APD/GBA (Belgium) - 18/2023

APD/GBA - 18/2023
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 5(1)(a) GDPR Article 6(1) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	02.03.2023
Published:	02.03.2023
Fine:	n/a
Parties:	A care home (the controller) Mrs. X (the data subject)
National Case Number/Name:	18/2023
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	French
Original Source:	Autorité de Protection des Données (in FR)
Initial Contributor:	n/a

An employer has no legal obligation to inform its staff of the identity of an employee who requested an intervention following harassment. This processing was considered unlawful, even though the identity of the employee was publicly available.

English Summary

Facts

A nursing home employee (the data subject) made a request for psychosocial intervention for abuse and harassment by the employer's management. Psychosocial intervention is a procedure, under Belgian labor law, aiming to address psychosocial issues raised by employees in workplaces with the help of a neutral and external advisor. In this case, the external advisor issued an opinion recommending to take individual and collective measures. The employer (controller) subsequently posted a note on a wall of the workplace entitled "Information for our staff following the formal complaint for violence and moral harassment lodged by Mrs X against the board + collective measures for the improvement of relations and general organisation" indicating that the employee made that request. The controller also wrote an open letter to its staff mentioning her name, explaining that she made that request.

On 16 January 2023, the data subject requested access to her data in order to know what the legal basis was for processing her personal data. The controller explained that it had an obligation to share to external advisor's recommendation regarding the collective measures and that the identity of the originator of the request was anyways publicly available. The data subject contested the controller's right to publish her personal data and, therefore, filed a complaint with the Belgian DPA on 23 January 2023.

Holding

The DPA argued that there was no legal obligation for an employer to publish the collective or individual measures included in an opinion issued by the external advisor.

The note posted by the controller on the wall mentioned the name and surname of the data subject. The DPA noted that these data were not communicated for the purpose of publishing the collective or individual measure but for information purposes. The controller could not, therefore, rely on a request, or even an obligation, from the external advisor to publish the data subject's first and last name and, thus, could not rely on Article 6(1)(c) for the processing in question.

The controller's second justification that the identity of the data subject as the originator of the request for intervention was already known to the staff was not valid as publicly available data are considered personal data as long as they are relating to an identifiable individual. Thus, the provisions of the GDPR applied to this case. In this way, even if the employees of the controller were aware of the origin of the request for action, the controller still had to rely on a legal basis to process the data subject's personal data, even when publicly available.

Finally, the DPA conducted the balancing test to see whether the legal basis of legitimate interest could be invoked but the processing did not fulfil the three cumulative criteria.

Therefore, the DPA held that the controller did not process the data of the data subject lawfully (violation of Article 5(1)(a) GDPR and Article 6(1) GDPR). It thus warned the controller that the publication of the names of the data subject in an open letter to the staff without a legal basis could result in a breach of Article 5(1)(a) GDPR and Article 6(1) GDPR, it ordered the controller to comply with the data subject’s request of erasure of her personal data in a timely manner and no later than 30 days from the publication of that decision.

Comment

This decision aimed at informing the alleged controller of the fact that it may have breached the GDPR and thus enabling it to comply with the GDPR requirements.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/9





                                                                          Litigation Chamber


                                                             Decision 18/2023 of March 2, 2023





File number: DOS-2023-00435


Subject: Complaint relating to the publication in the workplace of the first and last name of a

employee who submitted a request for formal psychosocial intervention




The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke
Hijmans, chairman;


Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and

to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the
data protection), hereinafter “GDPR”;


Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, hereinafter

“ACL”;

Having regard to the internal regulations as approved by the House of Representatives on 20

December 2018 and published in the Belgian Official Gazette on January 15, 2019;


Considering the documents in the file;


Made the following decision regarding:



The complainant: Ms. X, hereinafter “the complainant”; .

                                                                                                          .
                                                                                                          .
The defendant: the rest home Y, hereinafter: “the defendant”. Decision 18/2023 – 2/9



I. Facts and procedure


 1. The subject of the complaint concerns the publication of the surname and first name of the complainant in a note

       and a letter, both accessible at the complainant's workplace.

       The plaintiff is an employee of the defendant, the rest home Y. As part of her

       work, the complainant submitted a request for formal psychosocial intervention to

       of the external adviser in the prevention of psychosocial aspects, Z, for acts of violence

       and moral harassment. In this context, the external advisor gave an opinion to the

       defendant. This opinion would recommend the adoption by the defendant of collective measures

       and individual vis-à-vis the complainant. Following this notice, the defendant would have published on

       a wall of the nursing home a note identifying the complainant, by her first and last name,

       as the person who submitted the request for formal psychosocial intervention

       (below the note). Subsequently, the defendant again identified the defendant by

       his first and last name in an open letter to the staff of the rest home (hereafter the

       open letter). The plaintiff thus challenges the defendant's right to publish its

       personal data.

 2. On 23 January 2023, the complainant lodged a complaint with the Authority for the Protection of

       given against the defendant.


 3. On January 27, 2023, the complaint was declared admissible by the Front Line Service on the
                                              1
       basis of Articles 58 and 60 of the LCA and the complaint is forwarded to the Litigation Chamber
                                  st 2
       pursuant to Article 62, § 1 of the LCA.

 4. Pursuant to article 95 § 2, 3° of the LCA as well as article 47 of the rules of order

       inside the DPA, a copy of the file may be requested by the parties. If one of

       parties wishes to make use of the possibility of consulting the file, the latter is required to

       contact the secretariat of the Litigation Chamber, preferably via the address

       litigationchamber@apd-gba.be.



II. Motivation


 5. According to Article 4.7 of the GDPR, the controller is the “natural person or

       legal entity, public authority, service or other body which, alone or jointly with

       others, determines the purposes and means of the processing”. Since the parts

       of the file provided by the complainant were either signed by the defendant or written




1
 Pursuant to article 61 LCA, the Litigation Chamber informs the parties by this decision, of the fact that the complaint has been
declared admissible.
2 Pursuant to Article 95, § 2 LCA, by this decision, the Litigation Division informs the parties of the fact that following
of this complaint, the file was forwarded to him. Decision 18/2023 – 3/9


       on their behalf, the Litigation Chamber finds that the person responsible for the disputed processing

       would be the management of Y, the defendant.


 6. The Litigation Chamber recalls that the surname and first name are personal data

       personal within the meaning of Article 4.1 of the GDPR. This is information about a

       identified or identifiable natural person (in this case, the complainant) allowing

       directly identify the data subject. The publication of these personal data
       staff in a note posted on the wall of the institution where the complainant works

       therefore does not constitute processing within the meaning of Article 4.2 of the GDPR.

       of personal data is subject to the general principles as defined in

       Article 5 of the GDPR, the data controller being required to ensure that these principles

       generals are respected. 3


 7. On the basis of Article 5(1)(a) GDPR, personal data
       must be "processed in a lawful, fair and transparent manner with regard to the person

       concerned (lawfulness, fairness and transparency)". The principle of lawfulness of article 5.1.a of the GDPR

       implies that the data controller must designate one of the permitted legal bases

       by Article 6, paragraph 1 of the GDPR on the basis of which he wishes to carry out the processing

       of personal data.


 8. The bases of lawfulness of Article 6.1 of the GDPR are the following:

       “1. Processing is only lawful if and insofar as at least one of the conditions

       following is fulfilled:


       a) the data subject has consented to the processing of his or her personal data
           for one or more specific purposes;


       b) the processing is necessary for the performance of a contract to which the data subject is

           party or the execution of pre-contractual measures taken at the latter's request;

       c) processing is necessary for compliance with a legal obligation to which the controller

           treatment is submitted;


       d) the processing is necessary to protect the vital interests of the person

           concerned or of another natural person;

       e) processing is necessary for the performance of a task carried out in the public interest or falling within the

           the exercise of official authority vested in the controller;


       f) the processing is necessary for the purposes of the legitimate interests pursued by the controller

           processing or by a third party, unless the interests or freedoms and





3Article 5.2 of the GDPR. Decision 18/2023 – 4/9


           fundamental rights of the data subject which require data protection

           of a personal nature, in particular when the person concerned is a child. »


 9. It appears from the documents in the file that the complainant exercised her right of access to the

       defendant on January 16, 2023 in order to know the legal basis of the processing in question.

