APD/GBA (Belgium) - 172/2022: Difference between revisions
No edit summary |
No edit summary |
||
(2 intermediate revisions by one other user not shown) | |||
Line 95: | Line 95: | ||
The DPA continued by stating that the controller did not meet any of the lawfulness requirements of Article 6 GDPR, but examined nevertheless if the controller could rely on legitimate interest ([[Article 6 GDPR|Article 6(1)(f) GDPR]]), for which three cumulative requirements had to be fulfilled. Regarding the first requirement, the purpose test, the DPA considered that the purpose of publishing advertisements for commercial purposes was a legitimate interest in order to display professional qualities and attract attention (see also [[Recitals GDPR|recital 47]]). However, the DPA determined that the controller did not fulfil the second requirement, the necessity test. The DPA assessed whether it was necessary for the controller’s commercial purposes (such as promote its work, its seriousness and the past commercial experiences, etc.) to post the data subject’s postal address and pictures with identification data of the property. The DPA concluded that the posting of the information was not necessary to meet this commercial purpose, because the pictures with identification data could also have been posted without this identification data. The second requirement was therefore not fulfilled because the principle of data minimisation ([[Article 5 GDPR#1c|Article 5(1)(c) GDPR]]) was not respected. Moreover, the DPA also determined that the controller did not fulfil the third requirement, the balancing test, and stated that the data subject could never expect the posting of pictures of his newly acquired house with identification data for commercial purposes. The controller also did not ask the data subject for his consent for the publication of this data on the controller’s website. Thus, the controller did not seem to comply with [[Article 6 GDPR]]. Therefore, the controller had to comply with the erasure – and objection requests of the data subject as soon as possible. The controller was also obliged under [[Article 19 GDPR]] to notify each recipient to whom the data subject’s personal data had been disclosed, in this case the processor, of any erasure of personal data carried out in accordance with [[Article 17 GDPR|Article 17(1) GDPR]], unless such communication would prove impossible or would require disproportionate efforts. This was not the case according to the DPA in this decision. | The DPA continued by stating that the controller did not meet any of the lawfulness requirements of Article 6 GDPR, but examined nevertheless if the controller could rely on legitimate interest ([[Article 6 GDPR|Article 6(1)(f) GDPR]]), for which three cumulative requirements had to be fulfilled. Regarding the first requirement, the purpose test, the DPA considered that the purpose of publishing advertisements for commercial purposes was a legitimate interest in order to display professional qualities and attract attention (see also [[Recitals GDPR|recital 47]]). However, the DPA determined that the controller did not fulfil the second requirement, the necessity test. The DPA assessed whether it was necessary for the controller’s commercial purposes (such as promote its work, its seriousness and the past commercial experiences, etc.) to post the data subject’s postal address and pictures with identification data of the property. The DPA concluded that the posting of the information was not necessary to meet this commercial purpose, because the pictures with identification data could also have been posted without this identification data. The second requirement was therefore not fulfilled because the principle of data minimisation ([[Article 5 GDPR#1c|Article 5(1)(c) GDPR]]) was not respected. Moreover, the DPA also determined that the controller did not fulfil the third requirement, the balancing test, and stated that the data subject could never expect the posting of pictures of his newly acquired house with identification data for commercial purposes. The controller also did not ask the data subject for his consent for the publication of this data on the controller’s website. Thus, the controller did not seem to comply with [[Article 6 GDPR]]. Therefore, the controller had to comply with the erasure – and objection requests of the data subject as soon as possible. The controller was also obliged under [[Article 19 GDPR]] to notify each recipient to whom the data subject’s personal data had been disclosed, in this case the processor, of any erasure of personal data carried out in accordance with [[Article 17 GDPR|Article 17(1) GDPR]], unless such communication would prove impossible or would require disproportionate efforts. This was not the case according to the DPA in this decision. | ||
The DPA concluded by stating that the controller failed to comply with [[Article 12 GDPR|Articles 12(3)]], [[Article 12 GDPR|12(4)]], [[ | The DPA concluded by stating that the controller failed to comply with [[Article 12 GDPR|Articles 12(3)]], [[Article 12 GDPR|12(4)]], [[Article 17 GDPR#1|17(1)]], [[Article 19 GDPR|19]] and [[Article 21 GDPR|21(1) GDPR]]. The DPA ordered the controller to comply with the data subject’s request for erasure ([[Article 17 GDPR|Article 17(1) GDPR]]) and his right to object ([[Article 21 GDPR|Article 21(1) GDPR]]), pursuant to Article 95(1)(5) WOG and [[Article 58 GDPR|Article 58(2)(c) GDPR]]. In particular, the controller had to erase the postal address of the property, including on Google MAPS, and the identification numbers of the data subject's cadastral parcels on the controller's website. Moreover, the DPA ordered the controller to notify the data subject on the erasure of his personal data ([[Article 19 GDPR]]) and to no longer process this data. | ||
