APD/GBA (Belgium) - 79/2023

APD/GBA - 79/2023
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 5(1)(d) GDPR Article 12(3) GDPR Article 12(4) GDPR Article 15 GDPR Article 16 GDPR
Type:	Complaint
Outcome:	Partly Upheld
Started:
Decided:	19.06.2023
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	79/2023
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	French
Original Source:	APD/GBA (in FR)
Initial Contributor:	n/a

The Belgian DPA decided that subjective statements made in a meeting and faithfully recorded in the minutes do not fall within the scope of Article 16 GDPR.

English Summary

Facts

The data subject was a psychiatrist. At a meeting of the association of psychiatrists (controller), doubts were expressed as to the legitimacy of the data subject to practise as a psychiatrist and the controller decided to verify the data subject’s diploma. This information was recorded in the minutes of the meeting which were published in May 2018.

The data subject contacted the controller to request access and rectification of his data under Articles 15 and 16 GDPR. He considered that these data were publicly accessible since the publication of the minutes and requested the controller to publish a message to rectify them on the basis of the accuracy principle (Article 5(1)(d) GDPR). The controller didn’t follow up on this request, which led the data subject to lodge a complaint with the Belgian DPA.

Holding

The DPA recalled that the application of Article 16 GDPR requires inaccurate data. In this case, the DPA considered that the subjective statements made in the minutes do not imply the processing of inaccurate data if these statements are consistent with what was said during the meeting. In view of the purpose of the processing, i.e. to provide a written minute of what was said at the meeting, the data is accurate and therefore doesn’t fall within the scope of Article 16 GDPR.

Article 16 GDPR also provides a right to have incomplete data completed. In this case, the DPA considered that in view of the purpose of the processing, the data was complete. The right to have data completed is indeed not intended to enable the data subject to express disagreement with the statements made and faithfully recorded.

In view of the above, the DPA considered that the controller did not violate Article 16 GDPR. However, by not following up on the request of the data subject, the controller violated Article 12(3) and (4) GDPR. The DPA therefore issued a warning for these articles.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/10






                                                                        Litigation Chamber


                                                           Decision 79/2023 of June 19, 2023



File number: DOS-2022-01040


Subject: Complaint relating to the exercise of a right of rectification with regard to the content of a

minutes of meeting



The Litigation Chamber of the Data Protection Authority, made up of Mr Hielke

Hijmans, President, sitting alone;


Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and

to the free movement of such data, and repealing Directive 95/46/EC (general regulation on the

data protection), hereinafter GDPR;


Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter
ACL);


Having regard to the Law of 30 July 2018 relating to the protection of natural persons with regard to

processing of personal data (hereinafter LTD);

Having regard to the Rules of Procedure as approved by the House of Representatives on 20

December 2018 and published in the Belgian Official Gazette on January 15, 2019;


Considering the documents in the file;


Made the following decision regarding:



The complainant: Mr. X, hereinafter "the complainant";


The defendant: Y, Hereinafter “the defendant”; Decision 79/2023 - 2/11



I. Facts and procedure


    1. The complaint concerns the lack of follow-up given to the exercise of the right to rectification of the

        plaintiff with regard to personal data concerning him recorded in a lawsuit

        minutes of the defendant's meeting.


    2. On January 28, 2022, the complainant filed a complaint with the Authority for the Protection of

        data (APD).



    3. On April 7, 2022, the APD's Front Line Service (SPL) declared the complaint admissible on
        the basis of articles 58 and 60 of the LCA and sends it to the Litigation Chamber

        in accordance with Article 62, § 1 of the LCA.



    4. The following appears from the complaint and the documents annexed thereto.



    5. By letter dated June 3, 2021, the complainant, through his counsel, put the
        defendant in default on the basis of the provisions of Article 15 of the GDPR, to provide it

        the information that led her to doubt her professional background, her diplomas

        and on the basis of his legitimacy to practice as a psychiatrist as well as to rectify

        thedataconcerningitinapplicationofarticle16oftheGDPRandtoprovideproof

        of this correction.


    6. It is indeed apparent from a meeting minutes of the Respondent from 2017, which appears

        in a publication of the association, that an item on the agenda related to the "case" of the

        complainant. In this regard, the minutes state that the professional qualification of the

        complainant was questioned and a member of the defendant was invited to verify
        the existence of the complainant's diplomas.



