APD/GBA (Belgium) - 124/2021

APD/GBA (Belgium) - 124/2021
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 6(3) GDPR Article 13(1)(c) GDPR
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	10.11.2021
Published:
Fine:	None
Parties:	n/a
National Case Number/Name:	124/2021
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Dutch
Original Source:	Beslissing ten gronde 124/2021 (in NL)
Initial Contributor:	Matthias Smet

The Belgian DPA considered that it was competent to review the lawfulness of data processing operations which, although having started before 25 May 2018, had continued after that date, but that it was not competent for one-off or multiple processing operations that only took place before then (i.e. before the application date of the GDPR).

English Summary

Facts

Complainants X1 and X2 filed a complaint against a controller (the Defendant) regarding the disclosure to third parties of personal data concerning tenants of social housing in the context of an asset investigation. According to the Complainants, the Defendant did not have any valid legal basis to disclose such data (i.e. breach of Article 6 GDPR), and had failed to properly inform the Complainants about the processing activity (i.e. breach of Article 13 GDPR).

After these complaints were declared admissible, the Belgian DPA conducted an investigation at the premises of the Defendant. During the investigation, five additional breaches against data protection principles were discovered.

The Defendant stated that the processing it carried out formed part of the legal framework for social housing and that the legal basis for the processing, namely the consent of the Complainants, was expressly included in the Flemish regulations governing the social housing system.

Holding

Dismissal of the complaints

The processing operations in casu all took place before the GDPR became applicable, except for the period that was granted to the Complainants to leave the house. This period expired on 31 October 2021.

In previous decisions, the Belgian DPA had already stated that it can only be competent for data processing operations which, although having started before 25 May 2018, still continued after that date, but not for one-off or multiple processing operations which exclusively took place before 25 May 2018.

On the basis of these considerations, the Belgian DPA considers itself incompetent ratione temporis to review the merits of the complaints, given that the contested processing operations had been carried out before the GDPR had become applicable. Therefore, the Belgian DPA decided to dismiss the complaints in accordance with the terms of the its dismissal policy.

'Legal obligation' or 'fulfillment of a task in the public interest' as a legal basis

Despite the complaints being dismissed, the Belgian DPA provided guidance on the legal basis of the processing operations. The Belgian DPA stated in particular that if processing operations are carried out because the controller is legally obliged to do so, or because they are necessary for the performance of a task carried out in the public interest, the processing must be based on Union or Member State law. Article 6(3) GDPR specifies that the purpose of the processing must be found in that legal basis. In other words, a legislative standard must normally be sufficiently clear and precise so that the essential characteristics (including the precise purposes) of a processing operation are known when the above legal bases are relied on. The Belgian DPA noted however that, in practice, processing is often carried out on the basis of a general regulatory power, rather than on the basis of detailed provisions specifically allowing for such processing. Therefore, the Belgian DPA considered that when using general legal grounds, a balancing test is necessary between the necessity of the processing and the interests of the data subjects.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

                                                                                                1/12








                                                                                Dispute room



                                       Decision on the merits 124/2021 of 10 November 2021








File number : DOS-2018-05039en DOS-2018-05524



Subject : Sharing of personal data concerning tenants of social housing in the

framework of an asset investigation




The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke Hijmans,

chairman and Messrs Frank De Smet and Romain Robert;

Having regard to Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 on

the protection of natural persons with regard to the processing of personal data and

on the free movement of such data and repealing Directive 95/46/EC (General

Data Protection Regulation), hereinafter GDPR;


Having regard to the law of 3 December 2017 establishing the Data Protection Authority, hereinafter WOG;


Having regard to the internal rules of procedure, as approved by the Chamber of Representatives

on December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;

Having regard to the documents in the file;



has taken the following decision regarding:



The complainants: Mrs and Mr X1, represented by Mr. Özgür Balci (hereinafter: 'complainant 1'), and

                   Mrs. X2, represented by Mr. Özgür Balci (hereinafter "complainant 2"),

                   hereinafter collectively referred to as 'the complainants'.



