On 19 January 2005, the District Court of Hertogenbosch gave its first judgment in an appeal against the imposition of a fine by the Dutch Data Protection Authority (“the Authority”) for not complying with the obligation to notify the processing of personal data. The court ruled that the Authority was allowed to investigate and monitor compliance by means of a random check. In addition the court held that the controller, not the Authority, has the burden of proof regarding any exemptions the controller could use.
The Authority started its investigations in July 2003 and subsequently imposed 29 fines, ranging from €3,000 and €15,000, on 14 municipalities, 3 direct marketing businesses, 3 care insurers and 9 labour services bodies. Thirteen municipalities (and one labour services body) submitted a notice of objection, which in two instances resulted in reduction of the fines. In all other cases, the Authority has maintained its decision. Nine municipalities and the labour services body have since taken the matter to the District Court without success.
The court's decision (in Dutch) can be downloaded from the website of the authority: