On Thursday afternoon, 6 April 2023, the Rotterdam District Court delivered its judgment in the preliminary injunction proceedings brought by Blauw against Nebu. Blauw initiated these proceedings because Nebu failed to adhere to the contractual agreements set out in the data processing agreement and the legal obligations imposed on Nebu by the GDPR in the event of a data breach.
Blog
The aim of the preliminary injunction was therefore to ensure compliance with these agreements and obligations. For Blauw, the primary objective is to obtain a definitive answer as to whether its clients’ data was affected by the data breach at Nebu.
The court granted almost all of Blauw’s claims. This means that Nebu must provide all information necessary to inform Blauw about the data breach. More specifically, Nebu must inform Blauw whether its clients’ data was involved in this breach. The court accepted Blauw’s assertion that Nebu itself is unable to conduct a sufficient forensic investigation to determine with certainty whether specific data has been compromised. For this reason, the court granted Blauw’s request that Nebu must instruct an external agency with demonstrable expertise in cybersecurity to conduct a forensic investigation within 5 days. The court imposed a penalty on Nebu of €25,000 per day for the most significant claims.
With this preliminary injunction, Blauw now has the court’s support to compel Nebu to provide us with information and to cooperate. This concerns both the information that Nebu has available itself and the information that an external forensic agency will provide. In this way, we hope to obtain a definitive answer as to whether our clients’ data was involved in the data breach. We will also receive proper substantiation of this so that we have certainty.
Furthermore, there is now a court ruling that underlines the importance of contractual agreements and legal obligations regarding the processing of personal data, as agreed in data processing agreements and the GDPR. This is of great value to anyone who works with personal data and enters into agreements regarding it.
There is a reasonable chance that Nebu will file an appeal. In the meantime, Nebu is obliged to execute the judgment.