    7. The plaintiff states that the defendant's publication casting doubt on its

        skills and being publicly accessible since May 2018 to date, it has

        asked the defendant to dispel this doubt and to correct this information by a

        message also publicly accessible, on the basis of the principle of accuracy
        enshrined in the GDPR. In its complaint, the complainant cites Articles 5.1.d) and 16 of the

        GDPR in support of its approach.



    8. Since the Defendant neither followed up nor granted its request, the Complainant concludes that

        the defendant violates the provisions of Article 16 of the GDPR, enshrining the right to
        rectification but also the provisions of Article 12 of the GDPR in that the

        respondent had one month to follow up on its request or at the very least Decision 79/2023 - 3/11



        inform him of his desire not to follow up on this one that the latter has

        refrained from doing. Under the terms of the complaint, the complainant no longer invokes Article 15 of the GDPR

        which he had mobilized in his initial request to the defendant.



II. Motivation


        II.1.1. As to the jurisdiction of the Litigation Chamber


    9. The Litigation Chamber is of the opinion that the fact that the meeting of the defendant took place

        in 2017, followed according to the complainant by a publication in May 2018, does not call into question his

        competence rationae temporis.


    10. In fact, the Litigation Division starts from the idea that the disputed minutes drawn up from

        typewritten manner is necessarily still preserved today with the

        defendant and consists at least of the processing of personal data

        relating to the complainant appearing in a file within the meaning of Article 2 of the GDPR, if not in a

        automated processing if this storage were to take place electronically.

        In this case, this is continuous processing subject to the GDPR since its entry into force.
        application on May 25, 2018, the jurisdiction rationae temporis of the Litigation Chamber

        is established. Furthermore, since these minutes would actually be publicly

        accessible today as the support the plaintiff - and would therefore consist (such as the

        conservation mentioned above) also in a continuous processing to which the GDPR

        applies even if the minutes drawn up before May 25, 2018, or even distributed before this

        date, the Litigation Chamber would also be competent with regard to said processing.

        The Litigation Chamber was thus able to observe that at least one of the publications of the
        defendant is indeed freely accessible on the Internet. The elements that

        above justify that, prima facie, the Litigation Chamber declares itself competent

        regard to the facts reported.



    11. For all practical purposes, the Litigation Chamber indicates that in this case, the fact that the

        complainant resides outside the European Union has no effect on his

        jurisdiction. Indeed, the defendant presumed to be responsible for processing is established in
        Belgium and article 3.1. of the GDPR applies with regard to the territorial applicability of the GDPR.

        The complainant is certainly established outside the European Union but can rely on

        Article 77 of the GDPR to lodge a complaint – moreover declared admissible with regard to

        the conditions of admissibility laid down in the LCA by the SPL of the APD (point 3) – with

        ODA. Article 77 indeed states that “without prejudice to any other administrative remedy



1(….) Decision 79/2023 - 4/11



        or jurisdictional, any person concerned has the right to lodge a complaint with

        of a supervisory authority, in particular in the Member State in which its

        habitual residence, place of work or the place where the violation is alleged to have been committed, if it

        considers that the processing of personal data concerning him constitutes a
                                        2
        violation of this regulation”.

        II.1.2. As to the legality of the disputed publication (Article 6 of the GDPR)



    12. Given the uncertainties surrounding the evidence of this (online) publication, the
        Litigation Chamber will limit itself to reminding the defendant of its obligations with regard to

        of said publication (for everyone, if applicable and not only for members

        of the defendant for example) in the form of a warning (see below).



    13. Thus, as to the basis of lawfulness of said publication, the Litigation Chamber reminds the

        defendant only if the publication should not be able to rely on one of the bases of

        lawfulness of Article 6 of the GDPR - all of which contain, with the exception of the
        consent of the person concerned, a condition of necessity which joins

        Article 5.1 c) of the GDPR - it would contravene Article 6 of the GDPR. Indeed, only the

        data necessary for the purpose pursued can be legitimately processed. In his

        assessment of the condition of necessity, the Litigation Division invites the defendant

        to take into account the publicity thus given to all of a questioning of the diplomas of the

        complainant and thereby the legitimacy of the exercise of his profession, i.e.

        considerations which can be described as particularly serious for the complainant. Default
        basis of valid lawfulness on which to base the possible online publication, the

        defendant will have to draw all the consequences with regard to the GDPR, for example in

        terms of cessation of processing and possible deletion of data.




        II.1.3. Regarding the complainant's right to rectification (Article 16 of the GDPR)


    14. The Litigation Chamber recalls that Article 16 of the GDPR – right of rectification – sets out
        what follows :

               “The data subject has the right to obtain from the controller, within the

               as soon as possible, the rectification of the personal data concerning him

               which are inaccurate. Taking into account the purposes of the processing, the data subject

               has the right to obtain that incomplete personal data be

               supplemented, including by providing a supplementary declaration”.





