Court of Appeal of Brussels - 2022/AR/556: Difference between revisions

From GDPRhub
(shortened the summary)
 
(12 intermediate revisions by 2 users not shown)
Line 86: Line 86:
}}
}}


The Belgian Court of appeal of Brussels upheld a decision by the Belgian DPA to fine South Charleroi airport for using temperature scanners on the airport to detect potential COVID-19 infections. However, the Court reduced the original fine.   
The Belgian Court of appeal of Brussels upheld a decision by the Belgian DPA to fine Charleroi airport for using temperature scanners at the airport to detect potential COVID-19 infections without a legal basis. However, the Court reduced the original fine.   


== English Summary ==
== English Summary ==


=== Facts ===
=== Facts ===
In its [https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_47/2022 decision 47/2022], the Belgian DPA (DPA) had determined that the Brussels South Charleroi Airport (controller) had violated several GDPR provisions, which resulted in a fine of €100,000. The controller had monitored passengers' temperature using thermal cameras in order to detect COVID 19 infections. For more information, see the [https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_47/2022 GDPRhub summary]. In short, among other violations, the DPA determined that the controller processed health data without a legal basis. The DPA held that the protocol, which the controller used as its legal basis, was not legally binding.   
On 4 April 2022, the Belgian DPA issued [https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-47-2022.pdf decision 47/2022], in which it fined Charleroi Airport €100,000 for the use of thermal cameras and temperature checks for COVID-19 detection purposes. The DPA held that the controller lacked a lawful ground for processing these special category data, see the [https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_47/2022 GDPRhub summary].    


The controller appealed the decision on several grounds at the Brussels Court of Appeal in this case. Among other grounds, the controller held that the DPA was not independent in its decision making and had not been impartial. The controller also claimed that the DPA had abused its powers. According to the controller, the DPA had stated continiously in the press that the controller did not have a legal basis for its use of thermal cameras. However, the DPA did not issue any opinion of give recommendations to the controller so that it could improve its processing. The controller stated that it would have followed the instructions of the DPA if it had been given propper guidance and if the DPA had taken a clear position. The controller had also requested the anonymisation of the decision. Despite this, the decision was published alongside a press release. According to the controller, the choice to publish an not anonymised decision and to do a press report constituted a misue of power by the DPA. The controller also argued that the DPA did not properly apply the criteria described in [[Article 83 GDPR]] for determining the fine and had not consulted the EDPB Guidelines regarding [[Article 83 GDPR]].The controller also claimed, contrary to the original decision by the DPA, that it did have a legal basis for its processing of health data. In its submissions, the controller cited several national ministerial orders, which all contained a reference to specific legal protocol that, according to the controller, was legally binding. Therefore, it could use this protocol as a legal basis for its processing.  
The controller appealed this decision with the Market Court. The controller questioned the impartiality of the DPA by referring to several reports in the national press. These reports showed an appearance of partiality, according to the controller, which was enough to call the decisions of the DPA into question. The nature of these news reports were not specified in the ruling.  
 
The controller further argued that the DPA had misued its powers. According to the controller, the DPA had stated multiple times in the press that the controller did not have a legal basis for its use of thermal cameras. However, the DPA did not issue any opinion of give recommendations to the controller so that it could improve its processing. The controller stated that it would have followed the instructions of the DPA if the DPA had taken a clear position regarding the legality of the controller's processing. The controller had also requested the anonymization of the decision. Despite this, the decision was published alongside a press report. According to the controller, the choice to publish a non-anonymised decision and to publish press report alongside it constituted a misuse of power by the DPA.  
 
The controller also stated that the DPA had misued its powers with regard to the determination of the fine. 
 
The controller also argued that the DPA did not properly apply the criteria described in [[Article 83 GDPR]] for determining the fine and had not consulted the EDPB Guidelines regarding [[Article 83 GDPR]] ([https://edpb.europa.eu/system/files/2022-05/edpb_guidelines_042022_calculationofadministrativefines_en.pdf Guidelines 04/2022]). 
 
Lastly, the controller stated that it did have a legal basis for its processing of health data. In its submissions, the controller cited several national ministerial orders, which all contained a reference to specific legal protocol that, according to the controller, was legally binding. Therefore, it could use this protocol as a legal basis for its processing. The controller also cited several Royal decrees, which referred to the content of this protocol. 
=== Holding ===
=== Holding ===
The court considered that it had full jurisdiction to review the decision of the DPA. Under the full review as per Article 47 of the Charter and [[Article 78 GDPR]], the Court could substitute its views to the one of the DPA, to the extent that all elements and arguments were raised and discussed before the Court. The court determined that the impartiality-argument of the controller was unfounded since no specific complaint had been raised. The controller also did not provide any concrete evidence to support its argument. 
The court considered that it had full jurisdiction to review the contested decision of the DPA. Under the full review pursuant of Article 47 CFR and [[Article 78 GDPR]], the Court could substitute its views to the ones of the DPA, to the extent that all elements and arguments were raised and discussed before the Court.    


The DPA did not commit an abuse its powers when deciding to publish the decision in a non-anonymous manner. It specifically mentioned that the decision to publish the decision was well reasoned by the DPA, which had the discretionary power to decide on this issue. The Court deemed the other controllers' arguments to be 'obscure' and decided not to examine the other arguments relating to this issue any further.
The Court then went on to consider the grounds op appeal of the controller.    


The court also confirmed that the 'protocol' signed between the airport and the minister in charge invoked by the controller as a legal basis was not legally binding. This protocol only stated that Airports had the choice to carry out temperature checks. The DPA also emphasised that the 'European centre for disease Prevention and control' (ECDC) and the 'European Aviation Safety Authority' (EASA) were not recommending these temperature checks at airports due to the lack of scientific justification for this measure. Besides, the mere fact that a Royal Decree was referring to such a protocol did not make it binding and an appropriate legal basis.   
First, with regard to the impartiality, the Court noted that the controller's criticism was focussed on the legality of the appointment of certain external members. It was for the Parliament to decide on the appointment of external members. The Court determined that the impartiality-argument of the controller was unfounded since no specific argument had been raised that could affect the regularity of the decision and could lead to annulment.   
 
The controller also did not provide any concrete evidence to support its argument. 
 
Second, the DPA did not commit an abuse of its powers when deciding to publish the decision in a non-anonymous manner. It specifically mentioned that the decision to publish the decision was well reasoned by the DPA, which had the discretionary power to decide on this issue. The Court deemed the other controllers' arguments to be 'obscure' and decided not to examine the other arguments relating to this issue any further. 
 
The Court also determined that the DPA had not misused its powers with regard to the determination of the fine. The Court reminded that this can only be the case when a public authority used its power, meant to serve the public interest, for another purpose. The unauthorised purpose must moreover be the sole purpose of the contested act. Since the controller didn’t demonstrate that the DPA pursued an objective other than the enforcement of the right to data protection, this plea was also unfounded. 
 
Third, the Court also confirmed that the 'protocol' signed between the airport and the minister in charge invoked by the controller as a legal basis was not legally binding. The DPA had come to the same conclusion in the contested decision. This protocol only stated that Airports had the choice to carry out temperature checks. The Court also emphasised that the 'European centre for disease Prevention and control' (ECDC) and the 'European Aviation Safety Authority' (EASA) were not recommending these temperature checks at airports due to the lack of scientific justification for this measure. Besides, the mere fact that a Royal Decree was referring to such a protocol did not make it binding and an appropriate legal basis.   


The Court reduced the amount of the fine. In particular, the court stated that the DPA should have paid more attention to the following factors:
The Court reduced the amount of the fine. In particular, the court stated that the DPA should have paid more attention to the following factors:


* The controller had introduced the temperature checks in exceptional circumstances and had also announced its plans to the relevant authorities.
* The controller had introduced the temperature checks in exceptional circumstances (the pandemic) and had also announced its plans to the relevant authorities.
* The controller had fully cooperated with the DPAs during the procedure
* The controller had fully cooperated with the DPA during the procedure
* The controller had not profited economically from these temperature checks.  The sole purpose of the temperature checks was to support public health.
* The controller had not profited economically from these temperature checks.  The sole purpose of the temperature checks was to support public health.


Line 119: Line 135:


<pre>
<pre>
Brussels Court of Appeal -2022/AR/556 p. 2
Not registrable
 
Presents the
 
Directory number
 
20221gGl-\
 
Date of delivery
 
7 December 2022
IN REASON OF:
Role number
 
2022/AR/556
 
0 Not available to the
The SOCIÉTÉ ANONYME BRUSSELS SOUTH CHARLEROI AIRPORT (ei-after “CHARLEROI
recipient
AIRPORT"), whose registered office is located at rue des Frères Wright 8, 6041 Charleroi, registered with the
Expedition
Crossroads Bank for Enterprises at number 0444.556.344,
Delivered to
 
