Recently, the Administrative Jurisdiction Division of the Council of State (Council of State) upheld the District Court’s decision concerning an individual’s request for access to his or her personal data that had been processed by a former employer.
A former employee of the municipality of Zevenaar requested access to her personal data that had been processed by the municipality, her former employer. The municipality gave its former employee copies of documents that were used for the personnel and salary administration and indicated that these are the data that are being processed in the context of former employment at the municipality. Afterwards, the former employee requested other documents containing her personal data that had been processed. The municipality gave her most of the requested documentation, but it refused to hand over several documents and digital files which were not considered part of the personnel and salary administration, and therefore, they could not be classified as a “personal data filing system” (which is, within the meaning of the Dutch Data Protection Act (DDPA), a structured and searchable set of personal data).
The fact that they could not be classified as a personal data filing system is relevant because the DDPA (which grants the data subject the right to access the requested documents) only applies if the personal data, which are not processed by automatic means, are contained or are intended to be contained in a personal data filing system.
The municipality claimed not having all the requested documents and it rejected the former employee’s request to provide her with the documents. The former employee brought the case before the District Court which declared her request unfounded. The District Court held that a set of personal data can only be considered to be part of a personal data filing system if it can be shown that the data have more than one characteristic in common. The former employee then appealed before the Council of State, arguing that it is unjustified for certain folders to not be regarded as part of the personal data filing system. The Council of State was not persuaded by her reasoning and upheld the District Court’s decision. It said that the requested documents did not meet the requirement of belonging to the filing system, and that it was also likely that the municipality did not have certain documents she requested. It held that the municipality—by giving its former employee the other documentation containing information on the purposes for which the data are processed, the origin of the data, and the persons to whom the data are disclosed—fulfilled its obligation to give the former employee access to the processed personal data concerning her.
Council of State, 21 January 2013, LJN: BY9910