In 2014, the municipality of Arnhem introduced a new underground waste container system which requires its residents to use a registered card. As a result, each time a resident makes use of the containers, the municipality registers their identity, as well as their address and frequency of use of the containers. Upon the request of a resident who felt that this processing of personal data constituted a breach of their right to privacy, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) started an investigation.
In April 2017, the AP decided not to take any enforcement actions against the municipality. The AP motivated this by referring to the plans of the municipality to introduce a new waste system in January 2018, referred to as Diftar. According to the municipality, Diftar would make the data processing lawful as it will be used to impose fines on waste polluters. In order to do so, processing the data obtained through the registered cards is necessary. The AP therefore considered that since the data processing will be lawful within the foreseeable future, no enforcement action requires to be taken against the municipality at this stage.
The applicant appealed the decision of the AP, and the case was presented to a court in a summary proceedings. The court found that the implementation date of Diftar had not in fact been established. The conclusion of the AP does therefore not apply as it cannot factually be established that the data processing will become lawful within a reasonable amount of time. On July 13, 2017, the court dismissed the decision of the AP to not take enforcement actions against the municipality.
Following this judgment, the AP ordered the municipality to immediately terminate the data processing at subject, and imposed a penalty on the municipality of EUR 50.000 in case of non-compliance.
The full text of the decision of the AP can be found here (in Dutch only).