2Emphasis added by the Litigation Chamber. Decision 79/2023 - 5/11



    15. Article 16 of the GDPR is closely linked to the principle of correctness enshrined in Article 5.1.d)

        of the GDPR according to which the personal data processed must be "accurate and,

        if necessary, kept up to date; all reasonable steps must be taken to ensure that

        personal data that is inaccurate, having regard to the purposes for which

        they are processed, erased or rectified without delay (accuracy)”.



    16. The application of this right therefore presupposes in its first part (first sentence of
        16 of the GDPR) that the personal data of the data subject which

        are processed are inaccurate in relation to the purpose for which they are processed.



    17. In general, personal data may consist of information

        objectives such as a surname, first name, date of birth which, if they are not

        correctly spelled or mention a day, a month, incorrectly for example must

        certainly be corrected.


    18. Personal data may also consist of subjective assessments,

        opinions, questions or evaluations from third parties. In these

        case, when these data are disputed by the data subject, it is not

        necessarily a question of inaccuracy of the data. Their challenge may simply

        translate a disagreement between the person concerned on the one hand and the author of the said

        subjective assessment, opinion, questioning or evaluation on the other hand.



    19. In the same way, the remarks related in a report do not entail any

        processing, where appropriate, of inaccurate personal data if these statements are
        consistent with what was presented at the meeting in question. The data thus reported

        therefore do not fall within the scope of Article 16 of the GDPR and should not

        not be corrected by the controller. In view of the purpose pursued by

        the processing of data, i.e. the recording in writing of remarks made in meetings, the

        data is correct. In other words, the right of rectification enshrined in the right to

        data protection cannot in this case be diverted from its objective to deliver

        in question what would have been accurately reported in the written minutes of the meeting, or what

        that would have been issued as an assessment in one or the other report, were it the person
        concerned in disagreement with what would be said about him during this one or with the said

        evaluation. The Litigation Chamber has already clarified this in the past during a complaint

        addressed by a parent of a student about what was reported in the minutes of a meeting

        school about her daughter's learning difficulties. The right of rectification is not




3See. for example decision 42/2023 of the Litigation Chamber. Decision 79/2023 - 6/11



        not there to rewrite what would have been said in a meeting and then recorded in his account-

        rendered.



    20. Article 16 of the GDPR also provides (in its second part) the right for the person

        concerned to obtain that incomplete personal data relating to him

        be supplemented by a declaration. The Litigation Chamber is of the opinion that this

        additional information is not intended to allow the data subject

        to express his disagreement with the remarks made (and faithfully recorded) which relate

        data concerning him taking into account, here again, the purpose of said processing of

        data.



    21. The Litigation Chamber is of the opinion that in this case, the data relating to the complainant

        as recorded in the publication in dispute by the defendant can neither be
        qualified as inaccurate or incomplete within the meaning of Article 16 of the GDPR. Those data

        question his professional title and his authorization to practice his profession and

        request that a member of the defendant carry out the necessary checks. Also

        disagreeable may it be so expressed, recorded and disseminated (see above) such

        doubts, it is not questioned by the complainant that such would not have been the comments

        held with regard to him or that the data concerning him mentioned during the said meeting are not

        would not find mentioned in the minutes. The Litigation Chamber insists on this

        regard to the fact that it is clear from the manner in which the minutes are drafted that

        the processing of the complainant's data reflects the opinion of certain members of the

        defendant. The Litigation Chamber subscribes in this respect to the point of view of the doctrine

        which states that “it is also complex if the data in question records an opinion. Opinions are,

        by their very nature, subjective, and it can be difficult to conclude that the record of an

        opinion is inaccurate. As long as the record shows clearly that the information is an opinion
        and, where appropriate, whose opinionitis, it may be difficult to say thatitis inaccurate and

        needs to be rectified”.4








4https://gdprhub.eu/Article_16_GDPR#Right_to_Complete_Incomplete_Data


"The situation is also complex if the data in question reflect an opinion. Opinions are, by their nature,
subjective and it may be difficult to conclude that reflecting an opinion is inaccurate. As long as it is clear that the information
reported is an opinion and, if applicable, the opinion of the person concerned, it may be difficult to say that the data revealed by
These statements are inaccurate and must be corrected”. Decision 79/2023 - 7/11



    22. In conclusion, the Litigation Chamber decides that no breach based on a

        possible violation of Article 16 of the GDPR cannot be blamed on the defendant.

