Brinkhof successfully represents DPG Media B.V. in another reversal of a fine imposed by the Dutch Data Protection Authority

Brinkhof successfully represented DPG Media B.V. in an appeal against a fine imposed by the Dutch Data Protection Authority (DPA), resulting in the entire €525,000 fine being overturned. A machine translation of the judgement can be downloaded here.

The case centered on an internal policy implemented by Sanoma Media Netherlands B.V. (prior to its acquisition by DPG Media) which required its customers to provide a copy of their identification document when submitting data access or removal requests by other means than through their online account. The Dutch DPA deemed this policy to be in violation with Article 12(2) of the GDPR, imposing a €525,000 fine.

The court of Amsterdam ruled that the Dutch DPA’s fine was unwarranted as the Dutch DPA failed to take into account several relevant circumstances. Among other things, the court attached significance to the fact that there is an inherent tension between facilitating data protection rights on the one hand, and the need to identify an individual seeking access on the other. It reiterated that in principle, a copy of an identity document serves as a valid means of identification. During the relevant period of the case, the GDPR had only just come into effect. Sanoma had explicitly asked the DPA whether it could continue its policy following an initial information request of the Dutch DPA. The court considered that, rather than imposing a fine, the Dutch DPA should have engaged with Sanoma at this early stage and, at the very least, indicated that its policy was deemed non-compliant. More generally, the regulator should have taken on an informative role at this time when organizations were still adjusting their practices to comply with the new rules. The court also considered the limited impact of Sanoma’s policy, noting that its policy of requesting a copy of an identification document did not apply to the vast majority of data subject requests (who exercised their data subject rights through their online account).

This case marks the second time where a Dutch Court has overturned a fine imposed by the Dutch DPA in its entirety (with the VoetbalTV case being the only other published precedent so far), with Brinkhof representing the appellants in both instances.

DPG was assisted by Quinten Kroes, Marije Rijsenbrij and Marthe van der Velde.