Under Article 15 of the General Data Protection Regulation (AVG), a data subject has the right to access personal data processed about him or her. This means that the data subject may ask an organization if they are processing personal data about him or her, and if so, what personal data it is. Governments may also receive requests for inspection. The question that arises here is whether a decision on a inspection request can legally be considered a decision within the meaning of the General Administrative Law Act (Awb). When an administrative body grants an inspection request, this has a number of consequences. In this blog, we consider these consequences.
Author: Silvia Vinken
In the (now defunct) Personal Data Protection Act, a decision on a request for inspection, insofar as taken by an administrative body, was considered a decision within the meaning of the Awbp (Art. 45 Wbp). Now that the AVG is in force, an almost identical provision has been included in the Dutch Implementation Act of the AVG (UAVG). Article 34 UAVG provides that a written decision on a request for inspection counts as a decision within the meaning of the Awb. Moreover, decisions on requests for rectification (Art. 16 AVG) and data erasure(right to be forgotten, Art. 17 AVG) are also equated with a decision in the UAVG. This also applies to the other rights of data subjects mentioned in Articles 18 to 22 AVG.
The right of access only concerns access to the data of the person concerned himself and thus not of others. In principle, an administrative body, such as the municipality, must comply with such a request, but in some cases one of the statutory exceptions can be invoked. For example, Article 23 AVG and Article 41 UAVG mention a number of grounds on which a perusal request can be refused, such as national and public security, to prevent/detect criminal offenses and to protect the rights and freedoms of others.
It is also important for governments to distinguish a request for inspection from a request under the Government Information (Public Access) Act (Wob). After all, a Wob request for disclosure of information is not the same as a request for inspection pursuant to Article 15 AVG. With a WOB request, privacy must nevertheless be taken into account. For this, see our checklist 'WOB and personal data protection' from our book 'Checklist Privacy AVG: privacy policy in 46 checklists'.
For administrative bodies, equating a decision on a disclosure request with a decision in the sense of the Awb does have some consequences. For example, if a data subject's inspection request is refused, he or she will be able to lodge an objection or appeal and must be actively informed of this fact. This is different from a request for inspection that is not a decision. In that case, the data subject can turn to the civil courts by means of a petition (see Article 35 UAVG) or file a complaint with the Autoriteit Persoonsgegevens.
In addition, the administrative body must decide on a request for inspection in a timely manner. Article 12(3) AVG provides that the requester must receive information about the action taken on the request without delay and in any event within one month of the request. If the request for access is complex, this period may be extended by a further two months if necessary. In the case of an extension, the data subject will have to be informed of the extension within one month of the request. In principle, therefore, the requester should receive an initial response within one month. In the absence of a response, Article 6:12 of the Awb will apply. This article deals with the failure of an administrative body to make a decision in time (fictitious refusal). The applicant may then lodge an appeal as soon as, in accordance with Section 6:12(2) of the Awb, he or she has given the administrative body a notice of default and two weeks to make a decision as yet. This also applies if the administrative body has not made a timely decision after an extension of two months.
Failure to decide on time may entitle the applicant to a penalty payment. However, there is a danger here that the right of inspection will be used as a means of forfeiting a penalty payment. Until recently, the Wob was also frequently abused by submitting Wob requests with the same intention of obtaining a penalty payment. However, this does not mean that by abusing the right of inspection, applicants have gold in their hands. After all, the right of inspection is not unlimited (see our previous blogs) and abuse thereof may, depending on the circumstances, lead to inadmissibility of the applicant. Support can be sought in case law relating to Wob abuse cases. Should an administrative body wish to invoke abuse of rights, this does require weighty grounds. A weighty ground exists if the right of inspection has been used so obviously without a reasonable purpose or for a purpose other than that for which it was intended, that the request for inspection demonstrates bad faith (see also this ruling).
For public authorities, being administrative bodies, a decision on a request based on a privacy right under the AVG (for example, the right of inspection) is equated with a decision in the sense of the Awb. This entails the consequence that the Awb applies. If a requester disagrees with the refusal of a right of inspection, he can object and appeal. Another important consequence is that the administrative body must keep a close eye on the response and decision time to a request for inspection. This is because a requester has the right to appeal under Article 6:12 of the Awb against the administrative body's failure to make a timely decision, in which case the requester may be entitled to a penalty payment. The right of inspection is sometimes abused merely to obtain a penalty payment, but when the abuse of this is established, it can lead to inadmissibility.
This article can also be found in the AVG file