the
 
f
Applicant port,
CIV
 
Delivree ii
Having as counsel, Me Frédéric DECHAMPS, Lawyer at the Brussels Bar, whose Iecabine is located
the
f,
VIC
Delivree ,1
the
VIC
Court 'a pel
Brussels
Staircase Court Section
19th Chamber A Steps
Chamber
Stop
r COVER □1-□00□3□26574-0001-0□34-□6-□1-i7
IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII _J
Court of Appeal Brussels - 2022/AR/556 p.  
2
IN CONNECTION WITH:
BRUSSELS SOUTH CHARLEROI AIRPORT ANONYMOUS COMPANY (hereinafter "CHARLEROI
AIRPORT"), whose registered office is located at rue des Frères Wright 8, in 6041 Charleroi, registered  
with the Banque Carrefour des Entreprises under number 0444.556.344,
Applicant Portie,
Having as counsel, Mr. Frédéric DECHAMPS, Attorney at Law at the Brussels Bar, whose office is  
located
[...] .
[...] .
AGAINST:
AGAINST:
THE DATA PROTECTION AUTHORITY, whose registered office is located at Rue de la Presse 35, 1000
Brussels, registered with the Crossroads Bank for Enterprises under number 0694.67 9.950,
represented by the Chairman of its Management Committee,
Portie odverse,
Having as counsel Mr Evrard de Lophem, Mr Grégoire Ryelandt and Mr Clara Delbruyère, lawyers,
whose office is located [ . . . ].
Having regard to the procedural documents and in particular :
Decision 47/2022 of 4 April 2022 of the Contentious Chamber of t h e Data Protection
Authority (hereinafter 'the contested Decision');
the application filed with the court registry on 3 May 2022;
the schedule for the exchange of pleadings agreed by the Court at the introductory
hearing on 18 May 2022;
the conclusions of CHARLEROI AIRPORT of 28 September 2022;
the summary conclusions of the APD of 26 October 2022;
the documentary records filed by the parties;
r PAGE 01-□0□□3026574-□□□2-□□34-□6-□1-;i
L _J
Court of Appeal Brussels - 2022/AR/556
p. 3
Heard counsel for the parties at the public hearing of 9 November 2022 at 14:00, held by
videoconference by agreement of the parties.
I. The Decision attacked
1.
The ODA Litigation Chamber took the following decision:
"(...) the Contentious Chamber of the Data Protection Authority decides, after deliberation :
Under Article 101 of the LCA, impose a fine of EUR 100,000 on the defendant for violations of Articles
5.1.a, 5.1.b, 6.1.c}, 6.3, and 9.2.i), 12.1, 13.lc}, 13.2.a}, 13.2.d}, 13.2.e}, 35.1 and 35.7;
Under Article 100, § 1, 5° of the LCA, to impose a reprimand _for violations of Articles 30.1.a) and
30.1.d},;
Pursuant to Article 108(1) of the LCA, this decision may be appealed to the Market Court within thirty
days of its notification, with the Data Protection Authority as defendant.
II. Factual background and procedural history
2.
According to the applicant, the relevant facts can be summarised as follows, the Court specifying that
it will have regard to all the facts as they appear from the documents in the file:
In March 2020, Covid-19 continued to spread throughout the world and its spread in Europe could only be
halted by t h e decisions of the various Member State governments to put in place more or less strict
containment measures.
In Belgium, this decision to confine the population is accompanied by a ban on travel to and from
Belgium that has been in force since 18 March 2020. The applicant, like other airports in the country,
is forced to stop its activities and to put almost all its staff out of work.
rPAGE 01-00003026574-00□3-0□34-06-01-
L _J
Court of Appeal Brussels - 2022/AR/556 p. 4
L _J
Since the decision to close the borders and its implications for the applicant, the latter has not ceased
to enquire about the possibilities of resumption and dialogue with the political authorities on which it
depends in order to know how, in practice, to manage the two imperatives of combating the spread of
the coronavirus and the reopening of the borders and its obvious impact on the population.
/organisation of airports {PIECE XXX).
As part of this preparation for the reopening, the applicant participated in various meetings and
workshops requested by the Federal Authorities which were aimed at organising the recovery of the
airport sector while allowing for the supervision and health security of the persons concerned {PIECE
XXX).
On 8 June 2020, a decision of the National Security Council allows the reopening of the borders to and
from Belgium. The resumption of airport activities will be possible from 15 June, one week after this
decision. However, these trips abroad are conditional on
various measures (screening, pre-testing, post-travel testing, etc.) depending on the rules in force in
the various states, but also on a colour code decided by the federal government according to the
evolution of the pandemic in the various countries.
With regard to the reopening of airports, this has been defined by successive ministerial orders. These
ministerial orders provide that "practical modalities concerning health regulations applicable to the
reopening of airports shall be provided for through a Protocol".
determined by the competent minister in consultation with the sector concerned or to the minimum
general rules which have been communicated on the website of the competent public service"
(hereinafter the "Protocol").
The Protocol applicable to the applicant provided that "concerning the commercial transport of passengers
in the framework of the COV/0-19, the Belgian FPS Mobility and Transport issued a Protocol entitled
"Commercial Passenger Aviation" which specified the sanitary measures that had to be taken in order to
ensure the safety of passengers.
The information is available on the website of the FPS Mobility and Transport via the following link:
https:1/mobilit.belqium.be/en/airtransport/covid 19 coronavirus
I PAGE 01-00003026574-0004-0034-06-01-
Court of Appeal Brussels - 2022/AR/556 p.
S
In the context of COVID-19 and the resumption of commercial passenger aviation activities as of 8
June 2020 and until further notice, all airport operators shall implement the health measures detailed
in this document.
This Protocol provided, in addition to general health measures (masking, social distancing, etc.), for
temperature checks of passengers as a specific health measure applicable to airports.
As a reminder, the above-mentioned Protocol was drawn up on the basis of recommendations published by
the European Union Aviation Safety Agency (EASA) and the European Centre for Disease Prevention and
Control (ECDC).
On 15 June, when airport operations resumed, and in accordance with the Protocol - which in fact
imposes legal obligations on airports - the Applicant and the other airports in the country concerned
introduced temperature monitoring of passengers at the departure point using thermal cameras.
The Applicant also stresses that, at that time, taking temperatures was the only alternative for
achieving the objectives of the Protocol and the aforementioned Decree.
In practice, these temperature checks were carried out at two different locations in the airport, at the
departure area, in the pre-check tent via two cameras (hereinafter the "departure check") and at the
arrival area.
"This thermal camera check determined only whether a masked subject's temperature was above
38°C. This thermal camera monitoring only determined whether the temperature of a masked subject
was above 38°C.
More specifically, for the departure control, the control procedure took the following form: a first
temperature measurement using thermal cameras (Red Cross staff supported by the applicant's fire
brigade monitor this device). If the temperature of the person concerned was above 38°C, then the
staff monitoring the control screens carried out a second test with a digital forehead thermometer.
If the temperature displayed with the digital thermometer was below 38°C, the person concerned
continued to the airport terminal. If, however, the temperature was again higher than 38°C, the
person concerned was invited to the infirmary to take his/her temperature with a digital thermometer
under the arm. If the temperature is below 38°C, the person concerned continued on his way to the
airport terminal.
If the temperature was for the third time above 38°C, the fire service was informed via the radio on 112.
An ambulance firefighter working for the claimant would intervene to make sure that
/The passenger's history. This assessment consisted of asking the person concerned additional
questions to determine whether he or she was suffering from other symptoms that were frequently
considered to be symptoms of coronavirus. The exchange with the person concerned in this
assessment is oral and n o notes and/or storage of information were made.
I PAGE 01-00003026574-0005-0034-06-01-
L ..J
Court of Appeal Brussels - 2022/AR/556 p. 6
L _J
If the qualified firefighter-ambulance officer does not consider the person concerned to be potentially
infected with the coronavirus, the person concerned will return to the airport terminal.
If, after these three temperature tests and this anamnesis, there was a suspicion of coronavirus
contamination, the firefighter ambulance driver informed the person concerned of the situation and, if
necessary, informed him that the airline with which he was to fly forbade the passenger with fever to board
the plane.
It is fundamental to note that the applicant never refused to allow a passenger to proceed, but that,
through this procedure and the advice of the firefighter/ambulance officer, the persons concerned with
fever and other symptoms decided, of their own free will, not to go to the terminal to fly.
For arrival control, the control is only carried out on passengers returning from the red zone.
It was a one-off temperature check of the person concerned by thermal cameras. The Red Cross, as a
subcontractor, accompanies firefighters and ambulances
In the case of a temperature of more than 38°C, the person concerned received a document advising
him/her to be alert to other potential symptoms of coronavirus and to contact a doctor. If the temperature
was above 38°C, the person concerned received a document inviting him/her to be alert to other
potential symptoms of coronavirus and to contact a doctor if he/she so wished.
4 - On 17 June 2020, a press release from the Data Protection Authority (hereinafter "DPA" or "DPA")
denounced the implementation of this device at Zaventem airport.
The DPA announced that this type of processing of sensitive and high-risk data (collection of health data
within the meaning of Article 9 of the RGPD) was purely prohibited and that there was no basis in Belgium
for such processing.
/The DPA seemed to consider that it was the automated infrared camera technology that involved
compliance with the RGPD. The DPA seemed to consider that it was the automated infrared camera
technology that implied compliance with the GDPR. The DPA's opinion seems to have changed.
5 - On 28 August 2020, the inspection service, on its own initiative, examined the processing
operations carried out by the applicant in connection with the installation of thermal cameras to
prevent the spread of the Covid-19 virus.
In this context, the inspection service will write several letters requesting information to the applicant
{PIECES 2, 14, 24 of the APD file) dated 3 September 2020, 28 September 2020, 28 September 2020, 28
September 2020, 28 September 2020, 28 September 2020, 28 September 2020
October 2020 and 6 January 2021.
The applicant will always reply to these letters to the best of its ability and with the means at its disposal
in this period of crisis {PIECES 3, 6, 7, 8, 18, 19, 34 of the ODA file}. In its replies, the applicant even
suggested that the inspection service should come and see on site how the treatments were carried out so
that the service could see the organisation put in place by the applicant and propose any improvements.
The inspection service declined this proposal. In addition, on 8 January 2021, the inspection service will
question the Red Cross and /-Care, the applicant's subcontractors in the context of the processing of
personal data {PIECES 25 and 26 of the DPA file).
IPAGE □1-□□□□3□26574-□006-0034-06-01-;-J
Court of Appeal Brussels 2022/AR/556 p.
7
These subcontractors will respond to the DPA (PIECES 32, 37 and 38 of the DPA file) providing all the
information relating to these treatments.
Following these replies, the inspection service drew up an inspection report and forwarded the file to the
Litigation Chamber, which decided to deal with the case on its merits. It informed the claimant of this on 5
May 2021 (PIECES 44 to 45 of the ODA file).
6.- The Contentious Chamber, seized of the case, in its decision No. 47/2022 of 4 April 2022 (hereinafter
"the contentious decision"), imposes a fine of EUR 100,000 on the applicant for alleged violations of Articles
5.1.a, 5.1.b, 6.1.c, 6.3, and 9.2.i}, 12.1, 13.1.c}, 13.2.a}, 13.2.d}, 13.2.e}, 35.1 and 35.7, and imposes a
reprimand for alleged breaches of Articles 30.1.a) and 30.1.d}, and also decides to publish this decision on
its website.
3.
The applicant appealed against the contested Decision by application lodged at the Registry of the Court
of First Instance.
the court on 3 May 2022.
Ill. The legal framework.
4.
By the Decision under appeal, the DPA decides, with regard to the applicant
Under Article 101 of the LCA, to impose a fine of EUR 100,000 on the
defendant for violations of Articles 5.1.a, 5.1.b, 6.1.c}, 6.3, and 9.2.i), 12.1,
13.lc}, 13.2.a}, 13.2.d}, 13.2.e), 35.1 and 35.7 of the GDPR;
Under Article 100, §ler, 5° of the LCA, to impose a reprimand for violations of
Articles 30.1.a} and 30.1.d} of the GDPR.
6.
The Contentious Chamber of the ODA based the contested decision on the following considerations:
(...)
IPAGE □1-□□□□3026574-□□□7-□034-□6-□1-
L _J
Court of Appeal Brussels - 2022/AR/556 p. 8
L _J
333. In the present case, the Contentious Chamber found that the defendant had violated the
following articles:
a) Violation of Articles 6.1.c}, 6.3, and 9.2.i}, since it has not been demonstrated that the
processing of the personal data at issue is necessary on grounds of public interest in the field of public
health, such as protection against serious cross-border threats to health or for the purpose of
ensuring high standards of quality and safety of health care and medicinal products or devices, on the
basis of Union law or the law of the Member State which provides for appropriate and specific
measures to safeguard the rights and freedoms of the person concerned, including professional
secrecy. Furthermore, the legal bases invoked by the defendant (namely the Decree of 23 June 1994
on the creation and operation of the European Data Protection Supervisor's office) are not
sufficiently clear.
/The following provisions of the Act of 31 December 1963 on civil protection (as replaced by the Act
of 15 May 2007) and the "Commercial Passenger Aviation" Protocol of 11 June 2020 do not meet the
requirements of the Act of 31 December 1963 on civil protection.
/Article 6.1 c) Ju in combination with Article 6.3 of the GDPR.
b) Violation of Articles 5.1.a}, 12.1, 13.lc}, 13.2.a}, 13.2.d}, and 13.2.e}, for failing to provide
transparency to the persons concerned by not informing them that temperature measurement would
be carried out by means of thermal cameras; for failing to inform correctly the passengers returning
from the red zone; for failing to inform correctly about the legal basis of the processing, the purpose
of the processing and the regulatory framework of the obligation to monitor body temperature; for
failing to inform correctly about the period of retention of the data and the right to lodge a complaint
with the Data Protection Authority.
c) Violation of Article 5(1)(b), as the purpose of the processing was not sufficiently explicit when
the processing started, as it was not expressly stated in any of the sources of information used by the
defendant. The purpose of the processing was only made explicit in response to questions from the
Inspection Service and after the amendment of the privacy policy in December 2020.
d) Violation of Articles 35(1) and 35(7) for not having carried out a data protection impact
a sse s sm e n t before the processing operation was set up. Furthermore, the impact assessment is
incomplete as it does not contain an adequate description of the processing operations envisaged and the
purposes of the processing, it d o e s not sufficiently analyse the necessity and proportionality of the
processing and does not properly assess the risks to the rights and freedoms of the data subjects.
e) Violation of Articles 30(1)(a) and 30(1)(d) due to the absence of the name and contact details
of the controller and the data protection officer in the register of processing activities at the time of
the investigation and due to the lack of sufficient precision as to the categories of recipients of the
data.
334. Pursuant to Article 101 of the LCA, it decides to impose a fine of EUR 100,000 on the
defendant for violations of Articles 5.1.a}, 5.1.b}, 6.1.c}, 6.3, and 9.2.i}, 12.1, 13.1.c}, 13.2.a},
13.2.d}, 13.2.e}, 35.1 and 35.7.
I PAGE 01-□□□□3□26574-00□8-□034-□6-□1-i:-i
Court of Appeal Brussels - 2022/AR/556 p. 9
335. Having regard to Article 83 of the GDPR, the Administrative Jurisdiction Division gives
reasons for the imposition of an administrative penalty in a concrete manner1 , taking into account
the following criteria, drawn from this article, which it considers relevant in the case in point:
the nature, severity and duration of the breach (art. 83.2.a) - The breaches found are, in
particular, a breach of the provisions of the GDPR relating to the principles of data protection (article 5 of
the GDPR) and the lawfulness of processing (article 6 of the GDPR). An infringement of the above�mentioned provisions is, in accordance with Article 83, paragraph 5, of the GDPR, possible higher
financial penalties.
The infringements found also concern the violation of the provisions on information and transparency
obligations (Articles 5.1.a}, 12.1 and 13 of the GDPR). Compliance with the above provisions is
essential and must take place at the latest at the start of the processing of personal data. This is also
necessary to facilitate the exercise of the data subject's rights.
The infringements also concern the carrying out of the Impact A s s e s s m e n t on the
data protection. This obligation was only carried out after the start of the processing operation,
whereas it should have been carried out before (Article 35(1) of the GDPR) and was not carried out
in a manner that complied with the criteria of Article 35(7), which considerably affected the credibility
of the exercise and the potential benefits for the rights.
Any previous relevant breach by the controller or processor (art.83.2.e) GDPR}- The
defendant has never been subject to an infringement procedure before the Data Protection Authority.
/Categories of personal data concerned by the breach (Art. 83.2.q) GDPR) - The breaches
identified concern a category of personal data within the meaning of
/Article 9 of the LCA (data relating to the health of the persons concerned).
any other aggravating or attenuating circumstances applicable to the circumstances of the
case (Art. 83.2(k) GDPR): the defendant did not derive any benefit from the processing operations or
from the offences committed.
336. All the elements set out above justify an effective, proportionate and dissuasive sanction, as
referred to in Article 83 of the RGPD, taking into account the assessment criteria it contains.
(...)
342. In accordance with the foregoing, the Contentious Chamber finds that it can base itself on the
annual figures of Brussels South Charleroi Airport SA to determine the amount of the administrative
fine that it intends to impose on the defendant.
343. The Contentious Chamber refers to the conclusions of the defendant filed with the Contentious
Chamber and to the annual accounts filed with the National Bank of Belgium (NBB) on 5 July 2021,
which show a turnover for the financial year 2020 of EUR 28,859,291.41.
1 Brussels Court of Appeal (Market Court section), X. v APD, Judgment 2020/1471 of 19 February 2020
I PAGE 01-00003026574-0□09-□□34-□6-□1-
L ..J
Court of Appeal Brussels - 2022/AR/556 p. 10
344. The administrative fine of 100,000.00 euros corresponds to 0.34% of the defendant's annual
turnover for the year 2020. The Contentious Chamber refers to the defendant's submissions to the
Contentious Chamber and to the annual accounts filed with the National Bank of Belgium (NBB) on 5
July and 2021, which show a turnover of EUR 28,859,291.41 for the financial year 2020.
345. The proposed administrative fine of EUR 100 000 corresponds to 0.34 % of the defendant's annual
turnover for the year 2020.
346. The Contentious Chamber states that the maximum amount of the administrative fine for a
violation is determined by Articles 83.4 and 83.4 of the RGPD. The amount of the fine imposed in the
present decision is significantly lower than the maximum amount foreseen (which could have reached
a maximum of EUR 1154,371.65), as the Contentious Chamber took into account all the relevant
criteria set out in Article 83.2 of the LCA. In addition, the Contentious Chamber assessed the
concrete elements of each individual case in order to impose an appropriate sanction.
347. For violations of Articles 30.1.a) and 30.1.d), the Dispute Chamber shall decide, pursuant to
/It is not possible to impose a reprimand under Article 100, § 1, 5° of the LCA. Indeed, the violations
found concern relatively minor elements, the violation of which does not in itself justify the imposition
of a fine.
(...)
348. In view of the importance of transparency in the decision-making process of the Dispute
Resolution Chamber, the present decision is published on the website of the Data Protection Authority
in accordance with Article 95, §ler, 8° LCA, mentioning the identification data of the
the specificity of the present decision - which leads to the fact that even in case of omission of
identification data, re-identification is inevitable - as well as the general interest of this decision.
7.
Article 100 LCA is drafted as follows:
"1. The Administrative Jurisdiction Division shall have the power to:
1° to close the complaint without further action;
2° to order the dismissal of the case;
3° pronounce the suspension of the sentence;
4° propose a transaction;
5° to formulate warnings and reprimands;
6° order to comply with the requests of the person concerned to exercise these rights;
rPAGE 01-□□□□3□26574-□□1□-□□34-□6-□1-;-i
1it!1:11!1
L !
!I-.
I
..J
Court of Appeal Brussels - 2022/AR/556 p. 11
7° order that the interested party be informed of the security problem;
8° to order the freezing, restriction or temporary or definitive prohibition of the
processing; 9° to order the compliance of the processing;
10° to order the rectification, restriction or erasure of data and the notification of the recipients of
the data;
11° to order the withdrawal of the approval of certification bodies; 12°
to impose penalties;
13° to impose administrative fines;
14° order the suspension of transborder data flows to another state or international organisation;
15° transmit the file to the Brussels Public Prosecutor's Office, which informs it of the follow-up
given to the file;
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection
Authority.
§ (2) Where, after application of § 1, 15°, the public prosecutor waives the right to initiate criminal
proceedings, to propose an amicable settlement or a criminal mediation within the meaning of Article
216ter of the Code of Criminal Procedure, the public prosecutor may, in accordance with the provisions of
the Code of Criminal Procedure, request that the matter be referred to a court.
In the event that the public prosecutor has not taken a decision within six months from the day of receipt of
the file, the Data Protection Authority shall determine whether the administrative procedure should be
resumed.
Article 108 of the LCA reads as follows:
<< Art. 108.
§ 1. The Administrative Jurisdiction Division shall inform the parties of its decision and of the possibility
of appeal within thirty days from the date of notification to the Court of Contracts.
Except for the exceptions provided for by the law or unless the Administrative Jurisdiction Division
decides otherwise in a specially reasoned decision, the decision shall be enforceable provisionally,
notwithstanding an appeal.
The decision to erase data in accordance with Article 100, § 1, 10°, is not enforceable
by provision.
§ 2 An appeal may be lodged against the decisions of the Administrative Jurisdiction Division under
Articles 71 and 90 before the Court of Justice, which shall deal with the appeal in accordance with Articles
1035 to 1038, 1040 and 1041 of the Judicial Code.
IPAGE 01-00003026574-0011-0034-06-01-
Court of Appeal Brussels
-2022/AR/556 p. 12
L ...J


THE DATA PROTECTION AUTHORITY, whose registered office is located at rue de la presse 35, at 1000
Court of Appeal Brussels -2022/AR/556 p. 12
Brussels, registered with the Banque Carrefour des Entreprises at number 0694.67 9.950, represented by
L _J
Chairman of its Management Committee,
8.
 
The Decision also relies, inter alia, on the requirement of Articles 5.1.a, 5.1.b, 6.1.c), 6.3, 9.2.i), 12.1,  
 
13.1.c), 13.2.a), 13.2.d), 13.2.e), 30.1.a) and 30.1.d), 35.1 and 35.7 of the GDPR
Portie opposite,
9.
 
The applicant further alleges a failure to comply with the legal requirement to state reasons for the
Having as counsel My Evrard de Lophem, Grégoire Ryelandt and Clara Delbruyère, lawyers, including
contested decision in accordance with the Law of 29 July 1991 on the formal motivation of
office is located [...]..
administrative acts, as well as a violation by the DPA of the principles of proportionality, independence
 
and impartiality.
 
IV. The subject of the appeal
 
10.
 
In its final pleadings, the applicant requests the Court of Justice to :
Having regard to the pleadings and in particular:
"As a principal,
 
• To declare that the complaints against the applicant are unfounded,
          decision 47/2022 of April 4, 2022 of the Litigation Chamber of the Authority of
• Consequently, reformulate (and consequently annul) in all its provisions the decision
          Data Protection (hereafter "the Impugned Decision");
pronouncing the above-mentioned sanctions,
 
• Remove the fine imposed in this regard,
 
• Order the respondent to pay the totality of the costs, including the procedural indemnity
          the motion filed by the court registry on May 3, 2022;
In the alternative,
 
• Declare that t h e complaints against the applicant are partially unfounded,
 
• Consequently, reform (and consequently annul) in part the decision pronouncing
 
the above-mentioned sanctions,
          The timetable for the exchange of submissions recorded by the Court at the introductory hearing of 18
• Remove t h e fine imposed in this respect or reduce it to a fine of
          May 2022;
amount respecting the principles of necessity and proportionality,
 
• Order the respondent to pay all the costs, including the procedural indemnity".
          the conclusions of CHARLEROI AIRPORT of September 28, 2022;
11.
 
The ODA asks the Court of Marche to :
 
"Declare the action inadmissible, in whole or in part, or at least unfounded, and order the applicant to
          the summary conclusions of the DPA of October 26, 2022;
pay all the costs, including procedural damages of €1,680 (basic amount).
 
I PAGE 01-00003026574-0012-0034-06-01-
 
Court of Appeal Brussels - 2022/AR/556 p. 13
          the records of exhibits filed by the parties;
L ..J
 
1
 
V. Means of the reguerante
 
12.
 
