Since May 2010, a large-scale lawsuit against the central storage of fingerprints under the Passport Act by the Dutch Privacy First Foundation and 19 co-plaintiffs (citizens) has been under way. This was a civil case because with regard to the merits of the case, individual citizens were not able to turn to an administrative court.

Citizens could only go to an administrative court if they would first provoke an individual decision: an administrative refusal to issue a passport or ID card after an individual refusal to give one’s fingerprints. They could only litigate on an administrative level if they were prepared to live without a passport or ID card for years.

Moreover, the provision in the Passport Act on the central storage of fingerprints (article 4) still hasn’t entered into force. Therefore an administrative court was unauthorized to assess this provision. Contrary to other countries, a direct appeal against administrative law isn’t possible in the Netherlands.

Subsequently, an administrative court would have been able to individually and indirectly assess this article on the basis of higher privacy legislation only after that selfsame article would have entered into force, that is to say, after the central storage (and exchange) of everyone’s fingerprints would have become a fait accompli.

To preventmassive privacy violations, only a civil court was authorized to rule in the case of Privacy First et al. For many years civil courts have been the perfect type court for the direct assessment of national legislation on the basis of higher (privacy) legislation, even if the national legislation has not yet entered into force but does entail an imminent privacy violation.

Strong case

As a relevant foundation, Privacy First was able to take civil action in the general interest, on behalf of every Dutchman. Since the early ‘90’s this is possible via a special procedure under article 3:305a of the Civil Code: the so-called "action of general interest." Up until May 2010, when Privacy First et al. summoned the Dutch State, the Dutch Supreme Court seemed to have given the green light for this.

However, in July 2010, the Supreme Court disregarded its own case law by declaring that the interest groups can only turn to a civil court if individual citizens cannot pursue legal proceedings before an administrative court. But in Privacy First’s passport trial, citizens could not apply to an administrative court. So Privacy First et al. still had a very strong case. What’s more, the admissibility criteria of the Supreme Court seemed not to apply to actions of general interest, merely to ‘group actions’ that are organized on behalf of a group of people instead of the entire population.

Incomprehensible judgment

In February 2011, the district court of The Hague wrongly declared the passport trial inadmissible. A decision which was appealed by Privacy First et al. Courtesy also of the pressure exerted by this appeal, the central (as well as municipal) storage of fingerprints was largely discontinued in the summer of 2011 and the taking of fingerprints for ID Cards was halted altogether at the start of 2014.

In February 2014, The Hague Court of Appeal declared Privacy First — in the general interest — admissible after all and judged that the central storage of fingerprints is in violation of the right to privacy. The minister of the interior, Ronald Plasterk, was not amused and demanded an appeal in cassation before the Supreme Court.

Against all odds (as Privacy First has virtually all legislation, legislative history, case law and legal literature on its side), on May 22, 2015, the Supreme Court declared Privacy and its 19 co-plaintiffs inadmissible once more. According to the Supreme Court, the citizens can turn to an administrative court, which has also blocked the road to a civil court for Privacy First.

All this while in the last few years it had been established that the co-plaintiffs could not turn to an administrative court, at least not for the review of article 4b of the Passport Act concerning the central storage of fingerprints. In innumerable administrative cases over the past few years, judges of various administrative courts have declined jurisdiction. That meant that for Privacy First as an interested organization, the road to an administrative court was equally blocked.

The fact that the Supreme Court rules as if that isn’t so is simply incomprehensible. Furthermore, litigating citizens can neither be expected to get by without a passport for years, nor can they be expected to first let their privacy be violated (giving up fingerprints, even for storage) before a judge has determined whether this is legal. The fact that the Supreme Court seems to require this just the same is not just inconceivable (as well as in breach of its own case law) but also reprehensible.

Gap in the legal protection

The ruling of the Supreme Court creates a legal vacuum: if citizens or organizations want massive and imminent privacy violations, such as the central storage of fingerprints under the Passport Act, to be reviewed, then they may not be able to turn to either a civil or an administrative court. This creates a gap in the legal protection that has been in place in the Netherlands over the past few decades.

The Supreme Court may pass on this case to the highest administrative court (the Dutch Council of State) but it’s all but certain that the Council of State is able and still prepared to review the central storage of fingerprints under the Passport Act. In light of this, the Supreme Court should have waited for the ruling by the Council of State in four current and parallel administrative cases revolving around the Passport Act, prior to come up with its ruling in Privacy First’s passport trial. By not doing this, the Supreme Court has taken a huge risk, has completely prematurely stepped into the shoes of the Council of State and has put the Council of State under severe pressure.

If the Council of State were soon to judge differently than the Supreme Court (that is to say, judge that the Supreme Court is unauthorized to rule in these matters), the two institutions would make an enormous blunder and would create a huge gap in the legal protection in the Netherlands, in contravention of the European Convention on Human Rights (ECHR)

Multiple ECHR violations

Privacy First et al. await the ruling of the Council of State with considerable anticipation. In the meantime, Privacy First et al. will already prepare to file a complaint with the European Court of Human Rights in Strasbourg on account of a breach of article 8 ECHR (right to privacy) and articles 6 and 13 EHCR (right to access to justice and to effective legal remedies). Despite the Kafkaesque anti-climax before the Supreme Court, a European conviction of the Netherlands would be on the cards once the complaint has been filed.

Contribution by Privacy First