LVAT - eA-395-525/2024
From GDPRhub
| LVAT - eA-395-525/2024 | |
|---|---|
 | |
| Court: | LVAT (Lithuania) |
| Jurisdiction: | Lithuania |
| Relevant Law: | Article 6(1) GDPR Article 6(1)(c) GDPR Article 6(1)(f) GDPR |
| Decided: | 10.07.2024 |
| Published: | |
| Parties: | Valstybinė duomenų apsaugos inspekcija BĮ Klaipėdos miesto socialinės paramos centras |
| National Case Number/Name: | eA-395-525/2024 |
| European Case Law Identifier: | |
| Appeal from: | Vilnius Regional Administrative Court (Lithuania) |
| Appeal to: | Unknown |
| Original Language(s): | Lithuanian |
| Original Source: | LITEKO (in Lithuanian) |
| Initial Contributor: | fb |
A court ruled that a public legal person which performs state or municipal functions is equivalent to a public authority and, therefore, cannot rely on legitimate interest as a legal basis.
English Summary
Facts
The data subject is an employee of the controller, the budgetary institution Klaipėda City Social Support Centre (Klaipėdos miesto socialinės paramos centras). On 2 April 2021, the controller’s Ethics Committee received a report stating that the data subject allegedly had behaved in an unethical way in the workplace environment. These conducts consisted in writing disrespectful statements about her colleagues and managers in a closed Facebook group and, more generally, having a rude attitude while working.
On 6 August 2021, the data subject filed a complaint with the DPA. She argued that the investigation of the Ethics Committee infringed data protection law, as it processed her personal data without a legal basis under Article 6(1) GDPR. The data subject complained that the Committee unlawfully obtained her correspondence in the closed Facebook group.
The DPA upheld the complaint. It found that the controller could not base its processing on legitimate interest under Article 6(1)(f) GDPR and that, however, it had not applied the balancing test of legitimate interests and did not assess whether the legitimate interests of the controller override the rights and freedoms of the data subject. Moreover, the DPA noted that the controller can be compared to a public authority acting in the performance of their task. Therefore, according to Article 6(1) GDPR, Article 6(1)(f) GDPR cannot apply.
The decision was appealed before the Vilnius Regional Administrative Court (Vilniaus apygardos administracinis teismas). On 27 February 2023, the controller’s appeal was dismissed. The court held that the act of receiving and analysing the data subject’s posts constitutes processing of personal data under Article 4(2) GDPR. Moreover, it pointed out that the processing of personal data is lawful only if it relies on one of the legal basis contained in Article 6(1) GDPR. As for Article 6(1)(f) GDPR, the court found that the controller had not proven that its alleged interest of ensuring a safe environment for all employees overrides the data subject’s right of expression and of protection of her data.
Holding
Firstly, the court agreed with the DPA’s argument about legitimate interest. It noted that the controller is a budgetary institution, which is public legal person with limited civil liability, performing state or municipal functions, and is therefore equivalent to a public authority. Therefore, the processing cannot rely on the legal basis provided for by Article 6(1)(f) GDPR.
However, the court noted that the controller was under a legal obligation to examine the applications submitted to the Ethics Committee. Therefore, it held that the controller had lawfully processed this data as Article 6(1)(c) GDPR applied. On these grounds, the court upheld the appeals brought by the controller, annulled the decision of the Vilnius Regional Administrative Court and annulled the decision of the DPA.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Lithuanian original. Please refer to the Lithuanian original for more details.
Administrative file no. eA-395-525/2024 Judicial process no. 3-61-3-05368-2022-1 Procedural decision category 26 (S) SUPREME ADMINISTRATIVE COURT OF LITHUANIA S P R E N D I M A S ON BEHALF OF THE REPUBLIC OF LITHUANIA 2024 July 10 Vilnius The panel of judges of the Supreme Administrative Court of Lithuania, consisting of judges Laimutis Alechnavičiaus (chairman of the panel and speaker), Rytis Krasauskas and Egidijus Šileikis, at the court session, the appellate procedure of the written process examined the administrative case according to the appeal of the applicant's budgetary institution Klaipėda City Social Support Center against the Vilnius District Administrative Court in 2023. February 27 decision in the administrative case according to the complaint of the applicant's budgetary institution Klaipėda City Social Support Center to the defendant State Data Protection Inspectorate (the third interested party - R.L.) regarding the annulment of the decision. The panel of judges set by: I. 1. The applicant budgetary institution Klaipėda City Social Support Center (hereinafter referred to as the Center) appealed to the court with a complaint, requesting the cancellation of the 2022 decision of the State Data Protection Inspectorate (hereinafter referred to as the Inspection). September 29 decision no. 3R-821(2.13.-1.E) regarding R. L. 2021 August 13 of the complaint (hereinafter referred to as the Decision). The applicant also sought an order to pay the costs incurred by the respondent. 2. The applicant stated in the complaint that: 2.1. By decision, the inspection recognized R.L.'s complaint as well-founded and reprimanded the Center for processing R.L.'s personal data in the absence of any 2016 April 27 Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as GDPR) Article 6(1) for the condition of legal data processing. 2.2. Inspection in 2021 August 6 received R.L.'s complaint, which she supplemented in 2021. on August 13, which states that the Ethics Commission of the Center illegally, in the absence of R.L.'s meeting, obtained and used the data of her correspondence from a closed Facebook (hereinafter - Facebook) group containing R.L.'s name and surname, therefore, according to R.L., these data , the center handles illegally. 2.3. The inspection recognized the Center's processing of R.L.'s personal data as illegal in two respects. First, the Inspectorate concluded that the Center could not base the processing of personal data on GDPR Article 6(1)(f) in this case. Secondly, the Inspectorate concluded that the Center did not perform a test of the balance of legitimate interests and did not assess whether the legitimate interests of the data controller prevail over the rights and freedoms of the data subject. Both of the aforementioned conclusions of the Inspection are unfounded. 2.4. 2021 April 2 and 2021 April 7 The Center's Ethics Commission received two reports (hereinafter referred to as Reports) requesting an assessment of R.L.'s possibly unethical behavior in the work environment. The reports stated that R.L. behaves unethically while completing the reflections, acts destructively, behaves contemptuously in relation to the company's statutes, disrespects the instructions of the management, simply bullies "behind the scenes". It is said that it is very unpleasant to feel close, to work in the same team. It was also noted that R.L. uploads messages that humiliate the institution, its managers and employees in the subgroup's closed Facebook group. Based on these Reports, the Ethics Commission of the Center conducted an investigation. 