APD/GBA (Belgium) - 54/2021

APD/GBA - 54/2021
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 4 GDPR Article 5 GDPR Article 6 GDPR Article 24 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	22.04.2021
Published:
Fine:	None
Parties:	n/a
National Case Number/Name:	54/2021
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	French
Original Source:	Autorité de la protection des données (in FR)
Initial Contributor:	Fra-data67

The Belgian Data Protection Authority reprimands entity in charge of paying family allowances to its members for failure to comply with Articles 4, 5, 6 and 24 GDPR.

English Summary

Facts

In July 2019, an entity (voluntary intervener in the proceedings, hereinafter "the voluntary intervener") in charge of paying family allowances to its affiliates who have children consulted the data of the complainant's son in the National Register, in particular the "household composition" data and its history. This consultation took place in order to manage the family allowance file of the complainant's son, one of its affiliates, and to determine the amount of family allowance that he would be entitled to receive. This consultation was carried out via the TRIVIA application, developed by the BCSS, made available to the family allowance funds. This consultation was done on the basis of the National Register number of the affiliated person, son of the complainant.

It is this consultation of the history of the composition of the complainant's son's household that is the subject of the complaint. During this consultation, the volunteer intervener was given access to the information that the complainant had been part of her son's household at one time in his life. The complainant complains that this consultation of personal data concerning him had no basis of valid legitimacý within the meaning of Article 6 of the GDPR.

On 24 September 2019, the Supervisory Authority of the family allowance funds for the Brussels-Capital Region (IRISCARE/FAMIFED) received a request for information from the complainant via the contact form on its website. With this request for information, the complainant asked the Supervisory Authority about the consultation of his data on 9 and 17 July 2019.

Following several unsuccessful exchanges, and in the absence of a satisfactory response, the dispute was brought before the Belgian Data Protection Authority’s dispute chamber.

In this case, the defendant is the shared service center of the voluntary intervening entity. In this respect, the defendant was responsible for monitoring the personal data protection of all the family allowance funds in the group.

When he submitted his conclusions on 9 June 2020, the complainant underlined that a new consultation of his data, still without any legitimate basis according to him, had taken place on 21 April 2020. When questioned in this respect, the defendant answered to the complainant that this consultation was part of the management of the present case pending before the dispute chamber.

Dispute

Is access to the information that the complainant had been a member of his son's household at one time in his life considered processing of personal data within the meaning of Article 4 GDPR and is it justified on the basis of Article 6 GDPR?

Holding

The Belgian data protection authority found a violation of the GDPR, and gave the following reasons for its decision:

The notion of processing of personal data within the meaning of Article 4 GDPR

Very briefly, the dispute chamber begins by recalling that the fact of having accessed this information constitutes processing of personal data within the meaning of Article 4(2) GDPR irrespective of whether this processing is lawful within the meaning of the Regulation.

Furthermore, the dispute chamber holds that in this case the voluntary intervening entity must be considered as a controller, and the defendant as a processor of the voluntary intervener.

2. XXX

XXX

Accountability within the meaning of Article 24 GDPR

The Belgian data protection authority also concludes that the voluntary intervener failed to comply with Articles 24 and 5.2 of the GDPR when it was not able to put in place the technical measures intended to implement the GDPR. Indeed, the controller cannot therefore raise the argument that the application used - even if its use is imposed by a third party - does not allow it to comply with the GDPR.

Consequently, in application of its obligation of accountability and documentation, the voluntary intervener should at least have alerted the relevant authorities to the situation in which the forced use of the TRIVIA application placed it in relation to its obligations under the GDPR.

Sanctions

In view of these failings, the dispute chamber reprimanded the voluntary intervener and ordered the publication of the decision on the Belgian data protection authority's website with the deletion of the parties' direct identification data.

In addition, the dispute chamber stresses that it is important that an appropriate response be found quickly to the problem raised by the complaint, in order to allow limited consultation, in compliance with the GDPR, of the history of the "household composition" data (as well as the history of other data in the National Register, if applicable).

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

                                                                          Decision on the merits 54 / 2021-1 / 23






                                                                         Litigation Chamber




                                             Decision on the merits 54/2021 of 22 April 2021





File No .: DOS-2019-06237



Subject: Complaint relating to an illicit consultation of the National Register in the

                context of the allocation of family allowances



The Contentious Chamber of the Data Protection Authority, made up of Mr. Hielke

Hijmans, chairman, and of Messrs. Y. Poullet and C. Boeraeve, members, taking up the case in this

composition;


Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the

protection of individuals with regard to the processing of personal data and the

free movement of such data, and repealing Directive 95/46 / EC (general regulation on the protection

data), hereinafter GDPR;


Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter LCA);


Having regard to the Rules of Procedure as approved by the Chamber of Representatives on December 20

2018 and published in the Belgian Official Gazette on January 15, 2019;


Having regard to the documents in the file;




Took the following decision regarding:




The complainant: Mr X1, (hereinafter "the complainant");



The defendant: Y1, (hereinafter “the defendant”);


In the presence of: Y2 ASBL, (hereinafter "the voluntary worker"); Decision on the merits 54 / 2021-2 / 23





Both advising Maître Paul Van den Bulck and Maître Andrine Like, lawyers at the Bar

of Brussels, whose office is established at Rue des Colonies 56 box 3 in 1000 Brussels.





    1. Feedback from the procedure


In view of the mediation request filed on December 8, 2019 by the complainant with the Autorité de

data protection (DPA);



Given the failure of the mediation attempt communicated to the complainant on February 20, 2020 by the

First Line (SPL) of ODA;



Considering the agreement given by the complainant on February 20, 2020 for his request to be transformed into a complaint

in application of Article 62.2. LCA;



Considering the decision of March 9, 2020 of the SPL declaring the complaint admissible and the transmission of it to the

Litigation Chamber;



Having regard to the letter of April 8, 2020 from the Litigation Chamber informing the parties of its decision to

consider the case to be ready for treatment on the merits on the basis of Article 98 LCA and their

providing a timetable for the exchange of conclusions. In this letter, the Litigation Chamber


in particular specified the following to the parties:

        Without prejudice to any arguments you may wish to develop, you will ensure that you shed light on the

        Litigation Chamber on the data processing involved, on the role of the various

        possible stakeholders and their quality with regard to the regulations for the protection of

        data as well as on the precise legal basis of the disputed consultation of the data of the


        complainant. You will also ensure that you explain the measures put in place to guarantee

        access only to data justified by the processing of files and the traceability of such access.