The applicant, at the end of its submissions, develops the following "pleas":
              r PAGE 01- □0□□ 3026574- □□□ 2-□□ 34-□6- □1- ;i
11.1. As to the admissibility of the present action
First Maven: The present action is perfectly admissible, in that it seeks, on the one hand, recognition of
unfounded complaints and a manifest error of assessment and, on the other hand
, reformulation of the
contested decision, which necessarily implies its annulment
Second maven: The respondent is confused in its argumentation because the appellant did not
refer to the referral decision in its appeal but to the decision of the Contentious Chamber.
First limb: as regards the classification of the decision to deal with the case on the merits Second limb:  
as regards the time limit for appeal
Third limb: the decision to deal with the case on the merits is completely unreasoned and the
Contentious Chamber did not respond to this lack of reasoning, despite the fact that it was raised by
the
applicant.
11.2. As to the form of the procedure which allowed the adoption of the contested decision
Third plea: The lack of independence or impartiality of t h e respondent taints the decision with illegality
Fourth maven: The intimate party has committed a misuse of power
11.3 As to the merits of the contested decision
Fifth plea in law: The fine imposed on the applicant is not adequately reasoned or proportionate
First part: as regards the misuse of powers by the respondent Second part: as regards the
amount of the fine and the grounds
Sixth maven: The applicant had a legal basis for the processing of personal data in its possession.
personal nature
Seventh plea. The applicant complied with the principle of transparency and its obligation to provide
information
Means 8: / Data Protection Impact Assessment ("DPA")
Ninth maven: With regard to the publication of the contested decision
I PAGE 01-00003026574-0013-0034-06-01-
Court of Appeal Brussels 2022/AR/556 p. 14
L _J
VI. ODA resources
13.
In its final submissions, the DPA formulates the following pleas:
A. "Introductory disclaimer
1. The DPA notes that the applicant's application does not contain any pleas in law, so that it is
not easy to determine the structure, in particular the legal structure, of its arguments criticising the
contested decision.
2. It is only in her conclusions that she develops her argument, which is almost entirely new,
under the force of means.
B. Concerning the subject-matter of the action - plea 1: insofar as the applicant does not seek the
annulment of the contested decision, but (only) its reformation, the action is inadmissible
C. Concerning the alleged lack of formal reasoning for t h e opening of t h e investigation on the
merits
Mayen 2: The "decision to deal with the case on the merits" is a purely preparatory act: it is
not subject to appeal and is not subject to the formal reasoning requirements of an
administrative act giving rise to a complaint
Mayen 3, in the alternative: The "decision to deal with the case on the merits" was properly
reasoned
D. PLEA C O N C E R N I N G INDEPENDENCE AND IMPARTIALITY - PLEA 4: THE
LACK OF IMPARTIALITY OR INDEPENDENCE OF THE CONTENTED CHAMBER IS NOT
DEMONSTRATED
E. PLEAS IN LAW RELATING TO THE MISUSE OF POWER(S)
Mayen 5: The demonstration of a misuse of power supposes to prove that the authority acted
with an illicit aim, in an exclusive way: this demonstration is not brought by the plaintiff
IPAGE □1-□□□□3□26574-0□14-0034-06-01-
Court of Appeal Brussels - 2022/AR/556 p. 15
L ..J
May 6: The Court has no jurisdiction to hear the direct appeal against a decision of the Court of
Justice.
of the inspection service; in so far as it is directed against the inspection service, the
applicant's criticism is unfounded; moreover, it is inoperative: it cannot lead to the illegality
of the contested decision
First limb: The Court has no jurisdiction to hear the appeal against a decision of the
inspection service
Second plea: the misuse of powers that the applicant alleges against the inspection service is
unfounded
Third limb: The misuse of powers which the applicant alleges the inspection service to have
misused is, in any event, without effect on the legality of the decision of the Contentious
Chamber
Mayen 7: The Contentious Chamber did not err in law, let alone misuse its powers, in imposing a
fine on the applicant, rather than another penalty, or in fixing the amount of that fine
First limb: effective protection of the right to protection of personal data requires that the
authority can impose "effective, proportionate and dissuasive" sanctions
Second limb: neither the GDPR nor the LCA provide that the fine would be subsidiary or that a
fine could not be imposed on the first infringement committed
Third limb: the decision to impose a fine is the subject of a detailed statement of reasons in
the contested decision
Fourth limb: The amount of the fine is adequately reasoned in the contested decision
IPAGE 01-00003□26574-0015-0034-06-01-
Court of Appeal Brussels - 2022/AR/556 p. 16
L _J
F. Mayen 8: The applicant has violated Article 5(1)(b) of the RGPD (purpose limitation principle)
G. WITH REGARD TO THE LACK OF A LEGAL BASIS FOR THE TREATMENT
Maven 9: There was no legal basis that could be validly invoked by the applicant for taking the
temperature. The applicant has therefore violated Article 6, § 1 of the GDPR.
Mayen 10: The ODA did not challenge the legality of the ministerial orders and the Protocol
on which the applicant relied
H. WITH REGARD TO THE PRINCIPLE OF TRANSPARENCY AND THE OBLIGATION TO PROVIDE
INFORMATION
Maven 11: APO rightly found the applicant's privacy statement irrelevant
Maven 12: The applicant has violated Article 5(1)(a) of the RGPD (obligation to provide
information on the processing on the basis of thermal cameras)
Maven 13: The applicant has violated Articles 5(1)(a) (principle of transparency) and 12 and
13 of the GDPR
I. WITH REGARD TO THE OBLIGATION TO CARRY OUT A DATA PROTECTION IMPACT
ASS E S S M E N T ("DPI")
May 14: The applicant was required to conduct an A/PD
Maven 15: The DPIA should be conducted prior to the implementation of the treatment
Mayen 16: The PIA conducted by the applicant does not comply with the legal requirements
J. REASON17: THEAPPLICANT HAS INFRINGED ARTICLE 30(1)(A) AND 30(1)(D) OF THE RGPD
(DUTY TO KEEP A RECORD OF PROCESSING ACTIVITIES)
rPAGE 01-00003026574-0016-0034-06-01-
Court of Appeal Brussels - 2022/AR/556 p.
17
L ..J
K. PLEA 18: THE APD WAS ENTITLED TO DECIDE TO PUBLISH THE CONTESTED DECISION IN FULL
VII. Admissibility of the appeal
14. APD's pleas in defence to the effect that the action is wholly or at least partially
inadmissible (first, second, fourth and sixth (first limb) of the APD's pleas)
14.1. These of the ODA
According to the APD, in its first plea, "since the applicant did not seek the annulment of the
contested decision, but only its reformation, the action is inadmissible. The fact that, in her
submissions, the Applicant develops a new argument (and modifies the operative part of her
application), in a belated attempt to render her application (retroactively) admissible, is not
convincing. The criticisms made by the applicant are indicative of her wish to obtain, simply, a fresh
examination of the arguments she had already formulated before the Contentious Chamber - as if it
were a second instance of jurisdiction. This is the situation described in the above-mentioned
judgment.
In particular, the APD argues in this regard that an appeal to the Procurement Court is not "an
appeal, whereby the Court, substituting itself for the administrative authority, would re-examine the
file in order to take a decision that it deems appropriate, regardless of what the APO - in this case,
the Contentious Chamber - had decided beforehand. The reading of the Applicant's submissions is
symptomatic of the fact that the latter clearly confuses the appeal with an appeal, and it ceases to
refer in its submissions to its "appeal petition "2 , its "appeal "3 , the "intimate" part4 and which
requests "the reformation of the judgment".
In its second and fourth pleas, the ODA further submits that the applicant's appeal, in so far as it
concerns the decision of the OPA to deal with the case on the merits, is inadmissible, and that, even if
that decision were appealable, it is in any event manifestly out of time, and that in any event the
decision was adequately reasoned.
In the first part of its sixth plea, the DPA finally submits that the Court has no jurisdiction to hear the
appeal against a decision of the inspection service; in so far as it relates to such a decision, the
appeal is, in its view, inadmissible. In so doing, the APD targets the applicant's argument that the
APD's inspection s e r v i c e misused its powers by deciding to question the content of a regulation
issued by the executive during a health crisis.
For example, BSCA conclusions, § 9. BSCA
conclusions, § 11.
For example, BSCA conclusions, operative part and§§7 and 11.
I PAGE 01-00□□3026574-0□17-□□34-□6-□1-;i
Court of Appeal Brussels - 2022/AR/556 p. 18
L _J
14.2. These of the applicant
The Appellant submits that "The reformation sought in the appeal implies, ipso facto, the annulment
of the contested decision. The Respondent cannot draw any legal or factual arguments from the
semantics used by the Applicant in its appeal.
The applicant requests that the decision be re-examined because, in its view, the APO's objections
are unfounded or even illegal or based on a manifest error of assessment. To this extent, the Court of
First Instance may, inter alia, annul the contested decision of the APO:
- Where such a decision is irregular or unlawful, or
- Where it finds that the decision is based on a manifest error of assessment, it may also
"(...) substitute its decision for the annulled decision (. . .)".
With regard to the decision of the inspection service and the decision to investigate the file on the
merits, which, according to the APD, are also the subject of its appeal and which, therefore, fall
outside t h e jurisdiction of the Court of First Instance, the applicant submits in substance that the
subject-matter of its appeal is the contested decision of 4 April 2022, to which it complains, inter alia,
that it did not adequately respond to the objections which it had raised concerning the preparatory
decisions taken at the earlier stages of the procedure.
14.3. Decision of the Court
14.3.1.
While in some legislation conferring jurisdiction on the Court of Justice, it is explicitly stated that
the Court will rule in full jurisdiction, this possibility is not explicitly mentioned in data protection
matters. Article 108 § 1 ADA only provides that an appeal against the decisions of the
Administrative Jurisdiction Division may be lodged with the Court of Justice.
An appeal to the Court of Justice differs from an "ordinary" appeal such as that which can be lodged
with a judge of appeal in the judiciary. Article 6(1) of the ECHR provides that "Every
everyone is entitled to a fair and public hearing within a reasonable time
The Court shall decide either on disputes concerning his civil rights and obligations (...) or on disputes
concerning his civil rights and obligations (...)".
As regards the right to an effective remedy and a fair trial, Article 47 of the Charter of Fundamental
Rights of the European Union provides that "everyone whose rights and freedoms
IPAGE 01-00003026574-0018-0034-06-01-
Court of Appeal Brussels - 2022/AR/556 p.
19
L ..J
Everyone has the right to an effective remedy before a court in accordance with the conditions laid
down in this Article. Everyone has the right to have his case heard
(b) The right to a fair and public hearing by an independent and impartial tribunal, established in
advance by the Court. [...]
The European legislator has not specified what is meant by "an effective remedy before an
impartial and independent tribunal".
Article 78 of the GDPR provides for quanta lui (the Court highlights):
"Any natural or legal person has the right to an effective judicial remedy against a
legally binding decision of a supervisory authority which affects him.
Without prejudice to any other administrative or extrajudicial remedy, any person
concerned shall have the right to effective judicial redress where the supervisory
authority which is competent under Articles 55 and 56 fails to deal with a complaint or to
inform the person concerned within three months of the status o r outcome of his or her
complaint under
/Article 77.
Any action against a supervisory authority shall be brought before the courts of the  
Member State in whose territory t h e supervisory authority is established.
In order for this remedy to be effective and efficient, the Market Court may - in the form of full
jurisdiction granted by the legislator - not only annul the decisions of the DPA, but it may also
substitute its own decision for the annulled decision (provided that the DPA had to take a
decision and insofar as such a substitution can be made without violating any procedural rules).
However, in the exercise of this full jurisdiction, the Court of Justice must respect the limits of
judicial debate. Within the limits of the rules of public policy and within the limits of the
interpretation to be given to the grounds invoked before the Court, the latter must limit its
appreciation, i.e. it must limit the possible substitution of its own decision to the grounds
invoked by the applicant and to the defence of the other party.
In short, the Court of Contracts may substitute its decision for the challenged decision annulled
by the Court, provided that the Court does not raise a dispute which was not the subject of an
adversarial debate in the proceedings before it and insofar as no decision is taken with regard to
the parties to the proceedings and which they could not have defended in the proceedings before
it.
Consequently, the Court of First Instance has jurisdiction to annul the Impugned Decision or, if
necessary, to reform it, by mitigating or replacing the sanction by another one.
IPAGE □1-□0□□3□26574-0019-0034-□6-□1-
Court of Appeal Brussels - 2022/AR/556 p. 20
14.3.2.
The applicant's complaints concerning the decisions of the inspection service and the decision to deal
with the case on the merits are directed against the contested decision, which the applicant complains
did not provide an adequately reasoned reply to the arguments it put forward.
The Court of First Instance had submitted to the Contentious Chamber, in particular concerning
decisions taken at earlier stages of the procedure.
The purpose of the application before the Court of First Instance, as set out in the operative part of the
applicant's final submissions, is not to annul a decision of the inspection service,
It is not the decision to deal with the case on the merits, but the reformation of the decision taken by  
the APO on 4 April 2022, imposing sanctions on him, which is the only Decision challenged.
14.3.3.
Insofar as the applicant seeks to have the contested Decision amended, its appeal is admissible. The
contested Decision was taken by the APO on 4 April 2022. The application was lodged at the Registry
of the
court within the 30-day period referred to in article 108 § 1 of the law of 3 December 2017 on the creation of
the
of the Data Protection Authority.
VIII. Discussion - Decision of the Court of Marches
Preliminary remarks:
a body temperature is health data if it can be related to a specific person. Health data is
data that can be linked to a specific person.
personal data. It is generally prohibited to process specific personal data, unless an
exception to the Law applies. Health care providers are allowed to process patients'
health data if this is necessary for their
They may then take temperatures. But this is a different situation from taking
temperatures of visitors as an access control measure, outside a treatment relationship.
The present dispute concerns this context.
factual. There is no doubt that temperature monitoring involves the processing of personal
data.
The applicant, at the end of its final submissions, does not put forward any plea to
With regard to the second indent of the contested Decision, from which it appears that the
Contentious Chamber decided, "pursuant to Article 100, §1, 5° of the LCA, to impose a
reprimand for violations of Articles 30.1.a) and 30.1.d) of the RGPD".
IPAGE 01-00003026574-0020-0034-06-01-
L ..J
Court of Appeal Brussels - 2022/AR/556 p. 21
L ..J


Court of Appeal Brussels - 2022/AR/556 p. 21
L _J
16. As for the third plea of the reguerant: The lack of independence or impartiality of the respondent
vitiates the decision of illegality
16.1. These of the applicant
The applicant argues that "as an administrative authority, the Data Protection Authority as a whole must
be independent and impartial. This is a general principle of law which has been established in the case law
of the Conseil d'Etat for many years! ". It also states that "for some time now, the various reports in the
national press have shown a major problem of independence within t h e Data Protection Authority3
- this
problem has been raised and creates an appearance of partiality which is sufficient to call into question the
decisions taken by an administrative authority".
The applicant concludes that "there are grounds for considering that the principle of independence
and impartiality has been violated, and that this violation requires that a decision to dismiss the case
or to discontinue it should be ordered in the context of the present proceedings".
16.2. These of the ODA
The DPA concludes that the applicant, who bears the burden of proof, does not show how the criticisms
it relays could have concretely affected the impartiality (or independence) of th e C ommis s ion.
of the relevant collegiate body, the Dispute Chamber.
16.3. Decision of the Court
The alleged partiality of a collegiate body must be demonstrated in practice, which implies that specific
facts or behaviour concerning that body5
, carried out by its members (and likely to affect the impartiality
of the body as a whole), must be brought to light.
It is not the Contentious Division that is the subject of the criticisms made by the applicant. Contrary
to what the latter argues in its conclusions, the criticisms concern
primarily the legality of the appointment of certain external members of the Knowledge Centre and not
the independence of the Steering Committee6
- Yet, as the ODA rightly points out, these members
are not involved at any point in the ODA's litigation chain (whether for
(e.g. this case, or all cases dealt with by the Litigation Chamber).
See in particular C.E., 19 January 2022, 2S2.684.
This is emphasised by the applicant itself (BSCA's conclusions, § 18).
IPAGE 01-000□3□26574-□□21-0034-06-01-
Court of Appeal Brussels - 2022/AR/556 p.
22
L _J
The legal provisions relating to the independence and functioning of the Data Protection Authority
are referred to in Chapter 4 of the DPA (Articles 43 to 51), which defines the powers and duties of
the Authority.
obligations of the House of Representatives in this respect. In particular, it is the Chamber that
appoints the members of the DPA Dispute Chamber under Article 39 of the LCA, and it is the Chamber
that
who must control the incompatibilities defined in article 44 § 1 LCA, also according to the third
paragraph of article 44 § 1 LCA.
It also has the power to revoke them in the event of a breach of the law (Article 45 of the LCA). It also
has the power to revoke them in the event of a breach (Article 45 LCA).
The Court of Justice does not have jurisdiction in this matter.
In any event, the Court observes that no specific complaint has been raised, let alone demonstrated in
concreto, by the applicant as to the alleged lack of impartiality of the Contentious Chamber in the
present case, which could be said to affect the legality of the contested Decision.
Finally, it is undeniable that the Contentious Chamber has sat collectively in this case, so that
that any irregularity in the appointment or even bias on the part of one of its members, if shown,
could not in itself have affected the legality of the Decision
attacked.
The applicant's plea is unfounded.
17. As to the applicant's fourth plea: the ODA misused its powers
17.1. These of the applicant
The applicant submits that "the context and the manner in which the respondent managed this case
undoubtedly demonstrate a misuse of powers on her part, particularly in view of the following
elements:
- From the start of the processing operation by the applicant, the respondent made it known
in the press that, in its view, such a processing operation (temperature control) did not have a
sufficient basis, without, however, issuing an opinion or even a recommendation, which are, however,
the means of doing so
/s right to do so. Indeed, it was perfectly possible for the respondent to give an own-initiative opinion
on the treatment envisaged in the context of the fight against COVID 19. However, the intimate
refrained from issuing any opinion or even a recommendation on the treatment envisaged and carried
out by the applicant. However, it is clear that the applicant would have followed the intimates'
instructions if the intimates had taken a clear position in accordance with the legal means at their
disposal (and not through press articles), as was the case with their good cooperation with the
inspection services;
- Although the applicant had expressly requested the anonymisation of the decision in its
submissions, the respondent proceeded to publish the decision without legally justifying its decision or
even responding to the applicant's arguments, thereby rendering the decision obscure. The respondent
also considered it useful to communicate its decision by means of a press release, which was
absolutely not within its prerogatives and constituted a misuse of power; (...)".
Court of Appeal Brussels - 2022/AR/556 p. 23
L _J
rPAGE □1-□□□□3026574-0022-0□34-□6-□1-