The DPA also issued a decision pursuant to Article 95(1)(4) WOG and issued a warning to the controller pursuant to [[Article 58 GDPR|Article 58(2)(a) GDPR]], because the controller seemed to have failed to comply with [[Article 6 GDPR]], in order to ensure that the controller would respond to data subject’s requests in the future. | |||
== Comment == | == Comment == | ||
This is a prima facie decision, not a decision on the merits. Both parties still have the possibility to continue with the procedure if they wish so. | |||
== Further Resources == | == Further Resources == |
Latest revision as of 11:35, 20 December 2022
APD/GBA - 172/2022 | |
---|---|
Authority: | APD/GBA (Belgium) |
Jurisdiction: | Belgium |
Relevant Law: | Article 6 GDPR Article 6(1)(a) GDPR Article 6(1)(f) GDPR Article 12(1) GDPR Article 12(3) GDPR Article 12(4) GDPR Article 17(1) GDPR Article 19 GDPR Article 21(1) GDPR Article 58(2) GDPR |
Type: | Complaint |
Outcome: | Upheld |
Started: | 06.09.2022 |
Decided: | 24.11.2022 |
Published: | 24.11.2022 |
Fine: | n/a |
Parties: | Mister X (the data subject) the estate agency (the controller) |
National Case Number/Name: | 172/2022 |
European Case Law Identifier: | n/a |
Appeal: | n/a |
Original Language(s): | French |
Original Source: | Autorité de Protection des Données (ADP) (in FR) |
Initial Contributor: | n/a |
The Belgian DPA warned a real estate agency for failing to respond to an erasure request and an objection request. The controller did not remove an advertisement for the property sold to the data subject after the purchase was already completed.
English Summary
Facts
On 27 July 2022, the data subject bought a house with a real estate agency (controller), acting as an intermediary between the data subject and the seller. However, pictures of the house, the postal address and other information were still available on the controller’s website in an advertisement. This advertisement included, amongst other information, the address of the property and identification numbers of the cadastral parcels. On 24 June, the data subject requested the erasure of this data and objected to the processing by the controller. The controller refused to comply with these requests for marketing purposes, specifically for the controller’s commercial activity as a real estate agency. The data subject also contacted the host of the controller’s website (processor) to delete the information, without apparent success.
On 6 July 2022, the data subject filed a complaint at the Belgian DPA because the controller refused to comply with the requests. The DPA found that the advertisement, including the displayed information and pictures, was still online on the website on 12 October 2022.
Holding
The DPA held that the controller failed to comply with Articles 12, 13, 17(1) and 21(1) GDPR, because the controller did not respond to the data subject's objection request and erasure request within one month. Moreover, the DPA held that the controller did not have a legal basis for the processing on the controller’s website. The DPA determined that the controller was not able to use the legal basis of contract (Article 6(1)(b) GDPR), because the data subject was not a party to the contract between the controller and the seller of the property. The publication of the advertisement could therefore not be based on Article 6(1)(b) GDPR, especially not after the sale of the property.
The DPA continued by stating that the controller did not meet any of the lawfulness requirements of Article 6 GDPR, but examined nevertheless if the controller could rely on legitimate interest (Article 6(1)(f) GDPR), for which three cumulative requirements had to be fulfilled. Regarding the first requirement, the purpose test, the DPA considered that the purpose of publishing advertisements for commercial purposes was a legitimate interest in order to display professional qualities and attract attention (see also recital 47). However, the DPA determined that the controller did not fulfil the second requirement, the necessity test. The DPA assessed whether it was necessary for the controller’s commercial purposes (such as promote its work, its seriousness and the past commercial experiences, etc.) to post the data subject’s postal address and pictures with identification data of the property. The DPA concluded that the posting of the information was not necessary to meet this commercial purpose, because the pictures with identification data could also have been posted without this identification data. The second requirement was therefore not fulfilled because the principle of data minimisation (Article 5(1)(c) GDPR) was not respected. Moreover, the DPA also determined that the controller did not fulfil the third requirement, the balancing test, and stated that the data subject could never expect the posting of pictures of his newly acquired house with identification data for commercial purposes. The controller also did not ask the data subject for his consent for the publication of this data on the controller’s website. Thus, the controller did not seem to comply with Article 6 GDPR. Therefore, the controller had to comply with the erasure – and objection requests of the data subject as soon as possible. The controller was also obliged under Article 19 GDPR to notify each recipient to whom the data subject’s personal data had been disclosed, in this case the processor, of any erasure of personal data carried out in accordance with Article 17(1) GDPR, unless such communication would prove impossible or would require disproportionate efforts. This was not the case according to the DPA in this decision.
