On 7 May the European Court of Justice (Third Chamber) delivered judgment on a reference from the Raad van State in the Netherlands.
College van burgemeester en wethouders van Rotterdam v M.E.E. Rijkeboer concerns the local authority records relating to Mr Rijkeboer and his request for information as to the authority’s disclosure of those records to third parties. Information had been supplied but, in accordance with the relevant Dutch law, that information had related only to a limited period.
The reference read as follows:
‘Is the restriction, provided for in the [Netherlands] Law [on local-authority personal records], on the communication of data to one year prior to the relevant request compatible with Article 12(a) of [the] Directive …, whether or not read in conjunction with Article 6(1)(e) of that directive and the principle of proportionality?’
The full ruling can be read here.
The essence of the ruling, which does not at first glance appear to be enormously helpful, was summed up by the Court as follows:
‘Article 12(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data requires Member States to ensure a right of access to information on the recipients or categories of recipient of personal data and on the content of the data disclosed not only in respect of the present but also in respect of the past. It is for Member States to fix a time-limit for storage of that information and to provide for access to that information which constitutes a fair balance between, on the one hand, the interest of the data subject in protecting his privacy, in particular by way of his rights to object and to bring legal proceedings and, on the other, the burden which the obligation to store that information represents for the controller.
Rules limiting the storage of information on the recipients or categories of recipient of personal data and on the content of the data disclosed to a period of one year and correspondingly limiting access to that information, while basic data is stored for a much longer period, do not constitute a fair balance of the interest and obligation at issue, unless it can be shown that longer storage of that information would constitute an excessive burden on the controller. It is, however, for national courts to make the determinations necessary. ‘
