APD/GBA (Belgium) - 39/2020

APD/GBA - 39/2020
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 5(1)(f) GDPR Article 12 GDPR Article 14 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	28.07.2020
Published:	28.07.2020
Fine:	3000 EUR
Parties:	n/a
National Case Number/Name:	39/2020
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Dutch French
Original Source:	Belgian DPA (in NL) Belgian DPA (in FR)
Initial Contributor:	n/a

The Belgian DPA imposed a fine of 3000 euros on a local political association that has sent out election advertisements to the residents of the municipality for the local elections without legal basis and without providing information to the individuals.

English Summary

Facts

A local political association has sent out election advertisements to the residents of the municipality for the local elections in 2018. For this purpose, the association used the electoral roll from 2012 and compared it with that of 2018.

Holding

The litigation chamber of the BE DPA concluded that the processing took place without legal basis (Article 6.1.f not applicable), without privacy policy and without information to the individuals whose data were collected indirectly.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

1/23
Dispute room
Decision on the substance 39/2020 of 28 July 2020
File number : DOS-2018-05780
Subject: Complaint about the processing of voters' personal data during the vote
municipal elections
The Litigation Chamber of the Data Protection Authority, composed of Mr Hielke
Hijmans, Chairman, and Mr Jelle Stassijns and Mr Frank De Smet, Members;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of individuals with regard to the processing of
personal data and on the free movement of such data and repealing directive
95/46/EC (general data protection regulation), hereinafter AVG;
Having regard to the law of 3 December 2017 establishing the Data Protection Authority, hereinafter referred to as
WOG;
Having regard to the Internal Rules of Procedure approved by the Court of Auditors of
Members of Parliament on 20 December 2018 and published in the Moniteur belge on
15 January 2019;
Having regard to the documents in the file;
.
.
.
Decision on the substance 39/2020- 2/23
...
has taken the following decision on:
X , hereinafter referred to as "the complainant
Y , hereinafter referred to as 'the defendant':
1. Scope of the proceedings
1. In addition to the assessment by the Dispute Chamber of the facts to which the complaint relates, the
This decision also covers the Inspectorate's findings outside the scope of the present decision.
deal with the complaint. After all, all the findings appear to be a strong, if not
to be inextricably linked to the complaint, and for the Dispute Chamber it is
It is therefore necessary to deal with all these findings at the same time.
2. Facts and procedure
Complaint
2. On 12 October 2018, the complainant shall lodge a complaint with the Data Protection Authority.
3. The complaint may be summarised as follows. In the run-up to the
Municipal election of 14 October 2018, the complainant receives a letter to her
postal address with election propaganda. The letter is addressed directly to
of the party for which the defendant acts as list leader (hereinafter: the local party). The
responsible publisher mentioned on the envelope concerns the defendant. Who
At the time the letter was sent, the defendant was also mayor of the
municipality where the complainant has her main residence and where the complainant should share
take part in the aforementioned municipal council elections. The complaint is initially directed against the
local party.
4. In the aforementioned letter, the complainant is referred to as a "potential new resident". The
The complainant states in her complaint that the letter was "specifically addressed" to her. According to the
the complainant was able to register the local party on the basis of the electoral roll for the municipal council elections in
2018 it is impossible to know that the complainant is a new resident of the municipality.
5. The complaint also contains a number of pieces of evidence, including the letter which is the subject of the complaint,
as well as a number of screenshots of the social networking site Facebook. On the
Screenshots can be read that a person is writing the following:
"[...] anyone who gets a list of voters (every candidate) and who has a little bit of
excel can work can filter it out, but of course you have to make a little effort
[…]”
The Inspectorate's subsequent investigation revealed that the person (hereinafter: person Z) was assigned to
who owns the user profile on Facebook ranks fifth on the
list of candidates from the local party.
Procedure
6. On 17 October 2018, the complaint will be declared admissible by the First Line Service. 
Decision on the merits 39/2020- 3/23
...
7. At its hearing on 14 November 2018, the Dispute Chamber decided to request an investigation.
to the Inspectorate in accordance with art. 96, §1 j° 94, 1° WOG.
8. On 13 February 2019, the Inspection Service will address the respondent in his capacity as
Mayor of the municipality concerned. The Inspectorate asks the defendant
to transmit the following information:
an extract from the electoral roll showing the October communication by the
local party can be based;
the possible "additional list" of personal data relating to the
personal data of citizens of the municipality in which the local party is represented
for the municipal elections;
the name and contact details of the Data Protection Officer of the
municipality;
an explanation of the working method that makes it possible for the citizens of the municipality to
select as a new voter. The Inspectorate hereby refers to the reaction
of a candidate on the local party's list on Facebook.
9. On 14 March 2019, the Inspectorate will receive a reply from the defendant if
mayor, as well as the managing director of the administration of the
municipality. The letter includes, among other things, an extract from the electoral roll for the
Municipal elections in 2018. According to the letter, "may" the communication of the local
party are based on this.
Evidence shall also be added to show that, in the period between 1
August 2018 and 14 October 2018 no other personal data were consulted
from the population application or the national register.
The data of the Municipal Data Protection Officer will also be made available.
transferred.
10. On 9 April 2019, the defendant 'in [his] capacity as a framer for the
past municipal elections" an e-mail message to the Inspectorate.
In that message, the defendant stated that "correspondence had indeed been sent to the
new inhabitants" of the municipality concerned. The defendant clarifies that the
"concrete addresses of the new residents were extracted from the 2018 electoral rolls".
11. In the same e-mail, the defendant also states:
"The identity of the new residents was, moreover, a matter for the existing residents.
mandataries of our party, all working in a small national office.
municipality, adequate and almost fully known".
12. In a registered letter of 7 May 2019 addressed to the defendant, the
Inspectorate the question of which mandataries have the status of new resident on the
have added voter lists to create a 'new list of inhabitants'. The
The Inspectorate will ask for confirmation from the persons concerned.
In addition, the Inspectorate shall ask which person in the defendant's party
was responsible for the printed matter and the address list, as well as additional explanations on how to
the party the personal data of the data subjects in this regard in accordance with the principles
of the AVG. 
Decision on the merits 39/2020- 4/23
...
13. On 4 June 2019, the Inspectorate issued a reminder by registered letter of the questions raised by an
month earlier. The inspectorate points out - as it did in its previous letters - that
the duty of cooperation for those responsible for processing in accordance with Article 31 of the AVG
and the obligation under national law in Article 66 §2 of the WOG.
14. On 17 June 2019, the defendant will send an e-mail to the Inspectorate in response to
the letters from the Inspectorate. The defendant points out that the personal data, which
were used to send the letter to new residents, were merely
taken from the 2018 electoral roll. The defendant points out that several
candidates on his party's list removed the voters from the electoral roll so that only the
new voters remained on the list. According to the defendant, this was done on the basis of
"ready knowledge". In this sense, it can be noted that the Inspectorate established that the
municipality has more than 10,000 inhabitants. The defendant clarifies that the aforementioned
ready knowledge could be harnessed by the fact that "many of the candidates have been active for 18 to 30 years.
in politics, and certainly in civil society'.
15. Furthermore, the defendant writes:
"At the end of the 'deletion exercise', I have the 2018 electoral roll in addition to that
of 2012 to try to avoid major errors or certain ambiguities.
It is an established fact that the 'summary' juxtaposition of these 2 lists is not for it.
ensured that the list of new residents was fully correct, given afterwards
a few 'mistakes' were also passed on by our candidates: some new
residents had apparently not received the letter'.
16. The defendant refers to Article 17(3)(2) of the Electoral Code of 12 April 1894.
for the use of the electoral rolls, that is what it says:
"The copies or copies of the electoral roll issued with
application of §§ 1 and 2 may only be made for electoral purposes
used, including outside the period between the date of issue of the list
and the date of the election falls'.
17. The defendant points out that the processing of all personal data was carried out solely
for electoral purposes and states that "personal data from the 2012 electoral roll were
not used or abused'.
18. Furthermore, the defendant points out that the local party is a de facto association where
no specific responsible person was identified for the sending of the letter. The
The defendant indicates that, for the purposes of sending the letter, he is required to comply with the legal requirements applicable to him.
take responsibility for the local party.
19. On 31 July 2019, the Inspectorate will submit its report to the Dispute Settlement Chamber.
in accordance with Article 91 §2 of the WOG.
20. In addition to the factual findings with regard to the complaint, the Inspectorate also establishes
established that the local party does not provide any public information in relation to the
personal data protection. The Inspectorate also notes that the letter to the
new residents "has not made any reference to the rights of the person concerned 
Decision on the substance 39/2020- 5/23
...
complainant". The Inspectorate concludes that there are 'no sufficiently serious indications nor
evidence to support the merits [of the complaint]'.
21. On 25 September 2019, the Disputes Chamber decides that the file is ready for
treatment on the merits in accordance with Article 98 ff. of the WOG.
22. On 28 October 2019, the Disputes Chamber will receive a reply from the complainant.
23. The complainant refers to the Inspectorate's report and mentions the defence that the list
of new residents on the basis of readily available knowledge has been identified as 'seized by the hair'. The
the complainant points out that she is not active in any social association in the municipality and that there are
are not available (public) parameters that could identify it as a new
inhabitant.
24. The complainant also commented:
"In the email of 17 June [2019], [the defendant] admits that he has 'even' the list of
2012 compared to 2018. As far as I know, that list is not permitted
to be used after the elections. Not even 'for a while' either.
The complainant refers to the website of the Data Protection Authority where
explained that the principle of purpose limitation means that an electoral roll can only
be used for the election in the context of which the list was originally drawn up
provided.1
25. Furthermore, the complainant points out that one of the persons (person Z) who provides a hello and
submitted a signed declaration stating that he cooperated with the
compile the 'new list of residents', which is the same person whose response to
Facebook had transmitted by means of a screenshot in its complaint to the
Data protection authority.
In its conclusion, the complainant again quotes a screenshot of Facebook, where
the aforementioned person Z states, in the wording of the complainant, 'that it is child's play by
Just 'just' filter it out of the electoral list if you could work with excel and foremost what
makes an effort." The complainant concludes: 'that [person Z] actually admitted in this way to the 2
have lists side by side and with the right excel functionality / formula with each other
compared, he did not seem to realise at the time'.
26. On 28 November 2019, the defendant lodged his claims. In it, the defendant
that the personal data from the 2012 electoral roll were "not used" by the
establishment of the new list of inhabitants in 2018:
"Only the 2018 electoral roll and the 'deleted' list of possible [new
inhabitants] were drawn up by the candidates themselves on the basis of their ready knowledge
used as grounds for sending the letters'.
27. And so on:

1 With reference to: Data Protection Authority, AVG Elections Note, May 2018, available via:
https://www.gegevensbeschermingsautoriteit.be/sites/privacycommission/files/documents/Nota_verkiezingen_AVG.pdf, 9. 
Decision on the substance 39/2020- 6/23
...
"However, the defendant does have to make ('self annoying mistakes') major errors and
To avoid ambiguities, the lists have been juxtaposed for monitoring purposes. This
he admits (...) This does not mean, therefore, that the information from the old electoral roll of
2012 was used for the 2018 elections and propaganda for the 2018 elections".
28. The defendant underlines that the letters were only sent to people who
possibly be a new resident of the municipality. In that regard, the defendant points out that
the ready knowledge with regard to the new inhabitants of the municipality is "very large".
This is explained in the defendant's conclusion as follows:
"Indeed, the defendant has been a [doctor] in the municipality for 41 years and has been in the municipality for 30 years.
political action. The defendant, on the basis of his ready knowledge and with the help of
from Google Streetview (he knows more or less who lives in which house) a
deletion from the 2018 electoral roll'.
29. With regard to the written statements made by the aforementioned person Z on Facebook, the
Defendant in the main proceedings:
"The electoral roll in the EXCEL file had already been considerably shortened by its deletion.
This had given [person Z] the impression, which led to this misunderstanding in the
Facebook discussion, that an EXCEL operation had already taken place on the
electoral list. This is not correct, it was a 'manual' deletion,
the result of which was recorded in an EXCEL file. There was no use
made of all kinds of algorithms in EXCEL. This is because the defendant can only use a few
apply simple calculations via EXCEL, let alone complex operations
carry out."
30. With regard to the lack of information relating to
protection of personal data, the defendant contends in its conclusion that in the meantime
and that before that, 'the batch was very easily traceable'. And
Furthermore, 'if there were complaints, one could easily reach the party at
for example, the town hall."
31. With regard to the obligation on the defendant to provide information in relation to
retrieves data subjects where the personal data are not obtained from the data subject
the defendant that his identity and contact details were always clear to the
person concerned. The defendant argues that the complainant could always object to the
processing but has never done so. The defendant decides:
"This does not, of course, prevent the defendant from disclosing information relating to the
the persons concerned (right to object), in order to preserve their dignity and
ensure transparency. Defendant takes this as a lesson for the future
that data subjects should always be made aware of their rights'.
32. The defendant also indicated that he wished to be heard. For this reason, the
A hearing of the Dispute Chamber on 8 May 2020. The defendant leaves it up to the Disputes Chamber
know that he will not be present or represented at the hearing. The complainant is
present at the hearing. The complainant stresses that it has no link whatsoever with the
the defendant or his party. The complainant also contends that the defendant has failed to comply with his 
Decision on the substance 39/2020- 7/23
...
...to deliver its conclusion to the complainant, as required in advance by the Dispute Chamber.
The complainant confirms that she feels sufficiently heard by the Disputes Chamber.
33. In order to give the defendant the opportunity to defend himself/herself on the matter brought by the
Dispute Chamber planned amount of the administrative fine, decided the
Dispute resolution chamber relevant infringements in its standard form ' reaction form
against the proposed fine'. This 'fine form' was sent by e-mail to the
Communicated to the defendant on 16 June 2020, indicating that the defendant was able to respond
on the special circumstances of the case and the intended level of the
fine (in the present case, EUR 5 000).
34. In its reply, the defendant argues that no account was taken of the fact that the
Inspectorate has made a different assessment of the facts from that made by the
Litigation Chamber, 'the alleged duration of the infringement is therefore not a valid argument'.
The defendant argues that the proceedings before the Chamber of Disputes are in themselves deterrent
was sufficient and that the proposed level of the fine is 'exorbitant'. Furthermore, the
the defendant that the reasoning that in similar cases the same fine was always the same
imposed, points to a lack of concrete assessment on the part of the Chamber of Disputes.
35. Finally, the defendant also draws up the declaration form setting out the financial expenditure incurred by the
local party on showing that the party's total was less than EUR 20 000
issued "over a full legislature. The defendant states that it is not issued "at any time".
takes account, in some way, of the local party's real ability to pay".
Decision on the substance 39/2020- 8/23
...
3. Justification
3.1. The controller (Article 4, point 7) AVG)
36. The Conciliation Chamber finds, first of all, that the letter which is the subject of the complaint in this case
file, does not mention a specific signatory or responsible publisher. The
The defendant states that the letter which is the subject of the complaint in the present case is the address
of the defendant. As against the Inspectorate, the defendant declares that there is
"no specific person responsible" for the letter, but that the defendant
as the head of the list takes responsibility for the complaint, given that there is no
The person responsible was appointed.
37. In addition, the defendant states that the 'deletion' for the purposes of the new list of residents
obtained by several of the candidates of the local party. However, it was
only the defendant who submitted the new list of residents on the basis of the 2018 electoral roll in addition to
submitted the 2012 electoral roll, according to his own statements.
38. On the basis of the factual elements of the case and the defendant's statements,
the Chamber of Disputes finds that it is the defendant who is responsible for processing
within the meaning of Article 4(7) of the IPPC, for the processing operations which are the subject of
this complaint.
39. This qualification is also important in view of the fact that the defendant is a physical person in his response.
refers to the local party's declaration of election expenditure. The defendant in
However, this case concerns the head of the list as a physical person, in view of the local party
is a de facto association. The defendant himself states that, for the purposes of the processing operations in
takes responsibility for this case as the head of the list.2
3.2. The principles governing the processing of personal data and the
lawfulness of processing (Articles 5 and 6 of the AVG)
a) Processing of personal data from old electoral rolls
40. In his statements to the Inspectorate, the defendant refers to the
Electoral Code of 12 April 1894, but that reference is erroneous. For the legal
provisions on the use of voters' lists for local elections, it is Local and
Provincial Electoral Decree of 8 July 2011 (hereinafter: Local Electoral Decree) applicable.
3
41. Article 3 of the Local Electoral Decree states that the decree applies to the
organisation of the municipal council in all the municipalities of the Flemish Region. The situation
where the defendant and his local party stand for election as candidates to the
municipal elections in 2018 for a Flemish municipality, and in that period
sending out electoral propaganda - including the contested letter - falls within the ambit of the
scope of application of the aforementioned Decree.

2 Piece 17.
3 Decree organising local and provincial elections and amending the Municipal Decree
of 15 July 2005, the provincial decree of 9 December 2005 and the decree of 19 December 2008 concerning the organisation
of the public social welfare centres, B.S. 25 August 2011.
Decision on the merits 39/2020- 9/23
...
42. Article 20(3) of the Local Electoral Decree states:
"§3. The Municipal Executive may not submit lists of voters to the Provincial Executive.
to persons other than those who, in accordance with paragraph 1
or paragraph 2, first paragraph, have requested the list. The persons who have applied for a
have an electoral roll available, that list may be used only for electoral purposes
use and only in the period between the date of the
making the list available and the date of the election".
43. The electoral lists made available in the context of a given election shall be drawn up in accordance with the procedure laid down in Article 3.
election should therefore only be used until the date of that election. The
purpose limitation of the electoral roll is thus not limited to its use in the
within the framework of elections ('electoral purposes'), but also cumulatively until the election
for which the voters' list was created. Applied to the facts of the case, this means
that a 2012 electoral roll may not be used for the purposes of the
Municipal elections in 2018.
44. The defendant claims that he juxtaposed the electoral rolls for 2012 and 2018, and
continues that the information from the 2012 electoral roll was not "used or misused by the
establishment of the 'new' list of 'possible' new residents'.
The Dispute Chamber points out that merely storing and consulting the
personal data included in the 2012 electoral roll, including processing of
constitutes personal data within the meaning of the AVG, in accordance with Article 4(2) AVG.
45. The processing did not merely constitute a breach of this principle with regard to the processing of
personal data for those data subjects whose personal data are entered on the electoral roll of
2012, but also for those concerned - such as the complainant - who did not appear on the
electoral list of 2012 were mentioned. Determining the absence of the
personal data of data subjects on an old electoral roll, by consulting that list
old electoral roll, to modify and structure personal data of the same
persons concerned to be included on a new list of residents in 2018, should be considered to be
a diversion from the purpose of the old electoral roll in accordance with Article 5(1),
point (b) AVG.
46. The Chamber of Disputes finds that the storage and consultation of the electoral roll from 2012
by the defendant infringes the principle of purpose limitation in accordance with
Article 5(1)(b) AVG.
47. In addition, it may be established that the processing of personal data of the
2012 electoral roll with disregard for the purpose limitation, ipso facto an unlawful
processing within the meaning of Article 6(1) of the AVG. In this respect, the Disputes Chamber deems the
unlawfulness sufficiently clear, in view of the Local Kiesdecreet's use - i.e. also
consultation and comparison - of voters' lists for another party
election than that for which they have been made available. That is why it does not
raise the issue of Article 6(4) of the AVG in the light of the legal
provision in Article 20 of the Local Electoral Decree no assessment can be made with other
interests of the defendant, in the same way as the legal provision does not allow an account to be taken
be kept with other circumstances in order to allow the personal data to be kept
process.
Decision on the merits 39/2020- 10/23
...
48. Even if disregarding the legal provisions relating to electoral rolls is in itself
sufficiently clear to establish the unlawfulness, the Chamber of Disputes shall designate
the completeness also on the reasoning in section b) below, where the Dispute Settlement Chamber
justifies the creation of a 'new list of residents' with the personal data
on an electoral roll is not lawful in this case, even if it occurs during the period
within which the electoral rolls may be consulted and used. A fortiori, the following applies
justification for the processing of personal data on an old electoral roll from 2012,
whereby, by analogy, unlawfulness may be established for the purpose of making
a 'new list of inhabitants'.
b) Drawing up a list of new residents with the personal data on an electoral roll
49. In accordance with Article 16 of the Local and Provincial Electoral Decree, the voters' list mentions
the first name(s) and surname, date of birth, sex, and
main residence and, in certain cases, the nationality of the voters. Candidates at
elections may use the personal data contained in those electoral rolls for the purposes of conducting elections
of political prospection in the run-up to elections on the basis of the applicable
electoral legislation, which makes such processing somewhat foreseeable for the
person concerned.4
50. The defendant and some other candidates of the local party for which the defendant
is a front-runner, indicate that they are submitting personal data on the basis of their "ready knowledge".
have amended the electoral roll for the 2018 municipal elections in this way
and structured in such a way that they retained a list of (potential) new residents of the
municipality. The list was subsequently used by the defendant and his local party to
send letters to those (potential) new residents.
51. The defendant does not refer to any particular basis for the lawfulness of the
processing described above, and in particular one of the conditions laid down in Article 6(1), - processing as described above, and in particular one of the conditions laid down in Article 6(1).
1 AVG. It should be stressed that the use of electoral rolls by eligible voters should be avoided.
candidates concerns a possibility regulated by law - the processing is with
in other words, no legal obligation on the candidate for an election, in this
case for a municipal election, within the meaning of Article 6(1)(c) AVG.
52. Moreover, the defendant may not rely on any other means of processing.
legal basis in Article 6(1)(a) to (e) AVG. 5 Nowhere
cited - let alone demonstrated - that the complainant would have her consent
given in accordance with Article 6(1)(a) of the ASF and the absence of consent
also applies to the other parties involved. In addition, there is no agreement between the
data subjects and the defendant and his local party making the processing necessary
(Article 6(1)(b) of the AVG), nor is the processing necessary to protect vital interests
of the persons concerned or another natural person (Article 6(1)(b)) (Article 6(1)(c)).
(d) AVG). There can also be no question of the performance of a task in the general interest.
or a task carried out in the exercise of official authority by the aforementioned authorities

4 See in this respect also Legal Notice on Data Protection Authority, Processing of Personal Data for
electoral purposes: basic principles to respect citizens' privacy when sending
personalised election propaganda, May 2018, available via:
https://www.gegevensbeschermingsautoriteit.be/verkiezingen, 2.
5 See also : Ibid., 3-5/
Decision on the substance 39/2020- 11/23
...
provision, given that there are only individual interests or interests limited to the local party
in the context of the 2018 municipal elections (Article 6(1)(e) AVG).
53. The Chamber of Disputes finds that the processing of personal data from electoral rolls,
and in this case the modification, structuring and further use of those personal data,
may be carried out only where such processing is necessary for the purposes of promoting
the legitimate interests of the defendant within the meaning of Article 6(1)(f) AVG.
54. The Litigation Chamber understands that the defendant has an interest in having the personal data
on the electoral roll of a municipality in such a way that it changes,
structuring and further use of the electoral roll provides a list of new residents
who are members of the electoral public for the 2018 municipal elections in the
municipality where the defendant stands as a candidate.
55. Article 6(1)(f) AVG provides that the legal basis may be used in so far as
"processing is necessary in order to safeguard the legitimate interests of
the controller or of a third party, except where the interests or the
fundamental rights and freedoms of the data subject who seek to protect
personal data outweigh those interests, in particular when the
person concerned is a child'.
56. The case-law of the Court of Justice of the European Union requires that reliance be placed on
Article 6(1)(f) of the AVG must meet three cumulative conditions, "namely,
first, the representation of a legitimate interest of the parties concerned in the
controller or of the third party or parties to whom the data are disclosed, in
Secondly, the need for the processing of personal data for the purposes of the
defence of the legitimate interest and, thirdly, the condition that the
fundamental rights and freedoms of the data protection officer
do not prevail."
6
57. In other words, the person responsible for processing must prove that:
(1) the interests pursued by the processing can be considered legitimate
recognised (the "target test");
2) the intended processing is necessary for the realisation of these interests (the
"necessity test"); and
3) the balancing of these interests against interests, fundamental freedoms
and fundamental rights of persons concerned in favour of the
Processing controller or of a third party (the "balancing test").
1) The target test
58. In this case, it is important to underline that the legal predecessor of the European
The Data Protection Committee ("the Committee") states that the importance of the
processing controller is closely related to the purpose of a processing operation.7
The purpose of the processing of the personal data by the defendant is the following

6 CJEU Judgment of 4 May 2017, 'Rigas', C-13/16, ECLI:EU:C:2017:336, rn. 28; CJEU Judgment of 11 December 2019, "TK v
Asociatia de Proprietari bloc M5A-ScaraA", C-708/18, ECLI:EU:C:2019:1064, rn. 40.
7 Group opinion 06/2014 on the concept of legitimate interest, 9 April 2014 (WP 217), 29.
Decision on the substance 39/2020- 12/23
...
...strategically write to part of the electorate in order to make them eligible to stand for election...
candidate to be more attractive.8
59. For the use of personal data on electoral registers, the Flemish
legislator in Article 20 of the Local Electoral Decree that the personal data for such
can be used for electoral purposes.9
60. It is therefore possible to establish an interest for the defendant, an interest which is
is explicitly endorsed by the Flemish legislator. In view of the
Municipal elections still had to take place at the time of processing
of the personal data happened, it can also be established that it was a real
and present interest at the time of the facts.
61. The Dispute Chamber therefore finds that there is indeed a justified
it was in the defendant's interest to process the personal data entered on the electoral rolls
at the time of the events.
2) The necessity test
62. The Court of Justice pointed out that in order to pass the test of necessity
it should be examined 'whether the legitimate interest in the processing of data should be investigated
that is being pursued [...] cannot reasonably be achieved as effectively with
other means which are less detrimental to fundamental freedoms, and
rights of the persons concerned, in particular the right to respect for the
privacy and the right to the protection of personal data as guaranteed by the
Articles 7 and 8 of the Charter.
10
63. The condition of necessity should be examined in conjunction with the
minimum data processing in accordance with Article 5(1)(c) of the AVG as a general rule
principle on the processing of personal data.11
64. At no time does the defendant cite the reasons why it amends, structures and
continue to use the personal data from the 2018 electoral roll as 'new data'.
Population list' would be necessary for electoral purposes. The defendant merely states
that "no legislation exists which prohibits political parties from using their
ready to draw up a list of possible new residents'.
65. The legislator has clarified the limits within which personal data on a
the electoral roll may be used, with the limitation of personal data

8 Or as stated elsewhere: "political propaganda in order to win the voter's favour" in Legal note
Data protection authority, Processing of personal data for electoral purposes: basic principles to guide the
respect citizens' privacy when sending personalised election propaganda, May 2018,
available at: https://www.gegevensbeschermingsautoriteit.be/verkiezingen, 8.
9 See also ibid., 30: an interest mentioned in this recommendation is the sending of "unsolicited non-commercial information".
messages, including for political campaigns or charities" (own emphasis).
10 ArrestTK v Asociatia de Proprietari bloc M5A-ScaraA, rn. 47.
11 With analogous reasoning in TK v Asociatia de Proprietari bloc M5A-ScaraA, marg. 47. 48.
Decision on the merits 39/2020- 13/23
...
listed by candidates in the context of electoral propaganda
retrieved and further used; at the same time, the legislator considers it to be made available
of certain personal data to eligible candidates not needed to run their campaign
to feed.
12
66. The Dispute Chamber is of the opinion that further changes, structures and uses of the
electoral roll drawn up by the defendant, creating a new list of residents, not
is necessary for the campaign of the defendant and his local party. The use of
the electoral roll is not subject to the use provided for by the legislator, and is therefore not subject to the
use expected by those concerned, which is relevant to the balancing test. The
campaign can be conducted in an equally effective manner, given the defendant's
can also reach voters without specifically and isolated them as new residents.
write.
3) The weighting test
67. The Court of Justice has indicated that a legitimate interest such as that of the
the defendant in the present case 'involves a consideration of the issues at stake'.
opposing rights and interests, which depends on the particular circumstances of
a specific case and in the context of which account must be taken of the
importance of the rights deriving from Articles 7 and 8 of the Charter of Fundamental Rights of the European Union.
person concerned.
13
68. The criterion relating to the seriousness of the infringement of the rights and freedoms of the person concerned
constitutes an essential part of the consideration required by Article 6(1)(f) AVG
on a case-by-case basis. In that regard, according to the Court of Justice, account must be taken in particular of
shall mean "the nature of the personal data concerned, in particular any
sensitive nature, as well as the nature and the concrete way in which the
data concerned, in particular the number of persons having access and the manner in which they can be accessed
to which they shall have access.
14
69. The Court also considers that "the reasonable expectations of the parties concerned are also relevant to that assessment.
data subject that his or her personal data will not be processed when he or she, in the
circumstances of the case, it cannot reasonably be further processed
expect".
70. In that sense, the Conciliation Chamber also refers to recital 47 AVG: "the interests and the
fundamental rights of the person concerned may, in particular, override the interests of the
controller when personal data are processed in
circumstances in which the data subjects cannot reasonably be expected to carry out further processing
expect".

12 In this context, the following can be considered relevant: the Flemish legislator considers the identification number
of the National Register a data that is sensitive to the voter's privacy, as a result of which it is not displayed on the
electoral register, see Draft Decree amending the Provincial Decree of 9 December 2005 and others, Parl. St. Flemish
Parliament 2016-17, No 1128/1, 7.
13 JudgmentTK v Asociatia de Proprietari bloc M5A-ScaraA, rn. 52.
14 Ibid., 57.
Decision on the merits 39/2020- 14/23
...
71. The Litigation Chamber takes the view that the defendant's legitimate interest in
modify, structure and further amend the electoral roll in the manner described above
use, do not pass the weighting test.
72. The Chamber of Disputes points out, among other things, the nature and concrete manner of processing
of the data concerned: having regard to the defendant and other candidates of his local
batch for (many) years several ship mandates and the
take up the mandate of mayor, it can be expected that knowledge will be put to use
for processing collected in the exercise of those mandates.
73. In addition, the defendant himself states that his ready knowledge of the inhabitants of the
municipality stems from his decades-long professional career as a doctor, and the years of
the exercise of political mandates within the municipality, including the mandate as
mayor.
74. It is not in line with the principle of purpose limitation for knowledge that was, inter alia
acquired in the course of the exercise of the profession of doctor or within the framework of the
mandate of the defendant as mayor, to be applied when amending, structuring
and further use of a voters' list.
75. In addition, the Chamber of Disputes noted that a large number of those involved in the present case
in view of the number of inhabitants of the municipality stated by the Inspectorate, and
having regard to the number of voters on the electoral roll transmitted by the defendant to
the Inspectorate. In the 'form for reaction against proposed fine' it states
the defendant itself that the municipality has 8,074 voters, a significant number of those concerned
whose personal data were further processed.
76. In addition, it is not insignificant to establish that the data subjects did not in all reasonableness
Further processing could be expected.15 For example, the complainant refers in her complaint to the
information on a website of the Flemish government, which is the legislation on electoral lists
and municipal elections.16 Here it can be reiterated that the
electoral rolls on the basis of the legal provisions only of the first name(s) and
surnames, date of birth, sex, principal place of residence and in certain cases
cases, indicate the nationality of voters.
77. The persons concerned may therefore reasonably expect that the use
of those electoral rolls shall be limited to the personal data which are listed exhaustively
in legislation. Taking into account the legislation on the protection of
It is indeed possible, on the basis of the personal data collected, to
consult in the electoral roll itself, a proportion of the voters can be registered.17 The complainant
did not expect, however, that the defendant and the other candidates of his local party

15 Supra, rn. 63.
16 Available at: https://www.vlaanderenkiest.be/faq/hoe-gaat-de-afgifte-van-kiezerslijsten-zijn-werk.
17 One could, for example, think of writing to voters from a certain sub-municipality, from a specific
age, etc. 
Decision on the merits 39/2020- 15/23
...
...would process its personal data even further, and those personal data on a
change, structure and use in other ways.
78. In addition, the Litigation Chamber finds that the defendant pleads that the modified
and structured new list may not fully reflect reality,
and that perhaps not all the new residents were written to. Conversely
inhabitants who have already voted in the municipality for a previous
municipal elections, possibly on the list of new residents.
79. The possible inaccuracy of the personal data 'new resident' (by means of amending
and structuring of the electoral roll), personal data used to establish a
the 'new list of inhabitants' is not an argument in favour of an
Processing controller, but indicates rather inappropriate processing of
personal data, given the accuracy of such personal data, cannot be guaranteed
become. This in itself can be seen as an infringement of the rights of those concerned.
Proper processing of personal data is, after all, a principle relating to the processing of
personal data in accordance with Article 5(1)(d) of the AVG. This strengthens the
Disputes Chamber in its opinion that that processing on the basis of a justifiable
importance does not pass the weighting test.
4) Conclusion
80. On the basis of the target test, the necessity test and the weighting test, the
Dispute resolution chamber established that there can be no lawful processing on the basis of lawfulness
of the legitimate interest within the meaning of Article 6(1)(f) AVG. There is no
lawful processing within the meaning of Article 6(1) of the AVG where the defendant
modifies and structures personal data of data subjects in such a way that a
new list of inhabitants' remains, where that list is used for the purposes of isolation.
write to voters who are new residents of the municipalities. In addition, the
the accuracy of such lists cannot be guaranteed.
Decision on the substance 39/2020- 16/23
...
3.3. Information to be provided where the personal data are not from the
obtained by the person concerned (Article 14 of the AVG)
81. A few months before the facts (and accompanying
processing operations) the legislation on the protection of personal data in the context of
Elections were clarified.18 The emphasis was also placed on the right of the voter to vote.
to receive transparent information from political parties and candidates representing the electorate
writing on the basis of data from the electoral rolls in the run-up to the elections,
on how their personal data are processed.
82. The legal note clarified, inter alia, that pursuant to Article 14 of the AVG, the voter shall
has the right:
o to know who writes to her or him (name and address of the
person responsible for processing)
o for what purpose the use of personal data is made (in this case
electoral purposes)
o to know the origin of his data (in this case electoral rolls)19
83. The defendant argues that the leaflets and envelopes were used to send the
letters of election propaganda from his local party the details of the defendant
as the person responsible for processing. The letter (without envelope) which gave rise to
Until the present complaint, however, only the name and contact details of the local authority were included.
party, a de facto association.
84. The Chamber of Disputes points out that it is necessary to identify the
indicate the person responsible for processing on the letter itself, possibly under the heading of
responsible publisher', in order to avoid confusion with regard to the
avoid processing responsibility. The Dispute Chamber therefore finds that
the identification of the person responsible for processing was insufficiently clear
for the complainant, which means that the defendant infringes Article 14(1)(a) of the Directive.
(a) AVG.
85. As regards the purpose of the processing, the Chamber of Disputes finds that the letter -
in accordance with Article 14(1)(c) AVG - is sufficiently clear that the
concerns electoral propaganda designed to promote voter support for the
Municipal elections to be held in 2018. Explicit reference is made to the
hoped for support for the local party "on 14 October" and reference is made to the
previous and upcoming legislature of local government.
86. The Disputes Chamber then points out that the letter does not mention in any way that the
data subjects have the right to request access to and rectification of personal data
addressed to the controller and have the right to object to the
processing to object. In addition, it may also be pointed out that there is a need to
state that the persons concerned have the right to lodge a complaint with the

18 On the website of the Data Protection Authority under the theme file 'elections' and more specifically in the Already
said Legal Notice on Data Protection Authority, Processing personal data for electoral purposes:
basic principles to respect the privacy of citizens when sending personal data.
election propaganda, May 2018, available at: https://www.gegevensbeschermingsautoriteit.be/verkiezingen.
19 Ibid., 11.
Decision on the merits 39/2020- 17/23
...
Data protection authority. The Litigation Chamber therefore finds a breach of
Articles 14(2)(c) and 14(2)(e) AVG respectively.
87. In addition, in accordance with Article 14(2)(f) AVG, information is also relevant.
on the origin of the data to be provided to the data subject when the
personal data have not been obtained from that person. With regard to this aspect
the letter indicates that the data were found on "the electoral roll". Although the term is not
is fully correct, the Chamber of Disputes finds that it is sufficiently clear that certain
data came from a list of voters, as regulated by the Local Electoral Decree.
88. On the other hand, the letter at issue does not state that the electoral roll was being continued.
modified and structured so as to retain a list of new residents, and for this purpose
knowledge acquired for other purposes was used. Also the processing of
The personal data of the 2012 electoral roll were not included. These aspects are
However, it is essential to be sufficiently informed about the 'origin' of the
personal data.20
89. Although the defendant has formally stated that "no use has been made of any personal data of any kind", the defendant has also stated that "no use has been made of personal data of any kind".
algorithms in EXCEL" , the lack of information in the letter and the following
public communication on Facebook led to justified concerns on the part of the complainant
on the manner in which personal data have been obtained and further processed. The
The Dispute Settlement Chamber therefore considers that the origin of the personal data is
is not sufficiently clear to the persons concerned and that the defendant is thereby infringing the law
commits to Article 14(2)(f) AVG.
90. For the sake of completeness, it may be stated that the defendant himself acknowledges that 'the defendant
had to provide information with regard to the data subjects (right to object) in order to establish the
to ensure decency and transparency. The defendant takes this as a lesson to the
future, that those concerned should always be made aware of their rights'.
91. The rights referred to in Article 14(1)(c), (d) and (e) and in Article 14(2)(a), (b), (d) and (g) AVG
such information shall not be required to be stated by the defendant within the
factual context, in particular that of electoral propaganda based on
electoral rolls. In accordance with Article 14(5)(c) AVG, information must be provided in Article 14,
paragraph 1 and Article 14(2) AVG are not mentioned when acquiring or supplying
of the data is expressly provided for in the law of the Member State.
92. The Local Electoral Decree makes this sufficiently clear:
o the legal basis for the processing of personal data through electoral rolls
is (the importance of the candidate for the use of the electoral roll is - read
with the purpose - laid down by law);
o what the categories of personal data concerned are (the content of the
electoral list);

20 From the documents provided by the complainant, it is clear why it is important to provide this information as well. The
The complainant alleges, inter alia, that there were too few parameters available in the electoral roll to allow her to be considered a new resident.
Consider it. The complainant's suspicion is further heightened when they see on Facebook a comment made by an
candidate from the local party reads that certain lists were "filtered out" in Excel.
Decision on the merits 39/2020- 18/23
...
o who the recipients or categories of recipients of the personal data are
(eligible candidates in the specific municipal election);
o during which period personal data will be stored (i.e. only
in the context of the establishment, exercise or substantiation of a
legal action);
o what, as in the present case, the legitimate interests of the
be a processing controller (an interest recognised by the
electoral law, cfr.supra, rn. 55-58);
o why the processing cannot be based on consent (requesting
electoral rolls are laid down by decree and their use is not compulsory.
consent);
o that, on the basis of the provisions adopted and the instructions for use, there is no
automated decision-making.21
93. Article 14(1)(f) AVG is not applicable, as there is no question of a
international transfers in any manner described in that provision.
94. Taking all the above into account, the Dispute Chamber finds an infringement of Article
14 AVG. In particular, insufficient, unclear or no information is provided.
in accordance with Article 14(1)(a) AVG and Article 14(2)(c), (e) and (f)
AVG.

21 see Article 29 Working Group, Guidelines on transparency under Regulation 2016/679, last adopted version: 11 April 2018.
(WP260 rev.01), available at: https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=622227, 27-33.
Decision on the merits 39/2020- 19/23
...
3.4. Findings outside the scope of the Inspectorate's report: the
Absence of a privacy statement (Article 12, j° 14 AVG)
95. The obligation to provide information within the meaning of the AVG means that the controller must
must provide information to those concerned within the meaning of Article 12 j° 14 AVG.
This is often done in an exhaustive manner by means of a publicly available privacy statement,
Although the provision of information can also be done according to one's own interpretation.
22 The
It should be stressed that the European Data Protection Committee should
accepted the recommendation of the Article 29 Working Party that the
information should be available in "one place" or in "one document".
posed.23
96. The defendant acknowledges that his local party does not have a public privacy statement, but contends
that this has been rectified in the meantime. It attaches to its conclusion a document which
demonstrates that, following the Inspectorate's findings, steps have been taken to
to draw up a privacy statement.
97. The Disputes Settlement Chamber is of the opinion that the lack of information in the sentence
of article 12 j° 14 of the AVG, among other things by the complete absence of a public body.
privacy statement, infringes those provisions. The Chamber of Disputes takes note of
of the steps taken in the meantime by the defendant and his local party to establish a
provide a public privacy statement on their website.

22 For the sake of completeness, the Disputes Chamber notes that this is not the same as a privacy policy, for an informal
comparison, see i.a: Considerati, "What is the difference between a privacy statement and a privacy policy under the AVG?",
available at: https://www.considerati.com/nl/kennisbank/wat-is-het-verschil-tussen-een-privacyverklaring-en-eenprivacybeleid-onder-de-avg.html.
23 Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, last adopted version: 11 April 2018
(WP260 rev.01), available at: https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=622227, 18. 
Decision on the merits 39/2020- 20/23
...
3.5. The breaches of the AVG identified and the penalties imposed (Articles 58 and 83
AVG; Article 100 ff. WOG)
98. The Litigation Chamber finds that the defendant has proved that the following provisions have been infringed:
a. Articles 5 and 6 of the AVG, in view of the processing of personal data not on a
lawfully takes place where the defendant uses an electoral roll outside
the period during which this was allowed, which is not in accordance with the legal provisions.
established purpose of that list (a specific election). In addition, there is also
no lawful processing of personal data on an electoral roll where
the defendant's knowledge of another professional or political-social
uses his capacity to amend an electoral roll in such a way, and
structure so that a list of new residents is compiled;
b. Article 14 AVG, in view of insufficient, unclear or no information provided
shall be given to the data subject when the personal data have not been obtained from them,
as required under Article 14(1)(a) AVG and Article 14(2)(c)(e)
and point (f) AVG;
c. article 12 j° article 14 AVG, in view of the defendant and his local party at no time.
provide transparent information in some way to those concerned about the
processing of the personal data of the data subjects and exercising the
rights of data subjects, for example by means of a privacy statement.
99. The Disputes Chamber has already ruled on the unlawful processing of personal data.
dealt with in previous cases, in particular Decisions 04/2019, 10/2019, 11/2019 and the
most recently in decision 30/2020.
In each of those cases, the Chamber of Disputes proceeded to impose an
administrative pecuniary penalty, in particular for non-compliance with the principle of the
purpose limitation, as laid down in Article 5(1)(b) AVG.
100. The Disputes Chamber is of the opinion that, due to the reasons given above
infringements, an administrative fine within the meaning of Article 100, §1, 13° j° Article 101
WOG, as well as Article 83 AVG, is justified, taking into account the following considerations
elements.
101. Taking into account article 83 AVG and the case law of the Market Court,
The Chamber of Disputes justifies the imposition of an administrative sanction in concrete terms:
a) The seriousness of the infringement
102. The foregoing reasoning shows the seriousness of the infringement. Infringements of the
basic principles in Articles 5 and 6 AVG give rise to the highest fines in Article
83, paragraph 5 AVG.
Also with regard to the infringements of Article 14 of the AVG on transparency and information on the
personal data, the Chamber of Disputes notes that the lack of information in a letter
draw the attention of those concerned to the seriousness of the infringements.
In the event of infringements of those rights, the highest fines shall also be imposed.
pursuant to Article 83(5) AVG. 
Decision on the substance 39/2020- 21/23
...
(b) the extent to which the controller is technically or organisationally responsible for the processing.
has taken measures
103. It should be noted here that the defendant has been active for many years in the
municipal politics and that the relevant provisions of electoral law are adequately known
had to be.
104. However, it appears that the defendant did not properly fulfil his duty as controller.
where the Inspectorate's findings show that the Inspectorate has failed to carry out, or has carried out inadequately
technical and organisational measures have been taken in order to comply with the
obligations under the AVG. Not only is the defendant not sufficiently precise
employs in the processing of personal data, but also does not provide enough
information and does not offer sufficient transparency with regard to those concerned.
(c) The duration of the infringement:
105. In view of the special nature of the processing of personal data in function of (the
preparation for) the sending out of electoral propaganda in the run-up to the
Municipal elections in 2018,
24 has the processing only within a short
time period took place. However, it should be pointed out that the electoral roll of a
previous municipal election, in 2012, was still used to make an amendment and
structure the electoral roll in 2018 (supra, 3.2., part a).
106. However, the legislation in the Local Electoral Decree stipulates that the electoral roll may only be used for the purposes of the elections.
used until the date of the election for which the electoral roll serves; for that reason, the
processing of personal data from an electoral roll for an election in 2012 not
possible for an election in 2018. As regards the lack of transparency and
information, it may be pointed out that the defendant waited until after the transfer of
the report of the Inspectorate to take the necessary measures to ensure that the processing operations
to bring it into line with the provisions of the AVG.
(d) The necessary deterrent effect to prevent further infringements:
107. In the light of the various findings, it appears that the defendant was grossly negligent
includes respect for the fundamental rights to the protection of personal data.
sphere of life and in particular the provisions of the AVG, the Chamber of Disputes considers a
raise the issue of administrative fines in order to underline the serious omissions
and sanction, and as such create a deterrent effect.
108. In the Statement of Objections to Proposed Fines, the defendant cites that
the party's expenditure is limited. He shall also produce the necessary supporting documents for this purpose.
The defendant argues that, in view of the processing operations carried out within the framework of a local
electoral campaign, a proposed fine of EUR 5 000 would be disproportionate. The
Dispute Settlement Chamber takes these new elements into account in its deliberations and decides
as a result, to reduce the amount of the fine, given an amount of EUR 3 000,
taking into account the newly presented circumstances of the case, sufficient
is a deterrent to prevent further infringements. The Dispute Settlement Chamber does, however, point out that

24 By definition, therefore, it only concerns the period between obtaining the electoral roll and the date of the election.
Decision on the merits 39/2020- 22/23
...
that, given that the local party is a de facto association, the decision is merely
taken in respect of the defendant as a physical person, and the expenses incurred by the party
be included in the assessment only as a factual element.
109. The Chamber of Disputes points out that the other criteria laid down in Article 83(2) of the AVG in this case are
are not of such a nature as to result in sanctions or measures other than those provided for in the Directive.
Disputes Chamber in the context of this decision.
110. Having regard to the importance of transparency in relation to the decision-making of the
Disputes Chamber, this decision shall be published on the website of the
Data protection authority, whereby the direct identification data of the said
parties and natural persons will be removed.
3.6. The guarantees for the proper conduct of the procedure at the
Treatment on the merits before the Dispute Chamber
111. For the sake of completeness, the Disputes Chamber notes that, as the complainant cites, the
the defendant lodged its statement of defence within the period prescribed by
the Registrar of the Chamber of Disputes, but has not simultaneously transferred to the other party
party, as explicitly requested by the Disputes Chamber in its letter of 25 September 2019.
112. Given that the complainant did not oppose consideration of the document with the
conclusion of the defendant, and the complainant states that he or she considers that he or she has been sufficiently heard, and
in order to be able to include all relevant elements in the deliberations of the Dispute Settlement Chamber
the Chamber of Disputes has decided to uphold the conclusion with the pleas in law put forward by the
not to exclude the defendant from the proceedings.
Decision on the substance 39/2020- 23/23
FOR THESE REASONS,
the Data Protection Authority's Litigation Chamber, after deliberation, shall decide to
- the defendant in accordance with Article 58(2)(b) of the AVG and Article 100(1)(5) of the AVG
WOG to be reprimanded for the unlawful processing of personal data
by creating a 'new list of residents' within the meaning of Article 6(1) of the AVG, by the
unlawful consultation and comparison of personal data from an old electoral roll
from 2012 on the one hand, and by unlawfully structuring, modifying and using the
personal data from a 2018 electoral roll, on the other hand;
- the defendant in accordance with Article 58(2)(b) of the AVG and Article 100(1)(5) thereof
WOG to be reprimanded for failing to provide adequate information to those concerned, such as
provided the complainant with the transmission in accordance with Articles 12 and 14 of the AVG
of a letter of election propaganda, given the personal data not provided by the
those involved were obtained;
- the defendant in accordance with Article 58(2)(i) of the AVG, Article 83 of the AVG, and
Article 100, §1, 13° WOG to impose an administrative fine of EUR 3,000
having regard to the reasoned breaches of Articles 5, 6, 12 and 14 of the AVG.
An appeal may be lodged against this decision on the basis of art. 108, §1 of the WOG, within one month of the date of the decision.
period of thirty days from the date of notification to the Court of Justice of the European Communities with the
Data protection authority as defendant.
(Get.) Hielke Hijmans
President of the Chamber of Disputes