The defendant: Y, represented by mr. Kris De Sager, hereinafter “the defendant”. Decision on the merits 124/2021 - 2/12




I. Facts procedure



    1. On September 17, 2018 and September 26, 2018, respectively, Complainant 1 and Complainant 2 filed a

        lodge a complaint with the Data Protection Authority against the defendant.

        The object of the complaints concerns the communication to third parties of personal data

        concerning tenants of social housing in the context of an asset survey.


   2. On October 5, 2018 and October 15, 2018 respectively, the complaints will be

        First-line service has been declared admissible on the basis of Articles 58 and 60 WOG and the

        complaints pursuant to art. 62, §1 WOG transferred to the Disputes Chamber. The Dispute Room

        deals with both cases in a single decision as the subject matter of the complaint is fully

        is parallel.


   3. On October 18, 2018, in accordance with art. 96, §1 WOG the request of the Dispute Chamber

        sent to the Inspectorate to carry out an investigation, together with the complaints

        and the inventory of the pieces.


   4. The inspection will be completed by the Inspectorate on 21 October 2019, the report will be

        the file is added and the file is transferred by the Inspector General to the

        Chairman of the Disputes Chamber (art. 91, §1 and §2 WOG).

        The report contains findings with regard to the subject matter of the complaint and concludes that

        defendant:


                    • has not complied with the obligations imposed by Articles 5 and 6 of the GDPR;

                        (Principles on processing of personal data and lawfulness of the

                        processing)



                    • the obligations imposed by Article 12(1) of the GDPR and by Articles 13 and

                        14 of the GDPR;

                        (provision of transparent information, communication and further rules for the

                        exercise of the rights of data subjects, and regarding to provide

                        information)



                    • the obligations imposed by Article 44 of the GDPR and Article 49 of the GDPR

                        has not complied with.

                        (General principle on transfers and on derogations for specific

                        situations)



  5. The report also contains findings outside the subject matter of the complaint and concludes that

        defendant: Judgment on the merits 124/2021 - 3/12




                    • has not complied with the obligations imposed by Article 30(1) of the GDPR;

                         (register of processing activities)



                    • has not complied with the obligations imposed by Article 31 of the GDPR;

                (cooperation with the supervisory authority)



                    • the obligations imposed by Article 37(5) and (7) of the GDPR and Article 38,

                         paragraph 1 of the GDPR has not been complied with.

                (designation of the data protection officer and his position)



  6. In its report, the Inspectorate formulates an additional consideration of the temporal


        application of the GDPR to the aforementioned facts. In this regard, she refers to the fact that the

        Defendant has requested the complainants by letter dated April 11, 2018 for “no later than 31”

        October 2018 […] to leave the house and garage and make it available to Y”. The

        Inspectorate indicates that the GDPR applies to the aforementioned facts, in view of the fact that

        the period to vacate the house and garage expires on October 31, 2018, and thus after the

        become applicable of the GDPR on 25 May 2018 . 1


  7. In addition, the Inspectorate states that the GDPR has already entered into force on 24 May 2016

        pursuant to Article 99(1) of the GDPR, whereby the defendant had already taken the necessary steps

        must take to ensure that the processing of personal data is in accordance with the GDPR

        bring.


  8. On January 14, 2020, the Disputes Chamber will decide on the basis of art. 95, §1, 1° and art. 98 WOG that it

        file is ready for processing on the merits.


  9. The Disputes Chamber decides on the basis of the report of the Inspectorate to divide the file

        in two separate parts.


  10. On January 14, 2020, the concerned parties will be notified by registered letter of

        the provisions as stated in article 95, §2, as well as those in art. 98 WOG. They will also be

        pursuant to art. 99 WOG of the time limits for submitting their defences.


        With regard to the findings with regard to the subject-matter of the complaint, the

        date for receipt of the statement of reply from the complainants on 28 January 2020 and this before

        the statement of the defendant's reply on February 11, 2020. With regard to the findings

        going beyond the subject of the complaint, the deadline for receipt of the

        statement of defense of the defendant recorded on January 28, 2020.






