> ## Content Index
> Fetch the complete content index at: https://www.thedelatorrereview.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Rijkeboer: When the Right of Access Reaches Into the Past
- URL: https://www.thedelatorrereview.com/rijkeboer-when-the-right-of-access-reaches-into-the-past/
- Published: 2009-05-07T03:36:00.000Z
- Updated: 2026-09-13T00:44:52.000Z
- Description: In Rijkeboer, the CJEU held that the right of access must reach far enough into the past to remain effective. Retention limits may apply, but they must fairly balance meaningful access against the burden of keeping disclosure records.
- Author: Lydia
- Tags: Court of Justice of the European Union (CJEU), Caselaw, Right of Access, Data Retention, Data Protection Directive, Directive 95/46/EC, Storage Limitation, General Data Protection Regulation (GDPR)

**Case C-553/07 | Court of Justice of the European Union | Third Chamber | 7 May 2009**

> **Practice takeaways:** **①** The right of **access** is not limited to information about current processing; it **may extend to past disclosures**. **② Access is instrumental**: it enables data subjects to exercise other data-protection rights and seek remedies. **③ Member States may establish retention** periods for information about recipients and disclosures, but their discretion is **not unlimited**. **④ Retention and access periods must strike a** **fair balance** between the data subject’s interests and the burden on the controller. **⑤ A one-year period was not a fair balance** where the underlying personal data were retained much longer, unless longer retention of disclosure information would impose an excessive burden. 

*Rijkeboer* asked a deceptively simple question: **how far back must the right of access reach?**

Dutch law allowed an individual to learn who had received his personal data—but only for disclosures made during the preceding year. The CJEU held that access cannot necessarily stop there. Because **access** enables individuals to verify processing and exercise rights such as rectification, erasure, objection, and judicial remedies, it **must be capable of reaching into the past.** A retention rule that makes those rights ineffective may violate EU data-protection law. 

## What happened

Mr Rijkeboer asked the Rotterdam municipal authorities to identify everyone to whom information about him had been disclosed during the previous **two years**, including the content of those disclosures. He was particularly interested in learning who had received his former address. (Judgment, para. 23.)

The municipality provided information for only the preceding year. Dutch law required records of disclosures to be retained for one year, and older disclosure records had been automatically erased. (Judgment, paras. 20–21, 24–25.)

The Dutch Raad van State therefore asked whether limiting access to the preceding year was compatible with Article 12(a) of the Data Protection Directive, considered together with the storage-limitation rule in Article 6(1)(e) and proportionality. (Judgment, paras. 28–31.)

## Why the case matters

*Rijkeboer* treats access as more than a right to receive information. **Access is what makes other data-protection rights usable.**

A person who cannot discover that their information was improperly disclosed may be unable to seek correction, erasure, blocking, notification of recipients, objection, judicial relief, or compensation. That is why the Court concluded that access to information about recipients must, by necessity, extend into the past. (Judgment, paras. 49–54.)

The important qualification is that *Rijkeboer* did **not** establish an unlimited historical right of access. Instead, it required a **fair balance** between effective data-subject rights and the burden imposed on controllers by retaining historical disclosure information. (Judgment, paras. 56–66.)

## Key holding

The Court reached three connected conclusions.

- **Access must be capable of reaching into the past.** Otherwise, individuals could not effectively exercise rights concerning unlawful or inaccurate processing or pursue legal remedies. (Judgment, paras. 51–54.)
- **Member States may set time limits**, but their discretion is not unlimited. The period must allow data subjects effectively to exercise the rights protected by Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Directive 95/46 or the Data Protection Directive.) (Judgment, paras. 56–57.)
- **One year was not a fair balance in these circumstances** where the underlying personal data were retained much longer—unless longer retention of the disclosure history would impose an excessive burden on the controller. (Judgment, paras. 64–66.)

## The Court’s analysis

### 1\. Access serves other data-protection rights

The Court began with the purpose of access. Individuals must be able to verify that their personal data are accurate, lawfully processed, and disclosed only to authorized recipients. (Judgment, paras. 46–50.)

Access also enables the exercise of other rights: rectification, erasure or blocking; notification of recipients; objection to processing; and judicial remedies and compensation. (Judgment, paras. 51–52.)

### 2\. That means access must reach into the past

Article 12 did not expressly specify how far into the past access had to extend. But the Court concluded that the right **“must of necessity relate to the past.”**  (Judgment, para. 54.)

Otherwise, a person could lose the practical ability to challenge unlawful or inaccurate processing simply because the record showing what happened had disappeared. (Judgment, paras. 53–54.)

This is the core of *Rijkeboer*: **the effectiveness of the underlying rights helps determine the required scope of access.**

### 3\. But historical access is not unlimited

The Court nevertheless recognized that retaining disclosure histories indefinitely could impose substantial burdens, particularly where disclosures are frequent or involve many recipients. The Data Protection Directive did not require controllers to bear disproportionate burdens. (Judgment, paras. 56–63.)