2.5. R.L. refers to the allegedly private correspondence in the Facebook group (hereinafter referred to as the Group), which was allegedly made public and whose investigation by the Ethics Commission alleged that the Center violated the requirements for processing personal data, cannot be considered private correspondence, given that the Facebook group is used in the work of employees as a means of disseminating information (the former head of the subgroup to which R.L. belongs created an internal closed group, which includes all employees belonging to this subgroup, in order to promptly exchange work-related information, this Group is closed only conditionally, because it is accepted and in which all information can be published and received all employees of this subgroup can). 2.6. The Center did not collect the information published by R.L. in the Group itself, but received this information from the Center's employees with Notifications, in which the employees informed the Center about possible improper behavior of R.L. in the work environment, and provided the information published by R.L. in the Facebook group as evidence of possible improper behavior of R.L. in the work environment. R.L. herself initiated discussions with other employees of the Center, publicly published relevant information about her written reflections in this group, which was visible to all employees of this subgroup of the Center, thus deliberately spreading the information of the dispute to other employees of the Center subgroup, who also use this Group. 2.7. To the Ethics Commission of the Center (hereinafter referred to as the Commission) of the Director of the Center in 2020. June 25 by order no. V-520 approved work regulations of the Ethics Commission of the Klaipėda City Social Support Center of the Budgetary Institution (hereinafter referred to as the Regulation) assign the function of supervising the compliance of the Center's employees with the code of ethics, receiving and considering official reports of the Center's management and employee requests regarding violations of the code of ethics. After receiving R.L.'s correspondence from the Group, the Commission did not disseminate this information anywhere, did not make it public to third parties. Clause 8 of the Regulation establishes the requirement of confidentiality, there is no evidence that the members of the Commission have violated this requirement. The received data were processed for a specific, clearly defined and legitimate purpose - to ensure the interests and duties of the Center, as an employer, related to the implementation of the provisions of Article 30, Paragraphs 1, 2, Article 58, Paragraphs 4 and 5 of the Labor Code of the Republic of Lithuania (hereinafter referred to as DK) . In the case under consideration, the Commission could not conduct an investigation without examining the information on which R.L.'s possibly inappropriate behavior was based. 2.8. R.L.'s personal data was processed in accordance with the balance of interests and only to the extent that it was necessary. Disagrees with the conclusion of the Decision that the applicant did not justify that his legitimate interests as a data controller are higher than the rights and freedom of R.L. as a data subject. R.L. herself disseminated information in the Group used by employees for work purposes and created only for that purpose, using the Group in an inappropriate way, she cannot expect that the information she consciously and publicly disseminates to other employees of the Center's subgroup in the work environment will be protected in terms of personal data protection. In this case, the duty and interest of the Center to respond to the report of other employees about R.L.'s inappropriate behavior in the work environment was higher than R.L.'s rights and freedoms. 2.9. Disagrees with the assessment of the Inspection that the Center is comparable to government institutions. However, even if it were to be considered that the Center is comparable to public authorities, the essential aspect of the exception established in Article 6(1)(f) GDPR is that this clause cannot be applied to data processing carried out by public authorities in the performance of their tasks. Thus, according to Article 6(1) of the GDPR, Article 6(1)(f) of the GDPR does not apply to public authorities in general, not in all cases, but only in cases where the public authority carries out data processing in the performance of its tasks. In this case, the Inspection did not substantiate in the Decision what tasks the Center carried out, as a government institution, in processing R.L.'s personal data. In this case, the Center processed R.L.'s personal data acting against R.L. not as a public authority performing its functions, but as an employer against an employee. Therefore, in this case, when dealing with the processing of the employee's personal data by the Center, the exception provided for in Article 6(1) of the GDPR specified in the Decision is not applicable, according to which Article 6(1)(f) of the GDPR does not apply to data processing carried out by public authorities in the performance of their tasks. Therefore, the Inspection unjustifiably decided in the Decision that the Center could not base the processing of personal data in this case on Article 6, Paragraph 1, Point f of the GDPR. 2.10. The defendant must comply with the principles of public administration established in Article 3 of the Law on Public Administration of the Republic of Lithuania (hereinafter - VAĮ). The principle of the supremacy of the law is enshrined in Clause 4 of Article 3 of the VAĮ, which means that the powers to perform public administration for public administration entities must be determined in accordance with the requirements established by this law, and the activities of public administration entities must comply with the legal bases set forth in this law. Administrative decisions related to the implementation of the rights and duties of individuals must in all cases be based on laws. The inspection made a Decision that was not based on the provisions of legal acts and facts and was not motivated. 3. In its response to the complaint, the defendant Inspectorate asked to reject it and indicated that receiving data from other employees of the Center should be considered data processing. The applicant's explanations to the Inspectorate, the statements of the complaint only confirm that the applicant handled the received personal data of R.L. The applicant, as a data controller, was required to prove that R.L.'s personal data was processed in compliance with GDPR requirements. The applicant based the data processing of the dispute on Article 6(1)(f) of the GDPR, which requires an assessment of whether the interest is sufficiently expressed to be able to apply the balance criterion, comparing it with the rights and freedoms of the data subject. During the hearing of the complaint, the applicant did not provide evidence that the processing of the disputed data is necessary to ensure legitimate interests that are superior to the interests of the data subject or the fundamental rights and freedoms that require the protection of personal data. 4. The third interested party, R.L., in response to the complaint, essentially requested its rejection. 