1
 Article 99(2) of the GDPR Decision on the merits 124/2021 - 4/12



11. At the request of the defendant, the Disputes Chamber decided to exceptionally grant an extension

      of the claim periods. With regard to the findings with regard to the

      subject of the complaint (art. 98, 1° WOG), the time limit for the complainants' conclusion was determined

      on January 31, 2020 and this for the statement of reply of the defendant on February 14, 2020 .

      With regard to the findings that go beyond the object of the complaint, the extreme


      date for receipt of the defendant's claims set at January 31, 2020

12. On January 14, 2020, the defendant requests a copy of the file (art. 95, §2, 3° WOG), which

      it was transferred on January 22, 2020.


13. On 29 January 2020, the complainants lodged their statement of defense in which three pleas were raised:

      quoted:


                  • In the first ground of appeal, the complainants allege an infringement of Articles 5 and 6

                     of the GDPR. Defendant does not justify on what legal basis it

                     communicated the complainants' details to Z. There is no evidence that

                     complainants have consented to the communication of the

                     personal data to Z.


                  • In the second ground of appeal, the complainants allege an infringement of Articles 12, 13 and

                     14 of the GDPR. The information provided on the Defendant's website is not

                     transparent, incoherent and incomprehensible to those involved.

                  • In the third plea, the complainants allege an infringement of Articles 44 and 49

                     of the GDPR. Referring to the Inspection Report, the conditions of

                     Article 49 not complied with.


  14. On January 31, 2020, the Disputes Chamber will receive the statement of defense from the defendant

      with regard to findings outside the subject matter of the complaint. In this she wishes her

      to assert defenses in the file with regard to the findings made by the

      Inspection service was performed outside the scope of the complaint (art. 92.3° WOG) and the infringements that

      it believes it must conclude from these findings.


          • With regard to the findings regarding the register of processing activities,

              defendant that she has in any case always been transparent in all her communication to

              the Inspectorate and that it has complied with all its obligations. Defendant argues that

              the foregoing shows that it is impossible to conclude that it committed an infringement

              against Article 30(1) of the GDPR.


          • Concerning the determination of cooperation with the supervisory authority

              Defendant believes that it never fulfills its obligations under Article of the GDPR

              would have intentionally failed to comply and thus did not infringe Article 31 of the GDPR. Decision on the merits 124/2021 - 5/12



        • What the findings regarding the appointment of the data protection officer

            and its position, the defendant is of the opinion that all requirements are always met, and that

            the professional qualities and expertise in data protection beyond question


            to stand.

    According to the defendant, no infringement was committed with regard to Articles 37 and 38 of the GDPR.


15. On 14 February 2020, the Disputes Chamber received the statement of reply from the

    defendant with regard to the findings within the subject matter of the complaint. In her first

    In its plea, the defendant argues that only acts performed from the date on which the

    AVG regulation applies can withstand the test of the AVG. There would be no actions

    have been made from 25 May 2018 that would be the subject of discussion.


     In its second plea, the defendant states that the obligations imposed by Articles 5 and

     6 were complied with. In this regard, the defendant argues that this is a document issued by the Flemish Government and

     the Flemish Housing Company is a recognized social housing company with as

     specific aim to improve living conditions (of the most deprived and single people)

     by ensuring an adequate supply of social rental or owner-occupied housing. She acts and is

     bound by the legal framework on social rent. Defendant further argues that the

     processing of the personal data must be in accordance with the AVG, but that this processing is

     is based on the consent of the complainants, which is also provided for in the decision of

     the Flemish Government of 12 October 2007 to regulate the social rental system in

     implementation of Title VII of the Flemish Housing Code to regulate the social housing system

     for the implementation of Title VII of the Flemish Housing Code (hereinafter referred to as the "Social Rent Framework Decree")

     . In addition, the defendant refers to Legal Consideration 47 of the GDPR, which states that the

     processing of personal data that are strictly necessary for fraud prevention is also a

     legitimate interest for the controller. Furthermore, the defendant argues that the

     lack of a detailed procedure concerning the control of the

     property condition abroad and the exchanges of this information by no means

     means that information cannot be sought and obtained in any other way.


    With regard to Articles 13 and 14 of the GDPR, the defendant maintains that the GDPR has not yet

    was applicable.


