On the afternoon of Thursday 6 April 2023, the Rotterdam District Court ruled in the summary proceedings brought by Blauw against Nebu. Blauw started these proceedings because Nebu had failed to comply with the contractual agreements in the data processing agreement, and with its legal obligations under the GDPR in the event of a data breach.
News
The aim of the proceedings was therefore to ensure compliance with these agreements and obligations. Blauw’s main goal is to establish with certainty whether its clients’ data was affected by the data breach at Nebu.
The court granted almost all of Blauw’s claims. This means Nebu must provide all the information needed to inform Blauw about the data breach, and in particular whether its clients’ data was involved. The court accepted Blauw’s position that Nebu itself is unable to carry out a forensic investigation thorough enough to establish with certainty whether specific data has been compromised. It therefore granted Blauw’s claim that Nebu must instruct an external firm with proven cybersecurity expertise to carry out a forensic investigation within five days. The court attached a penalty of €25,000 per day to the most important claims.
With this ruling, Blauw now has the court’s backing to compel Nebu to provide information and cooperate. That covers both the information Nebu itself holds and the information an external forensic firm will provide. This should give us certainty about whether our clients’ data was involved in the breach, backed up by solid evidence.
The ruling also underlines the importance of contractual agreements and legal obligations on the processing of personal data, as set out in data processing agreements and the GDPR. That is of real value to anyone who works with personal data and makes agreements about it.
There is a real possibility that Nebu will appeal. In the meantime, Nebu is required to comply with the judgment.
