# Rb. Noord-Holland: GDPR Art. 16 does not cover correcting professional opinions in - Type: Case Law - Source: District Court Noord-Holland - Date: 2026-08-18 - Original: https://gdprhub.eu/index.php?title=Rb._Noord-Holland_-_C/15/373813 - Canonical: https://overview.legal/posts/607523 - Topics: Right to be Forgotten, Right to Rectification, Personal Data, Accuracy, Controllers, Storage Limitation, Retention Period, Healthcare, Healthcare, Health Data ## Summary Facts — On 14 October 2025, a data subject requested Geestelijke Gezondheidszorg, the Dutch sector association for mental health and addiction services (controller), to remove or correct personal data from its systems. The data subject was or has been client during this request, and is of the opinion that the data are factually incorrect and are not based on police or judicial information since he had not committed any criminal offences. Therefore, he submitted different statements as a matter of the request, and brought this case to court. According to the controller, they are legally obliged to keep a medical file, which is based on information provided by third parties. This information was used in a court hearing on 7 March 2022 for an authorisation of a crisis measure, while following the procedures of the Compulsory Mental Healthcare Act (Wvggz). This law has a retention period of five years after the end of the crisis measure. Since the measure ran against the data subject until 18 October 2024, a request of deletion cannot in principle be made before 18 October 2029. Therefore, the controller did not comply with this request. Holding — The Court held that Article 16 GDPR is only intended to correct inaccuracies that can be easily and objectively verified, thus not professional impressions, opinions, research results or conclusions. The statements provided by the data subject qualified as professional conclusions, which do not fall under the right on rectification under Article 16 GDPR. It makes no difference whether there has been no conviction, since this does not follow declarations that have been made by professionals. Therefore, the court rejects the request to rectify this information. Additionally, the Court rejects a request to the deletion of personal data based on Article 17 GDPR. First, the data subject did not refer to one of the six grounds in his request. Second, two exceptions are applicable under Article 17(3) GDPR. Deletion of personal data is not possible under Article 17(3)(b) GDPR, since there is a legal obligation in the Dutch Civil Code to keep a medical record. Additionally, there is no right to deletion based on Article 17(3)(d) GDPR, since the personal data had already been used in court to grant the authorisation of the crisis measures. ## Full text Judgment DISTRICT COURT OF NORTH HOLLAND Civil Law Alkmaar Division Case No. / Petition No.: C/15/373813 / HA RK 26-10 Order of August 18, 2026 in the matter of [petitioner], of [place of residence], petitioner, hereinafter referred to as: [petitioner], appearing in person, against STICHTING GGZ NOORD-HOLLAND-NOORD, of Heiloo, the respondent, hereinafter referred to as: GGZ, appearing in person. 1 The Proceedings 1.1. The course of the proceedings is evident from: - the petition with attachments received by the court on January 19, 2026, - the notice from [Petitioner] dated March 22, 2026, with a supplementary attachment, - the notice from [petitioner] dated April 24, 2026, with an additional attachment, - the oral hearing on July 7, 2026, for which the court clerk took notes. 1.2. The decision is scheduled for today. 2 The Facts 2.1. From March 26, 2014, through January 1, 2026, [petitioner] was a patient or client of GGZ. 2.2. On October 14, 2025, [the petitioner] sent a message to GGZ requesting that information—which, according to [the petitioner], is incorrect—be removed from or corrected in the systems. GGZ did not comply with the request. 3 The Petition and the Defense 3.1. [Petitioner] requests that the court: - order GGZ to remove the incorrect and unlawful data from [Petitioner]’s files, - to order GGZ to inform all third parties who have received this data in writing of the correction and removal, - to order GGZ to carry out the above within a time limit to be set by the court, - to order GGZ to provide [the petitioner] with a copy of the corrected records, - to impose a penalty for failure to comply with this order, - to order GGZ to pay the costs of the proceedings. 3.2. [Petitioner] bases the petition on the fact that the records maintained by GGZ contain information that is factually incorrect and/or not based on police or judicial information. [Petitioner] wants the information to be corrected or deleted. 3.3. GGZ opposes granting the request and argues as follows. According to GGZ, [the petitioner] has not specifically identified which personal data—in light of the purpose of the processing—are objectively incorrect or incomplete. 4 The Assessment 4.1. The court understands that [the petitioner] bases his request on Articles 16 and 17 of the GDPR.¹ Pursuant to Article 16 of the GDPR, an individual has the right to obtain the rectification of inaccurate personal data concerning him or her. Pursuant to Article 17 of the GDPR, an individual has the right to obtain the erasure of personal data concerning him or her. 4.2. An individual who wishes to have his or her data rectified or erased must submit a request to that effect to the controller. In this case, that is GGZ. On October 14, 2025, [the petitioner] sent a letter to GGZ containing his request. This request serves as the basis for the case discussed in these proceedings—and thus in this decision. That request refers to four statements: a statement from [Name 1], a statement from [Name 2], a statement from [Name 3], and a statement from [Name 4]. Of these four statements, two were submitted with the request: the statement from [Name 1] and the statement from [Name 3]. At the hearing, [the petitioner] stated that he had sent the statement from [Name 4] to the court. The court did not receive this statement, at least not prior to the hearing. After the hearing, [the petitioner] subsequently sent the statement to the court via email. However, in light of the rules of procedure governing petitions, this statement was filed too late and will therefore be disregarded. 4.3. The court will therefore limit its assessment to the statements of [Name 1] and [Name 3]. 