    With regard to the privacy statement, the respondent, referring to its reply letter of 1

    October 2019, that this was established on the advice of its official for

    data protection and that it is still subject to revision and reworking.


    As far as the wording is concerned, the defendant argues that the text is clear and that the abbreviations also

    clear when read in context. Decision on the merits 124/2021 - 6/12




II. Justification


    II.1. Jurisdiction of the Dispute Chamber


   16. On the basis of the information currently available to the Disputes Chamber, and in particular

       on the fact that the contested processing operations were carried out on a date before the applicable

       of the GDPR, the Disputes Chamber considers itself ratione temporis to be incompetent to process this complaint

       to treat and therefore decide to dismiss this on the basis of Article 95, §1, 3° WOG.


  17. In order for the Disputes Chamber to be competent, it is necessary that the GDPR applies to the

       processing of personal data that are the subject of the complaint. According to art. 4, paragraph 2

       GDPR is the processing of personal data: “any operation or set of operations with

       relating to personal data or a set of personal data, whether or not carried out via

       automated procedures, such as collecting, recording, organizing, structuring, storing,

       update or modify, request, consult, use, provide by transmission,

       distribute or otherwise make available, align or combine, shield,

       erasure or destruction of data”.


       The processing operations in this case and their timing can be summarized as follows: the order to

       verification investigation at the Dutch company Z dates from March 7, 2018. The investigation by the

       firm Z was completed and a report was submitted on March 28, 2018. Subsequently, with

       a letter dated 11 April 2018 an end to the lease and the defendants are

       requested to vacate the house and the garage by 31 October 2018 at the latest.


       In the defendant's letter, the complainants are given a period of time to

       to leave the garage. This period ends on October 31, 2018, so after the application of the

       GDPR on 25 May 2018. 2 In its conclusion, the defendant argues that the

       data processing in question took place before May 25, 2018, as a result of which the GDPR

       does not apply in this case. The Inspectorate argues in its report that the GDPR does apply

       is applicable because the aforementioned term expires on October 31, 2018, i.e. after the applicable

       become of the GDPR. Moreover, according to the Inspectorate, the GDPR has already entered into force on 24

       May 2016, pursuant to Article 99(1) of the GDPR, whereby the defendant already has the necessary

       should have taken steps to ensure that the processing operations are in accordance with

       would be with the GDPR.


   18. The Disputes Chamber establishes that the aforementioned processing of personal data has

       occurred before the GDPR came into effect on May 25, 2018. Although the deadline

       which was granted to the complainants to vacate the home and garage does indeed expire on 31

       October 2021, the processing operations that are the subject of this case have not

       occurred during this period. The Disputes Chamber is therefore not authorized to take cognizance of



2
 Article 99(2) GDPR Decision on the merits 124/2021 - 7/12




        to take. The Disputes Chamber finds the legal basis of its competence in the law of 3


        December 2017 establishing the Data Protection Authority (WOG) whose

        entry into force was established, subject to exceptions, on 25 May 2018 (Article 110 of the

        WOG). Although the Disputes Chamber is competent for data processing that, although before 25

        May 2018 but still continuing after that, she is not authorized for one-off

        processing operations that would have taken place before 25 May 2018 or multiple processing operations

                                            4
        the before May 25, 2018. The Disputes Chamber cannot determine that after 25 May 2018

        processing operations to which this case relates have taken place.

                                                                                           5
   19. In view of the foregoing, the Dispute Chamber proceeds to a technical dismissal through which this

        complaint is not followed up further as there is no infringement of the GDPR.


    II.2. Legislative framework : Relationship between the processing of personal data and the

          admission requirements in the context of social rent



   20. For the sake of completeness, the Disputes Chamber wishes to draw attention to the broader issue


        related to the complaint, namely the processing of personal data in function of the

        control of the registration and admission conditions in the context of social rent.


   21. In this context, the Disputes Chamber first of all points out that pursuant to Article 13.1c) of the GDPR, the

        controller already when collecting personal data concerning a

        data subject, this data subject must inform about, among other things, the processing purposes

                                                                                                           6
        for which the personal data is intended, as well as the legal basis of the processing. The

        The controller must therefore establish the legal basis for the processing prior to the processing

        transparent manner. No cascade system is possible in determining the

        applicable legal basis for the processing, where the controller

        designates alternative legal bases, as each legal base has different obligations


        associated with the controller.


