The Personal Data Authority ("AP"), the Dutch privacy watchdog, has received a lot of media attention since the General Data Protection Regulation ("AVG") went into effect last May 25. A common criticism is that the AP has lagged behind in sanctioning privacy law violations since its expanded fining powers in 2016. For example, its British counterpart ICO publishes several times a month about sanctioning decisions it has made.
Days after reports of a governance crisis within the AP, on August 9, the AP published the imposition and collection of an order under penalty at Theodoor Gilissen Bankiers ("TGB"), now called InsingerGilissen Bankiers. The timing is notable because the order under penalty was imposed more than one year ago.
The AP collected €48,000 in penalty payments from TGB in 2017. The AP took this action after TGB refused to cooperate with a request for inspection from one of its customers in 2016. In doing so, TGB violated (at the time) Article 35 of the Personal Data Protection Act ("Wbp"), now Article 15 of the AVG. The customer asked TGB for access to his personal data, including chat messages with TGB employees and internally issued instructions on the arrangements to be made with the customer.
After TGB's rejection, the customer tried to enforce his right of inspection before the District Court in The Hague. The court rejected this request on the grounds that the customer was abusing his right of inspection. The customer was in fact using the right of inspection to gather evidence for long-term liability proceedings between TGB and the customer.
Following TGB's rejection, the customer also sought to enforce its right of inspection through the AP. The AP granted the enforcement request and announced its intention to impose an order for incremental penalty payments if TGB did not comply with the inspection request. At a hearing, TGB defended itself against this by stating, among other things, the following:
the customer abuses his right of inspection (as already decided by the District Court of The Hague);
the AP is bound by the Hague District Court ruling for several reasons;
TGB is not required to provide share copies of documents, internal analyses, and the record of deliberations when requesting a review as requested by the customer, but only a overview of the personal data processed.
With regard to the first defense, the AP confirms that the reasons for making a request for inspection are important and that the right of inspection should not be abused. Abuse of right should not be assumed too quickly: information obtained from a access request may also be used for other purposes NB. BANNING has published several blog articles on the lawfulness or otherwise of access requests. See: What should government authorities pay attention to when requesting inspection pursuant to Article 15 AVG, Abuse of the right of inspection: fishing expeditions and Abuse of the right of inspection pursuant to the Personal Data Protection Act.
The AP also ignores TGB's second defense. The AP states that the decision of the District Court of The Hague only binds the parties involved. Because the AP was not a party to this dispute, it is not bound by the ruling. The AP continues by characterizing privacy law as a system of enforcement (and legal protection), in which the civil and administrative law avenues coexist, which in our view is correct.
In the third defense, the AP indicates that normally a comprehensible overview of the personal data processed is sufficient. If the objective of the right of inspection cannot be met with this overview, copies must also be provided, according to the AP. The AP does not reach a further assessment because TGB has not yet provided an overview and/or additional information.
The AP then gave TGB two months to provide access under a penalty of €12,000.00 per week. However, after timely provision by TGB, customer found that the personal data summary was incomplete. The AP confirmed the incompleteness after an investigation. TGB subsequently supplemented the overview. It did so four weeks after the imposition of the penalty. As a result, TGB forfeited and paid a penalty of 48,000.00 euros.
This article can also be found in the AVG file