Member States could therefore establish retention periods. Relevant considerations could include the sensitivity of the underlying data, how long those data were retained, the number of recipients, applicable limitation periods for legal actions, and the burden on the controller. (Judgment, paras. 58–63.)

### 4\. One year was too short unless longer retention was excessively burdensome

The problem was the mismatch.

Rotterdam could retain Mr Rijkeboer’s underlying personal data for a long period while keeping information about **who received those data and what was disclosed** for only one year. The Court held that this did not constitute a fair balance unless longer retention of the disclosure information would impose an excessive burden on the controller. (Judgment, paras. 64–66.)

The national court was responsible for making that factual determination. (Judgment, para. 66.)

## The Advocate General’s Opinion

Advocate General Ruiz-Jarabo Colomer framed the case as a tension **within data protection itself**: deleting data protects individuals, but deleting the history of how those data were used can prevent them from discovering and challenging past processing. (Opinion, paras. 2, 23–28.)

He treated access as a **“basic pillar”** of the Directive because it enables individuals to verify whether processing was lawful and enforce their rights. He therefore considered deletion secondary to access and viewed information about past disclosures as part of the protected data-processing record. (Opinion, paras. 29–45.)

For him, a one-year limit could be disproportionate—particularly where the individual had not been told about the disclosure, the access period, or the recipients. Because a fundamental right was at stake, he would place the burden on the controller to justify such a short period. (Opinion, paras. 64–73.)

The **Court ultimately adopted a more flexible fair-balance test**, weighing effective access against the burden that longer retention would impose on the controller.

## What the Court did—and did not—decide

The Court **did** decide that the right of access to recipient and disclosure information must extend into the past sufficiently to make the data subject’s rights effective, and that a one-year limit was not a fair balance on the facts presented unless longer retention would impose an excessive burden. 

It **did not** establish a universal retention period, require indefinite preservation of disclosure histories, or hold that recipient information must always be retained for exactly as long as the underlying personal data. The Court deliberately left Member States room to balance effective access against proportionality and controller burden.

## Rijkeboer under today’s GDPR

*Rijkeboer* interpreted Directive 95/46, not the General Data Protection Regulation (GDPR.) But its basic logic remains highly relevant—particularly at the intersection of the GDPR’s **right of access** and **storage-limitation principle**.

Article 15 GDPR now expressly gives individuals access to information about **“the recipients or categories of recipient”** to whom their personal data have been or will be disclosed. More broadly, access allows individuals to understand how their data is being used and provides the foundation for exercising other rights, including rectification, erasure, restriction, and objection. For more on that framework, see [**What is the “Right of Access” under the GDPR?**](https://www.thedelatorrereview.com/what-is-the-right-of-access-under-the-gdpr/)

At the same time, Article 5(1)(e) GDPR requires personal data to be kept **no longer than necessary** for the purposes of processing. Retention periods therefore must be justified by purpose rather than imposed indefinitely “just in case.” See [**What does “storage limitation” mean under the GDPR?**](https://www.thedelatorrereview.com/what-does-storage-limitation-mean-under-the-gdpr/)

That does not mean, however, that longer retention is inherently preferable. In [**Digital Rights Ireland**](https://www.thedelatorrereview.com/digital-rights-ireland-why-communications-metadata-can-reveal-a-life/), the Court emphasized the opposite side of the proportionality equation: retention of communications metadata is itself an interference with privacy and data-protection rights, and retention periods must be objectively justified rather than imposed indiscriminately. **Ministerio Fiscal** later reinforced that proportionality depends on what the particular data can actually reveal: more revealing data create a more serious interference and demand correspondingly stronger justification.

Those cases arise in a very different context—**government access to retained communications data under the ePrivacy Directive and the Charter**—and should not be read as determining how long an ordinary GDPR controller must retain disclosure records. But they reinforce the broader point relevant to *Rijkeboer*: **retention is itself processing, and proportionality operates in both directions.** Data should not be retained longer than justified, but neither should information necessary to make a statutory right effective disappear before that right can realistically be exercised.

*Rijkeboer* therefore **does not establish a general rule that disclosure logs must be retained for as long as the underlying personal data.** It instead requires a balance between competing considerations: 

---

> **Retention periods must not be so short that the right of access becomes ineffective, while continued retention must itself remain justified and proportionate in light of the circumstances of the processing.**

---

## Conclusion

*Rijkeboer* makes the right of access practical rather than merely formal.

If information necessary to understand past processing disappears too quickly, the individual may lose the ability to challenge that processing at all. Member States may impose limits, but those limits must preserve a fair balance between effective data-subject rights and the burden on the controller.