5. The third interested party stated that the sanction (reprimand) prescribed by the contested Decision is too mild a punishment for the committed violation, but did not ask for the Decision to be canceled or changed. He did not agree with the applicant's statements that the private Group should be considered a working environment. The Group did not have any rules regarding the content of the discussions, and the Group cannot be considered a working tool of the Center. The private correspondence of the members of the group was made public without its consent and is illegal. The applicant wrongly claimed that the data was processed for the purpose of ensuring work ethics, given that the requests were not properly motivated. According to a third interested party, the aim was to fight against openly expressed opinions about the legitimacy of the requirement to write reflections, which could be considered persecution for criticism. The third party concerned has not committed any ethical violations and has not been sanctioned. The authors of the messages are hidden, therefore, according to the third interested party, the data of the dispute was processed by the Center's administration. II. 6. Vilnius District Administrative Court in 2023. February 27 decision rejected the applicant's complaint. 7. The court noted that there was a dispute in the case regarding the State Data Protection Inspectorate in 2022. September 29 decision no. 3R-821(2.13.-1.E), by which the applicant was found to have illegally processed personal data and was reprimanded, legality and reasonableness. 8. The court found that: 8.1. in 2021 April 2 and 2021 April 7 The Center's Ethics Commission received reports requesting an assessment of R.L.'s possibly unethical behavior in the work environment. From the correspondence in the IMK Facebook group, it appears that the group is identified as a "private group", 22 people. Ethics Commission of the Center in 2021 May 11 at the meeting also considered by protocol decision no. 4 (hereinafter referred to as the Protocol Decision) decided: 1) not to issue the disciplinary sanctions provided for in the work regulations of the R.L. Center's Ethics Commission to the visiting supervision staff of the DSGS Center; 2) to recommend the Center's administration to adjust the part of the description of the procedure for improving the competence of the Center's employees regarding the preparation of reflections, where the preparation of the reflection is provided only for employees of category C; it is suggested that all categories of Center employees prepare reflections; 3) to recommend the Center's administration to take preventive measures regarding the formation of communication culture skills of the Institution, to organize training on strengthening cooperation and conflict resolution, using mediation, in order to foster and develop mutual understanding and benevolence among the members of the Center's community, to stop internal confrontation or opposition, to prevent internal foci of discord , which causes tension and stress, harms the physical and emotional health of employees, and the quality of their work. It can be seen from the Commission's work decision that, among other things, correspondence data from the Facebook group was analyzed. 8.2. In the inspection in 2021 August 6 R.L.'s complaint was received (Inspection Reg. No. 1R-5340(2.13.)), which was supplemented in 2021. August 13 (Inspection Reg. No. 1R-5464 (2.13.Mr)), which states that the Ethics Commission of the Center illegally, in the absence of R.L.'s meeting, received and used her correspondence data from the Facebook group, which contains her name and surname, the content of correspondence. Inspection in 2021 August 18 rejected part of the complaint regarding the Center's actions in violation of R.L.'s right to access data. Inspection in 2022 January 6 instructed the applicant in writing to provide information in implementation of the principle of accountability. The Center provided clarifications. In the decision of R.L., the inspection recognized the complaint as justified, recognized the data processing as illegal, based on the fact that the applicant for the data processing of the dispute did not substantiate any of the conditions for the legality of the data processing set out in Article 6 of the GDPR. The decision states that Article 6, Paragraph 1, Clause f of GDPR does not apply to data processing carried out by public authorities in the performance of their tasks, therefore the Center, which is a budgetary institution (a public legal entity with limited civil liability, implementing the functions of the state or municipality, is therefore equated to a public authority ), unjustifiably relied on the condition of legality of data processing specified in point f of Article 6, paragraph 1 of the GDPR. The decision states that the applicant did not provide evidence that the processing of personal data in dispute is necessary to ensure legitimate interests that are superior to the interests of the data subject or that the fundamental rights and freedoms that make it necessary to ensure the protection of personal data are superior to them and did not pass the test of the balance of legitimate interests . The measure of reprimand assigned to the Center by the decision is a reprimand. The decision was adopted in accordance with the Law on Legal Protection of Personal Data of the Republic of Lithuania (hereinafter referred to as ADTAĮ), Article 31, Part 1, Point 1, Part 2, Point 1, and Article 58, Part 2, Point b of GDPR. 9. The court, based on Article 4(1) of the GDPR, stated that the legislation defines the concept of personal data broadly enough. The court, after assessing Article 4, Clause 2 of the GDPR (data processing), stated that the applicant's arguments that the data were provided by other persons are not significant, since upon receiving personal data and performing at least one of the specified actions, it is considered that personal data processing has been carried out , which is subject to legal acts regulating the protection and processing of personal data. The court noted that the material scope of the regulation is defined in Article 2 of the GDPR, providing for an exhaustive list of exceptional situations or areas in which the provisions of the GDPR do not apply (data are processed in the course of activities to which Union law does not apply; data are processed by member states in the course of activities covered by Title V of the EU Treaty section 2; the data is processed by a natural person, engaged in exclusively personal or household activities; the data is processed by the competent authorities for the prevention, investigation, detection or prosecution of criminal offenses, including protection against threats to public safety, purposes). In this case, the applicant did not indicate or prove such situations, the court did not determine. 10. The court indicated that the processing of personal data is considered legal only in compliance with the principles related to the processing of personal data set forth in Article 5 of the GDPR and in the presence of at least one of the conditions for the processing of personal data set forth in Paragraph 1 of Article 6 of the GDPR. Pursuant to Article 6(1) of the GDPR, data processing is lawful only if at least one of the following conditions applies and only to the extent that it applies: points (a-f). The court noted that there is no dispute regarding the factual circumstances established in the case, that the applicant, having received the requests and R.L.'s correspondence submitted with them from the closed Facebook group, examined, analyzed and evaluated them at the Commission meeting and adopted the Protocol decision. In the court's assessment, the aforementioned actions are considered personal data processing, taking into account the definition of data processing established in Article 4, point 2 of the GDPR, according to which data processing includes, among other things, recording, familiarization, and storage. Taking this into account, the court decided that the defendant reasonably came to the conclusion that the processing of R.L.'s data by the applicant is subject to GDPR requirements. 