        You will also inform the Litigation Chamber of what is concretely understood by

        the terms "induced and involuntary consultation" used in the attachments to the complaint

        in the light of the specific facts.


Having regard to the main conclusions filed on May 22, 2020 by the defendant as well as by Y2

(the voluntary intervenor) who intervenes voluntarily to the cause by this means (see below

point 30 and following);

Having regard to the arguments of the complainant of June 9, 2020; Decision on the merits 54 / 2021-3 / 23






Having regard to the additional and summary conclusions of the defendant and the voluntary intervener of 3

July 2020;


Having regard to the invitation to the hearing sent by the Litigation Chamber to the parties on December 10, 2020;

Having regard to the hearing during the session of the Litigation Chamber of January 19, 2021 in the presence of the complainant


and Mr. A. Like, representing both the Respondent and the Volunteer Intervenor;

Having regard to the letter sent by counsel for the defendant and the voluntary worker on January 26


2021;

Having regard to the minutes of the hearing and the observations made thereon by the parties who have


been attached to these minutes.




    2. The facts and the subject of the request


    2.1. Preliminary remarks



1. For a good understanding of its decision and of all the actors to whom the parts

    procedure and the files of the parties refer, the Litigation Chamber specifies the following:




    - FAMIFED is the federal agency for family allowances. FAMIFED was to insure until

         December 31, 2019 the management of family allowances, including in the Region of

         Brussels-Capital.


                                             th
    - IRISCARE has, under the 6 state reform, become, in place of FAMIFED,

         the supervisory authority for family allowance funds for the Brussels-Capital Region.

         IRISCARE is responsible for setting up and managing the family allowances system of the

         Brussels-Capital Region.



    - During a period of transition, the two structures coexisted so that the relay of the mission

         legal process can switch from FAMIFED to the new regional authorities, including, as mentioned,

         for the Brussels-Capital Region, IRISCARE. In the context of this decision,

         IRISCARE and FAMIFED are referred to as the "Supervisory Authority".




    - The complainant includes the Crossroads Bank for Social Security (BCSS) among the “stakeholders”

         revolving around the disputed data processing indicating that it was the BCSS which, at the time

         facts, develops the TRIVIA application. The TRIVIA application allows benefit funds Decision on the merits 54 / 2021-4 / 23



         family to consult the available files of integrated actors, to integrate themselves

         actors and create files and obtain, through the intervention of the BCSS, access to the various

         sources of the social security network.



2. The defendant is the shared service center of group Y. It provides administrative services

     to the various entities of Group Y. In this regard, it notably monitors the protection

     personal data of all family allowance funds in the group. It

     has a Data Protection Officer (DPO) as well as a "Corporate Compliance 1

     Officer ”and“ Information Security Officer ”.



3. Y2, here a voluntary intervening party, aims in particular to pay family allowances to

     its affiliates who have children.




4. Mr. X2 is the son of the complainant, affiliated with Y2, voluntarily intervened in the cause (see below.

     points 30 et seq.).



     2.2. The facts at the origin of the dispute



5. In July 2019, the voluntary worker consulted the data of the complainant's son in the Register

     national, in particular the "household composition" data and its history. This consultation

     took place in order to manage the family allowances file for the complainant's son, one of his affiliates, and

     determine the amount of family allowances - including any supplement - that it would be

     entitled to receive from January 1, 2020. This consultation was done via the TRIVIA application,

     developed by the BCSS, made available to family allowance funds, including the worker

     voluntary, by the supervisory authority. This consultation was made on the basis of the register number

     affiliate's national, Mr. X2.




6. It is this consultation of the history of the household composition of Mr. X2 that is the subject of

     of the complainant's complaint. Indeed, during this consultation, the volunteer worker had access

     to the information that the complainant had been part of his son's household at some time

     his life. The complainant complains that this consultation of personal data

     concerning was not based on any valid basis of legitimacy within the meaning of Article 6 of the GDPR (see.

     title 2.3; point 23 et seq.).





1
 Deliberation 18/008 of 9 January 2018 on the communication of personal data by the Agency
federal for family allowances (Famifed) and various other social security institutions to the Ministry of
the German-speaking Community, in the context of the transfer of powers to follow up on the sixth reform
status - use of the TRIVIA application. Decision on the merits 54 / 2021-5 / 23


7. This research of the history of the composition of the household is called by the supervisory authority


    "search P028". It is carried out via the TRIVIA application already mentioned. During this

    research, the history of the household composition of Mr. X2 showed the complainant as

    having been part of his household in the past and this, as head of household.



8. On September 24, 2019, the Supervisory Authority received a request for information from the complainant

    via the contact form on its website. By this request for information, the complainant

    asked the Supervisory Authority about the consultation of its data on July 9 and 17, 2019.



9. There followed an exchange of e-mails between the complainant and the Supervisory Authority. The latter informed

    the complainant of the nature of the research P028 which had led to access to certain data on

    concerning and invited him, if necessary, to approach the family allowance fund (either

    the voluntary worker), in order to inquire more about the reason for the access to his data

    as they appeared in her son's household composition history.



10. On 7 October 2019, the complainant sent his request for information to the

    data of the volunteer worker via the address "[...]".



11. On 10 October 2019, the defendant, which ensures, as mentioned above in point 2, the follow-up

    on the protection of personal data of all family allowance funds

    group, acknowledged receipt and responded a first time to the request for information from

    complainant.



12. On October 14, 2019, the defendant replied to the complainant a second time. This answer was

    following a request for acknowledgment of receipt from the complainant regarding his request for information, which

    acknowledgment of receipt had been sent by the defendant on 10 October 2019 (see point 11 below

    above).



13. On November 6, 2019, the Complainant wrote again to the Respondent. On the same day, the

    defendant replied a third time to the complainant and confirmed having responded promptly to the

    October 10 and 14, 2019 at his request of October 7, 2019.



14. On November 7, 2019, the complainant, still addressing the respondent, developed his fears

    and raised the following question:

        "That one checks his tax flow [read the tax flow of Mr. X2] does not ask me personally

        no problem and that seems normal to me since his household is beneficiary / beneficiary

        Family Allowances. Decision on the merits 54 / 2021-6 / 23


        BUT, what are the legal bases that allow you to consult my own


        private data and tax flow? "



15. On November 7, 2019, the defendant replied a fourth time to the complainant and confirmed that the

    the tax flow of the complainant had not been examined and that only the identification data of the

    complainant had appeared while viewing her son's household history.



16. On 12 November 2019, the complainant confirmed receipt of the registered letter from the

    defendant by which the latter provided proof of the sending of her emails of the 10th and 14th

    October 2019.



17. On 20 November 2019, the Respondent informed the Complainant that a request for clarification had

    still requested from the Supervisory Authority regarding the consultation of its data. The

    Defendant's DPO returned the same day (i.e. a fifth time) with said clarification of

    the supervisory authority. In the response that the defendant sent to the complainant, the Supervisory Authority

    confirms that it appeared that there had been access to the complainant's identification data,

    this one being mentioned as having been part of the household of his son and that it was necessary to understand

    that this consultation was "induced and not voluntary" (in other words, that it was a

    incidental access via the history of the household composition of the complainant's son).



18. The same day, after receiving this response (see point 17 above), the complainant filed

    defendant in default to justify the legal grounds for the consultation of its data.



19. On November 27, 2019, the defendant returned to the complainant for a sixth time, specifying that

    the provisions of the General Law on Family Allowances (hereinafter "LGAF") justified the

    consultation of the history of the household composition of Mr. X2 (complainant's son) with

    of the National Register (i.e. Articles 51 and 54 LGAF). Literally, she indicated, for the

    good understanding of the complainant, that the mission of the family allowance funds included

    verification of entitlement to allowances including verification of "the history of the

    family composition for which the funds have the right to query the National Register ”.



20. On December 8, 2019, the complainant lodged an application with the APD in the following terms:

        "I noticed that (Y2- Brussels) [read the volunteer worker] had consulted my data

        personal without any valid reason in my eyes since I am a pensioner, without

        responsible for more than 10 years and that I live in Wallonia.



        After questions from those in charge, I received an answer that does not satisfy me in any way.

        given that the family composition history of one of my sons' household - including Decision on the merits 54 / 2021-7 / 23



         household apparently benefits from family allowances in Wallonia - does not have to lead to

         an induced and involuntary manner regardless because the legal references, unless I am mistaken

         part, do not allude to it) on queries of my private data which are not at all

         concerned.



         In my view, this is not a normal procedure but a malfunction (or a

         pirate query) which I cannot accept. "



21. On February 3, 2020, the defendant replied to the SPL's questions in connection with the attempt

    mediation conducted by this service of the ODA. In essence, the defendant responded to the DPA which

    had already been answered to the complainant by the Supervisory Authority, i.e. a P028 search had been

    carried out and that the consultation was non-voluntary but resulted from the consultation

    - necessary in the exercise of its legal missions - consultation of the history of the


    household composition of the complainant's son.



22. When communicating his conclusions on 9 June 2020, the complainant complained that a new

    consultation of his data, still without a legitimate basis according to him, had taken place on April 21

    2020. Interested on June 3 in this regard, the defendant on June 15, 2020, indicated to the complainant that

    this consultation was part of the management of this case pending before the DPA.

    The Litigation Chamber specifies from the outset that it will also rule on this second

    consultation, the legality of which is called into question by the complainant in terms of its conclusions as soon as

    when it is closely linked to the facts denounced by the complainant under the terms of his form

    complaint.2



    2.3. The subject of the complaint



23. In these same conclusions of June 9, 2020, the complainant specifies the subject of his complaint and expresses

    which his son, Mr. X2, has not resided with him since 2006. Consultation of the history


    the household composition of the latter - even necessary for the granting of allowances - must according to

    be subject to a time limit taking into account (1) either the day on which the person whose

    "history of household composition" data is consulted is potentially

    beneficiary / beneficiary of allowances / supplement, (2) either from the day of the birth of the child

    beneficiary. Access to the history of "household composition" since the birth of the one

    whose history is consulted - as happened in this case - is irrelevant and

    disproportionate in relation to the purpose pursued (the granting of family allowances).





2 See. in this sense, points 18 and s. of Decision 38/2021 of the Contentious Chamber:

https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-38-2021.pdf Decision on the merits 54 / 2021-8 / 23


    According to the complainant, this access constitutes an all the more unacceptable security breach:


         - that it emanates from public bodies;



         - that it potentially affects millions of people (beyond himself, his

                 wife and all the people with whom her son has, at some point in his

                 life, lived under the same roof);



         - that the useful data (i.e. the date / dates opening (s) the right to benefits

                 family and from which the consultation of the history of

                 management composition could be relevant) is / are available in the Cadastre

                 family allowances;



         - that the research system "P028" replaced an earlier system which

                 allowed relevant and targeted research. The complainant quotes in this regard the passage

                 following extract from the “Specific functional description of message P028” sheet:



                 1.2.1.1. P028 Historical consultation of household composition

                                  Principle

                 The P028 message is used to request data relating to the history of the

                 household composition in the National Register on the basis of a register number

                 national. This flow can be subsequently extended with data from the registry of the

                 BCSS.

                 This consultation flow combines the old consultation messages P036 and P038

                 in a single message. Unlike consultation message P036, this flow displays

                 the complete history, whether or not the person sought is the head of the household. It is not

                 therefore it is no longer necessary to carry out several consultations for this purpose. (…)



24. Finally, still in his conclusions of 9 June 2020, the complainant makes a series of requests to

    the Litigation Chamber, namely (page 11 of its conclusions):



- To jointly and indivisibly condemn the defendant, the voluntary intervener,

         the Supervisory Authority, the FPS Interior (National Register), the Crossroads Security Bank

         social (BCSS), or even any dishonest perpetrators responsible for access and processing

         of its data, in accordance with articles 221 to 230 of the Law of 30 July 2018 on the

         protection of individuals with regard to the processing of personal data

         staff ;

- Inform the King's Prosecutor of any breaches noted and inform the complainant of this

         Steps ; Decision on the merits 54 / 2021-9 / 23


- To ensure that the necessary corrections have been made to remedy the shortcomings


         denounced and this under penalty of penalty;

- Obtain proof that their tax data has not been processed within the framework of the

         consultation denounced;

- Obtain the necessary explanations regarding the consultations of July 9, 2019 and April 21, 2020

         by FAMIFED in the National Register;

- Obtain the identification and full contact details of all persons who have had access

         to his personal data and failing that condemn the defendant, the voluntary intervener and

         other contributors to periodic penalty payments;

- To invite those responsible in the broad sense of the illegal processing, or even the possible perpetrators

         indelicate, to compensate him for the material and moral damage suffered.



