What does the Blauw/Nebu case mean for practice?

Introduction

The summary proceedings in the Blauw/Nebu case were closely followed within and outside the privacy and IT law practice. Public interest was very high, partly because of the implications this case would have as a test for the legal status of data processing agreements under the GDPR within our Dutch legal system. This article will look back at the known facts in this high-profile case.

The court at Rotterdam ultimately largely granted Blauw's demands, with some minor mitigations to limit Blauw. The article will explain how the  court in Rotterdam reached a judgment based on an obligation under a data processing agreement.

The core of the legal question revolved around the scope and interpretation of a data breach assistance obligation. A provision that is mandatory under the GDPR to include in data processing agreements, but whose precise wording is unique in almost every data processing agreement.

What had happened in the Blauw/Nebu case?

On 10 and 11 March 2023, a cyberattack took place on Nebu's servers, in that attack the perpetrators managed to steal data, including personal data within the meaning of the EU General Data Protection Regulation ("GDPR"). The personal data originating from customers of several large companies in the Netherlands were (potentially) released onto the street. The major companies reported the data breach.

Nebu was a Dutch software development company that offered a component-based software system for market research and data collection. Nebu also offered technical support, hosting and training on this software for marketing, market research and opinion polls. Blauw was a market research company that used Nebu's IT services on behalf of several large companies. Blauw and Nebu had entered into a data processing agreement between them.

Nebu had either been a processor within the meaning of the GDPR or a sub-processor within the meaning of the GDPR of Blauw varying by the exact processing of personal data. It is therefore not surprising that these parties had entered into a data processing agreement.

Article  'controller' or 'processor'?

What did Blauw claim at the court?

In the summary proceedings, Blauw demanded further information from Nebu about the cyber-attack, the consequences and the measures taken by Nebu, partly on the basis of the mutual data processing agreement. Blauw also asked the court to order an independent forensic investigation.

It is important to note that Nebu did not dispute being obliged to provide information to Blauw, but only disputed the interpretation of the scope of that obligation. To the extent that Blauw would not have been the data controller within the meaning of the GDPR, the option for a partial dispute on this issue may have existed. It is possible that this case would have had a different outcome if it had.

How did the court rule?

Urgent interest

This case involved summary proceedings, so there had to be an urgent interest. The court assumed an urgent interest given the nature of the demands. This is not surprising, as Blauw had also demanded to order Nebu to retain important information. Also, for best results, a forensic investigation should usually take place as soon as possible after an incident. After all, there is a risk that important information about the cyberattack, its source and consequences could be lost if too much time passes.

Legal question

The legal question of the dispute revolved around two divergent interpretations of the scope of article 5.1 in the mutual data processing agreement , in which the parties had implemented the obligation under article 28 paragraph 3 opening words and under f GDPR. Blauw advocated a broad interpretation of this clause; Nebu understandably argued for a more limited interpretation partly in view of its business interests.

A 'data processing agreement ', is legally a relatively recent and somewhat remarkable phenomenon. Pursuant to Article 28(3) opening words and subparagraph (f) of the GDPR, a data processing agreement  must contain a provision on providing assistance with, among other things, the notification of data breaches.

"3. The processing carried out by a processor shall be governed by a contract or other legal act under Union law or Member State law binding the processor to the controller and specifying the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, and the rights and obligations of the controller. In particular, that contract or other legal act shall provide that the processor: [...]"

"(f) taking into account the nature of the processing and the information available to it, assist the controller in complying with its obligations under Articles 32 to 36;"

The GDPR defines what must be regulated in a provision in the data processing agreement , but does not go so far as to require the law to also prescribe the substantive text of that provision. Nebu, as will become clear, is entirely dependent on the court's interpretation of Article 5.1 of the data processing agreement concluded between the parties for the protection of its most sensitive business interests.

In r.o. 5.3 of the ruling, the court ruled that the provision of the data processing agreement should be interpreted broadly, giving the poetic qualification that under this provision of the data processing agreement, Nebu was under an obligation to cooperate in a "loyal and generous manner".

"5.3.
In the preliminary opinion of the court in preliminary relief proceedings, Blauw's right of instruction and Nebu's obligation to comply with it must be interpreted broadly. Blauw's right of instruction is intended, as appears from the text of Article 5.1, to enable Blauw to properly investigate an incident involving personal data, to determine its reaction to it and, if necessary, to be able to take appropriate steps. Nebu must therefore cooperate in this, and it must do so loyally and generously. As a result of its cooperation with Blauw, Nebu holds personal data of a large number of people ('a substantial part of the Dutch population', as Blauw states undisputed). The consequences of a (possible) data leak of that data can be large. This is not compatible with a limited interpretation of the right of instruction."

Thus, in deciding that a broad interpretation should be followed, the court expressly took into account that the consequences of a (possible) data leak of personal data on a substantial part of the entire Dutch population were large and a narrow interpretation was not compatible with this.

The same or similar consideration could be applied to other provisions in other data processing agreements. After all, all data processing agreements also ultimately serve to protect the rights and freedoms of data subjects.

Step-by-step assessment of specific demands

Blauw is vindicated, but the preliminary injunction court does set limits on the extent of what Blauw may ask of Nebu. Nebu must follow instructions from Blauw under article 5.1 of the data processing agreement concluded between them, unless: it cannot reasonably be seen that this is necessary for the purpose of article 5.1 of the data processing agreement, or Blauw makes "blatantly unreasonable demands", for example unreasonably short deadlines.