       In its response of January 18, 2023 and its open letter, the defendant does not cite

       explicitly of the legal bases of Article 6.1 of the GDPR but justifies such publication
       for two reasons: (1) the obligation to publish the recommendations and (2) the public nature of

       the origin of the complaint.


 10. As for the first justification, the Litigation Chamber notes that the execution of a

       possible request from the external psychosocial prevention adviser cannot be based on

       a legal obligation. Indeed, there is no legal obligation on the part of a

       employer to publish the collective or individual measures included in a notice issued
       by the external prevention adviser. Moreover, in the letter, the defendant indicates that

       the obligation imposed by Z related to the publication of the collective measures. However, the note

       posted by the management on the walls of the nursing home is entitled “Information for

       our staff following the formal complaint for violence and moral harassment filed by

       Mrs. X against management + collective measures for the improvement of relations and

       general organization” (the Litigation Chamber underlines). The complainant is again

       identified in the memorandum under the subtitle “Conclusionconcerningthecomplaint”: “Advisor

       prevention of occupational medicine (Z) did not reveal any violence or

       moral harassment on the part of the management towards Mrs X”.

 11. On the basis of these elements, the Litigation Division finds that the surname and first name of the

       complainant have not been communicated for the purpose of publishing the collective measures, or

       even individual. The only measurements published are the collective measurements and do not

       do not concern the complainant. The identity of the complainant in adequacy communicated only as

       informative. The defendant could then not rely on a request, or even a

       obligationoftheexternalpsychosocialpreventionadvisortopublishfirstnameandsurname

       of the complainant. The defendant could therefore not rely on Article 6.1.c of the GDPR
       for the disputed treatment.


 12. The defendant's second justification resides in the fact that the identity of the

       complainant as being at the origin of the request for intervention would already be known to the

       staff of Y. The external adviser would have carried out a survey among the workers

       of the institution during which the workers would have had the opportunity to express themselves on the



4See article 32sexiesdecies, paragraph 1 of the law of 4 August 1996 on the well-being of workers during the performance of
their work with regard to the prevention of psychosocial risks at work including, in particular, violence and moral harassment
or sexual at work, as amended by the law of February 28, 2014, where the employer is only obliged to send the written notice by
the prevention counselor and the person concerned by the request for formal psychosocial intervention and the person
having submitted the request for formal psychosocial intervention. Decision 18/2023 – 5/9


       ongoing dispute between the plaintiff and the defendant. The fact that the complainant is the

       person who requested the intervention of an external adviser would be in a way a

       information already public.


 13. With regard to the processing of publicly accessible data, the European Committee for

       data protection reminded “that personal data, even if they are

       been made public, remain considered as personal data and

       that their processing therefore continues to require appropriate safeguards”. The treatment of

       publicly accessible personal data must therefore also meet the

       principle of lawfulness recalled in points 7 and 8. Even if the employees of the institution of

       defendant knew the origin of the request to intervene, the defendant must

       rely on a legal basis to process the personal data of the complainant,

       certainly publicly accessible.


 14. Given the nature of the processing in question, the Litigation Chamber considers that the

       legal bases provided for in Article 6 of the GDPR do not seem to apply in

       the species. For the sake of completeness, the Litigation Chamber nevertheless examines whether the

       data processing could be based on the basis of lawfulness of the legitimate interest

       provided for in Article 6.1.f of the GDPR.


 15. As recalled by the Litigation Chamber in its decision 35/2020, pursuant to

       Article 6.1.f of the GDPR and the case law of the Court of Justice, three conditions

       cumulative must be met for a data controller to be able to validly

       rely on this legal basis, “namely, first, the pursuit of an interest

       legitimate by the data controller or by the third party or third parties to whom the data is

       communicated, secondly, the need for the processing of personal data

       personnel for the achievement of the legitimate interest pursued and, thirdly, the condition

       that the fundamental rights and freedoms of the person concerned by the protection of

       data do not prevail”. 7


 16. In order to be able to invoke the ground of lawfulness of “legitimate interest” under Article 6.1.f

       of the GDPR, the controller must demonstrate, in other words, that:


       1) the interests he pursues with the processing can be recognized as

       legitimate (the “purpose test”);






5European Data Protection Board (or EDPB), opinion 06/2014 on the notion of legitimate interest pursued by the
data controller within the meaning of Article 7 of Directive 95/46/EC, p. 43.