The DPA concluded by stating that the controller failed to comply with Articles 12(3), 12(4), 17(1), 19 and 21(1) GDPR. The DPA ordered the controller to comply with the data subject’s request for erasure (Article 17(1) GDPR) and his right to object (Article 21(1) GDPR), pursuant to Article 95(1)(5) WOG and Article 58(2)(c) GDPR. In particular, the controller had to erase the postal address of the property, including on Google MAPS, and the identification numbers of the data subject's cadastral parcels on the controller's website. Moreover, the DPA ordered the controller to notify the data subject on the erasure of his personal data (Article 19 GDPR) and to no longer process this data.
The DPA also issued a decision pursuant to Article 95(1)(4) WOG and issued a warning to the controller pursuant to Article 58(2)(a) GDPR, because the controller seemed to have failed to comply with Article 6 GDPR, in order to ensure that the controller would respond to data subject’s requests in the future.
Comment
This is a prima facie decision, not a decision on the merits. Both parties still have the possibility to continue with the procedure if they wish so.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/13 Litigation Chamber Decision 172/2022 of 24 November 2022 File number: DOS-2022-02927 Subject: Complaint relating to a refusal to respond to a request to exercise the right erasure, the right to object and the right to restriction of processing by a real estate agency. The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke Hijmans, chairman; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the data protection), hereinafter “GDPR”; Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, hereinafter “ACL”; Having regard to the internal regulations as approved by the House of Representatives on 20 December 2018 and published in the Belgian Official Gazette on January 15, 2019; Considering the documents in the file; Made the following decision regarding: The plaintiff: Mr. X, hereinafter “the plaintiff”; . The defendant: Agency Y, hereinafter: “the defendant”. . . Decision 172/2022 - 2/13 I. Facts and procedure 1. On July 6, 2022, the complainant filed a complaint with the Data Protection Authority (hereinafter “the DPA”) against the defendant. The subject of the complaint concerns the agency's refusal real estate (hereinafter “defendant”) to withdraw from its website the advertisement of a property real estate that the plaintiff (purchaser) bought on June 27, 2022 from the former owner (seller). 2. On June 24, 2022, the complainant exercises his right of erasure and opposition. It emerges from documents in the file that: the plaintiff asked the defendant "by telephone and by e-mail from the June 14 and June 16” to remove from the website (…) the information on his house located at “…” (minimum sale price; detailed descriptions; images of its interior and exterior; images with identification numbers of cadastral parcels; Google MAPS); the defendant refuses to comply with the plaintiff's request to maintain "[the] publication, and this for marketing purposes of [his] commercial activity as an agent”; the complainant asked the creator of the website, company Z, “to act promptly to remove the information [published on the defendant's website] or make access to them impossible”; the plaintiff indicates that he will "not hesitate to take the appropriate actions in order to defend [his] rights, including in particular [to file] a complaint with the Professional Institute of Agents immovable property (IPI) in relation to the actions of Y [and] [...] of the Direction générale de the Economic Inspection with regard to [the] commercial practices via its point of contact contact ". In support of his argument, the plaintiff cites in particular judgment 71/2020 of the Litigation Chamber. 1 3. On July 8, 2022, the Front Line Service (hereinafter “SPL”) of the APD requests additional information to the complainant, particularly if "the publications concerning [the]propertymention[...][its] nameandaddressoftheproperty”, and in the affirmative of provide him with the evidence. On the same date, the complainant informed the SPL that his name, unlike his postal address, is not mentioned on the publication contentious and attaches a screenshot taken at 6:11 p.m. The complainant adds in his e-mail from July 8, 2022 sent at 6:16 p.m. that his address is equivalent to personal data being given that anyone with access to his address can make the link between his real estate and his personal situation. 4. On September 6, 2022, the SPL declares the complaint admissible on the basis of Articles 58 and 60 of the LCA, and sends it to the Litigation Chamber in accordance with Article 62, § 1 of the ACL. 1Litigation Chamber,decisiononthemerits71/2020of30October2020,Thefulltextofthejudgmentisavailableat the website of the Data Protection Authority, at the following address: https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-71-2020.pdf. Decision 172/2022 - 3/13 II. Motivation 5. Pursuant to Article 4, § 1 of the LCA, the DPA is responsible for monitoring the principles of data protection contained in the GDPR and other laws containing provisions relating to the protection of the processing of personal data. 6. Pursuant to Article 33, §1 of the LCA, the Litigation Chamber is the body for ODA administrative litigation. It receives complaints that the Service de Première Ligne (SPL) transmits to it pursuant to Article 62, § 1 of the LCA, i.e. complaints admissible. In accordance with Article 60 paragraph 2 of the LCA, complaints are admissible if they are written in one of the national languages, contain a statement of the facts and the indications necessary to identify the processing of personal data on which they relate and which fall within the competence of the DPA. 7. Pursuant to articles 51 and s. of the GDPR and Article 4, § 1 of the LCA, it is up to the Litigation Chamber as an administrative litigation body of the DPA, to exercise effective control of the application of the GDPR and to protect the freedoms and rights fundamental rights of natural persons with regard to processing and to facilitate the free flow personal data within the Union. 