**Put simply: a right to know what happened to your data is not very useful if the records disappear before you can ask.**

## Sources and Useful Reading

### Sources

CJEU judgments, Advocate General opinions, and related case materials are available through [**InfoCuria**](https://infocuria.curia.europa.eu/tabs/tout?lang=EN&ref=thedelatorrereview.com), the Court of Justice of the European Union’s official case-law database. Cases can be located by searching the case name or case number (C-553/07).

- Court of Justice of the European Union, Third Chamber, Case C-553/07, *College van burgemeester en wethouders van Rotterdam v M.E.E. Rijkeboer*, Judgment of 7 May 2009, ECLI:EU:C:2009:293.
- Opinion of Advocate General Dámaso Ruiz-Jarabo Colomer, Case C-553/07, *Rijkeboer*, delivered 22 December 2008, ECLI:EU:C:2008:773.

### Useful reading from The De La Torre Review

- **“What Is the ‘Right of Access’ Under the GDPR?”** An overview of Article 15 GDPR, including the right to obtain information about recipients, a copy of personal data undergoing processing, and the relationship between access and other data-subject rights. It provides the modern GDPR framework for the right at the center of *Rijkeboer*. Read the Article. [Read the Article.](https://www.thedelatorrereview.com/what-is-the-right-of-access-under-the-gdpr/)
- **“What Does ‘Storage Limitation’ Mean Under the GDPR?”** A closer look at the principle that personal data should not be retained longer than necessary and the need to establish justified retention periods. It provides the other side of the tension in *Rijkeboer*: preserving enough information to make access effective without retaining data unnecessarily. [Read the Article. ](https://www.thedelatorrereview.com/what-does-storage-limitation-mean-under-the-gdpr/)
- **“Digital Rights Ireland: Why Communications Metadata Can Reveal a Life.”** A later CJEU decision examining the opposite side of the retention problem: the fundamental-rights consequences of retaining communications metadata too broadly or for periods that are not objectively justified. Although it arose in the surveillance context, it illustrates why retention itself must satisfy proportionality. [Read the Article.](https://www.thedelatorrereview.com/digital-rights-ireland-why-communications-metadata-can-reveal-a-life/)
- **“Ireland v. Parliament: The EU Had Power to Require Data Retention—But That Wasn’t the End of the Story.”** *Ireland* provides a useful contrast to *Rijkeboer*. While *Rijkeboer* considered how long information must remain available so that a data subject’s right of access remains effective, *Ireland* concerned mandatory retention of communications metadata for eventual law-enforcement purposes. Together, the cases illustrate why retention cannot be evaluated in the abstract: its legal significance depends on its purpose, context, and the interests or rights the retention serves. [Read the Article.](https://www.thedelatorrereview.com/ireland-v-parliament-the-eu-had-power-to-require-data-retention-but-that-wasnt-the-end-of-the-story/)
- **"Bavarian Lager: When Transparency Requests Become Data-Protection Questions."** *Bavarian Lager* illustrates the other side of access rights. While *Rijkeboer* emphasizes the information a data subject may need to exercise the right of access effectively, *Bavarian Lager* shows that a right of access to information does not automatically extend to third-party personal data contained within it. Those data remain independently subject to data-protection requirements.[Read the Article. ](https://www.thedelatorrereview.com/bavarian-lager-when-transparency-requests-become-data-protection-questions/)
- **“Ministerio Fiscal: Not All Access to Communications Data Is Equally Intrusive.”** A later CJEU judgment refining the proportionality analysis for access to retained communications data. The Court emphasized that the seriousness of an interference depends on what the particular data can reveal—useful context for understanding why retention and access cannot be assessed in the abstract. [Read the Article.](https://www.thedelatorrereview.com/ministerio%5Ffiscal/)
- **"CRIF: When a “Copy” of Your Personal Data Requires More Than a Data List."** Develops the Court’s access-rights jurisprudence under the GDPR. Like *Rijkeboer*, *CRIF* focuses on making access effective: the data subject must receive information in a form that allows the processing to be understood and relevant rights to be exercised. *CRIF* adds that this may require document or database context where necessary to make the personal data intelligible. [Read the Article.](https://www.thedelatorrereview.com/crif-when-a-copy-of-your-personal-data-requires-more-than-a-data-list/)
- **Nowak: When an Exam Answer Becomes Personal Data** — Complements *Rijkeboer*’s analysis of the right of access by addressing the logically prior question of what information qualifies as personal data. *Nowak* explains that information may relate to an individual through its **content, purpose, or effect**, helping define the information to which data-subject rights may attach. [Read the Article.](https://www.thedelatorrereview.com/nowak-when-an-exam-answer-becomes-personal-data/)

![](https://storage.ghost.io/c/54/ef/54efeb65-4f2f-479e-b4bb-a9ee526feeaa/content/images/2026/09/ChatGPT-Image-Jul-4--2026-at-04_44_14-PM-14.png)