        Therefore, the Litigation Chamber will close this aspect of the complaint without further action (see below).



        II.1.4. As for the lack of response to the complainant (article 12 of the GDPR)


    23. Under Article 12.3. of the GDPR, the controller provides the data subject

        concerned information on the measures taken following a request made in

        application of Articles 15 to 22 (therefore including Article 16 of the GDPR invoked in

        case), as soon as possible and in any case within one month from
        from receipt of the request. If necessary, this period may be extended by two

        months, given the complexity and number of requests. The person in charge of

        processing informs the data subject of this extension and the reasons for the postponement

        within one month of receipt of the request. When the person

        concerned submits its request in electronic form, the information is

        provided electronically where possible, unless the person concerned
        don't ask for it to be otherwise.



    24. It is also provided for in Article 12.4. of the GDPR only "if the controller does not

        does not respond to the request made by the person concerned, he informs the latter without

        delay and at the latest within one month of receipt of the request from the
        reasons for its inaction and the possibility of filing a complaint with an authority

        control and to lodge a judicial appeal”.



    25. In other words, regardless of the defendant's intention with regard to the request

        of rectification which was sent to it on June 3, 2021 (point 5), it had to react to the
        complaining what she seems to have refrained from doing. Therefore, the Litigation Chamber

        will also issue a warning in this regard (see.infra).



III. Corrective measures and sanctions


    26. Based on the facts described in the complaint file as summarized above, and on the

        basis of the powers attributed to it by the legislator under Article 95,
        § 1 of the LCA, the Litigation Chamber decides on the follow-up to be given to the file.



    27. In this case, the Litigation Chamber decides:

        – on the one hand, on the basis of Article 58.2.a) of the GDPR and Article 95, § 1, 4° of the LCA,

            to issue a warning to the defendant with regard to the grievance based on a possible Decision 79/2023 - 8/11



        breach of article 6 of the GDPR as well as article 12.3-4 of the GDPR, for

        reasons set out above ( Title II.1.2, points 12-13 and Title II.1.4, points 23-25).



    - on the other hand, in accordance with article 95, § 1, 3° of the LCA, to proceed with the classification
        without action on the grievance alleging a possible breach by the defendant of Article 16 of the

        GDPR for the reasons set out above (Title II.1.3 – points 14-22).


    III.1.1. As for the warning


28. The Litigation Chamber wishes to specify that this warning decision is a

    prima facie decision taken by the Litigation Chamber in accordance with Article 95 of the

    LCA on the basis of the sole complaint filed by the plaintiff and the exhibits he filed with

    the support of this, within the framework of the "procedure prior to the substantive decision".
    therefore not a decision on the merits within the meaning of Article 100 LCA.



29. The purpose of this warning decision is to inform the defendant and to inform him

    enables compliance where applicable (Title II.1.2) and in the future (Title II.1.4).



30. Therefore, if the defendant does not agree with the content of this decision
    prima facie and believes that it can make factual and/or legal arguments that

    could lead to a different decision on the point on which this warning relates, it

    may submit to the Litigation Chamber a request for processing on the merits of

    the case via the e-mail address litigationchamber@apd-gba.be, within 30 days

    after notification of this decision.


31. In the event of further processing of the complaint on the merits pursuant to Articles 98, 2° and 3°

    juncto article 99 of the LCA, the Litigation Chamber will invite the parties, either the

    plaintiff than the defendant, to introduce their arguments in the form of conclusions

    and to attach to the file all the documents that he and she deem useful.



32. The Litigation Chamber informs in this regard both the plaintiff and the defendant that the
    procedural file relating to the complaint leading to this warning decision

    may, pursuant to Article 95.2, 3° of the LCA, be requested by sending

    preferably an e-mail to the registry of the Litigation Chamber (litigationchamber@apd-

    gba.be). Decision 79/2023 - 9/11



     33. Finally, for the sake of completeness and transparency, the Litigation Chamber emphasizes

         that an examination of the case on the merits may lead to the imposition of the measures mentioned

         in Section 100 of the ACL 5.




         III.1.2. As for the classification without continuation



     34. In matters of dismissal, the Litigation Chamber is required to justify its
         step-by-step decision and:

         - to pronounce a classification without technical continuation if the file does not contain or not

             sufficient elements likely to lead to a sanction or if it includes a

             technical obstacle preventing him from rendering a decision;



         - or pronounce a classification without further opportunity, if despite the presence of elements

             likely to lead to a sanction, the continuation of the examination of the file does not seem to him

             not appropriate taking into account the priorities of the Data Protection Authority such

             as specified and illustrated in the Chamber's Dismissal Policy
                             7
             Litigation.