    2.4. Position of the defendant and the voluntary worker



25. The defendant and the voluntary intervener request, in support of their conclusions,

    that the Litigation Chamber declare the complainant's complaint, if admissible, unfounded, the

    consultation of the household composition of Mr X2, son of the complainant, being from their point of

    perfectly legal and legitimate view. They therefore request that the complaint of the

    Complainant without follow-up. The defendant and the voluntary intervener add that if by impossible,

    the ODA had to consider that in the circumstances of the case, access to the history of the

    composition is illegal, it should be the cause of both the National Register and the Authority

    supervision insofar as they are the ones who determine the data accessible during a

    search P028 (page 11 of the additional and summary conclusions of the defendant and

    the volunteer worker).



    3. The hearing of January 19, 2021



26. During the hearing on January 19, 2021 - of which the minutes were drawn up - the parties stated

    the arguments they had developed by their respective conclusions.



27. The following elements were particularly highlighted by the parties:

- the status of data controller of the voluntary worker;



- the deliberate choice, according to the complainant, to set up research which won the

         consultation of potentially irrelevant data and the seriousness of the problem at

         with regard to the number of people who may be affected by this structural failure; Decision on the merits 54 / 2021-10 / 23


- the absence of any legal impact of the "induced" and "non-voluntary" nature of the access


        irrelevant data on the qualification of processing within the meaning of Article 4.2. of the GDPR;



- the demonstration by the defendant and the voluntary intervener of the obligation to resort to

        the TRIVIA application and the impossibility for them to modify the parameters to consult the

        only historical data relating to a targeted period of time.



PLACE


As a preliminary

    ✓ As for the quality of the parties


28. Both in terms of her conclusions and of the hearing (see section 3 above), the intervener

    volunteer declares himself responsible for processing within the meaning of Article 4.7. of the GDPR with regard to

    disputed consultation, consultation which she furthermore qualifies as an incident. The defendant is for

    its part qualified as a subcontractor of the voluntary worker (page 10 of the conclusions and page 11

    additional and summary conclusions of the defendant and the voluntary intervener).




29. The Contentious Chamber takes note of this and does not see, in the context of its own analysis with regard to

    to the factual elements submitted to it and having regard to the applicable legal elements, no

    reason for not recognizing these respective qualities in the voluntary intervenor and the defendant.

    With regard to the voluntary worker more particularly, she defines in fact, at the start of her

    own mission, the purposes and means of the data processing it operates within the meaning of

    Article 4.7 of the GDPR which defines the data controller.



    ✓ As for voluntary intervention


30. The Contentious Chamber takes note of Y2's voluntary intervention in this procedure. This

    intervention is the result of the decision of Y2 who, voluntarily, and for the needs of the cause,

    intervened in the proceedings by way of pleadings (see title 1).



31. The Litigation Chamber specifies that neither the LCA nor the Internal Rules of the APD

    explicitly provide for the mechanism of (voluntary) intervention by a party that has not been

    challenged by the complainant.



32. Nevertheless, in the exercise of its competences, it is incumbent on the ODA, and therefore on

    the Litigation Chamber in the exercise of the powers devolved to it, to facilitate

    the exercise of the rights recognized to persons concerned by the GDPR, including the right to

    complaint (Article 77 of the GDPR - also recognized in Article 8.3. of the Charter of Rights Decision on the merits 54 / 2021-11 / 23



    fundamental as part of the essence of the right to data protection). In this

    perspective, filing a complaint should remain an easy process for people

    data subjects whose personal data are processed and with regard to the processing of which they

    believe that there has been a breach of data protection rules.



33. As it has already had the opportunity to develop in its Decision 17/2020, the authorities of

    data protection must therefore play an active role through the missions and powers

    which are assigned to them under Articles 57 and 58 of the GDPR.




34. In the same way that the complainant cannot be expected to identify straight away, from the terms
                                                                                              4
    of his complaint, all the legal grievances relevant to the facts denounced, the same

    so he cannot be expected to identify with certainty the controller

    concerned. To assert the contrary would be to seriously jeopardize the right of complaint of the

    complainant. Indeed, the identification of the controller, even in support of the definition

    provided for in Article 4.7. GDPR, is a process that can be particularly complex. Certainly

    detailed guidelines have already been published several times by the European Committee

    of Data Protection (EDPS) and its predecessor the Article 29 Group, on it. 5

    Nevertheless, it is clear that this identification often remains thorny. It requires

    sometimes even recourse to the Inspection Service in the most difficult cases.




35. In support of the foregoing considerations, in order to give effective effect to the right to lodge a complaint,

    and through it, to contribute to the effective application of the GDPR, the Litigation Chamber

    therefore naturally accepts this voluntary intervention. She specifies that, of course, the debate

    contradictory has developed with the latter as well. In these circumstances, the House

    Litigation is able to impose sanctions on the voluntary intervenor, if necessary.



    ✓ As to the competence of the APD and the Litigation Chamber


36. The Contentious Chamber specifies here at the outset, with regard to the measures requested by the

    complainant (see point 24), that it is in any case not competent to grant a

    any compensation even in the event of shortcomings noted. Indeed, this






3Decision 17/2020: https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-17-

2020.pdf See. also Decision 80/2020 of the Contentious Chamber:
https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-80-2020.pdf

4 Decision 38/2021 of the Contentious Chamber:

https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-38-2021.pdf

5 See EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR, on edpb.europa.eu. Decision on the merits 54 / 2021-12 / 23


    jurisdiction is not listed among the corrective measures and sanctions that it may decide on

    application of Articles 58.2. of the GDPR and 95 and 100 LCA.




    4. As for breaches of the GDPR



37. The Litigation Chamber notes that it emerges from the above statement of facts that the complainant

    criticizes the voluntary intervener for having accessed personal data on

    concerning and this, in its terms, without valid legal basis.



38. The Contentious Chamber notes that the parties do not dispute that during the consultation of

    the history of the household composition (National Register) of Mr. X2 in July 2019,

    the voluntary worker did have access to the information that the complainant had, at

    a time, is part of his son's household as head of household.



39. Having access to this information constitutes processing of personal data

    within the meaning of Article 4.2 of the GDPR regardless of whether the person responsible for

    treatment that accessed it - in this case the voluntary worker - intended to seek

    this information or if there was access incidentally, fortuitously, during the

    search for data relating to a separate person, in this case the complainant's son. that

    the voluntary worker had the intention or not to process this personal data,

    whether or not she then used it to make her decision, all of these are irrelevant

    on the qualification of "treatment" within the meaning of Article 4.2. of the GDPR.