11. As a result, the Inspectorate, while examining the data subject's complaint, assessed the explanation provided by the applicant and the legality of data processing on the basis specified. The court noted that Article 6(1) GDPR states that GDPR Article 6(1)(f) does not apply to data processing carried out by public authorities in the performance of their tasks. If the processing of personal data is based on the legitimate interests of the data controller or a third party (GDPR Article 6, paragraph 1, point f), it is mandatory to assess whether the legitimate interest of the data controller is superior to the interests or fundamental rights and freedoms of the data subjects, i.e. i.e. carry out a balancing of interests test. When applying the condition of lawful processing of personal data provided for in Article 6(1)(f) of the GDPR, it is important to assess whether the interest is sufficiently expressed to be able to apply the balance criterion, comparing it with the rights and freedoms of the data subject. 12. The court noted that the applicant did not prove to either the Inspectorate or the court that the private Facebook group is a work tool used exclusively for work purposes. According to the distribution of the burden of proof in court proceedings, each party must prove its claims. On the other hand, the processing of personal data obtained even in the work environment must be legal and carried out in advance for the purpose determined before data collection and the data is used only for the intended purposes. In the practice of the Supreme Administrative Court of Lithuania (hereinafter referred to as LVAT), it has been repeatedly emphasized that the data controller is responsible for compliance with the principles related to the processing of personal data enshrined in Article 5, Part 1 of the GDPR, and it is the data controller who must prove that personal data could have been processed and that due to this did not violate the principles related to the processing of personal data enshrined in Article 5, Part 1 of the GDPR (i.e. the principle of legality, fairness and transparency; the principle of purpose limitation; the principle of reducing the amount of data; the principle of accuracy; the principle of limitation of storage duration; the principle of integrity and confidentiality). This means that the data controller has the obligation to provide sufficient supporting evidence (e.g. the decision of the extended panel of judges of 2 July 2021 in administrative case No. eA-745-261/2021). As a result, the data controller (Centre) had to prove that personal data was processed in compliance with GDPR requirements. 13. From the appealed Decision, the Court established that the Inspectorate evaluated the explanations given by the applicant regarding the processing of personal data and concluded that the Center did not substantiate the legality of the processing of R.L.'s personal data by any of the legal conditions for the processing of personal data set out in Article 6 of GDPR and processed them illegally, therefore it did not agree with the applicant's complaint with the arguments presented to the court, that the contested Decision does not meet the requirements of the Law on Public Administration for administrative decisions, and was adopted in violation of the principles of public administration (rule of law, legal certainty). 14. The court emphasized that the practice of LVAT also indicates that the supervisory authority (Inspection) must assess and determine whether the explanations and evidence provided by the data controller are sufficient to state that the data were processed in a manner compatible with the purpose of processing and that legality was observed in doing so, the principles of fairness, transparency, purpose limitation, reduction of data volume, accuracy, while at the same time the rights of the data subject are not violated (e.g. the ruling of December 9, 2020 in administrative case No. eA-4388-968/2020). Pursuant to Article 6(1)(f) of the GDPR, the processing of personal data is considered lawful when the processing of data is necessary for the pursuit of the legitimate interests of the data controller or a third party, except in cases where such interests of the data subject or fundamental rights and freedoms that make it necessary to ensure the protection of personal data are above them, especially when the data subject is a child. The applicant essentially indicates his interest as an employer in ensuring a safe environment for all employees, ethical behavior in the team, and disciplining persons who do not comply with ethical requirements. In this aspect, the court noted that it has not been proven that this interest declared by the applicant as an employer is superior to a person's right to self-expression and the protection of his data, which is an integral part of every person's private life (constitutional value, Article 22, a value enshrined in international legal acts, e.g. Articles 8, 10 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, Articles 7, 8, 11 of the Charter of Fundamental Rights of the European Union). The applicant, claiming to act as an employer, did not substantiate that the processed data was generally related to the performance of work functions. The correspondence shows that R. L. criticized the decisions and distribution of functions of some of the employer's employees in a closed private Facebook group of 22 people, instructing an exclusive part of the employees to fill in the reflections. The court came to the conclusion that the assessment of the content of the reflection questionnaires filled out by R.L. and the entries in them, which were submitted to the Center as an employer, was sufficient for the assessment of ethical requirements. However, the handling of a larger volume, namely personal data obtained from a private Facebook group, was not justified by the applicant's stated goal of protecting a safe working environment and ensuring ethical requirements in the working environment. As can be seen from the case material and the arguments of the applicant's explanations to the Inspectorate and the court, the applicant, before processing the personal data in question, had not performed a balance of interests test and only during the investigation of the complaint at the Inspectorate and in the complaint submitted to the court, the argumentation about the protection of the employer's interests is developed, i.e. i.e. The applicant's interest was generally not sufficiently expressed in the explanation provided to the inspection. 