The right to access
You may ask a company or institution (hereinafter: organisation)
whether it is collecting and recording any of your personal data,
and if so, which. The organisation must respond to your request in
writing or by e-mail within a period of four weeks. You are not obliged
to indicate why you wish to have access to your data. To make a request
for access, you can use the modelbrief [model letter] of the Dutch
Data Protection Authority (Dutch DPA) [College bescherming persoonsgegevens
(CBP)]. If you request access to your data, an organisation must inform
you in a clear and comprehensible manner which data is being used,
the purpose for which it is being used and to which parties, if any,
your data has been disclosed. Where possible, the organisation must
also inform you where it obtained your data.
An organisation can charge you for the costs from handling your request
for access. When providing copies of a document a fee
per page of € 0,23
can be charged with a maximum of € 4,50. This fee is laid
down by law in the Besluit kostenvergoeding rechten
betrokkene Wbp [Individual
Reimboursement Decree with the Wbp].
Besides the Wbp also the Wet op de geneeskundige behandelingsovereenkomst
(Wgbo) [Medical Treatment Contracts Act] can apply
when requesting access to your medical record. More
information on the right to access, as laid down in the Wgbo, can be
found in the fact sheet Your
rights as a patient [Uw rechten als patiënt].
How
to submit requests for access
In practice, where requests for access are to be
submitted to a government body, these must be made in writing
or by e-mail. It is advisable that the same approach
be adopted for all other types of organisation. After all, if your
request for access is refused (in part) and you wish to take the case
to a court of law, you will be expected to demonstrate the steps you
have undertaken. This also applies if you ask the Dutch DPA to mediate
on your behalf. For information on mediation by the Dutch DPA, please
see the fact sheet entitled Mediation by the Dutch DPA
in Respect of Your Data [Bemiddeling door het CBP inzake
uw gegevens].
The scope of the right to access
Your right to access to your data, provided for under
the Wbp, extends solely to access to your own data. If the controller
uses personal working notes as a reminder, these notes do not fall
within the scope of the right to access. However, if these notes are
subsequently added to a file or disclosed to third parties, you will
be entitled to access to these notes, too. Under the Wbp, you are
not generally entitled to information pertaining to other data subjects.
For more information, please see the fact sheet entitled The
Disclosure of Your Personal Data [Verstrekken van uw persoonsgegevens].
Conditions applicable to access
Obtaining access is subject to the following conditions:
- The organisation must be able to establish that
you are the person to whom the personal data pertains.
This is to prevent others from accessing your data
by using your name. Your identity can be established
on the basis of a driving licence, passport or other
identity document.
- You will only be able to submit a request for access if you are older than 16 and have not been placed under guardianship. Where you are unable to submit a request for access yourself, the request must be made by your legal representative (a parent, for example) and the response should be addressed to that representative.
Reasons for refusal
An organisation may refuse to comply with your request for access in the following four cases:
- in order to prevent, detect and prosecute criminal offences. For example, the Social Security Fraud Department or a private detective agency may refuse access in the interest of the investigation;
- in case of weighty economic and financial interests on the part of the state and other public bodies;
- in order to supervise compliance with statutory regulations laid down to enable the detection and prosecution of criminal offences or to safeguard weighty economic and financial interests on the part of the state and other public bodies;
- if this is necessary for the protection of rights
and freedoms of other parties, including the organisation’s.
An organisation may invoke this ground if he can
demonstrate that the administrative burden on his
part will be increased to such an extent as to affect
or threaten to affect his rights and freedoms.
An organisation must be able to substantiate a refusal.
He must be able to demonstrate that the matter was
given careful consideration. This means that he must
balance your interest and rights against his own interest
when refusing a request for access.
Practical effects of right to access
An organisation may:
- provide you with copies of all documents pertaining to you, where paper files are concerned. In principle, these include reports of meetings and (telephone) notes that concern the establishment and implementation of a (contractual) relationship between you and an organisation, since these documents may contribute to the way in which you are assessed or treated in social and economic life;
- give you a clear paper overview/printout of the
data in the case of automated processing, i.e. digital
files. If no such overview is provided, you will
be entitled to access to the electronic form, which
you can use to make printouts yourself. Listening
to recorded telephone conversations may also fall
within the right to access. The overview should enable
you in any case to exercise the right of correction.
For information on the right of correction, please
see the fact sheet entitled The
Correction of Your Personal Data [Correctie van uw persoonsgegevens];
- ask you to make your request for access more specific if he has a considerable quantity of information on you;
- in highly exceptional cases, ask you to inspect your file in situ. This would apply, for example, in cases where a file is very extensive and copying would take a disproportionate amount of time and effort;
- refuse you access to part of your data. This may be necessary, for example, in order to safeguard information about another person contained in a social services’ file held on you. If this person is likely to object to the provision of access to you, the organisation must give this individual the opportunity to state his views before allowing access;
- initially refuse to provide you with copies that are already in your possession. This may concern copies of agreements and copies of correspondence, for example. In that case, the organisation may restrict itself to providing a list of the documents contained in the file. However, if you indicate that you still wish to have a copy, this copy should be provided to you after all;
- grant you access to your file on situ only, in
the event that you request access to a police register.
This has been provided for by law. For more information,
see the fact sheet entitled Uw gegevens bij de politie [Your Data Held by the Police].
If you have any questions or complaints
Your first course of action should always be to contact
the organisation itself about your questions or complaints.
Where you are unable to resolve these together, you
may ask the Dutch DPA to mediate on your behalf or
to investigate your complaint. For more information,
please see the fact sheets Mediation
by the Dutch DPA in Respect of Your Data [Bemiddeling
door het CBP inzake uw gegevens] and Your
Complaint and the Dutch DPA [Uw klacht en het CBP]. If a government body refuses (in part) to comply with your request for access or fails to respond in time, you may file an objection or lodge an appeal with that government body. The government body is obliged to inform you in this respect.
Your other rights
In addition to your right to access, you are entitled
to request that an organisation supplements, corrects,
erases or blocks your personal data (this is known
as the right of correction) and to raise an objection.
For more information on exercising these rights ,
please see the fact sheet entitled Data
Subjects and their Rights [Rechten van de betrokkene].