   22. At the time of the facts in question, the registration and admission requirements in the

        framework of social rent determined by the Social Rent Framework Decree. Article 3, 1 of the Framework Decision

        states that a natural person can be registered in the register referred to in Article 7, if he

        meets several conditions, including the following:


         ”3° [the (prospect) tenant], together with his family members, has no house or plot that



3
  See point 3.1.A.4 of the Disputes Chamber's Dismissal Policy, published on its website on June 16, 2021,
(https://www.dataprotectionauthority.be/publications/sepotbeleid-van-de-geschillenkamer.pdf).
4Decision on the merits 19/2020 of 29 April 2020 (https://www.dataprotectionauthority.be/publications/besluit-ten-

ground no.-19-2020.pdf)
5 See point 3.1.A4 of the Disputes Chamber's Dismissal Policy, published on its website on June 16, 2021,
(https://www.dataprotectionauthority.be/publications/sepotbeleid-van-de-geschillenkamer.pdf).

6See art. 13, 1 c of the GDPR.
7
 “Each landlord keeps a register in which, according to the order in which the application for registration is submitted, the candidate
tenants are registered, stating any priority rules […]” (Art. 7 of the Social Rent Framework Decree) Decision on the merits 124/2021 - 8/12




        is intended for residential construction wholly in full ownership or wholly in usufruct in domestic or

        abroad, unless it concerns a camping stay located in the Flemish Region”


   23. Pursuant to Article 52, §1 of the Framework Decree, the tenant gives the landlord, by means of his application

        to registration in the register, his registration as a prospective tenant or his tenantship, the


        permission to submit to the competent authorities and institutions and to the local authorities the

        necessary documents or information regarding the conditions laid down in this decree and

        to obtain obligations. These competent authorities and institutions are in§2 of the same

        article listed in a non-exhaustive manner as follows 9:


                1° the National Register of Natural Persons, mentioned in the law of 8 August 1983

               arranging a national register of natural persons;


               2° the social security institutions, mentioned in Articles 1 and 2, first paragraph, 2°, of the law

               of 15 January 1990 establishing and organizing a Crossroads Bank for the


               Social Security and the persons to whom the social security network with

               application of Article 18 of the same law was extended;


               3° the Federal Public Service Finance;


               4° the Civic Integration Crossroads Bank;

               5° the Houses of Dutch;


               6° the reception offices;


               7° the Flemish E-government coordination cell;


               8° the organizations and institutions referred to in Article 4, first paragraph, including the

               policy area Education and Training of the Flemish Community.


   24. These sources can be easily consulted for real estate properties in Belgium.

        However, investigations into real estate in EU countries or non-EU countries are less




8
 art. 52.§1.: The reference person gives the landlord, by means of his application for registration in the register, his registration as
prospective tenant or his tenantship, the permission to apply to the competent authorities and institutions and to the local authorities
administer the necessary documents or data regarding the conditions and obligations set out in this Decree
obtain, while preserving the application of the provisions of the law of December 8, 1992 on the protection of the
privacy in relation to the processing of personal data, its implementing decrees and any other provision

for the protection of privacy, established by or pursuant to a law, decree or decision.
9Art. 52.§2: For the implementation of the provisions of this Decree, the lessor relies on information provided by the competent authorities
governments or institutions or other landlords can deliver it electronically. If in this way no or insufficient
data are obtained, the candidate-tenant or tenant is requested to provide the necessary data.