Court of Appeal Brussels - 2022/AR/556 p. 23
L _J
According to the applicant: "Such action by the respondent is more akin to a kind of revenge against
the Belgian authorities, which did not consult the respondent and which the applicant had to endure,
all with a view to asserting its role and criticising the provisions adopted.
Such a questioning of the content of a norm, which serves as a basis for the criticized decision,
amounts to a misuse of powers by the respondent, mainly in order to achieve an unlawful aim, which
constitutes a misuse of power.
17.2. These of the ODA
The ODA responds to the Applicant's plea of misuse of powers by means of three pleas in defence.
Its argument can be summarised as follows:
The applicant's case does not seem clear,
The demonstration of a misuse of powers presupposes proof that the authority
acted with an unlawful purpose, exclusively; this demonstration is not provided
by the applicant,
The misuse of powers which the applicant alleges the inspectorate to have
m i s u s e d is unfounded and, in any event, has no bearing on the
legality of the decision of the Contentious Chamber,
The Contentious Chamber did not err in law, let alone misuse its powers, in
imposing a fine on the applicant,
than another sanction, nor in setting the amount of this fine.
17.3. Decision of the
Court 17.3.1.
The applicant's fourth plea seems to be interpreted as inferring a misuse of powers
of power committed by the Contentious Chamber, through the contested Decision, which consisted in
particular in denying the legal basis of the contested data processing without adequate or relevant
motivation, but at the end of a behaviour of political expediency consisting in wanting to take
"revenge" (sic) against "the authorities" (resic), not otherwise defined,
who would not have consulted it.
This misuse of powers is also apparent, according to the applicant, from the choice to publish the
contested Decision in a non-anonymous manner.
IPAGE 01-00003026574-0023-0034-06-01-
Court of Appeal Brussels - 2022/AR/556 p.
24
L
17.3.2.
The Court recalls that the plea can be defined in judicial law as the statement of a
"(C. Parmentier, Comprendre la technique de cassation, Brussels, Larder, 2011, p. 85, n° 91, taken up
by X. Taton and G. Eloy, "Structure et contenu des conclusions, chose jugee et mesures d'instruction :
nouvelles responsabilites des parties", in J. Englebert and X. Taton (dir.), Le proces civil efficace ?
Premiere analyse de la Joi du 19 octobre 2015 modifiant le droit de la procedure civile (dire
"Joi pot-pourri"), Bibliotheque de unite de droit judiciaire de l'ULB, Anthemis, 2015, p. 88, n° 12).
In addition, the pleas may relate to facts with legal consequences (pleas of fact), including purely
factual disputes (for example, did this fact with legal consequences occur or not?), or to the law
applicable to the given facts or to the legal consequences arising from that law (pleas of law).
In t h e event that a party's submissions do not fully meet this objective, the court is not obliged to
take into account - within the framework of its obligation to state reasons, article 780, 3° of the Judicial
Code, article 149 of the Constitution and article 6 of the ECHR - the pleas not explicitly stated.
17.3.3.
The Procurement Court recalls that it has jurisdiction, by virtue of article 108 of the LCA, only to rule
on appeals against decisions of the Dispute Division of the DPA. It has no jurisdiction over the
appropriateness or advisability of the DPA issuing a press release.
Furthermore, misuse of power is defined as the form of illegality which consists in the fact that an
administrative authority, acting apparently in a completely regular manner, both in terms of the
reasons and the wording of the decision, voluntarily uses its powers in order to achieve
exclusively or principally an illicit aim, i.e. other than that of the general interest in view of which
these powers have been conferred"
7
-
The Court observes that the fourth plea, as put forward by the applicant, appears obscure: it does
not allege specific facts, but rather vague conduct, "a desire for revenge on the part of the
authorities", unsupported by objective elements.
The Court will not examine further this "branch" of the applicant's plea, which appears to be obscure.
C.E., 3 March 2016, 234.011, Duperoux.
rPAGE □1-□□□□3026574-0024-□□34-□6-□1-
Court of Appeal Brussels - 2022/AR/556 p. 25
L _J
17.3.4.
With regard to the non-anonymous publication of the decision by the DPA, the Court stresses that the
DPA can generally be expected to be cautious in its public statements about the decisions taken until
the expiry of the time limit for appeal or, where appropriate, until the end of the appeal procedure.
This is particularly true when the parties are identified in the decision and press articles in question,
whereas in most cases DPA decisions are anonymised and do not identify the parties (who are not
legal persons).
The Court of Justice considers that if APO wishes to draw attention to certain decisions without
waiting for the possible appeal procedure in order to inform the persons concerned, it should show the
same transparency when the Court of Justice subsequently annuls or reforms these decisions.
In the contested Decision, the Contentious Chamber relies on three grounds to publish it in its entirety
before the expiry of the time limit for appeal:
- The importance of transparency;
- the specificity of the decision ;
- the public interest of the decision.
In this respect, the DPA has some discretionary power (the LCA simply states that the Litigation
Chamber decides on a case-by-case basis whether to publish its decisions on the website) and the
decision to publish was well reasoned.
This part of the plea is unfounded.
17.3.5.
The applicant's fourth plea is unfounded.
I PAGE 01-0□□□3026574-0025-□034-□6-□1-;i
Court of Appeal Brussels -2022/AR/556 p.
26
L ..J
18. As to the Reguerante's pleas 5, 6, 7 and 8 to contest the fine
By these three pleas, the applicant challenges the fine imposed on it by the Contentious Chamber
for infringement of Articles 5(1)(a), 5(1)(b), 6(1)(c), 6(3), 9(2)(i), 12(1), 13(1)(c), 13(2)(a), 13(2)(d),
13(2)(e), 35(1) and 35(7) of the RGPD.
These means, listed below, must be analysed together.
The reguerant's fifth plea: The fine imposed on the reguerant is not adequately motivated or
proportionate
Sixth plea in law of the reguerant : The applicant had a legal basis justifying the processing of
personal data
Seventh plea of the reguerant : The reguerant has respected the principle of transparency and its
obligation to provide information
Eighth plea in law: The data protection impact assessment ("DPIA")
18.1. These of the applicant
18.1.1.
The applicant puts forward its fifth plea in law in two parts, which can be summarised as follows:
The contested Decision reveals a misuse of powers on the part of the Contentious Chamber in
that it applied a fine without having notified the
The Commission considers that the processing operation concerned by this procedure ended
on 15 October 2020 for arrival controls and on 21 March 2021 for departure controls,
With regard to the motivation of the fine and the amount, there is no doubt that the DPA has not
applied the criteria as described in Article 83 of the GDPR and that the DPA has not taken into
account the Guidelines of the European Data Protection Board (hereinafter "EDPB") which
analyse the application of Article 83 of the GDPR in order to impose a fine and determine its
amount.
I PAGE □1-□0003026574-0026-0034-06-01-
Court of Appeal Brussels - 2022/AR/556 p. 27
L _J
The applicant further submits that the Contentious Chamber should therefore, in its decision to impose
a fine of €100,000, have taken account of these various factors, as well as the following elements
- The unintentional nature of the offence found,
- The absence of previous offences on his part,
- Exceptional circumstances related to the pandemic situation,
- the fact that the amount of the fine as imposed in this case is clearly overvalued in relation to the
criteria of the GDPR and the EDPB Guidelines.
18.1.2.
In its sixth plea, the applicant considers that the following legal bases justify the processing of the
personal data at issue, namely in the orders
The following ministries:
Ministerial Order of 5 June 2020 amending the Ministerial Order of 23 March 2020 on
emergency measures to limit the spread of the COVID-19 coronavirus (in force from 8 June
2020 to 30 June 2020);
Ministerial Order of 30 June 2020 (in force from 1 July 2020 to 18 October 2020);
Ministerial Order of 18 October 2020 on emergency measures to limit the spread of the
COVID-19 coronavirus (in force from 19 October 2020 to 28 October 2020);
Ministerial Order of 28 October 2020 on emergency measures to limit the spread of
the COVID-19 coronavirus (in force since 29 October 2020).
These various ministerial orders refer to a Protocol which is binding on the applicant. This Protocol
"concerns the commercial transport of passengers within the framework of COVID-19", issued by the
This protocol is entitled "Commercial Passenger Aviation". This Protocol specifies the sanitary measures
that must be implemented in airports and, according to the applicant, specifically states that "in the context
of COVID-19 and the resumption of activities /fries at
/In addition to the general health measures (wearing of masks, social distancing, etc.), the
temperature check of passengers is foreseen as a specific health measure applicable to airports". In
addition to the general health measures (wearing of masks, social distancing, etc.), the temperature
check of passengers is foreseen as a specific health measure applicable to airports.
I PAGE 01-□0003026574-0027-0034-06-□1-
Court of Appeal Brussels -2022/AR/556 p.
28
L ..J
18.1.3.
In its seventh plea, the applicant maintains that it used all the means at its disposal to comply with
the principle of transparency and its obligation to provide information
imposed under the RGPO. In essence, the applicant considers that it has done its best - by using
example of pictograms and posters to facilitate the understanding of the persons concerned
- with regard to its crisis capabilities and recognises, however, that some information
The Commission has taken the view that the information should have been included in the documents
or channels intended to inform the persons concerned and has undertaken to remedy this as quickly
as possible, and that these failings justify a possible reprimand, not a fine of such a high amount.
as described above.
18.1.4.
In its eighth plea, the applicant contests that an AIPO should have been established, while conceding
that it should have done so not after the processing operation had been carried out but
before. It explained that it had to deal with a situation
The applicant submits that the situation is exceptional, combining the disastrous consequences of the
COVI0-19 and its economic situation. According to the applicant, this situation must be regarded as a
cause of force majeure, since the infringement must not be regarded as significant and in no way
justifies a fine of such magnitude.
18.2. These of the
APO 18.2.1.
APO recalls at the end of its conclusions that under Articles 83 and 84 of the GDPR, sanctions (fines
or other) imposed by the data protection authority must be "effective, proportionate and dissuasive".
According to the APO, the imposition of a fine is not subsidiary. Although the Contentious Chamber
must give reasons for its choice of penalty, in the case of a fine it must not systematically explain, one
by one, why each of the other potential measures has not been chosen. On the contrary, the
contested decision explains that, under the RGPO, infringements (other than minor infringements)
must be sanctioned8
-
See also the Article 29 Guidelines in this regard, which state that "The point is not to qualify the fines as last resort, nor to shy away
from issuing fines, but on the other hand not to use them in such a way which wauld devalue their effectiveness as a toa/" (free
translation: "ii ne s'agit de ne considerer les amendes comme de dernier recours, ou de dissuader d'imposer des amendes, mais
d'autre part de ne les utiliser d'une maniere qui devalue l'efficacité de cet outil"); see
h t t p s : / / ec.europa.eu/newsroorn/ article29/items/611237.
rPAGE 01-00003026574-0028-0034-06-01-
Court of Appeal Brussels - 2022/AR/556 p. 29
L _J
According to the DPA, the Contentious Chamber gave valid reasons for its decision to impose a fine
on the
The DPA states that a form was sent to the applicant and that it was given the opportunity to
comment. The DPA states that a form was sent to the applicant and that it was given the opportunity
to comment9
-
These remarks are summarised in the contested decision itself10
. The contested decision then meets
these remarks11 and explains the way in which the amount of the fine was calculated12
-
18.2.2.
According to the DPA, with regard to the legal basis of the treatment, assuming that the Commercial
Aviation Protocol adopted by the Federal Public Service Mobility and Transport has a binding value
(quad non), the measures it provides for are in any event not included in the orders referring to that
Protocol. Indeed, none of the ministerial orders cited by the applicant provides for
expressly the taking of temperature of passengers transiting through the airport.
Furthermore, the DPA recalls that, in order to validly invoke the basis of lawfulness of Article 6, §1, c)
and
The exception provided for in Article 9(2)(i) of the RGPD, the controller must be able to
demonstrate the following elements:
In the case of the "important public interest in the field of public health" (Article 9.2.i);
that there is a legal provision which can be validly invoked by the controller in
accordance with Articles 6.1.c, 6.3 and 9.2.i) of the GDPR.
That the treatments concerned are necessary for:
o To comply with the legal obligation invoked in accordance with Article 6.1.c and
o Public interest r e a s o n s in the field of public health according to
article 9.2.i "
13
-
According to the DPA, with regard to the second element, i.e. the existence of a legal provision that
can be validly invoked, t h e DPA considers that "neither the decree on the creation and operation of
the
/Neither the ministerial order nor the law on civil security (...) regulate the legitimate treatment as
such. This treatment is provided for in the Protocol of
14/And the DPA adds, with regard to this Protocol, that it "does not provide a valid legal basis for
the processing within the meaning of Article 6.1 GDPR"
15
.
§ 337.
10 § 337.
11 §§ 337-341.
12 §§ 342-346.
13 Decision challenged, §83.
14 Decision challenged, §89.
15 Decision challenged, §98.
r PAGE 01-□□□□3026574-□□29-□□34-□6-□1-;i [!ll[!l
[!l ..-i.
s
Court of Appeal Brussels - 2022/AR/556 p.
30
L _J
The DPA notes that the Commercial Aviation Protocol, adopted by the FPS Mobility and Transport,
does not impose any obligation to check the temperature of passengers.
The DPA concludes that the Protocol does not meet the requirements of Article 6(3) of the GDPR, in
particular because:
the purposes of the processing are not mentioned in a sufficiently clear and precise
manner;
the modalities of the treatment are not defined;
the requirement of predictability is not met.
18.2.3.
With regard to the failure to comply with the obligation to conduct a PIA, the DPA submits that the
applicant was legally obliged to carry out a PIA prior to the implementation of the processing
operation and that the PIA was carried out by the
The applicant does not meet the legal requirements, his explanations in this respect being
inconsistent, which
implies a violation of Article 35 § 7 of the GDPR.
18.2.4.
Finally, as regards compliance with the transparency principle, the DPA submits that the applicant
does not dispute the DPA's statements concerning the general obligation of transparency under Article
5(1)(a) of the RGPD, nor does it dispute the DPA's position that it cannot be inferred from the presence
of certain information in the media or from the publication of certain information in the media that the
applicant is not a party to the RGPD.
The applicant is therefore exempt from the obligation to provide the information referred to in
paragraph 1.
Article 13 of the RGPD.
Court of Appeal Brussels - 2022/AR/556 p. 31
L _J
rPAGE 01-00003026574-0030-0034-06-01-


              L_J
Court of Appeal Brussels - 2022/AR/556 p. 31
18.3. Decision of the Court
18.3.1.
The conduct of the APO complained of by the applicant consists in fact in the inadequate or incorrect
statement of reasons for the contested decision in that it is based on a lack of legal basis for
penalising the contested treatment and on the failure to take account of a series of attenuating
circumstances or relevant criteria enabling the penalty imposed to be justified.
18.3.2.
The applicant does not show that, in penalising it, the Contentious Chamber is pursuing an objective -
which is not authorised - other than the public interest objective which it is required to pursue under
the RGPD and the LCA, namely the application of the fundamental right to the protection of
personal data.
personal nature. A fortiori, the applicant does not show that this unauthorised purpose is the exclusive
or even predominant purpose of the contested Decision.
No misuse of powers is shown by the applicant as regards the justification for the contested fine.
18.3.3.
With regard to the lack of a legal basis for the disputed treatment, APO is right to argue that the
Commercial Aviation Protocol, adopted by the Federal Public Service for Mobility and Transport, does
not impose any legal obligation on the parties.
no obligation to check the temperature of passengers. The Protocol only confirms that the choice to
carry out temperature checks is a choice of the applicant ("The airport of
Charleroi (Brussels South Charleroi Airport), on request of airlines operating there, has however
taken the decision to implement temperature testing of people entering the terminal. The airport
guarantees that the chosen method will not cause any delay or concentration
of people at the entrance to its facilities"
16 ).
Furthermore, the Protocol states that these controls were put in place at a time when the European
Centre for Disease Prevention and Control (ECDC) and the European Aviation Safety Authority
(EASA) were not recommending temperature controls at airports due to the lack of scientific
justification for this measure17
-
In its submissions, the Applicant submits that the Protocol, in the version applicable at the material
time, states as follows: "In addition to the general health measures (wearing of masks, social distancing,
etc.), the temperature check of passengers is provided for as a specific health measure applicable to
airports".
16 Piece 9, p. 5.
17 Piece 9, p. 5.
rPAGE 01-□□□□3026574-□031-0034-□6-□1-;i
L ..J
Court of Appeal Brussels - 2022/AR/556 p. 32
L _J
The Protocol is, however, reproduced in Exhibit 9 of the OAP and does not contain this sentence. This
sentence is also absent from the document to which the link in the Applicant's submission18 refers - the
Court cannot verify the relevance of this argument.
The fact that the Royal Decrees cited by the applicant enter or refer to the content of the Protocol
d o e s not imply that there is a legal basis for the treatment at issue in view of the
the uncertain nature of the terms contained therein. It is therefore unlawful for the Contentious
Chamber to
notes the absence of this legal basis.
18.3.4.
It is also clear from the facts of the case, and the applicant does not dispute this, that it is a
The APO has rightly identified breaches of the principle of transparency and of its own
information obligations. The applicant's plea that it did not infringe Article 5,
§1, a}, 12 and 13 of the RGPD (principle of transparency and information obligation) must
therefore be rejected.
18.3.5.
As regards the grounds and proportionality of the fine, the Decision expressly mentions in detail, in
points 332, 333 and 335, the reasons for which it intends to resort to it.
The contested decision also details certain attenuating circumstances which it adopted in order to
determine the amount of the fine, in particular the fact that the applicant had no previous record and
had not derived any benefit from the offences found.
However, the Court of First Instance considers that the statement of reasons for the contested
decision does not take into account, or at least does not sufficiently take into account, the following
attenuating circumstances within the meaning of
Article 83 of the RGPD to assess the need for an administrative fine:
- the deliberate or negligent nature of the infringement in exceptional circumstances rarely observed,
in particular the fact that the applicant introduced the temperature check in good faith, having
announced it to the competent authorities, in order to protect the public health not only of the
passengers but also of any person with whom they subsequently had contact. Temperature monitoring
was in no way introduced for commercial reasons;
- the extent to which the applicant cooperated with the supervisory authority to remedy the
infringement and mitigate its possible negative consequences, including the fact that the applicant
cooperated during the procedure with the APO;
18 BSCA Conclusions, § 31 (p. 26). The Respondent points out that this document indicates that it only
concerns the period "from 7 March 2022 until further notice".
IPAGE 01-□□□□3026574-□□32-□□34-□6-□1-;i
Court of Appeal Brussels - 2022/AR/556 p. 33
- any other aggravating or attenuating circumstances applicable to the circumstances of the case,
such as the financial gains made or losses avoided, which may or may not have resulted directly from
the infringement; in the present case, while it was found that the applicant had not benefited from the
temperature controls, no account was taken of the costs incurred by it as a result of those controls,
moreover during a period of extreme economic disadvantage for the airports, precisely because of the
high level of traffic.In the present case, while it was found that the applicant had not benefited from the
temperature controls, no account was taken of the costs incurred by it as a result of those controls,
and moreover during a period which was extremely unfavourable in economic terms for the airports,
precisely because of the exceptional health situation with which it had to contend,
- the purpose of the processing, in particular the fact t h a t the applicant introduced temperature
control solely to protect public health.
In the light of the foregoing, arising from the exceptional context of the pandemic situation which the
company as a whole had to face, the contested Decision must therefore be reformed in that the Court
of First Instance, exercising its full jurisdiction, reduced the fine imposed on the Applicant to the
amount of EUR 25,000.00
19. As to the applicant's ninth plea: As regards the publication of the contested decision
The Court has already answered this plea above in the context of the examination of the 4th plea of the
applicant. It is unfounded.
IX. Depens
20.
In accordance with article 1017, paragraph 1, of the Judicial Code, the ODA, which is the most
unsuccessful party, is ordered to pay costs, liquidated at 1,800.00 euros (procedural indemnity - case
not assessable in money).
IPAGE 01-00003026574-0033-0034-06-01-
L _J
Court of Appeal Brussels - 2022/AR/556 p.
34
L _J
ON THESE GROUNDS, THE
COURT,
Having regard to the provisions of the law of 15 June 1935 on the use of languages in
judicial matters
Declares the action admissible and partially founded to the following extent:
Partially annuls the contested decision number 47/2022 of the Contentious Chamber
of the Data Protection Authority of 4 April 2022 in case number DOS-2020- 04002, only insofar as it
imposes an administrative fine in the amount of
100,000.00 to SA BRUSSELS SOUTH CHARLEROI AIRPORT (BSCA) (as well as the motivation under
and;
The Court of Justice reduces the administrative fine imposed on SA BRUSSELS SOUTH CHARLEROI
AIRPORT (BSCA) to the amount of 25,000.00 euros.
Orders APD to pay the costs, including the procedural indemnity of 1,800.00 euros.
Condemns the DPA to pay the right to be heard before the Court of Appeal (400.00 €) to the FPS
FINANCE, in accordance with Article 2692
§ 1, of the Code of Registration, Mortgage and other Fees
and grafting.
Thus judged and pronounced at the public civil hearing of the 19th chamber A of the Court of Appeal of
Brussels, Market Court section, on 7 December 2022.
Where were present :
- Mr. F. FOGLI, Councillor ff. president,
- Mrs. A.-M. WITTERS, Councillor
- MR 0. DUGARDYN, Councillor
Registrar
I PAGE 01-00003026574-□034-0□34-□6-□1-
JOURDAN
</pre>
</pre>

Latest revision as of 09:53, 14 December 2023

Court of Appeal of Brussels (Belgium) - 2022/AR/556
Courts logo1.png
Court: Court of Appeal of Brussels (Belgium)
Jurisdiction: Belgium
Relevant Law: Article 5(1)(b) GDPR
Article 5(1)(a) GDPR
Article 6(1)(c) GDPR
Article 6(3) GDPR
Article 9(2)(i) GDPR
Article 12(1) GDPR
Article 13(1)(c) GDPR
Article 13(2)(a) GDPR
Article 13(2)(d) GDPR
Article 13(2)(e) GDPR
Article 30(1) GDPR
Article 30(1)(d) GDPR
Article 35(1) GDPR
Article 35(7) GDPR
Decided: 07.12.2022
Published: 09.01.2023
Parties:
National Case Number/Name: 2022/AR/556
European Case Law Identifier:
Appeal from: APD/GBA (Belgium)
47/2022
Appeal to:
Original Language(s): French
Original Source: GBA (in French)
Initial Contributor: n/a

The Belgian Court of appeal of Brussels upheld a decision by the Belgian DPA to fine Charleroi airport for using temperature scanners at the airport to detect potential COVID-19 infections without a legal basis. However, the Court reduced the original fine.