51° close the complaint without action;

 2° order the dismissal;
 3° pronouncing the suspension of the pronouncement;
 4° to propose a transaction;

 5° issue warnings and reprimands;
 6° order to comply with requests from the data subject to exercise his or her rights;
 7° order that the person concerned be informed of the security problem;
 8° order the freezing, limitation or temporary or permanent prohibition of processing;

 9° order compliance of the processing;
 10° order the rectification, restriction or erasure of the data and the notification thereof to the
data recipients;
 11° order the withdrawal of accreditation from certification bodies;

 12° to issue periodic penalty payments;
 13° to issue administrative fines;
 14° order the suspension of cross-border data flows to another State or an international body;

 15° forward the file to the public prosecutor's office in Brussels, which informs it of the follow-up given to the
case ;
 16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority.
6
 Market Court (Brussels Court of Appeal), September 2, 2020, judgment 2020/AR/329, p. 18.
7In this respect, the Litigation Chamber refers to its policy of dismissal as developed and

published on the website of the Data Protection Authority:
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
litigation.pdf. Decision 79/2023 - 10/11



    35. In the event of dismissal based on several reasons for dismissal, these

        last (respectively, classification without technical continuation and classification without continuation

        timeliness) should be addressed in order of importance .8



    35. In this case, the Litigation Chamber decides to proceed with the dismissal of the

        technical complaint. The decision of the Litigation Chamber is based more

        precisely on the fact that no violation of Article 16 of the GDPR can be established in

        the head of the defendant (points 14-22). This grievance is therefore unfounded in this case, the criterion

        A.2. of the Discontinued Discontinuance Policy of the Litigation Chamber finds at
                                         9
        apply (unfounded complaint). The Litigation Chamber therefore considers that it is

        inadvisable to continue the follow-up of the file, and decides accordingly not to proceed,

        inter alia, an examination of the case on the merits.



IV. Publication and communication of the decision


    36. Given the importance of transparency with regard to the decision-making process and the
        decisions of the Litigation Chamber, this decision will be published on the website of

        ODA. However, it is not necessary for this purpose that the identification data of the

        parties are directly mentioned.





























8Cf.Title 3–In which cases is my complaint likely to be dismissed without further action by the Litigation Chamber?
of the dismissal policy of the Litigation Chamber.
9
  Criterion A.2. : The Litigation Chamber will have to proceed to a classification without follow-up if it emerges in a way
evidence of your complaint that the Litigation Chamber cannot conclude that there is any violation
GDPR and personal data protection rules, based on the facts and legal grievances invoked

in your complaint. The complaint will then be considered manifestly unfounded within the meaning of Article 57.4.
of the GDPR. https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-
litigation-chamber.pdf. Decision 79/2023 - 11/11








  FOR THESE REASONS,

  the Litigation Chamber of the Data Protection Authority decides, after deliberation,



  - subject to the introduction of a request by the defendant for treatment on the

      merits in accordance with articles 98 e.s. of the ACL via the e-mail address

      litigationchamber@apd-gba.be, within 30 days of notification of the

      present decision, to issue a warning against the defendant in

      pursuant to Article 58.2.a) of the GDPR and Article 95.1, 4° of the LCA with regard to complaints

      based on possible breaches of Articles 6 and 12.3-4 of the GDPR.



  - to close the present complaint without follow-up pursuant to article 95, § 1, 3° of the LCA

      for the surplus.





    Pursuant to Article 108, § 1 of the LCA, this decision may be appealed to the

    Court of Markets (Brussels Court of Appeal) within 30 days of its

    notification, with the Data Protection Authority (DPA) as defendant.



     Such an appeal may be introduced by means of an interlocutory request which must contain the
                                                                       10
     information listed in article 1034ter of the Judicial Code. The interlocutory motion must

     be filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C.
         11
     jud. , or via the e-Deposit information system of the Ministry of Justice (article 32ter of C.

     jud.).






     (se). Hielke HIJMANS


     President of the Litigation Chamber





10The request contains on pain of nullity:

 (1) indication of the day, month and year;
 2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
     Business Number;
 3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
 (4) the object and summary of the grounds of the application;
 (5) the indication of the judge who is seized of the application;
the signature of the applicant or his lawyer.
11 The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.