6 Litigation Chamber, decision 35/2020 of June 30, 2020, points 26 and 27, available at
https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-35-2020.pdf
7
  CJEU, judgment of 4 May 2017, Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde t. Rīgas pašvaldības
SIA “Rīgas satiksme”, C-13/16; ECLI: EU:C:2017:336, para. 28-31; CJEU, judgment of December 11, 2019,
TK v. Asociaţia de Proprietari block M5A-ScaraA, C-708/18, ECLI:EU:C:2019:1064, para. 40. Decision 18/2023 – 6/9


       2) the envisaged processing is necessary for the realization of these interests (the “criterion of

       need ") ; And


       3) the balancing of these interests with the fundamental interests, freedoms and rights of

       data subjects leans in favor of the controller or a third party (the
       “balancing test”).


 17. With regard to the first condition, the Litigation Chamber notes, according to the documents

       of the file and more particularly its letter to the complainant of January 18, 2023, that the

       defendant justifies the publication of the identity of the complainant by, on the one hand, the fact that

       staff members reportedly inquired about the results of the investigation
       carried out by the external adviser Z and, on the other hand, his desire to show that no act of

       violence or harassment would have been observed on his part. Since the legitimacy

       processing can be interpreted broadly, the Chamber considers that the purposes which

       consist of informing the staff of an opinion of the external adviser and defending its reputation,

       must be considered as pursuing a legitimate interest. The first requirement

       included in Article 6.1.f of the GDPR is therefore fulfilled.

 18. With regard to the second condition (the “necessity test”), it should be

       demonstrate that the processing is necessary for the achievement of the purposes

       pursued. This means more precisely that one must ask oneself if the same result

       not be achieved by other means, without processing personal data or

       without processing that is unnecessarily burdensome or intrusive for the data subjects.

 19. Based on the purposes mentioned in point 17, it should therefore be checked whether the publication

       surnames and first names of the complainant may or may not contribute to informing staff about

       the existence of acts of violence and moral harassment on the part of the defendant. There

       Litigation Chamber considers that the publication of the surname and first name of the complainant

       is not strictly necessary for the pursuit of such purposes. Indeed, the mere mention

       the results of the external counsel's investigation, without containing the identity of the complainant,

       was sufficient for this purpose. The second condition is therefore not met.

 20. The three conditions for invoking legitimate interest as a legal basis being

       cumulative, the Litigation Chamber does not analyze the balancing criterion because the

       disputed treatment does not meet the requirements of the necessity test.

 21. The defendant could therefore not invoke Article 6.1.f of the GDPR to justify the

       publication of the surname and first name of the complainant in the note and the letter in question.

       presenting no legal basis for the disputed processing, the defendant does not seem to

       respect the principle of lawfulness prescribed by articles 5.1.a and 6.1 of the GDPR.



8 "Article 29" Working Party on data protection, Opinion 06/2014 on the notion of legitimate interest pursued by the
data controller within the meaning of Article 7 of Directive 95/45/EC, p. 27. Decision 18/2023 – 7/9


 22. The Litigation Chamber therefore considers that on the basis of the facts set out above, it

       must be concluded that the defendant may have committed a violation of the principle of

       legality prescribed by Article 5.1.a and 6.1 of the GDPR, which justifies, in this case, proceeding to

       making a decision in accordance with Article 95, § 1, 4° of the ACL, more specifically

       to warn the defendant that the publication of the surname and first name of the complainant in

       open notes or letters to staff without a legal basis could constitute a breach of
                                                                                      er
       article 5.1.a and article 6.1 of the GDPR, as well as, in accordance with article 95, §1, 5° of the ACL,

       to order it to comply with the complainant's request to delete the data at

       personal nature of the complainant of the note and the open letter, and this in particular seen:

            - The information note displayed concerning the psychosocial intervention and the letter

                opened in response to the letter from the CNE regional secretary, presumably

                written by the defendant, in which the plaintiff is identified;

            - The complainant's reply letter to the registered letter of January 18, 2023

                presumably written by the defendant, in which the defendant

                would explain the legal bases of the disputed processing in non-legal terms.