15. The court emphasized that the arguments of the applicant's complaint about the functions of the Ethics Commission operating at the Center, the duties of the Commission members provided for in the work regulations and compliance with confidentiality requirements do not deny the fact that personal data were illegally processed, since the applicant did not justify the personal data processing he indicated in Article 6(1)(f) of GDPR legality on the basis of point However, it was reasonable to evaluate all the established circumstances when it was decided to only reprimand the applicant for illegal processing of personal data. When the complaint or part of it is recognized as justified, the Inspectorate provides the data manager and/or data processor with reasons, instructions, recommendations and/or applies other GDPR Article 58, Part 2, Article 33 of this Law and other laws regulating personal data and/or privacy protection, specified measures (Article 31, d. 2, p. 1 of the Administrative Code of Administrative Offenses). The remedy is intended in accordance with Article 58(2)(b) of the GDPR, which provides for the powers of the supervisory authority to take remedial action, including the right to issue reprimands for an infringement. The inspection, within the limits of competence, after recognizing the complaint as justified, applied a proportionate measure (reprimand) for the discussed data processing violation. After summarizing the presented arguments, the court came to the conclusion that there is no legal basis for annulling the appealed legal and reasonable administrative decision. III. 16. In the appeal, the applicant requests the annulment of the decision of the Vilnius District Administrative Court in 2023. February 27 decision and make a new decision - to satisfy the applicant's complaint; order all litigation expenses incurred by the applicant in the courts of the first and appellate instances in favor of the Inspection Center. The appeal is based on the following arguments: 16.1. The court did not analyze the essential reasons on which the defendant based the appealed Decision. The first reason, on the basis of which the defendant based the Decision, was that the Center in this case could not base the processing of personal data on Article 6, Paragraph 1, Clause f of the GDPR. This motive was not examined in the court's decision. When deciding the question of whether the defendant reasonably concluded that the applicant could not justify the processing of personal data on the basis of Article 6(1)(f) of GDPR, the court first had to determine whether the investigated case of processing of personal data should be considered the tasks performed by the applicant as a public authority, but the court completely rejected this aspect did not investigate, although the Inspection based the Decision on that aspect. In the case under consideration, the applicant had the right to justify the processing of personal data on the basis of Article 6(1)(f) of GDPR. The data, the improper processing of which the applicant is accused of, was processed during the investigation of a possible violation of the person's work duties. In such a case, the data processing is justified on the basis of Article 6(1)(f) of the GDPR - processing the data is necessary for the pursuit of the legitimate interests of the data controller or a third party, except in cases where such interests of the data subject or fundamental rights and freedoms that require the protection of personal data are overridden override them, especially when the data subject is a child. 16.2. The defendant's conclusion that the Center is equivalent to public authorities cannot be accepted. However, even if the Center is considered to be comparable to public authorities, the essential aspect of the exception established in Article 6(1)(f) GDPR is that this clause cannot apply to data processing carried out by public authorities in the performance of their tasks. Thus, according to Article 6(1) of the GDPR, Article 6(1)(f) of the GDPR does not apply to public authorities not exclusively in all cases, but only in cases where the public authority carries out data processing in the performance of its tasks. In this case, the Inspection did not justify in the Decision what tasks the Center carried out, as a public authority, in processing R.L.'s personal data. In this case, the Center processed R.L.'s personal data while acting against R.L. not as a public authority performing its functions, but as an employer against an employee, therefore, in this case, when dealing with the processing of the employee's personal data by the Center, the exception provided for in Article 6, Part 1 of the GDPR does not apply, according to which the GDPR Article 6(1)(f) does not apply to data processing carried out by public authorities in the performance of their tasks. Therefore, the Inspectorate unreasonably decided in the Decision that the Center could not base the processing of personal data in this case on point f of Article 6, Paragraph 1 of the GDPR, and the court unreasonably did not say anything about this clear violation of the application and interpretation of the law. 16.3. The Inspection also concluded that the Center did not perform a test of the balance of legitimate interests and did not assess whether the legitimate interests of the data controller are higher than the rights and freedoms of the data subject. First, the alleged private correspondence of R.L. in the Facebook group, which was allegedly made public and whose investigation by the Ethics Commission allegedly violated the requirements for processing personal data, is indeed not considered private correspondence. The actions of employees in the Facebook group are not separated from the performance of their job functions and work-related responsibilities. In contrast, a Facebook group is one tool used at work. The Facebook group was created specifically by the former managers of the subgroup to which R.L. belongs, and this Facebook group unites only the employees of this subgroup. The Facebook group is called "Imk" (an abbreviation of Irina's Women's Team) in order to emphasize that this Facebook group communicates specifically with employees who belong to the subgroup of the social welfare department of Center Dienos led by I.P. The whistleblowers clearly identified that R.L. may be engaging in unethical behavior in a closed Facebook group that is a sub-group and only includes female employees of the sub-group. From the correspondence in the file in the Facebook group, it can be seen that the correspondence between the employees takes place there precisely on weekdays and during working hours, and not during free time, rest or holidays. Therefore, there was no basis for the court to conclude that there is a lack of evidence that the Facebook group is work-related and used as a work tool. The essential aspect by which Facebook groups are divided into public and private is the availability of their content to other Facebook users. 16.4. The court unjustifiably decided that the investigation of Facebook correspondence was redundant and unnecessary for the achievement of the goals stated by the applicant. According to the court, it was enough to analyze the reflections examined by R.L. themselves. The Center did not collect the information posted by R.L. in the Facebook group, but received this information from other employees of the Center with Notifications, in which the employees informed the Center about possible inappropriate behavior of R.L. in the work environment, and provided the information posted by R.L. in the Facebook group as evidence of possible inappropriate behavior of R.L. in the work environment. The persons who made the reports clearly stated that they are also asking for an assessment of R.L.'s behavior in the Facebook group, and not just her behavior regarding writing reflections. The applicant stated that the processing of personal data in this case was carried out in the course of investigating a possible violation of work duties, a violation of ethics. The applicant, as an employer, has the duty provided for in Article 30 of the Labor Code to ensure a safe working environment for employees and has the duty and right to respond to a breach of duty committed by an employee, and when investigating and deciding on the application of appropriate measures to the employee, the employer has the duty provided for in Article 58, Part 5 of the Labor Code to take into account all the circumstances related to the violation and to evaluate them. In order to fulfill the duties provided for in Article 30 of the Civil Code, the applicant could not ignore the individual aspects indicated in the reports and not investigate them, especially since R.L.'s unethical and humiliating behavior reached many more people through the messages published in the Facebook group than R.L.'s reflections. 