40. The Litigation Chamber recalls that any processing of personal data must

    rely on one of the bases of lawfulness provided for in Article 6 of the GDPR.



41. Article 3, paragraph 1, 9 ° of the Law of 8 August 1983 organizing a National Register of Persons

    physical (hereinafter the RN Law) provides that for each person registered in the National Register, the

    "household composition" data is recorded and kept as well as the modifications


    successive dates provided to this information as well as their effective date; this is

    the history (article 3 paragraph 2 of the RN Law). The royal decree of January 8, 2006 determining

    the types of information associated with the information referred to in Article 3, paragraph 1, of the law

    of August 8, 1983 organizing a national register of natural persons precise as to




6 See. article 4.2 of the GDPR: "processing", any operation or any set of operations carried out or not using
automated processes applied to data or sets of personal data, such as

that the collection, recording, organization, structuring, conservation, adaptation or modification,
the extraction, consultation, use, communication by transmission, dissemination or any other form of
provision, reconciliation or interconnection, limitation, erasure or destruction. Decision on the merits 54 / 2021-13 / 23


    him in Article 1, 9 ° that the information "household composition" is associated with the data

    following: "household reference person" on the one hand and "household member" on the other

    go.



42. Consequently, consultation of the “household composition” data from the National Register of

    son of the complainant may, de facto, take cognizance of personal data

    other people than the son himself, such as members of his household. Personal data

    that appear in the household composition and its history are both data of a

    personal data relating to the person whose National Register is consulted AND personal data

    personnel relating to persons who are included in the composition and history of its

    housework. There will therefore be processing of personal data of third parties.

    (separate from the one for which the "household composition" data is consulted, in this case the son

    of the complainant) when they are or have been part of the household of the person for whom

    the "household composition" data is consulted (as here the complainant). The result is

    however, not necessarily an absence of a basis of lawfulness for the processing of personal data.

    these third parties such as the complainant in this case.



43. Provided it is validly invoked, the legal basis for consulting the data

    "Household composition" (and its history) of the person concerned (in this case the son of

    complainant) includes the consultation of the data included under this information, including therefore

    members of his household, including the complainant. In this case, the basis of lawfulness in support of which

    consultation of the history of the household composition of the complainant's son is legitimate

    potentially also access - even induced as described by the defendant and

    the voluntary worker - to the data relating to the complainant according to which he was part of the household

    of his son.



44. The Litigation Chamber recalls that in addition to the required legal basis (Article 6 of the GDPR),

    personal data must, in accordance with the principle of minimization expressed in Article 5.1.c)

    of the GDPR, be adequate, relevant and limited to what is necessary with regard to the purposes for

    which they are processed (principle of minimization).



45. Finally, pursuant to Article 24 of the GDPR, it is the responsibility of the controller to implement

    implement the appropriate technical and organizational measures to ensure and be able to

    to demonstrate (as required by Article 5.2. of the GDPR) that the processing he carries out complies

    to the GDPR.



46. It follows from the foregoing that it is for the Contentious Chamber to verify whether the consultation


    (whose legality is contested by the complainant) - by the voluntary intervener in her capacity as Decision on the merits 54 / 2021-14 / 23


    data controller - the "household composition" data of the complainant's son, in this

    including the complete history thereof, met in this case the conditions of treatment imposed

    by the GDPR.



    4.1. As to the basis of legality and respect for the principle of minimization




47. The Contentious Chamber notes that the defendant and the voluntary intervener rely on

    Article 6.1.c) of the GDPR to legitimize the contested data processing. Article 6.1.c) authorizes the

    data processing necessary for compliance with a legal obligation to which the person responsible for
                             7
    treatment is submitted.



48. The Contentious Chamber recalls as it did in its recent decisions 37/2021 and

    38/2021 that in its Huber judgment, the Court of Justice of the European Union (CJEU) has, in view of

    of this condition of necessity, specified that it was an autonomous notion of the right

    Community which must be interpreted in a way that fully meets the purpose of the

                                                                                8
    Directive 95/46 / EC applicable at the time of this judgment.


                                   9
49. According to the conclusions he filed in this case, the Advocate General explains to this

    considering that "the concept of necessity has a long history in Community law and it is

    established as part of the proportionality test. It means that the authority which adopts

    a measure which infringes a fundamental right in order to achieve a justified objective must

    demonstrate that this measure is the least restrictive allowing this objective to be achieved. Otherwise,

    whether the processing of personal data may be likely to infringe the fundamental right to

    respect for private life, Article 8 of the European Convention for the Protection of

    man and fundamental freedoms (ECHR) which guarantees respect for private and family life,


    also becomes relevant. As the Court stated in the Österreichischer Rundfunk and others judgment,

    if a national measure is incompatible with Article 8 of the ECHR, this measure cannot

    meet the requirement of Article 7 (e) of the Directive. Article 8, paragraph 2, of the ECHR

    provides that an interference with privacy may be justified if it pursues one of the objectives therein

    listed and "in a democratic society, is necessary" for any of these purposes. The courtyard





7 See. decisions 37/2021 and 38/2021 of the Contentious Chamber which explain what is meant by

necessary for compliance with a legal obligation: https://www.autoriteprotectiondonnees.be/publications/decision-
quant-au-fond-n-37-2021.pdf https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-
38-2021.pdf

8
 CJEU, December 16, 2008, Heinz Huber v. Bundesrepublik Deutschland, C-524/06, ECLI: EU: C: 2008: 724, para. 52.

9
  Opinion of Advocate General Poiares Maduro delivered on 3 April 2008 in the proceedings before
the CJU resulting in the judgment cited in footnote 15 above (C-524/06). Decision on the merits 54 / 2021-15 / 23


     European Human Rights Council has ruled that the notion of "necessity" implies that a "need

     imperative social "is in question".



50. This case-law, formulated admittedly in the light of Article 7 (e) of Directive 95/46 / EC, applies to

     all the bases of lawfulness which retain this condition of necessity. She remains today

     relevant even though Directive 95/46 was repealed since this condition of necessity


     is maintained under Article 6.1 b) to f) of the GDPR and therefore in Article 6.1.c) invoked in

     the species. Article 6.1 of the GDPR in fact reproduces the terms of Article 7 of Directive 95/46 / EC
                                10
     of which it is the equivalent.



