Rechtsbescherming tegen bestuurlijke gegevensverwerkingen: toegang, toetsing en schadevergoeding

Abstract

This dissertation explores the extent to which the General Data Protection Regulation (GDPR) affects the Dutch legal order, focusing on how data subjects can access administrative justice to challenge governmental data processing under the Implementation Act GDPR and the General Administrative Law Act (GALA). While the GDPR advances European data protection, its enforcement relies on national administrative bodies and procedural laws. The dissertation identifies a key tension: Dutch administrative law centers on "decisions" as defined in Article 1:3 GALA, while the GDPR addresses factual acts, such as data processing. This misalignment complicates judicial review of autonomous data processing. Article 34 Implementation Act GDPR attempts to bridge this gap by treating responses to GDPR-based information requests as appealable decisions. However, administrative judges often lack the authority to assess the lawfulness of factual data processing, except in cases invoking the right to erasure (Article 17 GDPR).

Procedural obstacles arise when data subjects incorrectly invoke rights under the GDPR or when processing lacks clear classification as autonomous or accessory. Recent case law, including the April 2020 rulings, mitigates these barriers, allowing broader review of factual processing. Data protection law, once overlooked, is now driving innovation in administrative legal protection in the Netherlands.