16.5. in 2019 International Labor Organization Convention on the Elimination of Violence and Harassment at Work No. 190 and Recommendation on the elimination of violence and harassment in the world of work no. 206. Although the provisions of the aforementioned convention have been transferred to the DK since 2022. on November 1, but judging by the fact that the convention itself was adopted in 2019, its provisions are relevant in this dispute, assessing the scope of the employer's duty to respond to any manifestations of violence and harassment in the workplace. Therefore, the Center could not ignore and investigate the information provided about the messages R.L. wrote to other employees in the Facebook group, which other employees treated as the behavior of their colleague that humiliated them. Also, paragraphs 4 and 5 of Article 58 of the Labor Code oblige to substantiate the employer's conclusions regarding the violation of work duties, therefore, not being able to rely on the only evidence in which the employee's inappropriate behavior towards other employees is recorded, the employer would not be able to fulfill the obligation to substantiate his conclusions regarding the assessment of the employee's behavior from the aspect of labor discipline. 16.6. Examining issues at the Ethics Commission of the Center cannot be considered disclosure of personal data, because the examination of cases at the Commission is basically actions performed by the employer with the aim of evaluating the employee's actions from an ethical point of view, assessing whether there is a violation of labor discipline, identifying aspects of work organization that can be improved, etc. When solving these issues, the employee's personal data known to the employer is not disclosed and made public. In the case under consideration, the Ethics Commission of the Center, having received R.L.'s correspondence from the Facebook group, did not disseminate this information anywhere, it was not made public to third parties. The personal data specified by R.L. (name, surname, correspondence on the Facebook social network) were not made public, but were processed exclusively for the purpose of evaluating R.L.'s actions as an employee in terms of work discipline and compliance with work ethics. 16.7. In this aspect, assessing the importance of the information examined by the Ethics Commission of the Center for the investigation itself, the fact that the investigation itself was started precisely after receiving the information published by R.L. in the Facebook group, and this information was exactly what raised the question of possible inappropriate behavior by R.L., in the reports, the employees asked the employer to respond precisely to the information spread in R.L.'s own Facebook group, which caused other employees to feel bad in the work environment, the Ethics Commission of the Center could not examine this situation without examining the information received with the reports about the information spread in R.L.'s Facebook group. These circumstances confirm that in this case R.L.'s personal data were processed in accordance with the balance of interests and only to the extent that it was necessary. Therefore, it does not agree with the defendant's decision and the conclusion reached in the court decision that in this case the Center did not justify that its legitimate interests as a data controller are higher than the rights and freedoms of R.L. as a data subject. In this case, the Center's duty and interest in responding to the report of other employees about R.L.'s inappropriate behavior in the work environment was more important than R.L.'s rights and freedoms. 17. In its response to the appeal, the defendant Inspectorate requests the Vilnius District Administrative Court in 2023. February 27 leave the decision unchanged and reject the appeal. The feedback includes the following main arguments: 17.1. The court investigated and evaluated all the legally significant circumstances of the case in detail and made an evidence-based and legally motivated decision. 17.2. In its appeal, the Center rightly points out that Article 6(1)(f) GDPR does not apply to public authorities in general, not in all cases, but only in cases where the public authority carries out data processing in the performance of its tasks. In the event of a dispute, the Center claims that it processed the data while investigating possible violations of R.L.'s work ethics in the working Facebook group, but did not justify a legitimate interest, nor did it specify any other legal processing conditions that would justify the processing of personal data. 17.3. The center essentially states its interest as an employer in ensuring a safe environment for all employees, ethical behavior in the collective, and disciplining persons who do not comply with ethical requirements. The court correctly noted in its decision that it was not proven that this interest declared by the applicant as an employer is superior to the individual's right to self-expression and the protection of his data, which is an integral part of every individual's private life. The center, claiming that it acts as an employer, did not justify that the processed data was generally related to the performance of work functions, which it tries to justify in the appeal. The correspondence shows that R. L. criticized the decisions and distribution of functions of some of the employer's employees in a closed private Facebook group of 22 people, instructing an exclusive part of the employees to fill in the reflections. The court reached a conclusion, with which there is no reason to disagree, that the evaluation of the contents of the reflection questionnaires filled out by R.L. and the entries in them, which were submitted to the Center as an employer, was sufficient for the assessment of ethical requirements. However, the processing of a larger volume, namely the processing of personal data obtained from a private Facebook group, was not justified by the applicant's stated goal of protecting a safe working environment and ensuring ethical requirements in the working environment. The panel of judges states: IV. 18. In the case under consideration, the dispute arose regarding the State Data Protection Inspectorate in 2022. September 29 decision no. 3R-821(2.13.-1.E) on R. L. 2021 August 13 the legality and reasonableness of the complaint, in which the Center was reprimanded for processing R.L.'s personal data in the absence of a single condition for legal data processing specified in Article 6, Part 1 of the GDPR. 19. In the case under consideration, it was established that in 2021 April 2 and 2021 April 7 the applicant's Ethics Commission received two requests requesting an assessment of R.L.'s possibly unethical behavior in the working environment, together with the reports, comments were made on excerpts from correspondence in the Facebook group "IMK" containing R.L.'s statements. Applicant's Ethics Commission in 2021 May 11 2021 was examined at the meeting. April 2 and 2021 April 7 messages and the Facebook group correspondence material provided with the messages and made a protocol decision. 