The Bottom Line
- Financial Penalties for Delay: Ignoring statutory deadlines for responding to data subject requests under the GDPR can lead to court-ordered daily fines, separate from any penalties imposed by data protection authorities.
- Operational Excuses Have Limits: Citing internal challenges like staff shortages or a high workload may earn you a slight extension from a court, but it will not excuse a failure to comply with legal obligations for a timely decision.
- Empowered Data Subjects: This ruling confirms that individuals have a straightforward and effective legal path to compel organizations—including major public bodies—to respect their data rights, forcing the issue into a courtroom if necessary.
The Details
This case involved an individual’s request for access to their personal data held by the Dutch National Police, a right guaranteed under the GDPR. After receiving what they considered an incomplete response, the individual filed a formal objection. The Police then failed to issue a decision on this objection within the legally mandated timeframe. The individual, having followed procedure by issuing a formal notice of default, took the matter to court to force a decision.
The court’s reasoning was clear and direct. It confirmed that the legal deadline for the Police to decide on the objection had passed. The Police attributed the delay to a high volume of complex requests from the same individual, coupled with understaffing and personnel changes. While the court acknowledged these operational pressures by granting a slightly longer-than-standard new deadline, it unequivocally affirmed that such internal issues do not suspend an organization’s legal duty to respond in a timely manner. The fundamental right to a timely decision prevailed.
Ultimately, the court ordered the Police to issue a final decision on the objection within three weeks. To ensure compliance, the court attached a significant financial penalty (a “dwangsom”) of €100 for each day the new deadline is missed, up to a maximum of €15,000. This ruling serves as a potent reminder for all organizations that data subject rights are not optional. Failing to properly resource data compliance and privacy teams is a calculated risk that can result in direct, court-ordered financial consequences, litigation costs, and reputational damage.
Source
Rechtbank Zeeland-West-Brabant