8. On the basis of the facts described in the complaint file as summarized above, and on the basis powers attributed to it by the legislator under Article 95, §1 of the the LCA, the Litigation Chamber decides to proceed, on the one hand, to take a decision in accordance with Article 95, § 1, 5° of the LCA, more specifically to order the person responsible processing to comply with the complainant's request to exercise his right to erasure (Art. 17.1 of the GDPR) and his right to object (Art. 21.1 of the GDPR), on the other hand, to a er warning in accordance with Article 95, § 1, 4° of the LCA; and for the reasons set out below. 9. The Litigation Chamber notes that the complainant raises the refusal by the head of the processing to follow up on the request to exercise the right to erasure (art.17.1.c of GDPR) and opposition (Art. 21.1 GDPR). 10. Firstly, on the basis of the documents supporting the complaint, the Litigation Chamber finds that the complainant exercised, on June 24, 2022, his right to erasure (art. 17.1.c of the GDPR) and his right to object (Art. 21.1 of the GDPR) but that the controller did not respond to the complainant's request. 11. The Litigation Chamber recalls that Article 4.7) of the GDPR defines the “responsible for the 2 processing” as being “the natural or legal person, public authority, service 2GDPR, recitals 74, 79 and 81; GDPR, art. 4. 7), 4.8), 24, 26, 28, 29. Decision 172/2022 - 4/13 oranotherbodywhich,aloneorjointlywithothers,determinesthepurposesand means of treatment”. Article 4, 8) of the GDPR defines “processor” as “the natural or legal person, public authority, agency or other body dealing personal data on behalf of the controller”. 12. A “processing” of personal data means, according to the GDPR, “any operation or any set of operations whether or not carried out using processes automated and applied to personal data or sets of data personnel, such as collecting, recording, organizing, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, broadcast or any other form of making available, the reconciliation or interconnection, limitation, erasure or destruction”. 4 13. As the EDPB pointed out in Guidelines 07/2020 regarding the notions of controller and processor, the controller may be 5 designated by a legislative or regulatory text. Otherwise, to identify it, it should analyze the factual elements or circumstances of the case, in particular determine its legal and organizational capacity, as well as its autonomy in the definition of the purposes, i.e. the objectives pursued, and the means of processing. 14. The Litigation Chamber recalls that the controller must follow up on the request made pursuant to Articles 15 to 22 of the GDPR by the complainant, in this case a request for erasure provided for in Article 17 of the GDPR (exercise of the right to erasure) and opposition provided for in Article 21 of the GDPR (exercise of the right of opposition), and this in the 6 compliance with the conditions set out in Article 12 of the GDPR. 15. The Litigation Chamber also emphasizes that it is the responsibility of the controller to provide the complainant with information on the measures taken following a request formulated in application of Articles 15 to 22 of the GDPR, as soon as possible cause within one month of receipt of the request. Article 12.3 of the GDPR provides that this period may, if necessary, be extended by two months, taking into account the complexity and number of requests. In such a case, the controller inform the complainant of this extension and the reasons for the postponement within one month from from receipt of the request. 9 3 4GDPR, Art. 4.7), 4.8), 24, 26, 28, 29; GDPR, recitals 74, 79 and 81. GDPR, art. 4, 2). 5EDPB, “Guidelines 07/2020 concerning the notions of controller and processor in the GDPR”, adopted on July 7, 2021. 6 GDPR, Art. 12. 7GDPR, Art. 12.2 and 12.3. 8 GDPR, Art. 12.3. 9 GDPR, art. 12.3. Decision 172/2022 - 5/13 16. In the event that the data controller does not respond to the request made by the complainant, he shall inform the latter without delay and at the latest within one month from from receipt of the request, the reasons for its inaction and the possibility to lodge a complaint with a supervisory authority and to lodge an appeal 10 jurisdictional. 