 23. This decision is a prima facie decision taken by the Litigation Chamber

       pursuant to Article 95 of the LCA on the basis of the complaint submitted by the complainant,
                                                                         9
       within the framework of the “procedure prior to the substantive decision” and not a decision on the
       merits of the Litigation Chamber within the meaning of Article 100 of the LCA.


 24. The purpose of this decision is to inform the defendant, allegedly responsible for the

       processing, because it may have violated the provisions of the GDPR,

       in order to enable it to still comply with the aforementioned provisions.

 25. If, however, the defendant does not agree with the content of this decision

       prima facie and believes that it can make factual and/or legal arguments that

       could lead to another decision, it may send the Litigation Chamber a

       request for treatment on the merits of the case via the e-mail address litigationchamber@apd-

       gba.be, within 30 days of notification of this decision. The case

       applicable, the execution of this decision is suspended for the period

       aforementioned.

 26. In the event of further processing of the case on the merits, pursuant to Articles 98, 2° and 3°

       juncto article 99 of the LCA, the Litigation Chamber will invite the parties to introduce their

       conclusions and attach to the file all the documents they deem useful. If applicable, the

       this decision is permanently suspended.






9Section 3, Subsection 2 of the ACL (Articles 94 to 97 inclusive). Decision 18/2023 – 8/9


 27. With a view to transparency, the Litigation Division finally emphasizes that a

        dealing with the case on the merits may lead to the imposition of the measures mentioned in

        section 100 of the ACL. 10



III. Publication of the decision



 28. Given the importance of transparency regarding the decision-making process of the Chamber

        Litigation, this decision is published on the website of the Protection Authority

        Datas. However, it is not necessary for this purpose that the identification data

        of the parties are communicated directly.






    FOR THESE REASONS,


    the Litigation Chamber of the Data Protection Authority decides, subject to

    the introduction of a request by the defendant for treatment on the merits in accordance with

    to articles 98 e.s. of the ACL:


        - pursuant to Article 58.2.a) of the GDPR and Article 95, § 1, 4° of the LCA, to notify the

            defendant FOR THE FUTURE THAT THE PUBLICATION OF THE NAME AND FIRST NAME OF THE COMPLAINANT

            in open notes or letters to staff without a legal basis could constitute

            a violation of Article 5.1.a and Article 6.1 of the GDPR.


        - pursuant to Article 58.2.c) of the GDPR and Article 95, §1, 5° of the LCA, to order

            the defendant to comply with the plaintiff's request to delete the

            disputed personal data, as soon as possible and at the latest

            within 30 days of notification of this decision.








10Art. 100. § 1. The litigation chamber has the power to
 1° dismiss the complaint without follow-up;
 2° order the dismissal;
 3° pronouncing the suspension of the pronouncement;

 4° to propose a transaction;
 5° issue warnings and reprimands;
 6° order to comply with requests from the data subject to exercise his or her rights;
 7° order that the person concerned be informed of the security problem;
 8° order the freezing, limitation or temporary or permanent prohibition of processing;
 9° order compliance of the processing;
 10° order the rectification, restriction or erasure of the data and the notification thereof to the recipients of the
     data ;
 11° order the withdrawal of accreditation from certification bodies;
 12° to issue periodic penalty payments;

 13° to issue administrative fines;
 14° order the suspension of cross-border data flows to another State or an international body;
 15° forward the file to the public prosecutor's office in Brussels, who informs it of the follow-up given to the file;
 16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. Decision 18/2023 – 9/9



In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged,

within thirty days of its notification, to the Court of Markets (court

d'appel de Bruxelles), with the Data Protection Authority as defendant.


Such an appeal may be introduced by means of an interlocutory request which must contain the

information listed in article 1034ter of the Judicial Code. The interlocutory motion must be

filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 12

via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).










    (Sé). Hielke H IJMANS

    President of the Litigation Chamber












































11The request contains on pain of nullity:
  (1) indication of the day, month and year;

  2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
     Business Number;
  3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
  (4) the object and summary statement of the means of the request;
  (5) the indication of the judge who is seized of the application;
  6° the signature of the applicant or his lawyer.

12The request, accompanied by its annex, shall be sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.