information from the competent authorities or institutions or other landlords shows that the prospective tenant or tenant does not or does not
more meets the conditions and obligations of this Decree, this determination will be communicated to the prospective tenant or
tenant who can respond within one week after the notification. Among the competent authorities and institutions, mentioned in §1 and §2,
first paragraph, includes :1° the National Register of Natural Persons, mentioned in the law of 8 August 1983
arranging a national register of natural persons; 2° the social security institutions referred to in Articles 1 and 2,
first paragraph, 2°, of the law of 15 January 1990 establishing and organizing a Crossroads Bank for Social Security

and the persons to whom the social security network was extended under Article 18 of the same law; 3° the
Federal Public Service Finance;4°the Crossroads Bank for Civic Integration;5°the Houses of Dutch;6°the reception offices;7°de
Flemish E-government coordination cell;8° the organizations and the institutions referred to in Article 4, first paragraph, including the
policy area Education and Training of the Flemish Community. Decision on the merits 124/2021 - 9/12




        naturally. The defendant notes that no procedure with regard to investigations in

        non-EU countries was available at the time of the facts, but that this does not exclude the possibility that there

        can be called upon to private investigative agencies to comply with the obligation to check with


        with regard to the aforementioned condition of ownership.

   25. The Social Rent Framework Decree was repealed by the Decree of the Flemish Government of 11


        September 2020 to implement the Flemish Housing Codex. The aforementioned article 52, §§1 and 2

        of the Social Rent Framework Decree has been incorporated in full in Article 5.246, §1 of the

        the aforementioned decision of the Flemish Government of 11 September 2020. Social landlords can

        therefore still conducting research via the same non-exhaustive sources listed above

        to real estate. To address the lack of an effective

        procedure for investigations into foreign real estate, the Flemish


        The Social Housing Company (hereinafter: “VMSW”) has concluded a framework agreement with

        private investigative agencies specializing in real estate investigations in

        Abroad. Social landlords can call on these research bureaus when

        there is a risk of the presence of foreign immovable property at their (candidate)

        tenants.


   26. In its claims, the defendant refers to the fact that it has received a letter from the Flemish Government and

        Flemish Housing Company is a recognized housing company whose aim is to

        rental or sale of social housing the housing conditions of the person in need of housing

        improve families and singles, especially the most deprived families and


        single persons, by ensuring an adequate supply of social housing or social housing

        owner-occupied houses. It does this, among other things, by checking the registration conditions (such as:

        set out above).


   27. If the processing is carried out because the controller is legally required to do so

        mandatory10 or if the processing is necessary for the fulfillment of a task of general

        interest or for a task in the exercise of public authority, the 1

        processing has a basis in Union or Member State law. 12


    28. However, in accordance with Article 6.3 of the GDPR, “the purpose of the processing must be that legal basis”

        [to be] determined whether in relation to the processing referred to in point (e) of paragraph 1 is necessary


        [to be] for the performance of a task in the public interest or for the exercise of

        public authority conferred on the controller”. Furthermore, according to article

        6.3 GDPR, the legal basis also includes “specific provisions to regulate the application of the rules”

        of this Regulation, including the general conditions on the





10Art. 6, 1, (c) of the GDPR.
11
 art. 6, 1, (e) of the GDPR
12Art. 6.3 of the AVG. Decision on the merits 124/2021 - 10/12



       lawfulness of processing by the controller; the types processed


       data; The involved; the entities to which and the purposes for which the

       personal data may be provided; the target limitation; the storage periods; and the

       processing activities and procedures (…)”.

   29. The Disputes Chamber points out in this regard that, in accordance with the aforementioned Article 6.3 of the GDPR,

       read in conjunction with Article 22 of the Constitution and in the light of Articles 7 and 8 of

       the European Charter of Fundamental Rights, a legislative standard defines the essential features of a


       must record data processing that is necessary for the performance of a task of

       public interest or for the exercise of official authority vested in the
                                                    13
       controller is entrusted. The Disputes Chamber emphasizes that the parties involved

       processing should be framed by a standard that is sufficiently clear and precise

       the application of which is foreseeable to the persons concerned. In accordance with article 6.3

       GDPR, the precise purpose(s) of the processing should be specified in the legal standard itself

       included. Furthermore, the following elements must be foreseeable: the identity of the

       controller(s), the categories of data processed, on the understanding that

       they must be in accordance with Article 5.1 of the GDPR, "adequate, relevant and

       limited to what is necessary for the purposes for which they are processed", the

       categories of data subjects whose data will be processed, the retention period of

       the data, the recipients or categories of recipients to whom their data is sent

       communicated, the circumstances in which and the reasons for which they will be communicated

       and any limitation of the obligations and/or rights referred to in Articles 5, 12 to

       with 22 and 34 GDPR.