17. In this case, the Litigation Division – based on the definition of “responsible for treatment” included in Article 4.7) of the GDPR – declares the real estate agency as the controller and company Z as the processor since the latter has, it seems, created the website on behalf of and according to the instructions of the said agency real estate .11 18. In addition, the Litigation Division notes that the controller did not give following requests to exercise the right to erasure and opposition made by the complainant, therefore the controller has not complied with the requirements of Articles 12, 17.1 and 21.1 GDPR. 19. Secondly, on the basis of the documents supporting the complaint, the Litigation Chamber finds that : - the complainant indicated to the SPL – in his email of July 8, 2022 sent at 6:16 p.m. – that his name, unlike his postal address, is not mentioned on the publication disputed and attached a screenshot taken at 6:11 p.m. to support his complaint; - the ad in dispute is still published on the website of the real estate agency – in date of September 12, 2022 at 10:05 a.m. (Belgian time) and October 12, 2022 at 11:30 a.m. (Belgian time) Belgian) – at the following URL (…) - the postal address of the property, namely "..." is mentioned in the published announcement by the controller on its website. Figure 1 - Screenshot from September 12, 2022 at 10:05 a.m. (Belgian time – following URL address (…) [Screenshot] Figure 2 - Screenshot from October 12, 2022 at 11:30 a.m. (Belgian time – following URL address (… 10 GDPR, art. 12.4. 11The data processor processes the personal data only on behalf of the data controller. processing. The data processor is generally a third party outside the company. ;GDPR,art.4.7),4.8),24,26,28, 29; GDPR, recitals 74, 79 and 81; EDPB, “Guidelines 07/2020 concerning the notions of data controller GDPR”, adopted on July 7, 2021. Decision 172/2022 - 6/13 [Screenshot] 20. Article 4(1) of the GDPR defines “personal data” as “any information relating to an identified or identifiable natural person (hereinafter referred to as the "data subject"); is deemed to be an "identifiable natural person" a natural person who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, data of location, an online identifier, or to one or more specific elements specific to its physical, physiological, genetic, psychological, economic, cultural or social”. 21. The Litigation Chamber emphasizes that the processing is "lawful only if, and to the extent where at least one of the following conditions is met: a) the data subject has consented to the processing of his or her personal data for one or more specific purposes; b) the processing is necessary for the performance of a contract to which the data subject is party or the execution of pre-contractual measures taken at the latter's request; c) processing is necessary for compliance with a legal obligation to which the controller processing is submitted; d) the processing is necessary to safeguard the vital interests of the data subject or another natural person; e) processing is necessary for the performance of a task carried out in the public interest or falling within the the exercise of official authority vested in the controller; f) processing is necessary for the purposes of the legitimate interests pursued by the controller processing or by a third party, unless the interests or freedoms and rights fundamentals of the data subject which require data protection to be 13 personal nature, in particular when the person concerned is a child. [...] » . 22. In this case, the Litigation Chamber recalls that the publication of an image – in concreto images of a house published with the postal address of the person concerned and a image with identification numbers of cadastral parcels – is a processing of personal data within the meaning of Article 4.1) of the GDPR. 14 12 GDPR, Art. 4, 1). ; Opinion 4/2007 of the “article 29” working group on data protection on the concept of personal data personal character, adopted on 20 June 2007, available at https://cnpd.public.lu/dam-assets/fr/publications/groupe- art29/wp136_en.pdf. ; See the judgments Nowak (CJEU, 20 December 2017, C-434/16, ECLI:EU:C:2017:994) and Breyer (CUJE, 19 October 2016, C-582/14, ECLI: EU: C:2016:779). 13 GDPR, Art. 6.1. 14 Opinion 4/2007 of the “article 29” working group on data protection on the concept of personal data personnel, adopted on 20 June 2007, available at https://cnpd.public.lu/dam-assets/fr/publications/groupe- art29/wp136_en.pdf. ; See the judgments Nowak (CJEU, 20 December 2017, C-434/16, ECLI:EU:C:2017:994) and Breyer (CUJE, 19 October 2016, C-582/14, ECLI: EU: C:2016:779). ; Data Protection Authority, Litigation Chamber, October 30 Decision 172/2022 - 7/13 23. The Litigation Chamber understands that processing such as the publication of images of a building is necessary for the performance of a contract between a real estate agency and a owner of real estate. A real estate agency can establish the legality of this processing on the basis of Article 6.1, b) of the GDPR: the processing is necessary for the fulfillment of the mission of intermediary with which it is invested, namely to rent or sell the property of an owner to a third party. A real estate agency could not achieve the purpose of the contract without the specific data processing being implemented work (for example, the publication of photos of a property on the website). However, the Litigation Chamber understands that the complainant is the new owner of the real estate (purchaser) and that he is not a party to the contract which binds the real estate agency and the previous owner (seller). Therefore, the publication of the announcement on the site Internet of the controller cannot, in principle, be based on the contract ((article 6.1, b) of the GDPR), even less after the sale of June 27, 2022. 