Dutch Supreme court on GDPR civil enforcement of data subjects’ rights, repeating requests and the six-week deadline

In a recent judgment, the Dutch Supreme Court ruled (available in Dutch only) on a number of procedural aspects for the exercise of data subjects’ rights under the General Data Protection Regulation Act (“GDPR“) and the national implementation thereof. This regards the civil enforcement of data subjects’ rights, “repeated” requests and what effect is of

How do judges rule on GDPR right to access requests? Copy or no copy?

The Court of Justice of the EU has clarified whether the right of access from Article 15(3) GDPR also gives a right to a copy of the documents in which the personal data are recorded. This is only the case if that copy is necessary for an understandable and verifiable right of access by the data subject.

Recap seminar ‘duty of care and IT supplier’

On Thursday 14 July 2022, Tom de Wit and Esmée Fonville held a seminar in Eindhoven on the ‘duty of care of the IT supplier‘. The attendees all come into contact with (large) IT projects in practice, as customer, supplier or consultant. It is important for them to know what can be expected from an

Seminar “Duty of Care and IT Supplier”

In conflicts between IT suppliers and their customers, we increasingly notice that the special duty of care of the supplier is invoked. What is the impact of the duty of care on the interpretation of the agreement between parties? Does it bring unpredictable obligations for ICT suppliers? Is it a legitimate fallback option for inexperienced

annual update data privacy

The General Data Protection Regulation celebrated its third anniversary in 2021.  Privacy is a subject that is now on the agenda of most organisations. Moreover, the developments in this area of law are moving fast. The European and national legislators are not sitting still, and the same can be said of the supervisory authorities. Also,

the right to be forgotten of search results

The right to be forgotten was introduced in the Google/Costeja judgement of 13 May 2014. In response, Google created a request form for individuals to request the removal of specific search results that appear when their name is searched on in Google’s search engine. Since then, nearly one million removal requests have already been submitted

Dutch District Court nullifies decision on administrative fine under the GDPR

On 23 November 2020 a Dutch District Court (‘Court’) nullified a decision of the Dutch Data Protection Authority to impose an administrative fine on a company called VoetbalTV. This is the first Dutch judgment on fines under the General Data Protection Regulation (‘GDPR’).  What happened? The now bankrupt VoetbalTV (in English: FootballTV) was an internet