   30. The Disputes Chamber points out in this regard, however, that tasks of general interest or public

       authority with which controllers are entrusted are often not based on

       precisely defined obligations or legislative standards that meet the requirements stated

       under marginal 28, in particular the recording of the essential characteristics of the

       data processing. Rather, processing takes place on the basis of a more general

       authorization to act as is necessary for the performance of the task. This leads to

       the relevant legal basis in practice often no concretely defined provisions

       contains about the necessary data processing. Data controllers who on

       If you wish to invoke Article 6.1 e) GDPR on such a legal basis, you must then

       make a trade-off between the necessity of the processing for the task of general

       interests and the interests of those involved.







13See also the advice of the Knowledge Center of the GBA 36/2020, 42/2020, 44/2020, 46/2020, 52/2020 and 64/2020
(https://www.dataprotectionauthority.be/burger/zoeken?q=&search_category%5B%5D=taxonomy%3Apublications&sear

ch_type%5B%5D=advice&s=recent&l=25) Decision on the merits 124/2021 - 11/12




   31. The defendant also refers to Legal Consideration 47 of the GDPR which states that the

        processing of personal data that are strictly necessary for fraud prevention also a

        legitimate interest for the controller. The Disputes Chamber points out that

        the legal basis 'legitimate interest' as provided for in Article 6.1, f) of the GDPR does not apply

        applies to processing by bodies with a public law function in the context of

        the performance of their duties.14


   32. Finally, the defendant argues that the processing in question is based on the

        consent of the complainants and that the processing is therefore lawful under Article 6, 1, a)

        of the GDPR. This consent would result from the signing of a declaration of honor

        in which the tenant confirms that he does not own immovable property. More specifically, it mentions

        statement, which was prepared by the VMSW, the following:


        This declaration on honor serves to verify whether the imposed property value has been met

        met. The declaration made will be checked with the competent government department.


   33. The Disputes Chamber states that although consent may constitute a lawful ground for processing,

        as stipulated in Article 6, 1, a) of the GDPR, but adds that at the time

        processing is based on the consent of the data subject, there are several conditions

        this permission applies. Consent must be freely given, specific and

        informed and finally unambiguous.15In this context, Recital 43 of the

        GDPR states that there is no free consent in the case of a clear


        disproportion between the parties or if the failure to give consent to the data subjects

        obvious disadvantage. In this case there is a clear mismatch between the person concerned

        and the social housing company with a specific status under public law as

        controller. Moreover, the (candidate) social tenant does not have the

        actual choice to refuse without negative consequences to the refusal

        be connected. After all, in the event of refusal, he is no longer eligible for social security benefits

        home. The Disputes Chamber emphasizes that a legally required consent is not a lawful

        processing ground in accordance with Article 6(1)(a) of the GDPR as it is not free

        may have been given by the person concerned.


   34. In view of the above, the Disputes Chamber determines that the consent does not

        may constitute a legal ground for the present processing operations


   35. In this decision, the Disputes Chamber limits itself to these general considerations about the

        legal basis. The Disputes Chamber has observed these social problems and

        will investigate further when further proceedings in this regard are brought before it

        turn into.




14Recital 47 of the GDPR.
15EDPB Guidelines 05/2020 on consent underRegulation 2016/679, p. 7-8. Decision on the merits 124/2021 - 12/12




III. Publication of the decision



   36. Given the importance of transparency in the decision-making of the

       Litigation Chamber, this decision will be published on the website of the

       Data Protection Authority. It is not necessary, however, that the identification data

       of the parties be made public directly.



   FOR THESE REASONS,

   the Disputes Chamber of the Data Protection Authority decided, after deliberation, to

   of Article 100, §1, 1° WOG to dismiss the present complaint.



   Against this decision, pursuant to art. 108, §1 WOG, appeals must be lodged within a

   period of thirty days, from the notification, to the Marktenhof, with the

   Data Protection Authority as Defendant.












(get). Hielke Hijmans

Chairman of the Disputes Chamber