English Summary

Facts

On 4 April 2022, the Belgian DPA issued decision 47/2022, in which it fined Charleroi Airport €100,000 for the use of thermal cameras and temperature checks for COVID-19 detection purposes. The DPA held that the controller lacked a lawful ground for processing these special category data, see the GDPRhub summary.

The controller appealed this decision with the Market Court. The controller questioned the impartiality of the DPA by referring to several reports in the national press. These reports showed an appearance of partiality, according to the controller, which was enough to call the decisions of the DPA into question. The nature of these news reports were not specified in the ruling.

The controller further argued that the DPA had misued its powers. According to the controller, the DPA had stated multiple times in the press that the controller did not have a legal basis for its use of thermal cameras. However, the DPA did not issue any opinion of give recommendations to the controller so that it could improve its processing. The controller stated that it would have followed the instructions of the DPA if the DPA had taken a clear position regarding the legality of the controller's processing. The controller had also requested the anonymization of the decision. Despite this, the decision was published alongside a press report. According to the controller, the choice to publish a non-anonymised decision and to publish press report alongside it constituted a misuse of power by the DPA.

The controller also stated that the DPA had misued its powers with regard to the determination of the fine.

The controller also argued that the DPA did not properly apply the criteria described in Article 83 GDPR for determining the fine and had not consulted the EDPB Guidelines regarding Article 83 GDPR (Guidelines 04/2022).

Lastly, the controller stated that it did have a legal basis for its processing of health data. In its submissions, the controller cited several national ministerial orders, which all contained a reference to specific legal protocol that, according to the controller, was legally binding. Therefore, it could use this protocol as a legal basis for its processing. The controller also cited several Royal decrees, which referred to the content of this protocol.

Holding

The court considered that it had full jurisdiction to review the contested decision of the DPA. Under the full review pursuant of Article 47 CFR and Article 78 GDPR, the Court could substitute its views to the ones of the DPA, to the extent that all elements and arguments were raised and discussed before the Court.

The Court then went on to consider the grounds op appeal of the controller.

First, with regard to the impartiality, the Court noted that the controller's criticism was focussed on the legality of the appointment of certain external members. It was for the Parliament to decide on the appointment of external members. The Court determined that the impartiality-argument of the controller was unfounded since no specific argument had been raised that could affect the regularity of the decision and could lead to annulment.

The controller also did not provide any concrete evidence to support its argument.

Second, the DPA did not commit an abuse of its powers when deciding to publish the decision in a non-anonymous manner. It specifically mentioned that the decision to publish the decision was well reasoned by the DPA, which had the discretionary power to decide on this issue. The Court deemed the other controllers' arguments to be 'obscure' and decided not to examine the other arguments relating to this issue any further.

The Court also determined that the DPA had not misused its powers with regard to the determination of the fine. The Court reminded that this can only be the case when a public authority used its power, meant to serve the public interest, for another purpose. The unauthorised purpose must moreover be the sole purpose of the contested act. Since the controller didn’t demonstrate that the DPA pursued an objective other than the enforcement of the right to data protection, this plea was also unfounded.

Third, the Court also confirmed that the 'protocol' signed between the airport and the minister in charge invoked by the controller as a legal basis was not legally binding. The DPA had come to the same conclusion in the contested decision. This protocol only stated that Airports had the choice to carry out temperature checks. The Court also emphasised that the 'European centre for disease Prevention and control' (ECDC) and the 'European Aviation Safety Authority' (EASA) were not recommending these temperature checks at airports due to the lack of scientific justification for this measure. Besides, the mere fact that a Royal Decree was referring to such a protocol did not make it binding and an appropriate legal basis.

The Court reduced the amount of the fine. In particular, the court stated that the DPA should have paid more attention to the following factors:

  • The controller had introduced the temperature checks in exceptional circumstances (the pandemic) and had also announced its plans to the relevant authorities.
  • The controller had fully cooperated with the DPA during the procedure
  • The controller had not profited economically from these temperature checks. The sole purpose of the temperature checks was to support public health.

Therefore, the Court stated that it had to reform the original DPA decision and reduce the original fine to €25,000, which was the only change the Court ended up making to the original decision.

Comment

Similar temperature checks were performed at Brussels Airport. This was the subject of a separate (Dutch) decision of the DPA (48/2022), also issued on 4 April 2022 and appealed at the Market Court (2022/AR/560 & 2022/AR/564). Both the decision of the DPA and the decision of the Market Court are summarised on the GDPRhub.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details. 