24. The Contentious Chamber considers that the controller does not respond to any of the conditions of lawfulness provided for in Article 6 of the GDPR. The Chamber nevertheless examines whether the data processing could be based on the legal basis of “legitimate interest” provided for in Article 6.1, f) of the GDPR. Indeed, to prove the lawfulness of the publication of the announcement on the website with the postal address of the complainant and the numbers identification of cadastral parcels, the controller could – in lack of complainant or contract consent – rely on “legitimate interest” provided for in Article 6.1, f) of the GDPR. 25. In accordance with Article 6.1, f) of the GDPR and the case law of the Court of Justice of the Union European Union (hereinafter “the Court”), three cumulative conditions must be met in order to that a data controller can validly invoke this basis of lawfulness, "to namely, firstly, the pursuit of a legitimate interest by the controller or by or third parties to whom the data is communicated, secondly, the need for the processing of personal data for the fulfillment of the legitimate interest pursued and, thirdly, the condition that the fundamental rights and freedoms of the 16 person concerned by data protection do not prevail” 2020, decision on the merits 71/2020 (§56), available at https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-71-2020.pdf. 15CJEU, 4 May 2017, C-13/16, Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde v Rīgas pašvaldības SIA „Rīgas satiksme”, recital 28. See also CJEU, 11 December 2019, C-708/18, TK v Asociaţia de Proprietari blockM5AScaraA,considering40. ;Data Protection Authority,Litigation Chamber,October 30,2020,decision on the merits 71/2020 (§68), available at https://www.autoriteprotectiondonnees.be/publications/decision-quant-au- fund-n-71-2020.pdf. 16 CJEU, 4 May 2017, C-13/16, Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde v Rīgas pašvaldības SIA „Rīgas satiksme”, recital 28. See also CJEU, 11 December 2019, C-708/18, TK v Asociaţia de Proprietari blockM5AScaraA,considering40. ;Data Protection Authority,Litigation Chamber,October 30,2020,decision on the merits 71/2020 (§68), available at https://www.autoriteprotectiondonnees.be/publications/decision-quant-au- fund-n-71-2020.pdf. Decision 172/2022 - 8/13 26. In other words, in order to be able to invoke the basis of lawfulness of “legitimate interest” in accordance with Article 6.1, f) of the GDPR, the controller must demonstrate that: 1) the interests it pursues with the processing can be recognized as legitimate (the “ finality test”); 2) the envisaged processing is necessary to achieve those interests (the “necessity test”); and 3) the weighing of these interests against the fundamental interests, freedoms and rights data subjects weighs in favor of the data controller (the “test of weighting”). 27. With regard to the first condition (the "finality test"), the Litigation Chamber considers that the purpose of publishing announcements of immovable property sold by a real estate agency for commercial purposes to display the professional qualities and also attract the attention of potential buyers or future sellers by allowing them to get a more precise idea of the type of goods that have already been marketed must be considered to be made for a legitimate interest. In accordance with recital 47 of the GDPR, the interest that the defendant pursued as responsible for the processing can in itself be considered legitimate. The first condition repeated in Article 6, §1, f) of the GDPR is therefore fulfilled. 28. With respect to the second condition (the “necessity test”), the head of the processing must demonstrate that the processing is necessary for the achievement of the purposes pursued. This means more precisely that one must ask oneself if the same result not be achieved by other means, without processing personal data or without unnecessary substantial processing for data subjects. 29. Based on the purpose, namely the publication on the website of images of the goods sold with detailed descriptions, and this for commercial purposes to promote the work, the seriously, the qualities of enhancement of the buildings, or even the experiences the agency's past commercial activities, it is therefore necessary to check whether the publication of images showing the house with indication of the postal address of the person concerned and/or the cadastral parcel identification numbers may or may not contribute to the promotion of the real estate agency. 