51. The Article 29 Group also referred to the case law of the European Court of

     human rights (Eur. D.H. Court) to define the requirement of necessity 11 and concludes that the adjective

     "Necessary" therefore does not have the flexibility of terms such as "admissible", "normal", "useful",

     "Reasonable" or "expedient". 12




52. More precisely with regard to the basis of legitimacy which rests on the legal obligation to which would be

     held by the controller, the European Data Protection Board (EDPB -
            13
     EDPS) has set out the conditions under which this basis of lawfulness can be applied:

- the obligation must be imposed by law;

- the legislation must meet all the conditions required to make the obligation valid and

         binding;

- the legislation must comply with the applicable data protection law,

         in particular the principles of necessity, proportionality and limitation of purpose;

- the legal obligation itself must be sufficiently clear about the data processing

         of a personal nature that it requires;


- and the controller should not have an unjustified margin of appreciation as to

         how to comply with the legal obligation.



10 Note that the only differences to be noted are the addition to Article 6.1.d) of the GDPR of the vital interest of another

natural person as the data subject as well as the deletion in Article 6.1.e) of the GDPR of the "third party to which
the data is communicated ", the mission of public interest or falling within the exercise of public authority before
be that of the sole controller. In addition, a slight wording difference exists between the article
7.1. f) e Directive 95/46 / EC and Article 6.1. f) of the GDPR without modifying the scope of this provision.

All these modifications do not affect the condition of necessity.

11 Article 29 Group, Opinion 06/2014 of April 9, 2014 on the notion of legitimate interest pursued by the person responsible
data processing within the meaning of Article 7 of Directive 95/46 / EC, WP 217.


12Court eur. D.H., March 25, 1983, Silver and others v. United Kingdom, para 97.

13European Data Protection Board (EDPS), Opinion 03/2019 concerning questions and answers on

the interaction between the regulation on clinical trials and the general data protection regulation
(GDPR) [article 70, paragraph 1, point b)] of 23 January 2019 (point 11):
https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_opinionctrq_a_final_fr.pdf Decision on the merits 54 / 2021-16 / 23





53. In the present case, the defendant and the voluntary intervener put forward several provisions

    which, from their point of view, required them to proceed with the disputed treatment.



54. The Contentious Chamber notes in this regard the following:




- The granting of the social supplement in addition to the ordinary allowances is governed by the General Law

    relating to family allowances (LGAF) of 19 December 1939, in particular Articles 51, 54 and

    173quater. Article 173 quater explicitly provides that family allowance organizations and

    the ministerial services, responsible for the execution of this law, are required to contact the Register

    national of natural persons to obtain the information referred to in Article 3, paragraphs 1 and 2,

    of the Law of August 8, 1983 organizing a national register of natural persons. Among these

    data show the household composition and its successive modifications (ie history). The

    recourse to another source is only permitted insofar as the necessary information is not

    cannot be obtained from the National Register.




- Jurisdiction over the granting of family allowances and social supplement is regionalized

    and the complainant's son was listed as residing in the Brussels-Capital Region at the time
                                                           14
    of the consultation of the denounced National Register. In this regard, the Litigation Chamber notes

    that Article 9 of the Ordinance of 25 April 2019 of the Brussels-Capital Region regulating the granting
                                15
    family benefits specifies that the basic family allowance is increased by a supplement

    social under certain conditions, especially when the annual household income does not reach

    not a certain threshold. In other words, the granting of the supplement is conditioned by the income of the

    housework.



- Regarding the granting of this social supplement, Article 10 of the Ordinance of April 4, 2019 provides

    that "the assembled College sets the conditions under which the payment of social supplements is

    carried out provisionally, pending tax data establishing the annual income of the


    cleaning allowing a final decision to be taken ”. As a result, the assembled College of the Commission

    Community Commune has set the conditions for granting social supplements and certain

    supplements provided for in the General Law on Family Allowances in a Decree of 24

    October 2019.





14 The complainant states in this regard that his son has been living in Wallonia since a date much earlier than that of this
consultation (i.e. since July 2018). The voluntary worker and the defendant indicate that this change

of domicile had not been notified to them on the date of the P028 consultation and that now the voluntary worker
no longer manages the family allowances file of the complainant's son. The Litigation Chamber takes note of this.

15M.B., May 8, 2019.

https://bruxelles.famifed.be/sites/default/files/uploads/20190509_ordranteiegezinsbijslag_NLFR.pdf: Decision on the merits 54 / 2021-17 / 23



- In accordance with the aforementioned Decree of October 24, 2019, the preparatory measures that the funds

    family allowances were to be taken from 2019 in order to be able to establish, for each household

    Brussels resident, the correct amount of family allowances to which he would be entitled from the 1st

    January 2020, as well as the procedure to be followed for the granting of social supplements from

    2020, were decreed in the CO PF2 Circular of July 5, 2019 relating to the granting procedure

    provisional social supplements in the Brussels-Capital Region from January 1, 2020 ,.



- The defendant and the voluntary intervener rely on this Circular of July 5, 2019 relating to

    the procedure for provisionally granting social supplements in the Brussels-Capital Region to

    from 1 January 2020, in particular on its articles 2.2 and 7 to legitimize their consultation of

    the history of the household composition of the complainant's son.



- This circular provides that the establishment of the right to a supplement in the Brussels-Capital Region

    will be done in two phases, namely:

         Phase 1: A decision on the provisional payment of the supplement is taken in "time

         real ": in other words, it is automatically granted on a provisional basis if the conditions are met.

         Also, the supplement can be granted on a provisional basis following a request from the household

         accompanied by supporting documents relating to the current gross income of the household.



         Phase 2: Two years later, the taxable income of all households is verified using

         of the tax flow and the definitive establishment of the right to the social supplement is carried out on the basis


         tax data made available by the authentic source.


- As for the concept of household retained, the circular specifies that "this identification is made according to

         the notion of household as described in article 2 of the decree of October 24, 2019. This decree

         provides in Article 1 that it is to be understood by:

                 "1 ° member of the cohabiting household: any person who is neither a relative nor an ally

                 up to the third degree inclusive, with which the recipient cohabits and forms a

                 de facto household;

                 2 ° household members: the beneficiary and, where applicable, the spouse with whom he

                 cohabits and / or any other member of the cohabiting household ”



55. The Litigation Chamber concludes that in other words, prior to the granting of the supplement

    adequate social security from 1 January 2020, it went to the family allowance funds (including

    the voluntary worker), to identify, in application of the various aforementioned texts, from July 2019,

    beneficiaries and their income, more particularly that of their household as this concept is

    defined in article 2 of the decree of 24 October 2019. Decision on the merits 54 / 2021-18 / 23


56. This verification of the income condition of the household (and therefore of who was part of it) is, in


    the occurrence, through an identification of the household composition of the complainant's son via the

    consultation of the National Register. It is also not disputed that the allowance funds

    family, including the volunteer worker, were duly authorized to consult the National Register.