Not registrable
Presents the
Directory number
20221gGl-\
Date of delivery
7 December 2022
Role number
2022/AR/556
0 Not available to the 
recipient
Expedition
Delivered to
the 
f 
CIV
Delivree ii
the
f,
VIC
Delivree ,1
the
VIC
Court 'a pel 
Brussels
Staircase Court Section
19th Chamber A Steps 
Chamber
Stop
r COVER □1-□00□3□26574-0001-0□34-□6-□1-i7
IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII _J
Court of Appeal Brussels - 2022/AR/556 p. 
2
IN CONNECTION WITH:
BRUSSELS SOUTH CHARLEROI AIRPORT ANONYMOUS COMPANY (hereinafter "CHARLEROI
AIRPORT"), whose registered office is located at rue des Frères Wright 8, in 6041 Charleroi, registered 
with the Banque Carrefour des Entreprises under number 0444.556.344,
Applicant Portie,
Having as counsel, Mr. Frédéric DECHAMPS, Attorney at Law at the Brussels Bar, whose office is 
located
[...] .
AGAINST:
THE DATA PROTECTION AUTHORITY, whose registered office is located at Rue de la Presse 35, 1000 
Brussels, registered with the Crossroads Bank for Enterprises under number 0694.67 9.950, 
represented by the Chairman of its Management Committee,
Portie odverse,
Having as counsel Mr Evrard de Lophem, Mr Grégoire Ryelandt and Mr Clara Delbruyère, lawyers, 
whose office is located [ . . . ].
Having regard to the procedural documents and in particular :
Decision 47/2022 of 4 April 2022 of the Contentious Chamber of t h e Data Protection 
Authority (hereinafter 'the contested Decision');
the application filed with the court registry on 3 May 2022;
the schedule for the exchange of pleadings agreed by the Court at the introductory 
hearing on 18 May 2022;
the conclusions of CHARLEROI AIRPORT of 28 September 2022; 
the summary conclusions of the APD of 26 October 2022;
the documentary records filed by the parties;
r PAGE 01-□0□□3026574-□□□2-□□34-□6-□1-;i
L _J
Court of Appeal Brussels - 2022/AR/556 
p. 3
Heard counsel for the parties at the public hearing of 9 November 2022 at 14:00, held by 
videoconference by agreement of the parties.
I. The Decision attacked
1.
The ODA Litigation Chamber took the following decision:
"(...) the Contentious Chamber of the Data Protection Authority decides, after deliberation :
Under Article 101 of the LCA, impose a fine of EUR 100,000 on the defendant for violations of Articles 
5.1.a, 5.1.b, 6.1.c}, 6.3, and 9.2.i), 12.1, 13.lc}, 13.2.a}, 13.2.d}, 13.2.e}, 35.1 and 35.7;
Under Article 100, § 1, 5° of the LCA, to impose a reprimand _for violations of Articles 30.1.a) and 
30.1.d},;
Pursuant to Article 108(1) of the LCA, this decision may be appealed to the Market Court within thirty 
days of its notification, with the Data Protection Authority as defendant.
II. Factual background and procedural history
2.
According to the applicant, the relevant facts can be summarised as follows, the Court specifying that 
it will have regard to all the facts as they appear from the documents in the file:
In March 2020, Covid-19 continued to spread throughout the world and its spread in Europe could only be 
halted by t h e decisions of the various Member State governments to put in place more or less strict 
containment measures.
In Belgium, this decision to confine the population is accompanied by a ban on travel to and from 
Belgium that has been in force since 18 March 2020. The applicant, like other airports in the country, 
is forced to stop its activities and to put almost all its staff out of work.
rPAGE 01-00003026574-00□3-0□34-06-01-
L _J
Court of Appeal Brussels - 2022/AR/556 p. 4
L _J
Since the decision to close the borders and its implications for the applicant, the latter has not ceased 
to enquire about the possibilities of resumption and dialogue with the political authorities on which it 
depends in order to know how, in practice, to manage the two imperatives of combating the spread of 
the coronavirus and the reopening of the borders and its obvious impact on the population.
/organisation of airports {PIECE XXX).
As part of this preparation for the reopening, the applicant participated in various meetings and
workshops requested by the Federal Authorities which were aimed at organising the recovery of the 
airport sector while allowing for the supervision and health security of the persons concerned {PIECE 
XXX).
On 8 June 2020, a decision of the National Security Council allows the reopening of the borders to and 
from Belgium. The resumption of airport activities will be possible from 15 June, one week after this 
decision. However, these trips abroad are conditional on
various measures (screening, pre-testing, post-travel testing, etc.) depending on the rules in force in 
the various states, but also on a colour code decided by the federal government according to the 
evolution of the pandemic in the various countries.
With regard to the reopening of airports, this has been defined by successive ministerial orders. These 
ministerial orders provide that "practical modalities concerning health regulations applicable to the 
reopening of airports shall be provided for through a Protocol".
determined by the competent minister in consultation with the sector concerned or to the minimum 
general rules which have been communicated on the website of the competent public service" 
(hereinafter the "Protocol").
The Protocol applicable to the applicant provided that "concerning the commercial transport of passengers 
in the framework of the COV/0-19, the Belgian FPS Mobility and Transport issued a Protocol entitled 
"Commercial Passenger Aviation" which specified the sanitary measures that had to be taken in order to 
ensure the safety of passengers.
The information is available on the website of the FPS Mobility and Transport via the following link:
https:1/mobilit.belqium.be/en/airtransport/covid 19 coronavirus
I PAGE 01-00003026574-0004-0034-06-01-
Court of Appeal Brussels - 2022/AR/556 p. 
S
In the context of COVID-19 and the resumption of commercial passenger aviation activities as of 8 
June 2020 and until further notice, all airport operators shall implement the health measures detailed 
in this document.
This Protocol provided, in addition to general health measures (masking, social distancing, etc.), for 
temperature checks of passengers as a specific health measure applicable to airports.
As a reminder, the above-mentioned Protocol was drawn up on the basis of recommendations published by 
the European Union Aviation Safety Agency (EASA) and the European Centre for Disease Prevention and 
Control (ECDC).
On 15 June, when airport operations resumed, and in accordance with the Protocol - which in fact 
imposes legal obligations on airports - the Applicant and the other airports in the country concerned 
introduced temperature monitoring of passengers at the departure point using thermal cameras.
The Applicant also stresses that, at that time, taking temperatures was the only alternative for 
achieving the objectives of the Protocol and the aforementioned Decree.
In practice, these temperature checks were carried out at two different locations in the airport, at the 
departure area, in the pre-check tent via two cameras (hereinafter the "departure check") and at the 
arrival area.
"This thermal camera check determined only whether a masked subject's temperature was above 
38°C. This thermal camera monitoring only determined whether the temperature of a masked subject 
was above 38°C.
More specifically, for the departure control, the control procedure took the following form: a first 
temperature measurement using thermal cameras (Red Cross staff supported by the applicant's fire 
brigade monitor this device). If the temperature of the person concerned was above 38°C, then the 
staff monitoring the control screens carried out a second test with a digital forehead thermometer.
If the temperature displayed with the digital thermometer was below 38°C, the person concerned 
continued to the airport terminal. If, however, the temperature was again higher than 38°C, the 
person concerned was invited to the infirmary to take his/her temperature with a digital thermometer 
under the arm. If the temperature is below 38°C, the person concerned continued on his way to the 
airport terminal.
If the temperature was for the third time above 38°C, the fire service was informed via the radio on 112. 
An ambulance firefighter working for the claimant would intervene to make sure that
/The passenger's history. This assessment consisted of asking the person concerned additional 
questions to determine whether he or she was suffering from other symptoms that were frequently 
considered to be symptoms of coronavirus. The exchange with the person concerned in this 
assessment is oral and n o notes and/or storage of information were made.
I PAGE 01-00003026574-0005-0034-06-01-
L ..J
Court of Appeal Brussels - 2022/AR/556 p. 6
L _J
If the qualified firefighter-ambulance officer does not consider the person concerned to be potentially 
infected with the coronavirus, the person concerned will return to the airport terminal.
If, after these three temperature tests and this anamnesis, there was a suspicion of coronavirus 
contamination, the firefighter ambulance driver informed the person concerned of the situation and, if 
necessary, informed him that the airline with which he was to fly forbade the passenger with fever to board 
the plane.
It is fundamental to note that the applicant never refused to allow a passenger to proceed, but that, 
through this procedure and the advice of the firefighter/ambulance officer, the persons concerned with 
fever and other symptoms decided, of their own free will, not to go to the terminal to fly.
For arrival control, the control is only carried out on passengers returning from the red zone.
It was a one-off temperature check of the person concerned by thermal cameras. The Red Cross, as a 
subcontractor, accompanies firefighters and ambulances
In the case of a temperature of more than 38°C, the person concerned received a document advising 
him/her to be alert to other potential symptoms of coronavirus and to contact a doctor. If the temperature 
was above 38°C, the person concerned received a document inviting him/her to be alert to other 
potential symptoms of coronavirus and to contact a doctor if he/she so wished.
4 - On 17 June 2020, a press release from the Data Protection Authority (hereinafter "DPA" or "DPA") 
denounced the implementation of this device at Zaventem airport.
The DPA announced that this type of processing of sensitive and high-risk data (collection of health data 
within the meaning of Article 9 of the RGPD) was purely prohibited and that there was no basis in Belgium 
for such processing.
/The DPA seemed to consider that it was the automated infrared camera technology that involved 
compliance with the RGPD. The DPA seemed to consider that it was the automated infrared camera 
technology that implied compliance with the GDPR. The DPA's opinion seems to have changed.
5 - On 28 August 2020, the inspection service, on its own initiative, examined the processing 
operations carried out by the applicant in connection with the installation of thermal cameras to 
prevent the spread of the Covid-19 virus.
In this context, the inspection service will write several letters requesting information to the applicant 
{PIECES 2, 14, 24 of the APD file) dated 3 September 2020, 28 September 2020, 28 September 2020, 28 
September 2020, 28 September 2020, 28 September 2020, 28 September 2020
October 2020 and 6 January 2021.
The applicant will always reply to these letters to the best of its ability and with the means at its disposal 
in this period of crisis {PIECES 3, 6, 7, 8, 18, 19, 34 of the ODA file}. In its replies, the applicant even 
suggested that the inspection service should come and see on site how the treatments were carried out so 
that the service could see the organisation put in place by the applicant and propose any improvements. 
The inspection service declined this proposal. In addition, on 8 January 2021, the inspection service will 
question the Red Cross and /-Care, the applicant's subcontractors in the context of the processing of 
personal data {PIECES 25 and 26 of the DPA file).
IPAGE □1-□□□□3□26574-□006-0034-06-01-;-J
Court of Appeal Brussels 2022/AR/556 p. 
7
These subcontractors will respond to the DPA (PIECES 32, 37 and 38 of the DPA file) providing all the 
information relating to these treatments.
Following these replies, the inspection service drew up an inspection report and forwarded the file to the 
Litigation Chamber, which decided to deal with the case on its merits. It informed the claimant of this on 5 
May 2021 (PIECES 44 to 45 of the ODA file).
6.- The Contentious Chamber, seized of the case, in its decision No. 47/2022 of 4 April 2022 (hereinafter 
"the contentious decision"), imposes a fine of EUR 100,000 on the applicant for alleged violations of Articles 
5.1.a, 5.1.b, 6.1.c, 6.3, and 9.2.i}, 12.1, 13.1.c}, 13.2.a}, 13.2.d}, 13.2.e}, 35.1 and 35.7, and imposes a 
reprimand for alleged breaches of Articles 30.1.a) and 30.1.d}, and also decides to publish this decision on 
its website.
3.
The applicant appealed against the contested Decision by application lodged at the Registry of the Court 
of First Instance.
the court on 3 May 2022.
Ill. The legal framework.
4.
By the Decision under appeal, the DPA decides, with regard to the applicant
Under Article 101 of the LCA, to impose a fine of EUR 100,000 on the 
defendant for violations of Articles 5.1.a, 5.1.b, 6.1.c}, 6.3, and 9.2.i), 12.1, 
13.lc}, 13.2.a}, 13.2.d}, 13.2.e), 35.1 and 35.7 of the GDPR;
Under Article 100, §ler, 5° of the LCA, to impose a reprimand for violations of 
Articles 30.1.a} and 30.1.d} of the GDPR.
6.
The Contentious Chamber of the ODA based the contested decision on the following considerations:
(...)
IPAGE □1-□□□□3026574-□□□7-□034-□6-□1-
L _J
Court of Appeal Brussels - 2022/AR/556 p. 8
L _J
333. In the present case, the Contentious Chamber found that the defendant had violated the 
following articles:
a) Violation of Articles 6.1.c}, 6.3, and 9.2.i}, since it has not been demonstrated that the 
processing of the personal data at issue is necessary on grounds of public interest in the field of public 
health, such as protection against serious cross-border threats to health or for the purpose of 
ensuring high standards of quality and safety of health care and medicinal products or devices, on the 
basis of Union law or the law of the Member State which provides for appropriate and specific 
measures to safeguard the rights and freedoms of the person concerned, including professional 
secrecy. Furthermore, the legal bases invoked by the defendant (namely the Decree of 23 June 1994 
on the creation and operation of the European Data Protection Supervisor's office) are not 
sufficiently clear.
/The following provisions of the Act of 31 December 1963 on civil protection (as replaced by the Act 
of 15 May 2007) and the "Commercial Passenger Aviation" Protocol of 11 June 2020 do not meet the 
requirements of the Act of 31 December 1963 on civil protection.
/Article 6.1 c) Ju in combination with Article 6.3 of the GDPR.
b) Violation of Articles 5.1.a}, 12.1, 13.lc}, 13.2.a}, 13.2.d}, and 13.2.e}, for failing to provide 
transparency to the persons concerned by not informing them that temperature measurement would 
be carried out by means of thermal cameras; for failing to inform correctly the passengers returning 
from the red zone; for failing to inform correctly about the legal basis of the processing, the purpose 
of the processing and the regulatory framework of the obligation to monitor body temperature; for 
failing to inform correctly about the period of retention of the data and the right to lodge a complaint 
with the Data Protection Authority.
c) Violation of Article 5(1)(b), as the purpose of the processing was not sufficiently explicit when 
the processing started, as it was not expressly stated in any of the sources of information used by the 
defendant. The purpose of the processing was only made explicit in response to questions from the 
Inspection Service and after the amendment of the privacy policy in December 2020.
d) Violation of Articles 35(1) and 35(7) for not having carried out a data protection impact 
a sse s sm e n t before the processing operation was set up. Furthermore, the impact assessment is 
incomplete as it does not contain an adequate description of the processing operations envisaged and the 
purposes of the processing, it d o e s not sufficiently analyse the necessity and proportionality of the 
processing and does not properly assess the risks to the rights and freedoms of the data subjects.
e) Violation of Articles 30(1)(a) and 30(1)(d) due to the absence of the name and contact details 
of the controller and the data protection officer in the register of processing activities at the time of 
the investigation and due to the lack of sufficient precision as to the categories of recipients of the 
data.
334. Pursuant to Article 101 of the LCA, it decides to impose a fine of EUR 100,000 on the 
defendant for violations of Articles 5.1.a}, 5.1.b}, 6.1.c}, 6.3, and 9.2.i}, 12.1, 13.1.c}, 13.2.a}, 
13.2.d}, 13.2.e}, 35.1 and 35.7.
I PAGE 01-□□□□3□26574-00□8-□034-□6-□1-i:-i
Court of Appeal Brussels - 2022/AR/556 p. 9
335. Having regard to Article 83 of the GDPR, the Administrative Jurisdiction Division gives 
reasons for the imposition of an administrative penalty in a concrete manner1 , taking into account 
the following criteria, drawn from this article, which it considers relevant in the case in point:
the nature, severity and duration of the breach (art. 83.2.a) - The breaches found are, in 
particular, a breach of the provisions of the GDPR relating to the principles of data protection (article 5 of 
the GDPR) and the lawfulness of processing (article 6 of the GDPR). An infringement of the above�mentioned provisions is, in accordance with Article 83, paragraph 5, of the GDPR, possible higher 
financial penalties.
The infringements found also concern the violation of the provisions on information and transparency 
obligations (Articles 5.1.a}, 12.1 and 13 of the GDPR). Compliance with the above provisions is 
essential and must take place at the latest at the start of the processing of personal data. This is also 
necessary to facilitate the exercise of the data subject's rights.
The infringements also concern the carrying out of the Impact A s s e s s m e n t on the
data protection. This obligation was only carried out after the start of the processing operation, 
whereas it should have been carried out before (Article 35(1) of the GDPR) and was not carried out 
in a manner that complied with the criteria of Article 35(7), which considerably affected the credibility 
of the exercise and the potential benefits for the rights.
Any previous relevant breach by the controller or processor (art.83.2.e) GDPR}- The 
defendant has never been subject to an infringement procedure before the Data Protection Authority.
/Categories of personal data concerned by the breach (Art. 83.2.q) GDPR) - The breaches 
identified concern a category of personal data within the meaning of
/Article 9 of the LCA (data relating to the health of the persons concerned).
any other aggravating or attenuating circumstances applicable to the circumstances of the 
case (Art. 83.2(k) GDPR): the defendant did not derive any benefit from the processing operations or 
from the offences committed.
336. All the elements set out above justify an effective, proportionate and dissuasive sanction, as 
referred to in Article 83 of the RGPD, taking into account the assessment criteria it contains.
(...)
342. In accordance with the foregoing, the Contentious Chamber finds that it can base itself on the 
annual figures of Brussels South Charleroi Airport SA to determine the amount of the administrative 
fine that it intends to impose on the defendant.
343. The Contentious Chamber refers to the conclusions of the defendant filed with the Contentious 
Chamber and to the annual accounts filed with the National Bank of Belgium (NBB) on 5 July 2021, 
which show a turnover for the financial year 2020 of EUR 28,859,291.41.
1 Brussels Court of Appeal (Market Court section), X. v APD, Judgment 2020/1471 of 19 February 2020
I PAGE 01-00003026574-0□09-□□34-□6-□1-
L ..J
Court of Appeal Brussels - 2022/AR/556 p. 10
344. The administrative fine of 100,000.00 euros corresponds to 0.34% of the defendant's annual 
turnover for the year 2020. The Contentious Chamber refers to the defendant's submissions to the 
Contentious Chamber and to the annual accounts filed with the National Bank of Belgium (NBB) on 5 
July and 2021, which show a turnover of EUR 28,859,291.41 for the financial year 2020.
345. The proposed administrative fine of EUR 100 000 corresponds to 0.34 % of the defendant's annual 
turnover for the year 2020.
346. The Contentious Chamber states that the maximum amount of the administrative fine for a 
violation is determined by Articles 83.4 and 83.4 of the RGPD. The amount of the fine imposed in the 
present decision is significantly lower than the maximum amount foreseen (which could have reached 
a maximum of EUR 1154,371.65), as the Contentious Chamber took into account all the relevant 
criteria set out in Article 83.2 of the LCA. In addition, the Contentious Chamber assessed the 
concrete elements of each individual case in order to impose an appropriate sanction.
347. For violations of Articles 30.1.a) and 30.1.d), the Dispute Chamber shall decide, pursuant to
/It is not possible to impose a reprimand under Article 100, § 1, 5° of the LCA. Indeed, the violations 
found concern relatively minor elements, the violation of which does not in itself justify the imposition 
of a fine.
(...)
348. In view of the importance of transparency in the decision-making process of the Dispute 
Resolution Chamber, the present decision is published on the website of the Data Protection Authority 
in accordance with Article 95, §ler, 8° LCA, mentioning the identification data of the
the specificity of the present decision - which leads to the fact that even in case of omission of 
identification data, re-identification is inevitable - as well as the general interest of this decision.
7.
Article 100 LCA is drafted as follows:
"1. The Administrative Jurisdiction Division shall have the power to:
1° to close the complaint without further action;
2° to order the dismissal of the case;
3° pronounce the suspension of the sentence;
4° propose a transaction;
5° to formulate warnings and reprimands;
6° order to comply with the requests of the person concerned to exercise these rights;
rPAGE 01-□□□□3□26574-□□1□-□□34-□6-□1-;-i
1it!1:11!1
L !
!I-.
I
..J
Court of Appeal Brussels - 2022/AR/556 p. 11
7° order that the interested party be informed of the security problem;
8° to order the freezing, restriction or temporary or definitive prohibition of the 
processing; 9° to order the compliance of the processing;
10° to order the rectification, restriction or erasure of data and the notification of the recipients of 
the data;
11° to order the withdrawal of the approval of certification bodies; 12° 
to impose penalties;
13° to impose administrative fines;
14° order the suspension of transborder data flows to another state or international organisation;
15° transmit the file to the Brussels Public Prosecutor's Office, which informs it of the follow-up 
given to the file;
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection 
Authority.
§ (2) Where, after application of § 1, 15°, the public prosecutor waives the right to initiate criminal 
proceedings, to propose an amicable settlement or a criminal mediation within the meaning of Article 
216ter of the Code of Criminal Procedure, the public prosecutor may, in accordance with the provisions of 
the Code of Criminal Procedure, request that the matter be referred to a court.
In the event that the public prosecutor has not taken a decision within six months from the day of receipt of 
the file, the Data Protection Authority shall determine whether the administrative procedure should be 
resumed.
Article 108 of the LCA reads as follows:
<< Art. 108.
§ 1. The Administrative Jurisdiction Division shall inform the parties of its decision and of the possibility 
of appeal within thirty days from the date of notification to the Court of Contracts.
Except for the exceptions provided for by the law or unless the Administrative Jurisdiction Division 
decides otherwise in a specially reasoned decision, the decision shall be enforceable provisionally, 
notwithstanding an appeal.
The decision to erase data in accordance with Article 100, § 1, 10°, is not enforceable
by provision.
§ 2 An appeal may be lodged against the decisions of the Administrative Jurisdiction Division under 
Articles 71 and 90 before the Court of Justice, which shall deal with the appeal in accordance with Articles 
1035 to 1038, 1040 and 1041 of the Judicial Code.
IPAGE 01-00003026574-0011-0034-06-01-
Court of Appeal Brussels 
-2022/AR/556 p. 12
L ...J