30. The Litigation Chamber understands that the publication of images of goods sold by a real estate agency is a practice that may be deemed necessary to display the professional qualities and also attract the attention of potential or future buyers sellers allowing them to get a more precise idea of the type of goods that have already 17Data Protection Authority, Litigation Chamber, 30 October 2020, substantive decision 71/2020 (§69), available at https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-71-2020.pdf. 18 Data Protection Authority, Litigation Chamber, October 30, 2020, substantive decision 71/2020 (§70 to 72), available at https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-71-2020.pdf. Decision 172/2022 - 9/13 been marketed. However, the Litigation Division considers that this purpose may also be achieved without publication of the images with the identification data of the complainant. The second condition is therefore not satisfied because the principle of data minimization (Article 5.1, c) of the GDPR) has not been complied with. 31. With regard to the third condition (the “weighting test”), one must first take account of the reasonable expectations of the person concerned, in accordance with recital 47 GDPR. In particular, it must be assessed whether "the data subject can reasonably expect, at the time and in the context of data collection, to personal character, that they are processed for a given purpose”. 32. The Litigation Chamber finds that the plaintiff could not at any time have expected that images of his new home be published with his mailing address and/or cadastral parcel identification numbers for commercial purposes. Moreover, the er controller does not appear to have requested, under Article 6, §1, a) of the GDPR, the consent of the complainant to publish the images of the goods sold with his postal address and/or the identification numbers of the cadastral parcels The third condition is therefore not met. 33. The Litigation Chamber concludes that all of the elements set out above demonstrate that the controller cannot invoke article 6.1, f) of the GDPR to qualify the publication of the announcement with the postal address of the complainant and/or the numbers identification of legal cadastral parcels. Therefore, the controller seems not to comply with the requirements of article 6 of the GDPR. Thus, the manager of treatment must respond favorably to the request to exercise the right to the erasure and opposition of the complainant: he has the obligation to erase, as soon as possible, the complainant's personal data (Art. 17.1 GDPR) and must no longer process them (Art. 21.1 GDPR). 34. In addition, the data controller is required, under Article 19 of the GDPR, to the notification obligation with regard to the erasure of personal data complainant's staff: he must notify each recipient to whom the personal data complainant's staff were communicated, in this case the director and the host of the website of the real estate agency, any erasure of personal data made in accordance with Article 17.1 of the GDPR, unless such communication is proves impossible or requires disproportionate effort. The Litigation Chamber is of the opinion that such communication does not prove impossible since, in this case, it suffices to 19 GDPR, Recital 47. ;CJEU,11 December 2019,C-708/18,TKc/AsociaţiadeProprietariblocM5A-ScaraA,considering 58.; Data Protection Authority, Litigation Chamber, October 30, 2020, substantive decision 71/2020 (§73 to 75), available at https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-71-2020.pdf. 20 GDPR, art. 19. Decision 172/2022 - 10/13 communicate with, at most, two recipients, namely the director/creator of the site Internet and/or the host. 35. In conclusion, in view of the aforementioned examination, the Litigation Chamber considers that the data controller has not, prima facie, complied with Articles 12.3 and 12.4 of the GDPR, as well as Articles 17.1, 19 and 21.1 of the GDPR, which in this case justifies proceeding with the making a decision on the basis of Article 95, § 1, 5° of the LCA, more specifically to order the controller to comply with the complainant's request to exercise their right to erasure (art. 17.1 of the GDPR) and their right to object (art. 21.1 of the GDPR); to erase the personal data in question (namely the postal address of the property, including Google MAPS, and the numbers identification of the cadastral plots of the person concerned on the website of the real estate agency) ; to comply, under article 19 of the GDPR, with its obligation to notification regarding the erasure of personal data of the complainant ; and to no longer process this data. 36. The Litigation Chamber also concludes that the controller did not, prima facie, complied with Article 6 of the GDPR, which in this case justifies taking a decision on the basis of Article 95, § 1, 4° of the LCA, more specifically to address the responsible for processing a warning within the meaning of Article 58.2.a) of the GDPR so that the latter ensures, in the future, to respond to requests for the exercise of human rights concerned and delete, in the absence of the consent of the person concerned, the address postal address (including Google MAPS), and other identifying data such as identification numbers of the cadastral plots of future real estate that would be sold and published on the website. 37. This decision is a prima facie decision taken by the Litigation Chamber pursuant to Article 95 of the LCA on the basis of the complaint submitted by the complainant, 21 within the framework of the “procedure prior to the substantive decision” and not a decision on the merits of the Litigation Chamber within the meaning of Article 100 of the LCA. 38. The purpose of this decision is to inform the defendant, allegedly responsible for the processing, because it may have violated the provisions of the GDPR, in order to enable it to still comply with the aforementioned provisions. If, however, the controller does not agree with the content of this prima facie decision and believes that he can make factual and/or legal arguments which could lead to another decision, the latter may address to the House Litigation a request for processing on the merits of the case via the e-mail address litigationchamber@apd-gba.be, within 30 days of notification of the 21Section 3, Subsection 2 of the LCA (arts. 94 to 97 inclusive). Decision 172/2022 - 11/13 this decision. If necessary, the execution of this decision will be suspended. during the aforementioned period. 