57. The Litigation Chamber notes that it is not clear from the legal texts invoked which

    are the income that should be taken into account and hence, depending on the phase in which

    the consultation took place, what was the date of the household composition to be taken into

    consideration (current calendar year, backtracking by 2 years by analogy with the final calculation

    which will take place two years later as mentioned by the defendants and the intervener

    voluntary during the hearing (see Articles 2.1. and 2.2. of the circular of 5 July 2019)?). This

    precision would have been invaluable, it is also required by the principle of clarity and predictability of

    the "law", a principle long required by the case law of the European Court of Human Rights
                                     16
    man, as well as the CJEU.



58. The Litigation Chamber considers that at most, this history of the “composition” data

    household "of the complainant's son could have been consulted by going back to the opening date

    right to allowances / social supplement to these allowances and that in any event, the consultation

    the entire history of the complainant's son without a time limit was disproportionate

    and not necessary for the voluntary worker to comply with her legal obligation.



59. However, as the complainant denounces, the “P028 search” which was carried out prevails

    systematically consulting the history of household composition in its entirety,

    or since the birth of the person whose National Register is consulted. Access to this history

    of the complainant's son was therefore disproportionate and the data consulted was not

    relevant with regard to the objective pursued, namely the determination of the composition of

    household at a time T which must be taken into account in the granting of family allowances

    and the social supplement.



60. Accordingly, the Contentious Chamber concludes that, even if it invokes that the TRIVIA application which it

    had to use did not allow consultation of a time-limited history

    (see point 63), the voluntary worker did not carry out the processing necessary for her obligation


    legal and therefore cannot invoke Article 6.1.c) as a basis of lawfulness. The Litigation Chamber

    therefore finds a breach of Article 6 of the GDPR on its part, in the absence of any other basis

    valid lawfulness and without prejudice to the obligation of the controller to identify a basis



16Court eur. D.H., May 4, 2000, Rotaru v. Romania; CJEU, Joined cases C-511/18, C-512/18 and C-520/18,

La Quadrature du Net and others, ECLI: EU: C: 2020: 791, para 121. Decision on the merits 54 / 2021-19 / 23


                                                           17
    legality and not several depending on the circumstances. The Litigation Chamber also concludes

    also for a breach of Article 5.1.c) of the GDPR, the data of which the intervener has

    acquainted with it on the occasion of its illegal consultation (in the absence of a legal basis to legitimize it)

    therefore also irrelevant with regard to the aim pursued.



61. As for the consultation held on April 21, 2020, the Litigation Chamber notes that the

    the defendant and the voluntary intervener are based on their legitimate interest (article 6.1.f) of the GDPR),

    the consultation being justified according to them by the needs of the present procedure. Bedroom

    Litigation recalls in this regard that it has, in the past already, considered that the defense in court

                                                                                                        18
    is a legitimate interest that can validly be invoked by data controllers to

    as much as the cumulative conditions of necessity of the treatment for the realization of the interest

    lawful pursuit and proportionality (i.e. that the fundamental rights and freedoms of

    concerned do not prevail over the interest pursued) are met.



62. Without calling into question the fact that legal defense may indeed constitute an interest

    legitimate within the meaning of Article 6.1.f) of the GDPR, the Litigation Chamber concludes no less, for

    the same reasons as those underlying its conclusion regarding the initial consultation (see.

    points 57-60), that this consultation during the proceedings pending before the DPA was

    also illegal.




         4.2. As for the principle of accountability


63. The Litigation Chamber takes note of what the voluntary intervener declares on the one hand that it


    is required to use the TRIVIA application and on the other hand that it is impossible for him to target in time

    his request to consult the history of the "household composition" data in the Register

    national. The Litigation Chamber is not insensitive to this and refers on this point to the measures

    corrective measures that it decides to take as detailed in points 69 et seq. (title 5).



64. Notwithstanding this last point, the fact remains that in his capacity as responsible

    processing, the voluntary worker could not rely on Article 6.1.c) of the GDPR and did not have

    as was concluded in points 60 and 62 above from no valid basis of lawfulness to access

    the complainant's data via the consultation of the complete history of household composition

    of his son.





17 See. Decision 38/2021 of the Contentious Chamber:

https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-38-2021.pdf

18 See. the Decision 03/2020 of the Contentious Chamber:
https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-03-2020.pdf Decision on the merits 54 / 2021-20 / 23


65. The Contentious Chamber also finds a breach of Articles 24 and 5.2. of


    GDPR on the part of the voluntary worker when she has not been able to put

    put in place the technical measures intended to implement the GDPR. Here again, the House

    Litigation is not unaware of the lack of control of the application by the voluntary worker. This

    circumstance is not, however, such as to eliminate any breach on his part

    given his capacity as data controller.



66. Indeed, the objective of the principle of accountability, or "principle of responsibility" in its translation

    French (Article 5.2. of the GDPR), is to make data controllers accountable - whether it is

    private companies or public authorities or bodies -, and allow the authorities to

    data protection monitoring such as ODA to verify the effectiveness of the measures taken

    applying it. Risks must be identified by setting up action plans and

    control procedures and these organizations must be able to prove without difficulty that they have

    carried out an identification, an assessment and a framework of the risks in terms of protection

    of personal data with regard to the processing they carry out. This principle would be broadly

    undermined, or even emptied of all substance if it was enough for a data controller to invoke,

    once faced with a complaint lodged with the supervisory authority, the fact that the application

    computer used - even its use imposed by a third party - does not allow it to comply

    to the GDPR.



67. In accordance with its obligation of accountability and documentation, the voluntary worker

    therefore, at a minimum, should have alerted the relevant authorities to the overhang situation

    in which the constrained use of the TRIVIA application placed it in relation to its obligations

    arising from the GDPR.



68. The Litigation Chamber is also aware of the care taken by the defendant to respond to

    questions from the complainant and making contact with the supervisory authority to be able to explain to the

    the situation better at the latter. But here again, these circumstances are not such as to

    allow the Litigation Chamber to conclude that there was no breach. Bedroom

    Litigation also noted that the intervener now undertook to contact

    the Supervisory Authority.




