Supreme Court Gives Ruling on Passport Photos of Holders of OV Chip Card
Authorization of Examining Magistrate Required For Claiming
Photographs
The Facts
On 23 March 2010 the Dutch Supreme Court gave a ruling in the
case of Trans Link Systems B.V., the card publisher and central
back office of the OV (=Public Transport) Chip-Card system, against
the Public Prosecution Service. In May 2007 the Public Prosecutor
in Rotterdam claimed personal data, including identifying data and
photos of holders of an OV Chip Card, by means of a list with the
card numbers of the users of the OV Chip Card wickets at the metro
stations Maashaven and Heemraadlaan in Rotterdam, in the night of 6
March 2007 from 10:00 p.m. until 7 March 2007 00:00
a.m.
Powers to Claim Data
On the basis of Sections 126nc et seq. of the Dutch Code of
Criminal Procedure, Police and Public Prosecution Service may claim
data that is relevant for the detection of (more serious) criminal
offenses. In principle, these data may be claimed with regard to
anyone, not only with regard to a 'suspect'. For this
reason the circle of the data subjects can be large: if, for
instance, on 1 April around lunch time a robbery takes place in the
center of Utrecht, the data may be claimed of all persons who have
booked a room on this day in the nearby Stadshotel, or of all
people who have borrowed books from the nearby library between, for
instance, 10:00 a.m. and 2:00 p.m. These data may be claimed from
any person who is reasonably eligible for this. This is basically
every organization that processes personal data.The Dutch Code of
Criminal Procedure provides for various claims, depending on the
nature of the data claimed. There are, in short, four data
categories that may be claimed:
- identifying data (name and address details, date of birth,
sex and administrative characteristics);
- historical data (i.e. data that have been stored or
recorded, for example data about purchases);
- future data (data that have not yet been recorded but were
to be processed anyway at a later time); and
- sensitive data (personal data concerning a person's
religion or philosophy of life, race, political persuasion,
health, sexual life, or trade union membership).
Claim for Provision of Photographs
The claim for provision of photographs of a number of holders of an
OV Chip Card was based on Section 126nd (historical data) of the
Dutch Code of Criminal Procedure, but, in the opinion of TLS,
should have been based on Section 126nf of the Dutch Code of
Criminal Procedure. After all, on the basis of the Dutch Personal
Data Protection Act, a photograph is regarded as sensitive or
special personal data, because a photograph reveals the race of a
person. A heavier requirement applies to the claiming of sensitive
data than to the claiming of 'historical data', for which a
signature of the Public Prosecutor is sufficient. The claiming of
special data requires an authorization of the examining
magistrate.
TLS refused to provide the photographs claimed, because in this
case there was no such authorization. The Public Prosecutor, in her
turn, refused to adjust the claim and enforced provision by TLS. It
must be observed in this respect that a refusal to obey a claim may
be prosecuted for violation of Section 184 of the Dutch Penal Code
(failure to comply with an order or formal request made by a public
servant).
Eventually, under pressure of the Public Prosecution Office, TLS
provided the photographs, but immediately afterwards submitted a
notice of complaint to the Chamber of the Court of Rotterdam. A
complaints procedure pursuant to Section 552a of the Dutch Code of
Criminal Procedure is the only possibility available to an
addressee of a claim to be put in the right (afterwards). It is
unsatisfactory that at that time the data have already been
provided and may have played a role in the criminal investigation
and the criminal prosecution, which cannot be reversed. This is all
the more persuasive since the complaints procedure, at any rate the
proceedings conducted by TLS, takes up a lot of
time.
Decision Chamber of the Court of
Rotterdam
On 2 June 2008, more than a year after the claim and the
provision of the photographs, the Chamber found for TLS. The Public
Prosecution Office lodged an appeal with the Supreme Court against
the decision of the Court. In this appeal it was brought forward
that it was not the Public Prosecution Office's intention to
obtain privacy-sensitive data, but only to obtain data about travel
movements. On 8 December 2009, in his opinion Advocate General mr.
A.J.M. Machielse advised the Supreme Court to uphold the judgment
of the court.
Judgment of the Supreme Court
With a reference to the Dutch Personal Data Protection Act, the
Supreme Court is of the opinion that data concerning the race of a
person, or from which information about his race can be derived,
must be regarded as "sensitive" information. In such a
case the law requires a written authorization of the examining
magistrate before the surrender of these data can be claimed.
Information about his race can be derived from a person's
photograph. That is the reason why the Public Prosecution Office
should not have claimed these photographs without an authorization
of the examining magistrate. The opinion of the Public Prosecution
Office that the authorization would only be required if the
intention of the claim was to derive sensitive information
from these photographs, is incorrect in the opinion of the Supreme
Court. The court therefore rightfully ordered the claimed
photographs to be returned to TLS. The Supreme Court thus dismissed
the cassation appeal of the Public Prosecution
Office.
Conclusion
This decision is remarkable and important for all organizations
that may be confronted with claims, especially claims to provide
camera and video footage. In such cases too, images may be claimed
that reveal data about a person's race, so that an
authorization of the examining magistrate is required. Under the
Personal Data Protection Act a controller may only provide personal
data if this is necessary in order to comply with a legal
obligation to which he is subject. When, in response to an
incorrect claim, the personal data is provided rashly, this may
constitute a violation of the Personal Data Protection Act.
The full judgment is available at
rechtspraak.nl LJN BK6331.