Subsequently, the court considered step-by-step all of Blauw's specific demands against Nebu, which were largely upheld, with the court indicating that a factor was that no independent forensic investigation had taken place or even started so far.

Among other things, Blauw is entitled to information on whether information relating to Blauw's customers has been leaked, undoubtedly very important to Blauw now that those customers will in turn look to Blauw to obtain this information, for example under data processing agreements entered into between Blauw and those customers.

The demand for appointment of an independent forensic investigator is also granted.

"5.11.
Blauw demands that an external party conduct an independent investigation into the cause of the incident, the extent to which data exfiltration took place and the measures taken by Nebu in response to the cyber-attack. Nebu stated at the hearing that it cannot yet state whether data from (the customers of) Blauw was exfiltrated. This means that Nebu did not manage to find this out for itself in a period of several weeks. Under these circumstances, also in view of the large number of personal data at issue in this matter and in light of the initially limited information Nebu provided to Blauw, the court in preliminary relief proceedings ruled that the demand for the appointment of a forensic investigator falls under Blauw's right of instruction under Article 5.1 of the DPA. The fact that under the DPA Blauw can choose to have an audit conducted at Nebu itself does not alter this. Demand 5 will therefore be upheld as stated below."

In which the court is apparently unimpressed "that Nebu failed to find this out on its own in a period of a few weeks," but does indicate as a limit that Nebu is allowed to mask data about parties other than Blauw and Blauw's customers in the forensic investigator's report.

So what about the importance of protecting business-sensitive information?

The court expressly indicated that it had taken into account that from Nebu no independent forensic investigation had taken place, or had even been started. According to the court, this makes it more reasonable for Blauw to demand information than in the situation where Nebu had immediately ordered an independent investigation. Had Nebu reacted to the cyber-attack and the feared data leak by immediately initiating an independent investigation, it might not have had to proverbially bare its buttocks to a customer in such a drastic way for the company.

"5.7.
In the foregoing, the court took into account that so far no independent forensic investigation has taken place or even been initiated. This makes it more reasonable for Blauw to want information than in the situation where Nebu had immediately ordered an independent investigation.

The inevitable consequence of this is that Nebu's business confidential information may come into Blauw's possession. Incidentally, the court assumes that Blauw will handle the information it will obtain as a result of this judgment in a prudent manner."

The court seems to diminish Nebu's concerns on this point with the comment that this is simply unavoidable. Apparently, on the main point of concern for Nebu, the comment that the court assumes that Blauw will deal prudently with the information it will obtain is sufficient. While the  court's confidence has undoubtedly been flattering to Blauw, it is very questionable whether Nebu feels equally heartened.

Limits

In this case, therefore, the court in preliminary relief proceedings did not attach much weight to Nebu's interest in protecting its business-sensitive information from Blauw’s probe. Other interests than the preservation of trade secrets apparently do weigh more heavily for the court.

Where it concerns information that may touch on legally protected confidentiality between client and lawyer for Nebu and its lawyers. As well as, the information about third parties, such as clients of Nebu other than Blauw. Here the court does set a clear boundary that this information does not concern Blauw and she is not allowed to see it.

Nor did the court in preliminary relief proceedings accept the demands regarding information to be obtained by Nebu in the future. A demand to order Nebu to always provide Blauw with new information about the incident without delay and in any case within four hours after it became known, and in addition to that to send an update twice a day, went just a bit too far. Although the court also attributed this demand to the apparently lacking or too slow provision of information by Nebu after the incident. The  court deemed a daily update before 18:00 reasonable.

Again, Nebu could have possibly saved itself a lot of inconvenience by taking charge from the very first moment and initiating better information provision. Partly for this reason, it is advisable for any organisation that holds a lot of (personal) data to implement a data breach protocol and actively practice how to respond to a (suspected) data breach.

Conclusion

The Blauw/Nebu case provides a valuable real-world example on the interpretation and enforceability of the clauses of data processing agreements under Dutch law. The data processing agreement is a relatively recent and somewhat strange phenomenon within Dutch law. However, the data processing agreement is also conclusively shown to be a legal agreement within the meaning of Dutch law in its own right. The execution of the obligations in that data processing agreement can be enforced in a Dutch court of law.  

The facts of this case also show that a party that wants to be able to protect its business-sensitive information after a data leak is detected would do well to take visible control from day one, for instance by implementing a well-developed and practised data leak protocol. As well as properly regulating the provision of information and, in the light of the GDPR, immediately appointing an independent investigator if there are predictable questions that cannot be answered by oneself. One cannot count on a Dutch court to let the interest of protecting business-sensitive information prevail over other interests, such as but not limited to privacy interests, in each case.

Advice

It is always advisable to have agreements, including therefore data processing agreements, checked before your organisation commits to a legal obligation that could potentially have unintended negative consequences for the organisation. The way the obligation to assist in the fulfilment of a counterparty's (statutory) obligations is formulated in a data processing agreement  has real consequences for the legal positions of both parties in incidents involving personal data.

It is advisable with the interests of your business or organisation in mind to include deliberately worded clauses in each data processing agreement. Do you have questions about the nature of the legal risks that data processing agreements entered into by your organisation may entail for your organisation?

Contact WiseMen for legal advice on data processing agreements and any other privacy-related legal documentation, such as data breach protocols and data breach registers.

Approach us for legal advice today!

Do you want to use our knowledge and call us with some regularity? Subscribe to the Virtual Legal Department. 

Interested? Call or email us:

T. +31(0)70-3819281
E. info@wisemen.nl

For the latest information, subscribe to the newsletter now

WiseMen Newsletter!