    5. Regarding corrective measures and sanctions


69. Under article 100 LCA, the Litigation Chamber has the power to:

1 ° dismiss the complaint;

2 ° order the dismissal;


3 ° pronounce a suspension of the pronouncement; Decision on the merits 54 / 2021-21 / 23


4 ° propose a transaction;

5 ° issue warnings or reprimands;


6 ° order compliance with the requests of the person concerned to exercise these rights;

7 ° order that the person concerned be informed of the security problem;


8 ° order the freezing, limitation or temporary or definitive prohibition of processing;

9 ° order that the processing be brought into conformity;


10 ° order the rectification, restriction or erasure of the data and the notification thereof
data recipients;


11 ° order the withdrawal of accreditation of certification bodies;

12 ° give periodic penalty payments; 19

                                             20
13 ° issue administrative fines;

14 ° order the suspension of transborder data flows to another State or an organization

international;

15 ° send the file to the public prosecutor's office in Brussels, who informs them of the consequences

data on file;

16 ° decide on a case-by-case basis to publish its decisions on the website of the

data.



70. It is important to contextualize the shortcomings noted by the Litigation Chamber with a view to


    to identify the most appropriate corrective measures and sanctions.



71. In this context, the Litigation Chamber will take into account all the circumstances of the case

    and explanations provided by the parties. In this regard, the Litigation Chamber wishes

    to specify that it belongs to it sovereignly as an independent administrative authority -

    in compliance with the relevant articles of the GDPR and the LCA - to determine the measure (s)

    corrective (s) and appropriate sanction (s). 21




72. Thus, it is not for the complainant to ask the Litigation Chamber to order such

    or such corrective measure or sanction. If, notwithstanding the above, the complainant should

    nevertheless ask the Litigation Chamber to pronounce one or the other measure and / or


19
  https://www.autoriteprotectiondonnees.be/publications/politique-en-matiere-d-astreinte.pdf

20 The Contentious Chamber does not comment on the advisability of a possible administrative fine to

    against the defendant. Given the latter's "public authority" status within the meaning of
    Article 5 of the Law of 30 July 2018 on the protection of individuals with regard to processing
    of personal data, read in conjunction with Articles 83.7. of the GDPR and 221 § 2 of the law of
    July 30, 2018 cited above, the Litigation Chamber is in fact not authorized to impose such a fine on him.


21 Litigation Chamber, Decision on the merits 81/2020:
https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-81-2020.pdf Decision on the merits 54 / 2021-22 / 23



    sanction, it is not up to the latter to justify why it would not retain one or

    the other request made by the complainant. These considerations leave intact the obligation for

    the Litigation Chamber to justify the choice of corrective measure (s) and / or sanction (s)

    which it judges, (among the list of measures and sanctions made available to it by the articles

    58 of the GDPR and 95.1 and 100.1 of the LCA recalled above) appropriate to condemn the party

    in question. The Contentious Chamber recalls here, as it mentioned in point 36 above,

    that it is not competent to grant any compensation.



73. The Litigation Chamber found a breach of Articles 6, 5.1.c) as well as of Articles 24


    and 5.2. of the GDPR on behalf of the voluntary worker (points 60, 62 and 65).



74. In view of these shortcomings, the Litigation Chamber sends the voluntary intervener
                                                             22
    a reprimand on the basis of Article 100.1, 5 ° LCA which constitutes, in view of the facts and

    breaches noted, the effective, proportionate and dissuasive sanction as required by

    the applicable article 83 of the GDPR. In this regard, the Litigation Chamber wishes to stress that it

    is not in a position to issue a warning to the voluntary worker as soon as this

    measure cannot be applied when a breach is found. Disclaimer applies

    only when the planned processing operations are likely to violate the

    provisions of the GDPR.




75. The Litigation Chamber is of the opinion that beyond the reprimand addressed to the intervener

    voluntary, it is important that an adequate response be quickly found to the problem raised

    by the complaint and this, in order to allow a limited consultation, respectful of the GDPR, of

    the history of the "household composition" data (as well as the history of other data from the

    National Register if applicable). The Contentious Chamber refers in this regard to the deliberations

    of the Sectoral Committee of the National Register (CSRN) of the former Commission for the Protection of Life

    private (OPC) under which the NISA grants access to limited historical data

    over time in accordance with Article 4 § 1, 3 ° of the Privacy Law which then set out the principle

    proportionality (now principle of minimization worded in Article 5.1, c) of the GDPR). 23 The

    Litigation Chamber is also challenged by the document entitled "File - Description

    specific function of the P028 message ”(in particular point 1.2.1.1.) highlighted by the

    complainant, according to which it would have been waived to use an application more respectful of the


    principle of minimization (see point 23).





22 See. Article 58. 2 b) of the GDPR which provides for sending a call to order to the controller when

 "The processing operations have resulted in a violation of the provisions of this Regulation".


23
  See. taking for example the deliberation of the sectoral committee of the National Register RN No. 20 of March 25, 2009. Decision on the merits 54 / 2021-23 / 23


76. For all these reasons, the Litigation Chamber will draw the attention of the APD Steering Committee


    on this issue. Where appropriate, the ODA bodies could, in accordance with their

    respective competences assigned to them by the LCA, decide to enter into a dialogue with the whole

    of the bodies concerned and / or conduct an in-depth investigation of the issue

    which arose during the complaint leading to this decision.



77. The Contentious Chamber also decides to send a copy of this decision to

    services of the National Registry as well as to Famifed, Iriscare and the Crossroads Security Bank

    social security (BCSS) mentioned by the complainant in the terms of his complaint.




        6. Transparency


78. In view of the importance of transparency with regard to the decision-making process and

    decisions of the Litigation Chamber, this decision will be published on the website of the APD

    by deleting the direct identification data of the parties (either the defendant,

    the voluntary worker and the complainant) and the natural persons mentioned. On the other hand, the Chamber

    Litigation believes that it has no other possibility, for the proper understanding of this

    decision, only to mention Famifed, Iriscare, the Banque-Carrefour de la sécurité

    social (BCSS) and National Registry services.




FOR THESE REASONS,


THE LITIGATION CHAMBER

Decided


    - To issue a reprimand against the voluntary intervener on the basis of the article

        100.1, 5 ° LCA.


Under Article 108.1 LCA, this decision can be appealed to the Court of

contracts (Brussels Court of Appeal) within 30 days of notification, with

the Data Protection Authority as respondent.





(Sé) Hielke Hijmans

President of the Litigation Chamber