20. It was also established that the defendant in 2021 August 6 received R.L.'s complaint, which was supplemented in 2021. on August 13, which states that the applicant's Ethics Commission illegally obtained and used the content of her correspondence from the Facebook group, which includes her name and surname, in the absence of R.L.'s meeting. Defendant 2022 September 29 decision no. 3R-821(2.13.-1.E) R.L. recognized the complaint as justified, recognized the data processing as illegal, based on the fact that the applicant for the processing of the disputed data (name, surname and correspondence) did not justify any of the conditions for the legality of data processing set out in Article 6 of GDPR . The decision states that GDPR Article 6(1)(f) does not apply to data processing carried out by public authorities in the performance of their tasks, therefore the applicant, which is a budgetary institution (a public legal entity with limited civil liability, implementing the functions of the state or municipality, is therefore comparable to a public authority ), unjustifiably relied on the condition of legality of data processing referred to in Article 6(1)(f) GDPR. The decision states that the applicant did not provide evidence that the processing of the personal data in dispute is necessary to ensure legitimate interests that are superior to the interests of the data subject or that the fundamental rights and freedoms that make it necessary to ensure the protection of personal data are superior to them and did not pass the test of the balance of legitimate interests . The decision imposed a reprimand on the applicant. 21. The court of first instance approved the decision of the State Data Protection Inspectorate in 2022. September 29 in decision no. 3R-821(2.13.-1.E) and rejected the applicant's complaint in its decision. 22. In the submitted appeal, the applicant disagrees with the decision of the court of first instance, requests it to be annulled and a new decision to be made - to satisfy the applicant's complaint. Claims that the processing of R.L.'s personal data was legal based on GDPR Article 6, Paragraph 1, Clause f. 23. According to Article 140 of the Law on Administrative Cases of the Republic of Lithuania (hereinafter - ABTĮ) the court, when examining the case in the appeal procedure, checks the validity and legality of the decision of the court of first instance without going beyond the limits of the appeal. The court goes beyond the limits of the appeal when the public interest requires it or when not going beyond the limits of the appeal would significantly violate the rights of the state, municipality and individuals and the interests protected by law. Paragraph 1 of Article 10 of the Civil Code establishes that, if necessary, the court investigates the circumstances of the case, which are important for the correct resolution of the case, ex officio (by duty). The court determines the scope of such an investigation and is not bound by the requests of the participants in the administrative proceedings. 24. The panel of judges of the appellate instance, having assessed the evidence collected in the case under consideration, partially disagrees with both the first instance court's and the defendant's conclusions. It should be noted that the observance of ethics in the activities of the social support center of the city of Klaipėda is in the public interest of public institutions and in the field of public administration performed by them, therefore, in order to ensure the public interest and correctly resolve the dispute, the court goes beyond the limits of the appeal. 25. There is no dispute in the case that the applicant is the controller of R.L.'s personal data in the case under consideration, and the applicant is also R.L.'s employer. 26. Paragraph 1 of Article 4 GDPR establishes that personal data means any information about an identified or identifiable natural person (data subject); an identifiable natural person is a person whose identity can be determined directly or indirectly, in particular by an identifier such as a name, a personal identification number, location data and an Internet identifier, or by one or more of that natural person's physical, signs of physiological, genetic, mental, economic, cultural or social identity. 27. By the Dispute Resolution, the defendant recognized the processing of R.L.'s data - name, surname and correspondence - as illegal. There is no doubt that name and surname are personal data. However, the court panel, having evaluated the content of R.L.'s correspondence in the Facebook group "IMK" presented in the case and analyzed by the applicant, states that the content of the correspondence does not contain any identifying data, as defined in Article 4, Clause 1 of the GDPR, which could be used to determine the identity of a person, therefore in the case in question correspondence data shall not be considered personal data and shall not be subject to GDPR provisions. It can be stated that the defendant unjustifiably decided that the applicant processed correspondence data illegally in the sense of the GDPR. 28. Pursuant to Article 6(1) of the GDPR, data processing is lawful only if at least one of the following conditions applies and only to the extent that it applies: a) the data subject has given consent for his personal data to be processed by one or for several specific purposes; b) processing the data is necessary in order to fulfill a contract to which the data subject is a party, or in order to take action at the request of the data subject before concluding the contract; c) processing the data is necessary to fulfill a legal obligation applicable to the data controller; d) processing data is necessary in order to protect the vital interests of the data subject or another natural person; e) processing data is necessary in order to perform a task carried out in the public interest or in the performance of public authority functions assigned to the data controller; f) processing data is necessary for the pursuit of the legitimate interests of the data controller or a third party, except in cases where such interests of the data subject or the fundamental rights and freedoms necessary to ensure the protection of personal data prevail over them, especially when the data subject is a child. 29. In the case under consideration, the applicant R.L. bases the legality of personal data processing on GDPR Article 6(1)(f). The panel of judges agrees with the arguments of the first instance and the defendant, that in the case under consideration, Article 6, paragraph 1, point f of the GDPR does not justify the legality of the personal data processing carried out by the applicant, because the applicant is a budgetary institution, a public legal entity with limited civil liability, implementing the functions of the state or municipality, and therefore is equated to a government institution. The applicant did not prove that the processing of personal data in dispute is necessary to ensure his legitimate interests and which are superior to the interests of the data subject or the fundamental rights and freedoms that make it necessary to ensure the protection of personal data, nor did he perform the balancing test of legitimate interests. 30. As mentioned earlier, in 2021 April 2 and 2021 April 7 the applicant's Ethics Commission received two requests requesting an assessment of R.L.'s possibly unethical behavior in the working environment, together with the reports, comments were made on excerpts from correspondence in the Facebook group "IMK" containing R.L.'s statements. 