4.4. [Petitioner] has stated in general terms that all information relating to criminal offenses must be removed, because it is incorrect and/or not based on police or judicial information. [Petitioner] asserts that he has not committed any criminal offenses and that this is also evident from the judicial information he has submitted. 4.5. GGZ argues that, pursuant to Article 7:454 of the Civil Code (BW), it is required to maintain a medical record. Some of the information in the medical record is provided by third parties. This also applies to the information needed to assess whether imposing a crisis measure is necessary. The treating physician or psychiatrist bases his or her opinion on that information. Based on this information, the District Court of North Holland, by order dated March 7, 2022—following a hearing at which [the petitioner] was present with his attorney—granted authorization to continue a crisis measure. The assessment based on the information with which [the petitioner] disagrees has therefore already taken place. According to GGZ, it followed the procedure it is required to follow under the Compulsory Mental Health Care Act (Wvggz). For example, the Wvggz specifies its own retention period for data processed under the Wvggz. A request to destroy such data may only be made five years after the end of the crisis measure. Since the Wvggz measure against [the petitioner] was in effect until October 18, 2024, this means that a request for the deletion of the data cannot, in principle, be considered before October 18, 2029. 4.6. The court denies [the petitioner]’s request. In the remainder of this decision, the court will explain how it arrived at this decision. 4.7. The court finds that Article 16 of the GDPR concerns the rectification of inaccurate personal data. The right to rectification is not intended to correct or remove professional impressions, opinions, research results, or conclusions. It must concern inaccuracies that can be easily and objectively established. 4.8. [Applicant] refers to the statements by [Name 1] and [Name 3], from which, in his view, the information relating to criminal offenses must be removed. However, these statements by [Name 1] and [Name 3] must be classified as professional conclusions, so that rectification under Article 16 of the GDPR is not applicable. In this regard, the court notes that the conclusions of [Name 1] and [Name 3] are based on information from a medical record. The criminal data described in the statements originate from that medical record. Some of it concerns events that took place within the institution, while some of it consists of information provided by third parties. [Name 1] and [Name 3] were permitted to base their professional judgement on this information. Whether a report was actually filed or prosecution took place makes no difference in this regard. The summary of judicial information submitted by [petitioner] merely indicates that no conviction occurred because there were grounds for dismissal of the case. It does not indicate whether or not a report was filed. Nor does it indicate that the information pertaining to criminal offenses is incorrect. This means that the court—to the extent that there are even facts that cannot be classified as professional impressions, opinions, research results, or conclusions—it is not possible to determine, based on the documents submitted by [the petitioner], that there are inaccuracies. In any case, the criminal documentation submitted by [the petitioner] is insufficient for that purpose. 4.9. According to the court’s judgement, there is therefore no basis to order GGZ to rectify the data pursuant to Article 16 of the GDPR. The court will therefore deny [the petitioner]’s request based on this article. 4.10. Article 17 of the GDPR concerns the erasure of personal data by the controller, in this case GGZ. The [petitioner]’s request under Article 17 of the GDPR is unsuccessful. First of all, [the petitioner] has not explained at all on which of the six grounds listed in Article 17 of the GDPR he is basing his request. Furthermore, according to the court, at least two of the exceptions listed in article 17(3) of the GDPR apply. Pursuant to Article 17(3)(b) of the GDPR, there is no right to erasure of personal data to the extent that processing is necessary for compliance with a legal obligation to process data imposed on the controller by Union or Member State law, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Under Article 7:454 of the Dutch Civil Code, GGZ is obligated to retain a medical record. Therefore, [the petitioner] is not entitled to erasure. Pursuant to Article 17(3)(d) of the GDPR, there is no right to erasure of personal data to the extent that such data is necessary for the establishment, exercise, or defense of legal claims. As already established in paragraph 4.5 above, the statements containing the personal data have already been used in this case in a lawsuit in which the court granted authorization for the continuation of a crisis measure. In the court’s judgement, retroactive deletion is therefore incompatible with this. The court will therefore also deny [the petitioner]’s request pursuant to Article 17(3)(d) of the GDPR. 4.11. [The petitioner] has been found to be in the wrong and must therefore pay the litigation costs (including subsequent costs). GGZ’s litigation costs are estimated at: - court filing fee € 735.00 - subsequent costs € 189.00 (plus the surcharge as stated in the decision) Total € 924.00 5 The Decision The Court 5.1. denies the petition, 5.2. orders [the petitioner] to pay the court costs of €924.00, to be paid within fourteen days of receiving a demand to that effect, plus €98.00 and the costs of service if [the petitioner] fails to comply with the orders in a timely manner and the judgment is subsequently served. This order was issued by B. de Metz, Esq., judge, assisted by the court clerk, and pronounced in open court on August 18, 2026. 1 Articles 16 and 17 of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. ## Cited law provisions (3) ### GDPR — gdpr-art-17-par-3-pnt-b-en for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; ### GDPR — gdpr-art-17-par-3-pnt-d-en for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or ### GDPR — gdpr-art-16-en The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. --- Generated by overview.legal · https://overview.legal/posts/607523 · 2026-11-14