Ministry of Finance, the Minister – Court Ruling (Netherlands, 2025)

A data subject, a former employee of the Dutch Tax and Customs Administration, requested access to his personal data under Article 15 GDPR. In response, the Ministry of Finance (the controller) sent an overview of the processed data. Considering it incomplete, the data subject lodged an objection, further specifying their request. They requested email correspondence containing the user IDs of team members, the purposes for which the personal data was used, and its recipients. In its new decision dated 30 May 2024, the controller identified an email message containing the data subject's personal data. It partially complied by granting access to the personal data within it, but did not specify the purpose of processing and the recipients of the data. The data subject appealed the part of the decision concerning the email to the District Court. They argued that merely providing the processed personal data was insufficient and that the access right under Article 15(1) GDPR entitled them to receive information on the purpose of the processing and the recipients of this data. The controller justified its decision by arguing that the data subject asked more than what was required under Article 15(1) GDPR. It also supported its decision by referring to the restrictions under Article 23 GDPR in conjunction with national law (Article 41 UAVG). It further contended that the information requested might not be available or reproducible to begin with. The court annulled the contested decision and ordered the Ministry to adopt a new decision. The court first distinguished between the "right of access under Article 15 GDPR" and the "right of access to administrative documents". The former does not require the controller to disclose the underlying administrative documents, provided that the controller fulfils the purpose of Article 15 GDPR. The purpose of Article 15 GDPR is to enable the data subject to verify the lawfulness of the processing of their personal data. Information about the purposes of the processing and the recipients of the data is therefore directly relevant. The court held that the controller should have provided this information to the data subject unless it could successfully demonstrate that the restrictions under Article 23 GDPR, as implemented by national law (Article 41 UAVG), applied. Any restriction must be necessary and proportionate to the objective pursued. The court found that the controller did not explain why the restriction was necessary and proportionate. The contested decision therefore lacked due care and adequate reasoning. Lastly, owing to the duty to implement Article 15 GDPR, the controller could not simply state, without justification, that the information requested did not exist. The court annulled the decision; the Minister was ordered to reimburse the court fee of €194 and to adopt a new decision within six weeks, instead of providing a simple overview of the processed data.