Court of Appeal Brussels -2022/AR/556 p. 12
L _J
8.
The Decision also relies, inter alia, on the requirement of Articles 5.1.a, 5.1.b, 6.1.c), 6.3, 9.2.i), 12.1, 
13.1.c), 13.2.a), 13.2.d), 13.2.e), 30.1.a) and 30.1.d), 35.1 and 35.7 of the GDPR
9.
The applicant further alleges a failure to comply with the legal requirement to state reasons for the 
contested decision in accordance with the Law of 29 July 1991 on the formal motivation of 
administrative acts, as well as a violation by the DPA of the principles of proportionality, independence 
and impartiality.
IV. The subject of the appeal
10.
In its final pleadings, the applicant requests the Court of Justice to :
"As a principal,
• To declare that the complaints against the applicant are unfounded,
• Consequently, reformulate (and consequently annul) in all its provisions the decision 
pronouncing the above-mentioned sanctions,
• Remove the fine imposed in this regard,
• Order the respondent to pay the totality of the costs, including the procedural indemnity
In the alternative,
• Declare that t h e complaints against the applicant are partially unfounded,
• Consequently, reform (and consequently annul) in part the decision pronouncing 
the above-mentioned sanctions,
• Remove t h e fine imposed in this respect or reduce it to a fine of
amount respecting the principles of necessity and proportionality,
• Order the respondent to pay all the costs, including the procedural indemnity".
11.
The ODA asks the Court of Marche to :
"Declare the action inadmissible, in whole or in part, or at least unfounded, and order the applicant to 
pay all the costs, including procedural damages of €1,680 (basic amount).
I PAGE 01-00003026574-0012-0034-06-01-
Court of Appeal Brussels - 2022/AR/556 p. 13
L ..J
1
V. Means of the reguerante
12.
The applicant, at the end of its submissions, develops the following "pleas":
11.1. As to the admissibility of the present action
First Maven: The present action is perfectly admissible, in that it seeks, on the one hand, recognition of 
unfounded complaints and a manifest error of assessment and, on the other hand
, reformulation of the 
contested decision, which necessarily implies its annulment
Second maven: The respondent is confused in its argumentation because the appellant did not 
refer to the referral decision in its appeal but to the decision of the Contentious Chamber.
First limb: as regards the classification of the decision to deal with the case on the merits Second limb: 
as regards the time limit for appeal
Third limb: the decision to deal with the case on the merits is completely unreasoned and the 
Contentious Chamber did not respond to this lack of reasoning, despite the fact that it was raised by 
the
applicant.
11.2. As to the form of the procedure which allowed the adoption of the contested decision
Third plea: The lack of independence or impartiality of t h e respondent taints the decision with illegality
Fourth maven: The intimate party has committed a misuse of power
11.3 As to the merits of the contested decision
Fifth plea in law: The fine imposed on the applicant is not adequately reasoned or proportionate
First part: as regards the misuse of powers by the respondent Second part: as regards the 
amount of the fine and the grounds
Sixth maven: The applicant had a legal basis for the processing of personal data in its possession.
personal nature
Seventh plea. The applicant complied with the principle of transparency and its obligation to provide 
information
Means 8: / Data Protection Impact Assessment ("DPA")
Ninth maven: With regard to the publication of the contested decision
I PAGE 01-00003026574-0013-0034-06-01-
Court of Appeal Brussels 2022/AR/556 p. 14
L _J
VI. ODA resources
13.
In its final submissions, the DPA formulates the following pleas:
A. "Introductory disclaimer
1. The DPA notes that the applicant's application does not contain any pleas in law, so that it is 
not easy to determine the structure, in particular the legal structure, of its arguments criticising the 
contested decision.
2. It is only in her conclusions that she develops her argument, which is almost entirely new, 
under the force of means.
B. Concerning the subject-matter of the action - plea 1: insofar as the applicant does not seek the 
annulment of the contested decision, but (only) its reformation, the action is inadmissible
C. Concerning the alleged lack of formal reasoning for t h e opening of t h e investigation on the 
merits
Mayen 2: The "decision to deal with the case on the merits" is a purely preparatory act: it is 
not subject to appeal and is not subject to the formal reasoning requirements of an 
administrative act giving rise to a complaint
Mayen 3, in the alternative: The "decision to deal with the case on the merits" was properly 
reasoned
D. PLEA C O N C E R N I N G INDEPENDENCE AND IMPARTIALITY - PLEA 4: THE 
LACK OF IMPARTIALITY OR INDEPENDENCE OF THE CONTENTED CHAMBER IS NOT 
DEMONSTRATED
E. PLEAS IN LAW RELATING TO THE MISUSE OF POWER(S)
Mayen 5: The demonstration of a misuse of power supposes to prove that the authority acted 
with an illicit aim, in an exclusive way: this demonstration is not brought by the plaintiff
IPAGE □1-□□□□3□26574-0□14-0034-06-01-
Court of Appeal Brussels - 2022/AR/556 p. 15
L ..J
May 6: The Court has no jurisdiction to hear the direct appeal against a decision of the Court of 
Justice.
of the inspection service; in so far as it is directed against the inspection service, the 
applicant's criticism is unfounded; moreover, it is inoperative: it cannot lead to the illegality 
of the contested decision
First limb: The Court has no jurisdiction to hear the appeal against a decision of the 
inspection service
Second plea: the misuse of powers that the applicant alleges against the inspection service is 
unfounded
Third limb: The misuse of powers which the applicant alleges the inspection service to have 
misused is, in any event, without effect on the legality of the decision of the Contentious
Chamber
Mayen 7: The Contentious Chamber did not err in law, let alone misuse its powers, in imposing a 
fine on the applicant, rather than another penalty, or in fixing the amount of that fine
First limb: effective protection of the right to protection of personal data requires that the 
authority can impose "effective, proportionate and dissuasive" sanctions
Second limb: neither the GDPR nor the LCA provide that the fine would be subsidiary or that a 
fine could not be imposed on the first infringement committed
Third limb: the decision to impose a fine is the subject of a detailed statement of reasons in 
the contested decision
Fourth limb: The amount of the fine is adequately reasoned in the contested decision
IPAGE 01-00003□26574-0015-0034-06-01-
Court of Appeal Brussels - 2022/AR/556 p. 16
L _J
F. Mayen 8: The applicant has violated Article 5(1)(b) of the RGPD (purpose limitation principle)
G. WITH REGARD TO THE LACK OF A LEGAL BASIS FOR THE TREATMENT
Maven 9: There was no legal basis that could be validly invoked by the applicant for taking the 
temperature. The applicant has therefore violated Article 6, § 1 of the GDPR.
Mayen 10: The ODA did not challenge the legality of the ministerial orders and the Protocol 
on which the applicant relied
H. WITH REGARD TO THE PRINCIPLE OF TRANSPARENCY AND THE OBLIGATION TO PROVIDE 
INFORMATION
Maven 11: APO rightly found the applicant's privacy statement irrelevant
Maven 12: The applicant has violated Article 5(1)(a) of the RGPD (obligation to provide 
information on the processing on the basis of thermal cameras)
Maven 13: The applicant has violated Articles 5(1)(a) (principle of transparency) and 12 and 
13 of the GDPR
I. WITH REGARD TO THE OBLIGATION TO CARRY OUT A DATA PROTECTION IMPACT 
ASS E S S M E N T ("DPI")
May 14: The applicant was required to conduct an A/PD
Maven 15: The DPIA should be conducted prior to the implementation of the treatment
Mayen 16: The PIA conducted by the applicant does not comply with the legal requirements
J. REASON17: THEAPPLICANT HAS INFRINGED ARTICLE 30(1)(A) AND 30(1)(D) OF THE RGPD 
(DUTY TO KEEP A RECORD OF PROCESSING ACTIVITIES)
rPAGE 01-00003026574-0016-0034-06-01-
Court of Appeal Brussels - 2022/AR/556 p. 
17
L ..J
K. PLEA 18: THE APD WAS ENTITLED TO DECIDE TO PUBLISH THE CONTESTED DECISION IN FULL
VII. Admissibility of the appeal
14. APD's pleas in defence to the effect that the action is wholly or at least partially 
inadmissible (first, second, fourth and sixth (first limb) of the APD's pleas)
14.1. These of the ODA
According to the APD, in its first plea, "since the applicant did not seek the annulment of the 
contested decision, but only its reformation, the action is inadmissible. The fact that, in her 
submissions, the Applicant develops a new argument (and modifies the operative part of her 
application), in a belated attempt to render her application (retroactively) admissible, is not 
convincing. The criticisms made by the applicant are indicative of her wish to obtain, simply, a fresh 
examination of the arguments she had already formulated before the Contentious Chamber - as if it 
were a second instance of jurisdiction. This is the situation described in the above-mentioned 
judgment.
In particular, the APD argues in this regard that an appeal to the Procurement Court is not "an 
appeal, whereby the Court, substituting itself for the administrative authority, would re-examine the 
file in order to take a decision that it deems appropriate, regardless of what the APO - in this case, 
the Contentious Chamber - had decided beforehand. The reading of the Applicant's submissions is 
symptomatic of the fact that the latter clearly confuses the appeal with an appeal, and it ceases to 
refer in its submissions to its "appeal petition "2 , its "appeal "3 , the "intimate" part4 and which 
requests "the reformation of the judgment".
In its second and fourth pleas, the ODA further submits that the applicant's appeal, in so far as it 
concerns the decision of the OPA to deal with the case on the merits, is inadmissible, and that, even if 
that decision were appealable, it is in any event manifestly out of time, and that in any event the 
decision was adequately reasoned.
In the first part of its sixth plea, the DPA finally submits that the Court has no jurisdiction to hear the 
appeal against a decision of the inspection service; in so far as it relates to such a decision, the 
appeal is, in its view, inadmissible. In so doing, the APD targets the applicant's argument that the 
APD's inspection s e r v i c e misused its powers by deciding to question the content of a regulation 
issued by the executive during a health crisis.
For example, BSCA conclusions, § 9. BSCA 
conclusions, § 11.
For example, BSCA conclusions, operative part and§§7 and 11.
I PAGE 01-00□□3026574-0□17-□□34-□6-□1-;i
Court of Appeal Brussels - 2022/AR/556 p. 18
L _J
14.2. These of the applicant
The Appellant submits that "The reformation sought in the appeal implies, ipso facto, the annulment 
of the contested decision. The Respondent cannot draw any legal or factual arguments from the 
semantics used by the Applicant in its appeal.
The applicant requests that the decision be re-examined because, in its view, the APO's objections 
are unfounded or even illegal or based on a manifest error of assessment. To this extent, the Court of 
First Instance may, inter alia, annul the contested decision of the APO:
- Where such a decision is irregular or unlawful, or
- Where it finds that the decision is based on a manifest error of assessment, it may also 
"(...) substitute its decision for the annulled decision (. . .)".
With regard to the decision of the inspection service and the decision to investigate the file on the 
merits, which, according to the APD, are also the subject of its appeal and which, therefore, fall 
outside t h e jurisdiction of the Court of First Instance, the applicant submits in substance that the 
subject-matter of its appeal is the contested decision of 4 April 2022, to which it complains, inter alia, 
that it did not adequately respond to the objections which it had raised concerning the preparatory 
decisions taken at the earlier stages of the procedure.
14.3. Decision of the Court
14.3.1.
While in some legislation conferring jurisdiction on the Court of Justice, it is explicitly stated that 
the Court will rule in full jurisdiction, this possibility is not explicitly mentioned in data protection 
matters. Article 108 § 1 ADA only provides that an appeal against the decisions of the 
Administrative Jurisdiction Division may be lodged with the Court of Justice.
An appeal to the Court of Justice differs from an "ordinary" appeal such as that which can be lodged 
with a judge of appeal in the judiciary. Article 6(1) of the ECHR provides that "Every
everyone is entitled to a fair and public hearing within a reasonable time
The Court shall decide either on disputes concerning his civil rights and obligations (...) or on disputes 
concerning his civil rights and obligations (...)".
As regards the right to an effective remedy and a fair trial, Article 47 of the Charter of Fundamental 
Rights of the European Union provides that "everyone whose rights and freedoms
IPAGE 01-00003026574-0018-0034-06-01-
Court of Appeal Brussels - 2022/AR/556 p. 
19
L ..J
Everyone has the right to an effective remedy before a court in accordance with the conditions laid 
down in this Article. Everyone has the right to have his case heard
(b) The right to a fair and public hearing by an independent and impartial tribunal, established in 
advance by the Court. [...]
The European legislator has not specified what is meant by "an effective remedy before an 
impartial and independent tribunal".
Article 78 of the GDPR provides for quanta lui (the Court highlights):
"Any natural or legal person has the right to an effective judicial remedy against a 
legally binding decision of a supervisory authority which affects him.
Without prejudice to any other administrative or extrajudicial remedy, any person 
concerned shall have the right to effective judicial redress where the supervisory 
authority which is competent under Articles 55 and 56 fails to deal with a complaint or to 
inform the person concerned within three months of the status o r outcome of his or her 
complaint under
/Article 77.
Any action against a supervisory authority shall be brought before the courts of the 
Member State in whose territory t h e supervisory authority is established.
In order for this remedy to be effective and efficient, the Market Court may - in the form of full 
jurisdiction granted by the legislator - not only annul the decisions of the DPA, but it may also 
substitute its own decision for the annulled decision (provided that the DPA had to take a 
decision and insofar as such a substitution can be made without violating any procedural rules).
However, in the exercise of this full jurisdiction, the Court of Justice must respect the limits of 
judicial debate. Within the limits of the rules of public policy and within the limits of the 
interpretation to be given to the grounds invoked before the Court, the latter must limit its 
appreciation, i.e. it must limit the possible substitution of its own decision to the grounds 
invoked by the applicant and to the defence of the other party.
In short, the Court of Contracts may substitute its decision for the challenged decision annulled 
by the Court, provided that the Court does not raise a dispute which was not the subject of an 
adversarial debate in the proceedings before it and insofar as no decision is taken with regard to 
the parties to the proceedings and which they could not have defended in the proceedings before 
it.
Consequently, the Court of First Instance has jurisdiction to annul the Impugned Decision or, if 
necessary, to reform it, by mitigating or replacing the sanction by another one.
IPAGE □1-□0□□3□26574-0019-0034-□6-□1-
Court of Appeal Brussels - 2022/AR/556 p. 20
14.3.2.
The applicant's complaints concerning the decisions of the inspection service and the decision to deal 
with the case on the merits are directed against the contested decision, which the applicant complains
did not provide an adequately reasoned reply to the arguments it put forward.
The Court of First Instance had submitted to the Contentious Chamber, in particular concerning 
decisions taken at earlier stages of the procedure.
The purpose of the application before the Court of First Instance, as set out in the operative part of the 
applicant's final submissions, is not to annul a decision of the inspection service,
It is not the decision to deal with the case on the merits, but the reformation of the decision taken by 
the APO on 4 April 2022, imposing sanctions on him, which is the only Decision challenged.
14.3.3.
Insofar as the applicant seeks to have the contested Decision amended, its appeal is admissible. The 
contested Decision was taken by the APO on 4 April 2022. The application was lodged at the Registry 
of the
court within the 30-day period referred to in article 108 § 1 of the law of 3 December 2017 on the creation of 
the
of the Data Protection Authority.
VIII. Discussion - Decision of the Court of Marches
Preliminary remarks:
a body temperature is health data if it can be related to a specific person. Health data is 
data that can be linked to a specific person.
personal data. It is generally prohibited to process specific personal data, unless an 
exception to the Law applies. Health care providers are allowed to process patients' 
health data if this is necessary for their
They may then take temperatures. But this is a different situation from taking 
temperatures of visitors as an access control measure, outside a treatment relationship. 
The present dispute concerns this context.
factual. There is no doubt that temperature monitoring involves the processing of personal 
data.
The applicant, at the end of its final submissions, does not put forward any plea to
With regard to the second indent of the contested Decision, from which it appears that the 
Contentious Chamber decided, "pursuant to Article 100, §1, 5° of the LCA, to impose a 
reprimand for violations of Articles 30.1.a) and 30.1.d) of the RGPD".
IPAGE 01-00003026574-0020-0034-06-01-
L ..J
Court of Appeal Brussels - 2022/AR/556 p. 21
L ..J

Court of Appeal Brussels - 2022/AR/556 p. 21
L _J
16. As for the third plea of the reguerant: The lack of independence or impartiality of the respondent 
vitiates the decision of illegality
16.1. These of the applicant
The applicant argues that "as an administrative authority, the Data Protection Authority as a whole must 
be independent and impartial. This is a general principle of law which has been established in the case law 
of the Conseil d'Etat for many years! ". It also states that "for some time now, the various reports in the 
national press have shown a major problem of independence within t h e Data Protection Authority3
- this 
problem has been raised and creates an appearance of partiality which is sufficient to call into question the 
decisions taken by an administrative authority".
The applicant concludes that "there are grounds for considering that the principle of independence 
and impartiality has been violated, and that this violation requires that a decision to dismiss the case 
or to discontinue it should be ordered in the context of the present proceedings".
16.2. These of the ODA
The DPA concludes that the applicant, who bears the burden of proof, does not show how the criticisms 
it relays could have concretely affected the impartiality (or independence) of th e C ommis s ion.
of the relevant collegiate body, the Dispute Chamber.
16.3. Decision of the Court
The alleged partiality of a collegiate body must be demonstrated in practice, which implies that specific 
facts or behaviour concerning that body5
, carried out by its members (and likely to affect the impartiality 
of the body as a whole), must be brought to light.
It is not the Contentious Division that is the subject of the criticisms made by the applicant. Contrary 
to what the latter argues in its conclusions, the criticisms concern
primarily the legality of the appointment of certain external members of the Knowledge Centre and not 
the independence of the Steering Committee6
- Yet, as the ODA rightly points out, these members 
are not involved at any point in the ODA's litigation chain (whether for
(e.g. this case, or all cases dealt with by the Litigation Chamber).
See in particular C.E., 19 January 2022, 2S2.684.
This is emphasised by the applicant itself (BSCA's conclusions, § 18).
IPAGE 01-000□3□26574-□□21-0034-06-01-
Court of Appeal Brussels - 2022/AR/556 p. 
22
L _J
The legal provisions relating to the independence and functioning of the Data Protection Authority 
are referred to in Chapter 4 of the DPA (Articles 43 to 51), which defines the powers and duties of 
the Authority.
obligations of the House of Representatives in this respect. In particular, it is the Chamber that 
appoints the members of the DPA Dispute Chamber under Article 39 of the LCA, and it is the Chamber 
that
who must control the incompatibilities defined in article 44 § 1 LCA, also according to the third 
paragraph of article 44 § 1 LCA.
It also has the power to revoke them in the event of a breach of the law (Article 45 of the LCA). It also 
has the power to revoke them in the event of a breach (Article 45 LCA).
The Court of Justice does not have jurisdiction in this matter.
In any event, the Court observes that no specific complaint has been raised, let alone demonstrated in 
concreto, by the applicant as to the alleged lack of impartiality of the Contentious Chamber in the 
present case, which could be said to affect the legality of the contested Decision.
Finally, it is undeniable that the Contentious Chamber has sat collectively in this case, so that
that any irregularity in the appointment or even bias on the part of one of its members, if shown, 
could not in itself have affected the legality of the Decision
attacked.
The applicant's plea is unfounded.
17. As to the applicant's fourth plea: the ODA misused its powers
17.1. These of the applicant
The applicant submits that "the context and the manner in which the respondent managed this case 
undoubtedly demonstrate a misuse of powers on her part, particularly in view of the following 
elements:
- From the start of the processing operation by the applicant, the respondent made it known 
in the press that, in its view, such a processing operation (temperature control) did not have a 
sufficient basis, without, however, issuing an opinion or even a recommendation, which are, however, 
the means of doing so
/s right to do so. Indeed, it was perfectly possible for the respondent to give an own-initiative opinion 
on the treatment envisaged in the context of the fight against COVID 19. However, the intimate 
refrained from issuing any opinion or even a recommendation on the treatment envisaged and carried 
out by the applicant. However, it is clear that the applicant would have followed the intimates' 
instructions if the intimates had taken a clear position in accordance with the legal means at their 
disposal (and not through press articles), as was the case with their good cooperation with the 
inspection services;
- Although the applicant had expressly requested the anonymisation of the decision in its 
submissions, the respondent proceeded to publish the decision without legally justifying its decision or 
even responding to the applicant's arguments, thereby rendering the decision obscure. The respondent 
also considered it useful to communicate its decision by means of a press release, which was 
absolutely not within its prerogatives and constituted a misuse of power; (...)".
Court of Appeal Brussels - 2022/AR/556 p. 23
L _J
rPAGE □1-□□□□3026574-0022-0□34-□6-□1-

