RVS - 202401622/1/A3
Dutch court overturns €600K GDPR fine due to insufficient proof of personal data.
The Council of State in the Netherlands overturned a €600,000 fine imposed by the Dutch DPA on the Municipal Executive Board of Enschede. The fine was for processing personal data without a legal basis. The court ruled that the DPA failed to sufficiently prove that pseudonymised MAC addresses and location data constituted personal data, a key requirement under GDPR.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Autoriteit Persoonsgegevens?
Get an email when a new story names Autoriteit Persoonsgegevens, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Council of State overturned a €600,000 GDPR fine against the Municipality of Enschede because the Dutch DPA could not sufficiently prove that pseudonymised MAC addresses and location data qualified as personal data under GDPR. This case highlights a critical gap in regulatory enforcement: the legal definition of 'personal data' is context-dependent, and pseudonymisation can shift the burden of proof significantly. Organisations and regulators alike must rigorously assess whether data elements can reasonably identify individuals before classifying and enforcing them as personal data. This ruling matters because it sets a precedent that challenges assumptions about pseudonymised data, potentially affecting how organisations design privacy programmes and how DPAs build their enforcement cases.