Press Release: Court rules in favor of Blauw Research

So the stakes of the summary proceedings were compliance with these agreements and obligations. For Blauw, the main goal is to have a definitive answer as to whether data belonging to its clients was touched in the data breach at Nebu.

The court granted virtually all of Blauw's claims. It means that Nebu must provide all information necessary to inform Blauw about the data breach. More specifically, Nebu must inform Blauw whether data from its clients was involved in this data breach. The court adopted Blauw's assumption that Nebu itself is unable to conduct adequate forensic investigations to determine with certainty whether certain data was affected. For that reason, the court granted Blauw's demand that Nebu be allowed to commission an outside agency with demonstrable expertise in cybersecurity to conduct a forensic investigation within 5 days. On the main claims, the court imposed a penalty of €25,000 per day on Nebu.

With this summary proceedings, Blauw now has the support of the court to force Nebu to give us information and cooperate. This concerns the information it has available itself as well as the information that an external forensic agency will provide. In this way we hope to get a definitive answer as to whether data from our clients was involved in the data breach. We will also get good substantiation so that we have certainty.

In addition, there is now a court ruling that underlines the importance of contractual agreements and legal obligations regarding the processing of personal data as agreed upon in processor agreements and the AvG. This is of great value to anyone working with personal data and making agreements about it.

There is a good chance Nebu will appeal. In the meantime, Nebu is obliged to carry out the judgment.

‍