Court of Appeal Brussels - 2022/AR/556 p. 23
L _J
According to the applicant: "Such action by the respondent is more akin to a kind of revenge against 
the Belgian authorities, which did not consult the respondent and which the applicant had to endure, 
all with a view to asserting its role and criticising the provisions adopted.
Such a questioning of the content of a norm, which serves as a basis for the criticized decision, 
amounts to a misuse of powers by the respondent, mainly in order to achieve an unlawful aim, which 
constitutes a misuse of power.
17.2. These of the ODA
The ODA responds to the Applicant's plea of misuse of powers by means of three pleas in defence. 
Its argument can be summarised as follows:
The applicant's case does not seem clear,
The demonstration of a misuse of powers presupposes proof that the authority 
acted with an unlawful purpose, exclusively; this demonstration is not provided 
by the applicant,
The misuse of powers which the applicant alleges the inspectorate to have 
m i s u s e d is unfounded and, in any event, has no bearing on the
legality of the decision of the Contentious Chamber,
The Contentious Chamber did not err in law, let alone misuse its powers, in 
imposing a fine on the applicant,
than another sanction, nor in setting the amount of this fine.
17.3. Decision of the 
Court 17.3.1.
The applicant's fourth plea seems to be interpreted as inferring a misuse of powers
of power committed by the Contentious Chamber, through the contested Decision, which consisted in 
particular in denying the legal basis of the contested data processing without adequate or relevant 
motivation, but at the end of a behaviour of political expediency consisting in wanting to take 
"revenge" (sic) against "the authorities" (resic), not otherwise defined,
who would not have consulted it.
This misuse of powers is also apparent, according to the applicant, from the choice to publish the 
contested Decision in a non-anonymous manner.
IPAGE 01-00003026574-0023-0034-06-01-
Court of Appeal Brussels - 2022/AR/556 p. 
24
L
17.3.2.
The Court recalls that the plea can be defined in judicial law as the statement of a
"(C. Parmentier, Comprendre la technique de cassation, Brussels, Larder, 2011, p. 85, n° 91, taken up 
by X. Taton and G. Eloy, "Structure et contenu des conclusions, chose jugee et mesures d'instruction : 
nouvelles responsabilites des parties", in J. Englebert and X. Taton (dir.), Le proces civil efficace ? 
Premiere analyse de la Joi du 19 octobre 2015 modifiant le droit de la procedure civile (dire
"Joi pot-pourri"), Bibliotheque de unite de droit judiciaire de l'ULB, Anthemis, 2015, p. 88, n° 12).
In addition, the pleas may relate to facts with legal consequences (pleas of fact), including purely 
factual disputes (for example, did this fact with legal consequences occur or not?), or to the law 
applicable to the given facts or to the legal consequences arising from that law (pleas of law).
In t h e event that a party's submissions do not fully meet this objective, the court is not obliged to 
take into account - within the framework of its obligation to state reasons, article 780, 3° of the Judicial 
Code, article 149 of the Constitution and article 6 of the ECHR - the pleas not explicitly stated.
17.3.3.
The Procurement Court recalls that it has jurisdiction, by virtue of article 108 of the LCA, only to rule 
on appeals against decisions of the Dispute Division of the DPA. It has no jurisdiction over the 
appropriateness or advisability of the DPA issuing a press release.
Furthermore, misuse of power is defined as the form of illegality which consists in the fact that an 
administrative authority, acting apparently in a completely regular manner, both in terms of the 
reasons and the wording of the decision, voluntarily uses its powers in order to achieve 
exclusively or principally an illicit aim, i.e. other than that of the general interest in view of which 
these powers have been conferred"
7
-
The Court observes that the fourth plea, as put forward by the applicant, appears obscure: it does 
not allege specific facts, but rather vague conduct, "a desire for revenge on the part of the 
authorities", unsupported by objective elements.
The Court will not examine further this "branch" of the applicant's plea, which appears to be obscure.
C.E., 3 March 2016, 234.011, Duperoux.
rPAGE □1-□□□□3026574-0024-□□34-□6-□1-
Court of Appeal Brussels - 2022/AR/556 p. 25
L _J
17.3.4.
With regard to the non-anonymous publication of the decision by the DPA, the Court stresses that the 
DPA can generally be expected to be cautious in its public statements about the decisions taken until 
the expiry of the time limit for appeal or, where appropriate, until the end of the appeal procedure.
This is particularly true when the parties are identified in the decision and press articles in question, 
whereas in most cases DPA decisions are anonymised and do not identify the parties (who are not 
legal persons).
The Court of Justice considers that if APO wishes to draw attention to certain decisions without 
waiting for the possible appeal procedure in order to inform the persons concerned, it should show the 
same transparency when the Court of Justice subsequently annuls or reforms these decisions.
In the contested Decision, the Contentious Chamber relies on three grounds to publish it in its entirety 
before the expiry of the time limit for appeal:
- The importance of transparency;
- the specificity of the decision ;
- the public interest of the decision.
In this respect, the DPA has some discretionary power (the LCA simply states that the Litigation 
Chamber decides on a case-by-case basis whether to publish its decisions on the website) and the 
decision to publish was well reasoned.
This part of the plea is unfounded.
17.3.5.
The applicant's fourth plea is unfounded.
I PAGE 01-0□□□3026574-0025-□034-□6-□1-;i
Court of Appeal Brussels -2022/AR/556 p. 
26
L ..J
18. As to the Reguerante's pleas 5, 6, 7 and 8 to contest the fine
By these three pleas, the applicant challenges the fine imposed on it by the Contentious Chamber 
for infringement of Articles 5(1)(a), 5(1)(b), 6(1)(c), 6(3), 9(2)(i), 12(1), 13(1)(c), 13(2)(a), 13(2)(d), 
13(2)(e), 35(1) and 35(7) of the RGPD.
These means, listed below, must be analysed together.
The reguerant's fifth plea: The fine imposed on the reguerant is not adequately motivated or 
proportionate
Sixth plea in law of the reguerant : The applicant had a legal basis justifying the processing of 
personal data
Seventh plea of the reguerant : The reguerant has respected the principle of transparency and its 
obligation to provide information
Eighth plea in law: The data protection impact assessment ("DPIA")
18.1. These of the applicant 
18.1.1.
The applicant puts forward its fifth plea in law in two parts, which can be summarised as follows:
The contested Decision reveals a misuse of powers on the part of the Contentious Chamber in 
that it applied a fine without having notified the
The Commission considers that the processing operation concerned by this procedure ended 
on 15 October 2020 for arrival controls and on 21 March 2021 for departure controls,
With regard to the motivation of the fine and the amount, there is no doubt that the DPA has not 
applied the criteria as described in Article 83 of the GDPR and that the DPA has not taken into 
account the Guidelines of the European Data Protection Board (hereinafter "EDPB") which 
analyse the application of Article 83 of the GDPR in order to impose a fine and determine its 
amount.
I PAGE □1-□0003026574-0026-0034-06-01-
Court of Appeal Brussels - 2022/AR/556 p. 27
L _J
The applicant further submits that the Contentious Chamber should therefore, in its decision to impose 
a fine of €100,000, have taken account of these various factors, as well as the following elements
- The unintentional nature of the offence found,
- The absence of previous offences on his part,
- Exceptional circumstances related to the pandemic situation,
- the fact that the amount of the fine as imposed in this case is clearly overvalued in relation to the 
criteria of the GDPR and the EDPB Guidelines.
18.1.2.
In its sixth plea, the applicant considers that the following legal bases justify the processing of the 
personal data at issue, namely in the orders
The following ministries:
Ministerial Order of 5 June 2020 amending the Ministerial Order of 23 March 2020 on 
emergency measures to limit the spread of the COVID-19 coronavirus (in force from 8 June 
2020 to 30 June 2020);
Ministerial Order of 30 June 2020 (in force from 1 July 2020 to 18 October 2020);
Ministerial Order of 18 October 2020 on emergency measures to limit the spread of the 
COVID-19 coronavirus (in force from 19 October 2020 to 28 October 2020);
Ministerial Order of 28 October 2020 on emergency measures to limit the spread of 
the COVID-19 coronavirus (in force since 29 October 2020).
These various ministerial orders refer to a Protocol which is binding on the applicant. This Protocol 
"concerns the commercial transport of passengers within the framework of COVID-19", issued by the
This protocol is entitled "Commercial Passenger Aviation". This Protocol specifies the sanitary measures 
that must be implemented in airports and, according to the applicant, specifically states that "in the context 
of COVID-19 and the resumption of activities /fries at
/In addition to the general health measures (wearing of masks, social distancing, etc.), the 
temperature check of passengers is foreseen as a specific health measure applicable to airports". In 
addition to the general health measures (wearing of masks, social distancing, etc.), the temperature 
check of passengers is foreseen as a specific health measure applicable to airports.
I PAGE 01-□0003026574-0027-0034-06-□1-
Court of Appeal Brussels -2022/AR/556 p. 
28
L ..J
18.1.3.
In its seventh plea, the applicant maintains that it used all the means at its disposal to comply with 
the principle of transparency and its obligation to provide information
imposed under the RGPO. In essence, the applicant considers that it has done its best - by using
example of pictograms and posters to facilitate the understanding of the persons concerned
- with regard to its crisis capabilities and recognises, however, that some information
The Commission has taken the view that the information should have been included in the documents 
or channels intended to inform the persons concerned and has undertaken to remedy this as quickly 
as possible, and that these failings justify a possible reprimand, not a fine of such a high amount.
as described above.
18.1.4.
In its eighth plea, the applicant contests that an AIPO should have been established, while conceding 
that it should have done so not after the processing operation had been carried out but 
before. It explained that it had to deal with a situation
The applicant submits that the situation is exceptional, combining the disastrous consequences of the 
COVI0-19 and its economic situation. According to the applicant, this situation must be regarded as a 
cause of force majeure, since the infringement must not be regarded as significant and in no way 
justifies a fine of such magnitude.
18.2. These of the 
APO 18.2.1.
APO recalls at the end of its conclusions that under Articles 83 and 84 of the GDPR, sanctions (fines 
or other) imposed by the data protection authority must be "effective, proportionate and dissuasive".
According to the APO, the imposition of a fine is not subsidiary. Although the Contentious Chamber 
must give reasons for its choice of penalty, in the case of a fine it must not systematically explain, one 
by one, why each of the other potential measures has not been chosen. On the contrary, the 
contested decision explains that, under the RGPO, infringements (other than minor infringements) 
must be sanctioned8
-
See also the Article 29 Guidelines in this regard, which state that "The point is not to qualify the fines as last resort, nor to shy away 
from issuing fines, but on the other hand not to use them in such a way which wauld devalue their effectiveness as a toa/" (free 
translation: "ii ne s'agit de ne considerer les amendes comme de dernier recours, ou de dissuader d'imposer des amendes, mais 
d'autre part de ne les utiliser d'une maniere qui devalue l'efficacité de cet outil"); see
h t t p s : / / ec.europa.eu/newsroorn/ article29/items/611237.
rPAGE 01-00003026574-0028-0034-06-01-
Court of Appeal Brussels - 2022/AR/556 p. 29
L _J
According to the DPA, the Contentious Chamber gave valid reasons for its decision to impose a fine 
on the
The DPA states that a form was sent to the applicant and that it was given the opportunity to 
comment. The DPA states that a form was sent to the applicant and that it was given the opportunity 
to comment9
-
These remarks are summarised in the contested decision itself10
. The contested decision then meets 
these remarks11 and explains the way in which the amount of the fine was calculated12
-
18.2.2.
According to the DPA, with regard to the legal basis of the treatment, assuming that the Commercial 
Aviation Protocol adopted by the Federal Public Service Mobility and Transport has a binding value
(quad non), the measures it provides for are in any event not included in the orders referring to that 
Protocol. Indeed, none of the ministerial orders cited by the applicant provides for
expressly the taking of temperature of passengers transiting through the airport.
Furthermore, the DPA recalls that, in order to validly invoke the basis of lawfulness of Article 6, §1, c) 
and
The exception provided for in Article 9(2)(i) of the RGPD, the controller must be able to
demonstrate the following elements:
In the case of the "important public interest in the field of public health" (Article 9.2.i);
that there is a legal provision which can be validly invoked by the controller in 
accordance with Articles 6.1.c, 6.3 and 9.2.i) of the GDPR.
That the treatments concerned are necessary for:
o To comply with the legal obligation invoked in accordance with Article 6.1.c and
o Public interest r e a s o n s in the field of public health according to 
article 9.2.i "
13
-
According to the DPA, with regard to the second element, i.e. the existence of a legal provision that 
can be validly invoked, t h e DPA considers that "neither the decree on the creation and operation of 
the
/Neither the ministerial order nor the law on civil security (...) regulate the legitimate treatment as 
such. This treatment is provided for in the Protocol of
14/And the DPA adds, with regard to this Protocol, that it "does not provide a valid legal basis for 
the processing within the meaning of Article 6.1 GDPR"
15
.
§ 337.
10 § 337.
11 §§ 337-341.
12 §§ 342-346.
13 Decision challenged, §83.
14 Decision challenged, §89.
15 Decision challenged, §98.
r PAGE 01-□□□□3026574-□□29-□□34-□6-□1-;i [!ll[!l
[!l ..-i.
s
Court of Appeal Brussels - 2022/AR/556 p. 
30
L _J
The DPA notes that the Commercial Aviation Protocol, adopted by the FPS Mobility and Transport, 
does not impose any obligation to check the temperature of passengers.
The DPA concludes that the Protocol does not meet the requirements of Article 6(3) of the GDPR, in 
particular because:
the purposes of the processing are not mentioned in a sufficiently clear and precise 
manner;
the modalities of the treatment are not defined;
the requirement of predictability is not met.
18.2.3.
With regard to the failure to comply with the obligation to conduct a PIA, the DPA submits that the 
applicant was legally obliged to carry out a PIA prior to the implementation of the processing 
operation and that the PIA was carried out by the
The applicant does not meet the legal requirements, his explanations in this respect being 
inconsistent, which
implies a violation of Article 35 § 7 of the GDPR.
18.2.4.
Finally, as regards compliance with the transparency principle, the DPA submits that the applicant 
does not dispute the DPA's statements concerning the general obligation of transparency under Article 
5(1)(a) of the RGPD, nor does it dispute the DPA's position that it cannot be inferred from the presence 
of certain information in the media or from the publication of certain information in the media that the 
applicant is not a party to the RGPD.
The applicant is therefore exempt from the obligation to provide the information referred to in 
paragraph 1.
Article 13 of the RGPD.
Court of Appeal Brussels - 2022/AR/556 p. 31
L _J
rPAGE 01-00003026574-0030-0034-06-01-

Court of Appeal Brussels - 2022/AR/556 p. 31
18.3. Decision of the Court
18.3.1.
The conduct of the APO complained of by the applicant consists in fact in the inadequate or incorrect 
statement of reasons for the contested decision in that it is based on a lack of legal basis for 
penalising the contested treatment and on the failure to take account of a series of attenuating 
circumstances or relevant criteria enabling the penalty imposed to be justified.
18.3.2.
The applicant does not show that, in penalising it, the Contentious Chamber is pursuing an objective -
which is not authorised - other than the public interest objective which it is required to pursue under 
the RGPD and the LCA, namely the application of the fundamental right to the protection of 
personal data.
personal nature. A fortiori, the applicant does not show that this unauthorised purpose is the exclusive 
or even predominant purpose of the contested Decision.
No misuse of powers is shown by the applicant as regards the justification for the contested fine.
18.3.3.
With regard to the lack of a legal basis for the disputed treatment, APO is right to argue that the 
Commercial Aviation Protocol, adopted by the Federal Public Service for Mobility and Transport, does 
not impose any legal obligation on the parties.
no obligation to check the temperature of passengers. The Protocol only confirms that the choice to 
carry out temperature checks is a choice of the applicant ("The airport of
Charleroi (Brussels South Charleroi Airport), on request of airlines operating there, has however 
taken the decision to implement temperature testing of people entering the terminal. The airport 
guarantees that the chosen method will not cause any delay or concentration
of people at the entrance to its facilities"
16 ).
Furthermore, the Protocol states that these controls were put in place at a time when the European 
Centre for Disease Prevention and Control (ECDC) and the European Aviation Safety Authority 
(EASA) were not recommending temperature controls at airports due to the lack of scientific 
justification for this measure17
-
In its submissions, the Applicant submits that the Protocol, in the version applicable at the material 
time, states as follows: "In addition to the general health measures (wearing of masks, social distancing, 
etc.), the temperature check of passengers is provided for as a specific health measure applicable to 
airports".
16 Piece 9, p. 5.
17 Piece 9, p. 5.
rPAGE 01-□□□□3026574-□031-0034-□6-□1-;i
L ..J
Court of Appeal Brussels - 2022/AR/556 p. 32
L _J
The Protocol is, however, reproduced in Exhibit 9 of the OAP and does not contain this sentence. This 
sentence is also absent from the document to which the link in the Applicant's submission18 refers - the 
Court cannot verify the relevance of this argument.
The fact that the Royal Decrees cited by the applicant enter or refer to the content of the Protocol 
d o e s not imply that there is a legal basis for the treatment at issue in view of the
the uncertain nature of the terms contained therein. It is therefore unlawful for the Contentious 
Chamber to
notes the absence of this legal basis.
18.3.4.
It is also clear from the facts of the case, and the applicant does not dispute this, that it is a
The APO has rightly identified breaches of the principle of transparency and of its own
information obligations. The applicant's plea that it did not infringe Article 5,
§1, a}, 12 and 13 of the RGPD (principle of transparency and information obligation) must 
therefore be rejected.
18.3.5.
As regards the grounds and proportionality of the fine, the Decision expressly mentions in detail, in 
points 332, 333 and 335, the reasons for which it intends to resort to it.
The contested decision also details certain attenuating circumstances which it adopted in order to 
determine the amount of the fine, in particular the fact that the applicant had no previous record and 
had not derived any benefit from the offences found.
However, the Court of First Instance considers that the statement of reasons for the contested 
decision does not take into account, or at least does not sufficiently take into account, the following 
attenuating circumstances within the meaning of
Article 83 of the RGPD to assess the need for an administrative fine:
- the deliberate or negligent nature of the infringement in exceptional circumstances rarely observed, 
in particular the fact that the applicant introduced the temperature check in good faith, having 
announced it to the competent authorities, in order to protect the public health not only of the 
passengers but also of any person with whom they subsequently had contact. Temperature monitoring 
was in no way introduced for commercial reasons;
- the extent to which the applicant cooperated with the supervisory authority to remedy the 
infringement and mitigate its possible negative consequences, including the fact that the applicant 
cooperated during the procedure with the APO;
18 BSCA Conclusions, § 31 (p. 26). The Respondent points out that this document indicates that it only 
concerns the period "from 7 March 2022 until further notice".
IPAGE 01-□□□□3026574-□□32-□□34-□6-□1-;i
Court of Appeal Brussels - 2022/AR/556 p. 33
- any other aggravating or attenuating circumstances applicable to the circumstances of the case, 
such as the financial gains made or losses avoided, which may or may not have resulted directly from 
the infringement; in the present case, while it was found that the applicant had not benefited from the 
temperature controls, no account was taken of the costs incurred by it as a result of those controls, 
moreover during a period of extreme economic disadvantage for the airports, precisely because of the 
high level of traffic.In the present case, while it was found that the applicant had not benefited from the 
temperature controls, no account was taken of the costs incurred by it as a result of those controls, 
and moreover during a period which was extremely unfavourable in economic terms for the airports, 
precisely because of the exceptional health situation with which it had to contend,
- the purpose of the processing, in particular the fact t h a t the applicant introduced temperature 
control solely to protect public health.
In the light of the foregoing, arising from the exceptional context of the pandemic situation which the 
company as a whole had to face, the contested Decision must therefore be reformed in that the Court
of First Instance, exercising its full jurisdiction, reduced the fine imposed on the Applicant to the 
amount of EUR 25,000.00
19. As to the applicant's ninth plea: As regards the publication of the contested decision
The Court has already answered this plea above in the context of the examination of the 4th plea of the
applicant. It is unfounded.
IX. Depens
20.
In accordance with article 1017, paragraph 1, of the Judicial Code, the ODA, which is the most 
unsuccessful party, is ordered to pay costs, liquidated at 1,800.00 euros (procedural indemnity - case 
not assessable in money).
IPAGE 01-00003026574-0033-0034-06-01-
L _J
Court of Appeal Brussels - 2022/AR/556 p. 
34
L _J
ON THESE GROUNDS, THE 
COURT,
Having regard to the provisions of the law of 15 June 1935 on the use of languages in 
judicial matters
Declares the action admissible and partially founded to the following extent:
Partially annuls the contested decision number 47/2022 of the Contentious Chamber
of the Data Protection Authority of 4 April 2022 in case number DOS-2020- 04002, only insofar as it 
imposes an administrative fine in the amount of
100,000.00 to SA BRUSSELS SOUTH CHARLEROI AIRPORT (BSCA) (as well as the motivation under
and;
The Court of Justice reduces the administrative fine imposed on SA BRUSSELS SOUTH CHARLEROI 
AIRPORT (BSCA) to the amount of 25,000.00 euros.
Orders APD to pay the costs, including the procedural indemnity of 1,800.00 euros.
Condemns the DPA to pay the right to be heard before the Court of Appeal (400.00 €) to the FPS 
FINANCE, in accordance with Article 2692
§ 1, of the Code of Registration, Mortgage and other Fees
and grafting.
Thus judged and pronounced at the public civil hearing of the 19th chamber A of the Court of Appeal of 
Brussels, Market Court section, on 7 December 2022.
Where were present :
- Mr. F. FOGLI, Councillor ff. president,
- Mrs. A.-M. WITTERS, Councillor
- MR 0. DUGARDYN, Councillor
Registrar
I PAGE 01-00003026574-□034-0□34-□6-□1-
JOURDAN
Retrieved from "https://gdprhub.eu/index.php?title=Court_of_Appeal_of_Brussels_-_2022/AR/556&oldid=38668"
Creative Commons Attribution-NonCommercial-ShareAlike
Powered by MediaWiki