39. In the event of further processing of the case on the merits, pursuant to Articles 98, 2° and 3° juncto article 99 of the LCA, the Litigation Chamber will invite the parties to introduce their conclusions and attach to the file all the documents they deem useful. If applicable, the this decision is permanently suspended. 40. In the interests of transparency, the Litigation Chamber finally emphasizes that a dealing with the case on the merits may lead to the imposition of the measures mentioned in 22 section 100 of the ACL. III. Publication of the decision 41. Given the importance of transparency regarding the decision-making process of the Chamber Litigation, this decision is published on the website of the Protection Authority Datas. However, it is not necessary for this purpose that the identification data of the parties are communicated directly. 22 st Art. 100. § 1. The litigation chamber has the power to 1° dismiss the complaint without follow-up; 2° order the dismissal; 3° pronouncing the suspension of the pronouncement; 4° to propose a transaction; 5° issue warnings and reprimands; 6° order to comply with requests from the data subject to exercise his or her rights; 7° order that the person concerned be informed of the security problem; 8° order the freezing, limitation or temporary or permanent prohibition of processing; 9° order compliance of the processing; 10° order the rectification, restriction or erasure of the data and the notification thereof to the recipients Datas ; 11° order the withdrawal of the approval of the certification bodies; 12° to issue periodic penalty payments; 13° to issue administrative fines; 14° order the suspension of cross-border data flows to another State or an international body; 15° forward the file to the public prosecutor's office in Brussels, who informs it of the follow-up given to the file; 16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. Decision 172/2022 - 12/13 FOR THESE REASONS, the Litigation Chamber of the Data Protection Authority decides, under subject to the introduction of a request by the controller of a treatment on the merits in accordance with articles 98 e.s. of the ACL: - under article 58.2.c) of the GDPR and article 95, §1, 5° of the ACL, to order the controller to comply with the request of the data subject to exercise their rights, more specifically to comply with the complainant's request to exercise his right to erasure (Art. 17.1 GDPR) and his right to object (Art. 21.1 GDPR); of delete the personal data in question (i.e. the postal address of the property, including Google MAPS, and the identification numbers of the cadastral plots of the person concerned on the website of the real estate agency); to comply with its obligation to notify with regard to the erasure of data personal nature of the complainant; to no longer process this data; And this within 30 days of notification of this decision; - pursuant to Article 58.2.a) of the GDPR and Article 95, §1, 4° of the LCA, issue a warning against the controller so that the latter ensures, in the future, to respond to requests for exercise of the rights of the person concerned and delete, in the absence of consent of the person concerned, the postal address (including GoogleMAPS), and other identification data such as phone numbers identification of the cadastral plots of future real estate which would be sold and published on the website; - to order the controller to inform the Authority by email of data protection (Litigation Chamber) of the suite which is given to this decision, within the same period, via the e-mail address litigationchamber@apd-gba.be; and - if the controller does not comply in due time with what it is asked above, to deal ex officio with the case on the merits, in accordance with articles 98 e.s. of the ACL. Decision 172/2022 - 13/13 In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged, within thirty days of its notification, to the Court of Markets (court d'appel de Bruxelles), with the Data Protection Authority as defendant. Such an appeal may be introduced by means of an interlocutory request which must contain the 23 information listed in article 1034ter of the Judicial Code. The interlocutory motion must be filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 24 via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.). (se).Hielke H IJMANS President of the Litigation Chamber 23 The request contains on pain of nullity: 1° indication of the day, month and year; 2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or Business Number ; 3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned; 4° the object and the brief statement of the means of the request; 5° the indication of the judge who is seized of the application; 6° the signature of the applicant or his lawyer. 24The request, accompanied by its annex, shall be sent, in as many copies as there are parties involved, by letter recommended to the court clerk or filed with the court office.