31. Pursuant to the provisions of Articles 10 and 11 of the Law on Public Administration and the Government of the Republic of Lithuania of 2007 August 22 by resolution no. 875 approved by provisions III and IV of the rules for handling requests and complaints of individuals in public administration entities, the defendant received in 2021 April 2 and 2021 April 7 applications, acquired a legal duty against applicants to process their applications. There is no evidence in the file that, in accordance with Article 11, Part 3 of the Administrative Code, the applicant had a reason to refuse to consider these requests. 32. 2020 of the director of the applicant submitted in the case under consideration. June 25 by order no. V-520 approved Work Regulations of the Ethics Commission of the Budgetary Institution Klaipėda City Social Support Center confirm that requests of this type received by the applicant in 2021. April 2 and 2021 on April 7, are assigned to be examined by the applicant's Ethics Commission. Clause 3.3 of the Regulation establishes that the Ethics Commission accepts and considers official reports of the Center's management (the director, his deputies, heads of departments) and employee requests regarding violations of the code of ethics. Clause 12.1 of the Regulation establishes that the basis for initiating an investigation into a possible violation of the Code of Ethics is a written official notice or request by a person (applicant) with specified facts and supporting documents. 33. After assessing the factual circumstances and legal regulation specified in points 30, 31 and 32 of this decision, the appellate court panel decides that the applicant had a legal obligation to examine the 2021 applications submitted to him. April 2 and 2021 April 7 applications and materials submitted with applications. Considering that in 2021 April 2 and 2021 April 7 R.L.'s name and surname are directly indicated in the requests, and point "c" of Article 6, paragraph 1 of the GDPR allows data processing in cases where the data controller seeks to fulfill a legal obligation applicable to him, it can be concluded that the applicant processed R.L.'s personal data legally. Therefore, the defendant's decision, by which the applicant was recognized as having illegally processed R.L.'s personal data and the reprimand addressed to the applicant, is unfounded and voidable. 34. Taking into account the fact that the disputed Decision of the defendant in the case does not provide arguments that the applicant did not comply with the principles of legal personal data processing provided for in Article 5 of the GDPR, the court of appeals does not comment further on this matter. 35. In summary, it can be stated that the court of first instance incorrectly evaluated the evidence collected in the case, improperly applied the norms of substantive law, and therefore made an unfounded decision, which is annulled and a new decision is made - to satisfy the applicant's complaint. 36. Paragraph 3 of Article 41 of the Civil Code establishes that if the Supreme Administrative Court of Lithuania changes the decision of the court of first instance or adopts a new decision without re-examining the case, it shall accordingly change the distribution of litigation costs. 37. According to Article 40, Part 1 of the Civil Procedure Code, the party to the proceedings in whose favor the decision was made has the right to receive reimbursement of its expenses from the other party to the proceedings. The party in whose favor the decision was made has the right to demand compensation and the costs for the assistance of a lawyer or a lawyer's assistant (Article 40 d. 5 of the Civil Code). Paragraph 1 of Article 41 of the Civil Procedure Code stipulates that the party interested in the reimbursement of expenses submits a written request to the court with the calculation and justification of expenses before the end of the proceedings. 38. In the case under consideration, the final judgment of the court was passed in favor of the applicant, therefore, he was entitled to compensation of litigation costs. In the appeal, the applicant asks for an award from the Inspectorate for the litigation costs incurred in the courts of the first and appellate instances: EUR 22.50 stamp duty for 2022. 31 October complaint regarding the annulment of the Inspection Decision, 605 EUR for the lawyer's assistance in preparing the 2022 31 October complaint regarding the annulment of the Inspection's Decision, EUR 11.25 stamp duty for the appeal, EUR 605 for the lawyer's assistance in preparing the appeal. 39. In the present case, it was established that the applicant's application for reimbursement of the costs of EUR 605 for the preparation of the complaint and the evidence in support of them: November 4 The VAT invoice for legal services, confirmation of the crediting of funds to the client's account, was submitted only to the court of appeals, i.e. i.e. after the trial of the case has essentially ended in the court of first instance, therefore the issue of reimbursement of the applicant's expenses for the services of preparing the complaint provided by the representative is not resolved (ABTĮ Art. 41 d. 1) (see, for example, the ruling of the LVAT of January 31, 2024 in administrative case no. eA-1003-624/2024). The applicant submitted to the court of first instance only a document justifying the payment of the stamp duty, therefore the applicant is liable for the 22.50 EUR stamp duty paid by him for the complaint. 40. The applicant asks the court of appeal to award 605 EUR for the legal assistance provided by the lawyer in preparing the appeal. The applicant is requested to award the amount of representation costs, based on the evidence, not exceeding the 2004 order of the Minister of Justice of the Republic of Lithuania. April 2 by order no. 1R-85 approved Recommendations on the approval of the maximum amount of the fee awarded in civil cases for the legal assistance (services) provided by a lawyer or a lawyer's assistant (version of order No. 1R-77 of March 19, 2015) set the maximum amounts of awarded representation costs. After assessing the essence of the dispute in the case, the scope, complexity, nature of the case and its procedural outcome, in accordance with the principles of reasonableness, fairness and justice, the applicant is awarded EUR 605 from the defendant for representation costs incurred in the court of appeal. For the filing of the appeal, the applicant paid a stamp duty of 11.25 EUR, therefore, the applicant is liable for the stamp duty of 11.25 EUR paid by the defendant. Thus, the applicant is awarded a total of EUR 638.75 (605 + 11.25 + 22.50) in legal costs. Pursuant to Article 41, Article 144, Paragraph 1, Clause 2 of the Law on Administrative Cases of the Republic of Lithuania, the panel of judges n u s p r e n d z i a: To satisfy the appeal of the social support center of Klaipėda city of the budgetary institution of the applicant. 2023 of the Vilnius District Administrative Court. February 27 cancel the decision and make a new decision - to satisfy and cancel the complaint of the applicant budgetary institution Klaipėda City Social Support Center in 2022 of the State Data Protection Inspectorate. September 29 decision no. 3R-821(2.13.-1.E) regarding R. L. 2021 August 13 complaint. The applicant budgetary institution Klaipėda City Social Support Center was ordered by the defendant State Data Protection Inspectorate to pay EUR 638.75 (six hundred and thirty-eight euros and 75 euro cents) in legal costs incurred during the trial of the case in the courts of first instance and appeal. The decision is not subject to appeal. Judges Laimutis Alechnavičius Rytis Krasauskas Egidijus Šileikis
