Right of inspection and access under Article 15 GDPR according to the Division and the EDPB

On March 2, 2022, the Administrative Jurisdiction Division of the Council of State perpetuated the line it had taken with regard to the scope of the right of access under Article 15 of the General Data Protection Regulation (hereinafter: GDPR). New in this ruling is the reference by the Division to the draft guidelines of the EDPB on the right of inspection/right of access.

Case study
The Appellant requested the provision of a copy of the personal data processed, based on Articles 12 and 15 of the GDPR. In response, by decision of 14 October 2019, the administrative authority had provided overviews/ summary lists – the Division uses both terms – of the personal data processed, indicating to whom the data had been provided and the legal basis and purpose thereof, and copies of some documents in which personal data had been processed.

The Appellant also argued to the Division that the underlying documents should have been provided.

In this regard the Division considered, with reference to an earlier judgment of its own (ABRvS March 3rd, 2021, ECLI:NL:RVS:2021:452):

‘The obligation to provide a “copy of the personal data” (under Article 15(3) AVG; IS) therefore does not mean that an administrative body is obliged to provide a copy of the document in which the personal data is contained. An administrative body may do so, but it may also choose another form, provided that the chosen means of provision fulfills the purpose of Article 15(3) AVG – i.e. to inform itself about the processing and to check its lawfulness (see also Guidelines 01/22 of the European Data Protection Board, paragraphs 23, 150 and 153).

With regard to the method of providing the personal data described in the case, i.e. an ‘other form’, the Division considers that this is in line with the purport of Article 15 (3) AVG.

And again with a reference to the guidelines of the European Data Protection Board (EDPB; 12,14 and 152) the Division considered that Article 15 GDPR ‘For access to documents on administrative matters, [the appellant] may submit a request under the Open Government Act.’

The Division declared the appeal unfounded with respect to this and another ground of appeal not discussed here (concerning the incompleteness of the file provided).

Guidelines 01/2022 of the EDPB
A new element compared to the March 21, 2021 ruling is that the Division relies on the EDPB’s ‘Guidelines 01/2022 on data subject rights – Right of access’, a form of so-called ‘soft law’.

Personal note author:
And in my opinion, this is remarkable, since the administrative courts generally reviews ex tunc and the Guidelines were adopted by the EDPB only on January 19th, 2022 and have not yet been adopted. In addition, fundamental criticisms of these Guidelines have been voiced in the context of the consultation (closed March 11). For example, Zwenne indicates that they do not take into account rulings of national courts of member states and even contradict these rulings on some points (G.J. Zwenne, Comments dated March 9, 2022, p. 1, posted on the EDPB website).

Two helpful further interpretations of the EDPB
However, the latter does not appear to be the case when interpreting the concept of a copy of personal data. The EDPD also indicates that when a copy of personal data is provided, it need not necessarily be a reproduction of the original documents (paragraph 23).

However, the EDPB does provide two further interpretations of this concept that are relevant to this case, but which the Division does not include in its considerations.

First of all, the EDPB indicates that a copy of the personal data can be provided by a compilation that contains all personal data (‘containing all’), as long as this allows the data subject to verify the processing of the personal data and its lawfulness (paragraph 150). In doing so, the EDPB emphasizes that even if there is a ‘summary’, it should still include (‘encompass all’) the personal data covered by the right of access.

By using the words ‘compilation’, which in both English and Dutch has the meaning of composition of writings, works etc. and ‘containing/ encompassing all’, it becomes clear that when personal data are provided by a ‘summary’ (or ‘overview list’), this overview must contain the personal data themselves and not, for example, an extract or summary thereof or an overview of categories of personal data.

The EDPB also provides a clarification regarding the provision of original documents that the Division omits. Where the Division considers that the provision of original documents is ‘allowed’ and leaves it at that, the EDPB tightens this obligation by indicating that it may follow from the personal data itself that a copy of the original document must be provided. For example, in the case of a handwritten text by the data subject, since a handwriting is also personal data (paragraph 150).

Personal note author:
In my opinion, it may be confusing for legal practitioners that the Division refers to the Guidelines in order to adduce its considerations, but does not also include the mentioned interpretations of the EDPB in its considerations. This could have immediately provided the necessary clarity and/or reinforcement with respect to the considerations. Although in earlier case law rules have been formulated with regard to these subjects that largely correspond to the line chosen by the EDPB – see for example already ABRvS 1 August 2012, ECLI:NL:RVS:2012:BX3309 with regard to the provision of ‘a complete overview’ pursuant to Section 35 of the Wbp, and ABRvS 1 August 2012, ECLI:NL:RVS:2012:BX3309 Rechtbank Midden Nederland 8 December 2022, ro. 6, ECLI:NL:RBMNE:2020:5275 about when there is a claim to a copy of the original, not every legal professional will have these ready (yet). An incomplete or incorrect manner of providing the copy could be the result.

The fact that for the acquisition of administrative documents a Woo (formerly Wob) procedure is the appropriate way and not the procedure under Article 15 AVG, is an obvious point. What is remarkable, however, is that this was apparently not pointed out to the appellant earlier, for example in the decision to provide from October 2019(!), and that the Division does not find this remarkable.

 

Source:
Afdeling bestuursrechtspraak Raad van State 2 maart 2022, ECLI:NL:RVS:2022:649