning the email to the District Court. He argued that merely providing the processed personal data was insufficient and that the access right under Article 15(1) GDPR entitled him to receive information on the purpose of the processing and the recipients of this data. The controller justified its decision by arguing that the data subject asked more than what was required under Article 15(1) GDPR. It also supported its decision by referring to the restrictions under Article 23 GDPR in conjunction with Article 41 UAVG. It further contended that the information requested might not be available or reproducible to begin with. The court annulled the contested decision and ordered the Ministry to adopt a new decision. The court first distinguished between the "right of access under Article 15" and the "right of access to administrative documents". The former does not require the controller to disclose the underlying administrative documents, provided that the controller fulfils the purpose of Article 15 GDPR. The purpose of Article 15 is to enable the data subject to verify the lawfulness of the processing of their personal data. Information about the purposes of the processing
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Ministry of Finance, the Minister in NL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Ministry of Finance, the Minister - Netherlands (2025). Retrieved from cookiefines.eu
Last updated: