APD/GBA (Belgium) - 57/2021

APD/GBA (Belgium) - 57/2021
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 5(1)(a) GDPR Article 5(2) GDPR Article 6(1)(c) GDPR Article 6(1)(f) GDPR Article 13(1)(c) GDPR Article 13(1)(d) GDPR
Type:	Complaint
Outcome:	Partly Upheld
Started:
Decided:	06.05.2021
Published:	06.05.2021
Fine:	30.000 EUR
Parties:	n/a
National Case Number/Name:	57/2021
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Dutch
Original Source:	Beslissing ten gronde 57/2021 van 06 mei 2021 (in NL)
Initial Contributor:	Enzo Marquet

The Belgian DPA states that a separate and clearly defined purpose is necessary for transfer to a third party. Multiple, different processing can take place for the same purpose, but each requires a legal basis.

English Summary

Facts

This decision is a reconsideration of the decision 24/2020 and executes the appeal of the Market Court of 18 November 2020 (2020/AR/813), it gives the defendant the possibility to defend itself against all infractions on the GDPR for which the initial sanction was based on.

To summarise, the complainant claimed that its health data was used by an insurance company for a purpose for which he did not explicitly agree. The defendant now claims to use legitimate interest as legal basis.

Holding

Legal basis of legitimate interest The defendant states that non-sensitive personal data can be processed based on legitimate interest for different purposes: - conducting computer tests; - monitoring the quality of service; - training of personnel; - monitoring and reporting; - storing recordings of video surveillance for the statutory period; and - compiling statistics from coded data, including big data. For each of these purposes, a balancing test was done.

The DPA recites the requirements for relying on Article 6(1)(f), namely purpose test, necessity of the processing and a balancing test.

As regards the first condition (the so-called "purpose test"), the DPA considers that the processing purpose as described by the Respondent must be considered as carried out in view of a legitimate interest. The interest pursued by the Respondent as the data controller can in itself be regarded as legitimate, in accordance with recital 47 of the GDPR.

In order to satisfy the second condition, it must be demonstrated that the processing is necessary for the achievement of the purposes pursued. More specifically, this means asking the question whether the same result can be achieved by other means without processing personal data or without an unnecessarily intrusive processing for the data subjects.

In order to verify whether the third condition of Article 6(1)(f) - the so-called "balancing test" between the interests of the controller, on the one hand, and the fundamental freedoms and fundamental rights of the data subject, on the other hand - can be met, the reasonable expectations of the data subject must be taken into account in accordance with recital 47 GDPR. More specifically, it should be evaluated whether "the data subject may reasonably expect, at the time and in the context of the collection of the personal data, that processing may take place for that purpose."

Conducting computer tests

The DPA holds that this satisfies the first, second and third criteria. It does state that the data subject could be more informed about the tests.

Monitoring the quality of service and compiling statistics from coded data, including big data

This topic has three parts: "statistics and quality tests", "satisfaction questionnaires" and "quality tests operations", each legitimate interest basis was assessed by the DPA:

Statistics and quality tests

All criteria have been fulfilled.

Satisfaction questionnaires

All criteria have been fulfilled.

Quality tests operations

All criteria have been fulfilled.

Training of personnel

The first criteria has been fulfilled. The necessity test has not been fulfilled, as it is not necessary to use client data in order to provide training cases for personnel, this is a breach of data minimisation of Article 5(1)(c). The balancing test is also not fulfilled as it is not within the reasonable expectations of a person taking an insurance for their information to be used as an example.

Monitoring and reporting

The first criteria has been fulfilled.The second criteria has been fulfilled as a minimum of data is necessary to fulfill legal obligations. Said legal obligations however, did not foresee in an explicit legal basis for the processing.The third criteria has also been fulfilled as it is a reasonable expectation of a data subject that the insurance company must fulfill its legal obligations.

Storing recordings of video surveillance for the statutory period

The first and second criteria have been fulfilled. The third criteria has not been fulfilled as a data subject signing an insurance contract cannot reasonably expect that their data will be used for video surveillance. This falls under the Camera law of 21 March 2007, including the obligation to put up pictograms to inform the data subjects.

Model of balancing test

The defendant states that all these balancing tests scored less than 30 on the model that they used, which means legitimate interest can be used as a legal basis. The DPA holds that this is purely instrumental and no legal value can be given to a model.

Legal basis for transfer to third parties

The defendant claims that transfers to third parties is not a processing purpose, but a form of processing within the meaning of Article 4(2).

The DPA states according to Article 5(1)(a), personal data must be processed processed for a specific purpose and the processing must be legitimate within the meaning of Article 6(1). It is possible to do multiple processing for the same purpose, but this must be done in compliance with the above.

As the defendant is not able to state a specific and separate purpose for the transfer to a third party, and in light of the transparency principle within the meaning of Article 13(1)(c), there is a breach of the GDPR.

Transparency principle

Notwithstanding Article 13(1)(d) regarding transparency of its legitimate interests, the defendant claims that they fulfilled the requirements by merely stating in the privacy notice that the personal data will be processed based on its legitimate interest without indicating what those interests are.

Those legitimate interest are not public as they contain company sensitive information and the documents are very 'heavy', not suited for a privacy notice.

As the defendant is not able to state a specific and separate purpose for the transfer to a third party, and in light of the transparency principle within the meaning of Article 13(1)(d), there is a breach of the GDPR. And even if the defendant does not want to share sensitive information, they must at least provide more information to its data subjects in a clear and transparent way. Sharing company sensitive or 'heavy' documents on their own is not required for this.

Based on the above, the first decision, and the appeal, the fine for the insurance company is reduced to €30.000 (from €50.000)

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

                                                                                         1/36









                                                                       Dispute Chamber



                                      Decision on the merits 57/2021 of 06 May 2021





File number: DOS-2019-02902



Subject: Lack of transparency in a privacy statement

insurance company (reconsideration of decision 24-2020)







The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke

Hijmans, chairman and Messrs. Dirk Van Der Kelen and Jelle Stassijns, members;


Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

on the protection of natural persons with regard to the processing of

personal data and on the free movement of such data and repealing Directive

95/46 / EC (General Data Protection Regulation), hereinafter GDPR;



In view of the law of 3 December 2017 establishing the Data Protection Authority, hereinafter

WOG;



Having regard to the rules of internal procedure, as approved by the Chamber of
Representatives of the people on December 20, 2018 and published in the Belgian Official Gazette on

January 15, 2019;



Considering the documents in the file;







                                                                                                 .
                                                                                                 .

                                                                                                 . Decision on the merits 57/2021 - 2/36



has taken the following decision regarding:

    - Mr X, hereinafter “the complainant”;

    - Y, represented by Masters Benoit Van Asbroeck and Simon Mortier, hereinafter “de

        defendant".




    1. Facts and procedure




  1. This decision is a reconsideration of decision 24/2020 of the Disputes Chamber of 14

      May 2020, and implements the judgment of the Marktenhof of 18 November 2020, with

      roll number 2020 / AR / 813.



  2. This decision must be read in conjunction with decision 24/2020 and contains a

      review to give the defendant the opportunity to defend himself

      regarding all breaches of the GDPR for which a sanction was imposed in the initial decision,


      insofar as these infringements are contested by Y. With this review, the

      The disputes chamber thus falls within the framework of the initial decision, also with regard to the

      administrative fine that cannot exceed the amount of the initially determined fine.

      With regard to the allegations concerning the Disputes Chamber in the initial decision

      ruled that there was no breach of the GDPR, that judgment is preserved. The

      infringements identified in the initial decision and not contested by Y remain

      equally preserved.




  3. On June 14, 2019, the complainant lodged a complaint with the Data Protection Authority against

      defendant.



      The object of the complaint concerns the use of health data that the

      insurance company of the person concerned has obtained under a

      hospitalization insurance for other purposes without the express consent of the

      insured person concerned. The complainant states that he has no problem with his

      health data is processed for the performance of obligations under

      the hospitalization insurance taken out with the defendant, but a problem

      when those same health data are processed for the purposes listed

      in point 4.3. of the privacy statement and for the transfer to third parties as mentioned in point 9

      of the same privacy statement (it concerns point 6, but the reference to point 9 is a

      material mistake) as stated in the defendant's privacy statement. He asks that

      specifically for those purposes, as well as for the transfer the defendant gives the choice to the

      data subject to consent or not to the processing of his health data. Decision on the merits 57/2021 - 3/36



    Finally, the complainant indicates that he wishes to receive a data protection impact assessment

    of the defendant as there is a high-risk data processing involved

    The involved.




4. On 26 June 2019, the complaint will be declared admissible on the basis of Articles 58 and 60 of

    the WOG, the complainant will be informed of this on the basis of art. 61 WOG and the complaint becomes

    on the basis of art. 62, §1 WOG submitted to the Disputes Chamber.



5. On 23 July 2019, the Disputes Chamber will decide on the basis of art. 95, §1, 1 ° and art. 98 WOG that it

    file is ready for treatment on the merits.



6. On July 24, 2019, the parties concerned will be notified of

    the provisions as stated in article 95, §2 and in art. 98 WOG. The were also involved

    parties on the basis of art. 99 WOG of the time limits for their defenses

    to submit. The deadline for receiving the complainant's reply was

    recorded on 7 October 2019 and 7 November 2019 for the defendant.



7. On July 29, 2019, the defendant reports to the Disputes Chamber that it has taken note of

    the complaint, it requests a copy of the file (art.95, §2, 3 ° WOG) and accepts it electronically

    all communication regarding the case (art. 98, 1 ° WOG).



8. A copy of the file will be sent to the defendant on 30 July 2019.



9. On August 2, 2019, the Disputes Chamber will receive a letter in which the defendant indicates

    that he wishes to be heard by the Disputes Chamber (art. 98, 2 ° WOG).



10. On September 6, 2019, the Disputes Chamber will receive the statement of defense from the

    defendant. Respondent argues, first, that processing special categories of

    personal data, in this case health data by health insurer Y in a lawful manner

    happens. The processing of these special categories of personal data (Art.9 GDPR)

    is prohibited in principle. The respondent invokes the exception for the processing

    of Article 9 (2) a GDPR, the express consent of the data subject. Second, argues

    respondent that no separate consent is required for each transfer of

    personal data. Thirdly, according to the respondent, there is no question of asking

    consent to the processing of data other than health data. Finally it was

    according to the respondent, a data protection impact assessment is not necessary in this case

    since it concerns existing processing operations and not new processing operations

    commences after May 25, 2018. Decision on the merits 57/2021 - 4/36





11. The complainant has not exercised the right to submit a reply.



12. The defendant does not submit a new claim and only submits exhibits on 7 November 2019


    in support of the statement of defense submitted on 6 September 2019.



13. On January 9, 2020, the Parties will be notified that the hearing will take place

    on January 28, 2020.



14. On January 28, 2020, the defendant will be heard by the Disputes Chamber. The complainant, though

    duly summoned, did not appear. Among other things, the defendant answers questions from

    the Disputes Chamber on the legal basis for the processing of personal data, no

    being health data. After this, the debates are closed.



15. On January 29, 2019, the official report of the hearing will be presented to the parties.



16. On January 31, 2020, the defendant will provide the annual turnover as requested during the hearing

    of the last three financial years. For the years 2016-2018, these always amount to a turnover between

    the 500 and 600 million Euros.



17. On 6 February 2020, the Disputes Chamber will receive a number of comments from the defendant

    with regard to the official report, which it decides to include in its deliberations.



18. On March 25, 2020, the Disputes Chamber will notify the defendant of its intention to do so

    to impose an administrative fine, as well as the amount thereof

    in order to give the defendant the opportunity to defend himself before the sanction becomes effective

    is imposed.



19. On May 8, 2020, the Disputes Chamber will receive the respondent's response to the intention

    to impose an administrative fine, as well as the amount thereof.

    The defendant alleges that the alleged infringements as contained in the intent of

    the Disputes Chamber would be completely new and he was unable to do so

    to defend. However, the Disputes Chamber must establish this from the documents in the file

    it is indisputable that the defendant does have full rights of defense

    can exercise.

    The defendant also claims to disagree with the imposition of a fine, or the

    intended amount of the fine. However, he does not put forward any (new) arguments

    substantiation of this thesis. The response of the defendant gives before the Dispute Chamber Decision on the merits 57/2021 - 5/36




      therefore no reason to adjust the intention to impose a

      administrative fine nor to change the amount of the fine such as

      intended.



  20. On May 14, 2020, the Disputes Chamber ruled as follows in its Decision on the merits 24/2020:

       - on the basis of art. 100, §1, 9 ° WOG, to order the defendant that the processing in


       is brought into line with article 5.1 a), article 5.2, article 6.1, article 12.1, article

       13.1 c) and d) and 13.2 b) GDPR.

       - on the basis of art. 100, §1, 13 ° WOG and art. 101 WOG to impose an administrative fine

       of EUR 50,000 as a result of the violations of article 5.1 a), article 5.2, article 6.1, article

       12.1, article 13.1 c) and d) and article 13.2 b) GDPR.



  21. On 17 June 2020, the Disputes Chamber will receive the

      notification of an application against the GBA, lodged at the Registry of the Court.



  22. The introductory session for the Marktenhof will take place on 24 June 2020, at which the


      conclusion deadlines for the parties are set, as well as the case is set for

      pleadings at the session on October 21, 2020.

      The Marktenhof will pass judgment on 18 November 2020.

      The judgment contains the following points for attention with regard to the assessment of

      the subject of the petition:



      • Annulment of decision on the merits no. 24/2020 of 14 May 2020 of the Disputes Chamber.

      • The Marktenhof argues that the defendant should be given the opportunity - after the complaint is ready

          and clearly formulated in writing - in order to reach a written conclusion on this


          take. The fact that the defendant was asked on the occasion of the hearing

          (which was stated in the minutes of the hearing) to take a position

          on the general question of the legitimate interest on which the defendant

          is relying on processing other than health data and that the defendant

          only formulated a brief answer to this without any reservations or objections

          does not adequately justify decision no. 24/2020 of 14 May 2020.


  23. Following up on the judgment, the Disputes Chamber will decide on November 27, 2020 to proceed

      to retake the file with a view to taking a new decision. The

      The underlying consideration is that the Disputes Chamber notwithstanding the





1
   The judgment is available on the website of the Data Protection Authority via the following link:
https://www.gegevensbeschermingsautoriteit.be/publications/tussenarrest-van-02-september-2020-van-het-markthof.pdf Decision on the merits 57/2021 - 6/36




    annulment of the aforementioned decision by the judgment of the Marktenhof, is still contained

    by the initial complaint filed on June 14, 2019 as declared admissible by the

    First-line service on June 26, 2019. Therefore, the debates will be reopened

    and new closing deadlines are set, so that parties can take a stand

    regarding the legitimate interest on which the defendant relies on other than

    process health data.



  The parties are notified of the following settlement deadlines:

  • the deadline for the complainant's reply is set at 8

       January 2021;

  • the deadline for the defendant's reply is set at 19

       February 2021;


  The date of the hearing will also be determined, which will take place on March 22, 2021.



24. On 27 November 2020, the Disputes Chamber will receive the notification from the complainant that the

    because of the clear arguments it seems unnecessary to add additional arguments to him.

    On the same day, the Disputes Chamber will inform the defendant that it informs the complainant

    has stated that it will not submit a conclusion. At the request of the defendant, the

    The Disputes Chamber also states that the initially determined date for the statement of reply of the

    defendant, as well as the date of the hearing.



25. On February 19, 2021, the Disputes Chamber will receive the conclusion with accompanying documents from

    the defendant. In it, the defendant puts forward the following pleas:

           • The respondent can rely on its legitimate interests for the processing

               of personal data for purposes in accordance with Article 4.3 of its old

               privacy statement (no violation of article 5.1 a); 5.2, 6.1 f) and 13.1 c) and d)

               GDPR.

           • Respondent can rely on an applicable legal basis for transfers to

               third parties in accordance with Article 6 of the old privacy statement (no

               violation of articles 5.1 a), 5.2, 6.1 and 13.1 c) and d) GDPR.

           • If defendant cannot invoke all legal grounds under Article

               6.1 GDPR for the processing purposes in accordance with Article 4.3 of the old

               privacy statement and transfers to third parties in accordance with Article 6 of the old

               privacy statement, this constitutes an infringement of the freedom to conduct a business of the

               defendant.

           • Respondent argues that a reprimand is sufficient and that the administrative fine of

               € 50,000.00 is disproportionate. Decision on the merits 57/2021 - 7/36



26. On March 22, 2020, the parties will be heard by the Disputes Chamber. The complainant, though

    duly summoned, did not appear. The defendant will explain his defense during the hearing

    to. No elements other than those that already form part of this are applied

    File. After this, the debates are closed.




27. The minutes of the hearing will be presented to the parties on 25 March 2021

    in accordance with Article 54 of the Rules of Procedure. The defendant delivers on April 5

    2021 the Disputes Chamber some comments with regard to the official report, which

    she decides to include it in her deliberation.



28. On April 6, 2021, the Disputes Chamber announced its intention to the defendant

    to proceed to impose an administrative fine, as well as the amount

    in order to give the defendant the opportunity to defend himself before the sanction

    is effectively enforced.



29. On April 27, 2021, the Disputes Chamber will receive the respondent's response to the intention

    to impose an administrative fine, as well as the amount thereof.

    In summary, the defendant states in his response to the intention to impose a

    administrative fine the following:



  - With regard to the lack of a demonstrated legitimate interest as a legal basis for the

       purposes “training personnel” and “storage of video surveillance recordings

       during the legal period, ”the defendant argues that there was no

       questions were asked regarding legality, necessity or the

       proportionality of these processing purposes.



       In this regard, the Disputes Chamber notes that the defendant in the claims already

       The legality, necessity and proportionality of all have been discussed extensively


       processing purposes, including those for “staff training” and “storage

       of video surveillance recordings during the legal period ”, so that no

       additional clarification was requested during the hearing. Be at a hearing

       only punctual questions were asked about any remaining uncertainties in order to clarify them

       and to allow the Disputes Chamber to form an opinion.

       At present, the Disputes Chamber can only establish that the respondent's response to the

       intention to impose an administrative fine as a result of the infringement of

       Article 6.1 GDPR with regard to the purposes “training personnel” and “storage

       of video surveillance recordings during the legal period ”in the absence of a Decision on the merits 57/2021 - 8/36



    demonstrated legitimate interest as legal basis, does not contain any new elements that of

    nature to change the judgment of the Disputes Chamber.



- With regard to the amount of the fine, the defendant is of the opinion that no fine is possible


    be charged for charging that personal data would have been processed without it

    to have a legitimate interest. At the very least, the defendant believes that a

    amount of EUR 30,000 is disproportionately high. The defendant argues that from the

    written conclusions and the hearing revealed that general training material

    in principle, it is always anonymized and there is virtually no personal data of customers

    are processed via CCTV. The documents in the file do not show that either

    any personal data of the complainant would have been processed for this

    processing purposes. For that reason, the complainant (and by extension the other customers of

    defendant), have in principle not been personally harmed by any lack of

    legitimate interests for the processing activities “staff training” and

    “The storage of video surveillance recordings during the legal period”.



    The Disputes Chamber emphasizes whether or not experiencing any personal harm

    does not constitute a criterion for imposing an administrative fine, as this is not

    included in Article 83.2 GDPR. It will therefore motivate this sanction in its decision below

    without taking into account whether or not the complainant has any personal disadvantage

    ago. The criteria for imposing an administrative fine are clearly defined

    in article 83.2 GDPR, on which the Disputes Chamber will make its decision regarding the administrative

    fine.



    To the extent necessary, the Disputes Chamber adds that the complainant is

    has provided personal data to the defendant for processing under a

    hospitalization insurance and the defendant then on the basis of the then

    privacy statement indicated that the personal data of the complainant was also processed for all

    purposes stated in the privacy statement. Based on the then privacy statement

    the defendant processed the complainant's data for each of the purposes included

    in the privacy statement. This is also evident from the conclusion that underlies the current one

    decision, in which the defendant himself defines the allegations arising from the complaint

    (see marginal 33) and the allegations under points f), g) and h) are the subject of

    his defense. The allegations arising from the complaint and as made by the defendant himself

    described in his conclusion, concern defects in the privacy statement issued by the complainant

    concern, as well as ipso facto any other customer of the defendant who has a

    take out hospitalization insurance. After all, the privacy statement is not exclusively for the complainant

    drawn up, but for each client of the defendant who takes out hospitalization insurance. Decision on the merits 57/2021 - 9/36



    This also explains why the defendant in his claim the legality, necessity

    and proportionality of all processing purposes, without distinction of whether or not

    concerns a processing purpose for which personal data of the complainant will be made

    processed, tries to demonstrate. The defendant verifies whether it is for all processing purposes


    has a legitimate interest, because for each of those processing purposes the

    personal data of the complainant were processed in accordance with the then

    privacy declaration.



- In addition, the defendant is of the opinion that an amount of EUR 30,000 is disproportionate to

    the infringement.

    More specifically, as regards the seriousness of the infringement, the defendant does not agree with the

    statement of the Disputes Chamber that, solely because of the fact that an infringement of Articles 5

    and 6 of the GDPR, the infringements are therefore automatically “serious” and

    Would be “serious”. The defendant argues that on the one hand these articles are the basis

    lie with almost the entire GDPR and therefore virtually any violation of the other GDPR

    articles can be reduced to an infringement of articles 5 and 6 GDPR.

    On the other hand, these infringements are classified as being “serious” and “serious”.

    prevent a differentiation from being made with infringements that are actual

    weighty and serious, such as, for example, the complete absence of one

    privacy declaration. However, this is not at all relevant here.

    The defendant argues that it has indeed stated these processing purposes in its

    privacy statement and has extensive weighing of interests with due diligence

    to determine whether it can rely on its legitimate interests.



    Regarding the defendant's contention that a breach of the basic principles of the GDPR

    included in Articles 5 and 6 GDPR would not automatically be considered serious and serious

    can be considered, the Disputes Chamber notes that Article 83.5 GDPR itself provides for

    a more severe punishment for this infringement for which there is the highest maximum fine

    determined precisely because of the fact that these are basic principles that lie at the heart of a

    concern data processing. The defendant's claim that any breach of the GDPR

    can be traced back to a breach of basic principles, does not stand as the

    The Disputes Chamber is caught by the complaint and carries out the assessment against the GDPR within those limits

    and therefore by no means, contrary to what the defendant maintains, any infringement could be possible

    are "reduced" to violations of the basic principles. Since the complaint is exactly the

    basic principles, the Disputes Chamber will rule on the

    application of those principles. Where the defendant cites as an example that the

    a complete absence of a privacy statement would be serious and important, states the

    Disputes Chamber that the total lack of a privacy statement is not only a serious and Decision on the merits 57/2021 - 10/36



      would be a serious infringement, but a total disregard of the GDPR. However, this increases

      does not mean that a defective privacy statement, such as in the present case, which contains the

      does not respect basic principles of the GDPR, if it must be serious and weighty

      classified.




      Regarding the duration of the breach, the defendant points out that it already has its privacy statement

      during the initial procedure at the beginning of 2020 and has amended its privacy statement to

      following the initial decision of the Disputes Chamber at the beginning of 2021

      adjusted and this should be taken into account as an attenuating circumstance.

      As to the deterrent effect, the defendant points to her again

      willingness to constantly adjust its privacy statement, which they do

      twice has done so in a very drastic manner, thus the purpose of these proceedings

      this has been achieved according to the defendant.



      The Disputes Chamber has already announced its intention to impose an administrative one

      fine, as well as the amount thereof, that it is already done by the defendant

      efforts to bring the new privacy statement into line with the GDPR,

      evidence of his willingness. Hand must be

      noted that although the changes made to the new privacy statement are beneficial

      are an element in the assessment of the administrative fine, they do not serve it

      that the infringements established would be rectified (see marginal 120).

      The Disputes Chamber gives more detailed reasons for the imposition of the administrative fine

      in section 3 of this decision.



    It follows from the foregoing that the respondent's response to the Disputes Chamber is none

    gives rise to an adjustment of the intention to impose an administrative one

    fine, nor to change the amount of the fine as intended.





  2. Justification



    1. Legitimate interest


      a) Preliminary remark



30. It follows from the judgment of the Marktenhof that the Disputes Chamber in its decision 24/2020 of

    May 14, 2020 would have ruled without the defendant being able to fully comply

    because the decision of the Disputes Chamber would not have been limited to the

    allegations that are the subject of the complaint. Decision on the merits 57/2021 - 11/36





31. However, the complainant explicitly states in the complaint that the customer should be given the choice whether to use

    agrees to the processing operations listed in points 4.3 and 6 and does not receive them. After all, once

    he has given his consent to the processing of his personal data in the context of


    hospitalization insurance, according to the complainant, data processing should be limited to

    to perform the obligations arising from that insurance. The complainant argues

    that the defendant does not use his data for any other purpose, more specifically the

    the purposes stated in points 4.3 and 6 of the old privacy statement, can be processed without

    permission. The complaint thus becomes the legal basis of the processing for the purposes

    listed in section 4.3. The complainant believes that those purposes are mentioned in point 4.3

    consent is required and the defendant therefore does not automatically obtain the data obtained on the basis

    of permission in the context of a hospitalization insurance can also be used for others

    purposes, for which the defendant relies on his legitimate interest.



32. The complaint thus essentially relates to the legal basis on which the defendant can rely

    appeal to process the personal data obtained from the complainant for the purposes

    listed in points 4.3 and 6 of the defendant's old privacy statement.



33. In the present claim of the defendant, the allegations are listed in the paragraphs

    a) to h):




   “A) Y would consent to the processing of medical data for the purpose of closing

   and executing insurance contracts under duress, eliminating these

   consent would be invalid (violation of Article 5 (1) (a))

   (legality principle); 6 (1) (a) and 9 (2) (a) GDPR)



   b) Y must grant the Complainant access to the DPIA

   (“GBEB”) that it allegedly carried out for the processing of medical data related

   with the performance of insurance contracts with its customers (violation of articles

   35 and 36 GDPR)



   c) Y should, in Articles 4.3 and 6 of the old Privacy Statement, make a better distinction

   between the processing of medical data on the one hand and the processing of other "ordinary"

   personal data on the other hand (violation of Article 13 (1) (c) GDPR);



   d) Y should take additional steps to inform data subjects of their

   right to object pursuant to Article 21 (2) GDPR (violation of Article 12 (1)

   and 13 (2) (b) GDPR) Decision on the substance 57/2021 - 12/36





  e) Y serves the legal grounds referred to in Article 6 of the Y old Privacy Statement for the

  transfer of personal data to third parties, to be further clarified (violation of Article 13,

  para.1 lit.c) GDPR)




  f) Y would process personal data without proven legal basis (including her

  legitimate interest within the meaning of Article 6 (1) of the GDPR) for a number of in Article 4.3 of the

  the purposes stated in the old Y Privacy Statement and in Article 6 of the old Y Privacy Statement

  said transfers to third parties (violation of Article 5 (1) (a))

  (principle of legality) and 6 (1) GDPR)



  g) Y would have provided insufficient information about her in her old Privacy Statement

  legitimate interests, where Y invokes this legal basis (violation of

  Articles 5 (1) (a) (principle of transparency) and 13 (1) (c) and (d) GDPR)



  h) Y, where Y relies on this legal basis, would not have sufficiently demonstrated why

  its legitimate interests would exist and would have failed to demonstrate in

  to what extent her interests would outweigh the interests and fundamental rights of the Complainant

  (Violation of Article 5 (2) GDPR). "



34. The defendant also confirms that the allegations set out in points a) to h)

    arise from the complaint by stating the following in the conclusion:

    “Should the Dispute Chamber consider the above allegations and alleged violations

    on the GDPR by Y (points a to h) do not arise from the complaint […], becomes the Disputes Chamber

    invited to inform Y of this […]. ”



35. The Disputes Chamber notes in this regard that already in the complaint the allegations as now

    described by the respondent in points a) to h) and

    about which the defendant now indicates that these do indeed arise from the complaint,

    but about which he nevertheless put forward no defense in respect of f), g) and h) in the

    procedure prior to decision 24/2020 of 14 May 2020.

    As to the allegations under a) to e) of his Opinion, the defendant states

    indicates that he has either been able to defend himself and has been upheld by the

    Disputes Chamber (this concerns allegations a) and b)), or has not disputed the allegations

    and has been corrected in the new privacy statement (this concerns the allegations under c), d) and

    e)). Regarding the established infringement of Article 13.1 c) GDPR regarding the allegation under

    c), the breach of Article 12.1 and Article 13.2 b) GDPR on allegation under point (d) and the Decision on the merits 57/2021 - 13/36




      infringement of article 13.1 c) GDPR regarding the allegation under e) refers the Dispute Chamber

      to the motivation for this in decision 24/2020 of 14 May 2020.

      The defense in the present Opinion focuses only on the allegations under points f), g)

      and H).



  36. To the extent that there would be some uncertainty about the subject of the complaint

      on behalf of the defendant prior to the decision 24/2020, the

      The litigation chamber nevertheless offered the defendant the opportunity to submit itself

      and the Disputes Chamber will then check whether, and if necessary, to what extent the

      defendant has infringed the GDPR with regard to allegations such as

      described in points f), g) and h) of his opinion and whether the administrative fine should be applied

      are maintained.






        b) Legal basis for the purposes stated under 4.3 of the privacy statement



  37. The defendant argues that it can rely on its legitimate interests for the

      processing of non-sensitive personal data for the following purposes

      under point 4.3 of the old privacy statement:

          • performing computer tests;

          • monitoring the quality of the service;

          • training of personnel;

          • monitoring and reporting;

          • the storage of video surveillance recordings during the legal period; and

          • compiling statistics on coded data, including big data.







  38. For each of these purposes, the defendant has carried out a balancing of interests. The


      The Disputes Chamber below assesses the weighing of interests for each of these purposes
                                                         2
      in accordance with the firm decision-making it uses to assess the

      legitimate interest.



  39. In accordance with article 6.1 f) GDPR and the case law of the Court of Justice of the European

      Union must meet three cumulative conditions for a





2 See inter alia: Decision on the merits 03/2021 of 13 January 2021; Decision on the merits 71/2020 of October 30, 2020;

Decision on the merits 36/2020 of 9 July 2020; Decision on the merits 35/2020 of 30 June 2020. Decision on the merits 57/2021 - 14/36




      controller can validly invoke this ground of lawfulness, “te

      know, in the first place, the promotion of a legitimate interest of the

      controller or of the third party (ies) to whom the data are provided, in the

      second, the necessity of processing the personal data for the purpose

      of the legitimate interest, and, thirdly, the condition that the fundamental

      rights and freedoms of the person involved in data protection do not prevail ”

      (“Rigas” judgment).



  40. In order to be able to rely on the lawfulness ground of

      in other words, the “legitimate interest” is the responsibility of the controller

      to show that:

    1) the interests pursued by this processing can be recognized as justified

        (the “target key”);

    2) the intended processing is necessary for the realization of these interests (the


        “Necessity test”); and

    3) the balancing of these interests against the interests, fundamental freedoms and

        fundamental rights of data subjects weighs in favor of the

        controller (the “balancing test”).



  41. With regard to the purpose of “performing computer tests”, the defendant argues

      next one:



    “Context of the processing purpose

    This processing purpose includes the tests performed by IT testers and developers:

    • related to "changes", which are minor changes or related to purely functional ones

    aspects; and

    • in the context of any automation projects.

    These tests are carried out as part of:

    • IT and network security;


    • the maintenance, improvement and development of (the quality of) Y products and services;

    or

    • improving the customer experience (eg to make internal processes and systems more efficient

    for back-office activities, to enhance the user experience in Y's digital channels

    improve, etc.).






3HvJEU, 4 May 2017, C-13/16, Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde v Rīgas pašvaldības SIA
'Rīgas satiksme', recital 28. See also CJEU, 11 December 2019, C-708/18, TK t / Asociaţia de Proprietari bloc M5A-ScaraA,

recital 40. Decision on the substance 57/2021 - 15/36



  This process does not include the acceptance and emulation phase, which is only specialized by the team

  activities "can be performed before the changes can actually be made

  implemented and can be put into production. ”




42. With regard to the first condition (the so-called “target test”), the Disputes Chamber of

    judgment that the processing purpose should be as described by the defendant

    considered performed for a legitimate interest. The importance that the

    defendant as controller may in accordance with recital 47

    GDPR can be considered justified in itself. The first is therefore satisfied

    condition contained in Article 6.1, f) GDPR.



43. In order to fulfill the second condition, it must be demonstrated that the processing

    necessary for the achievement of the objectives pursued. This means more

    stipulates that the question should be asked whether the same result can be achieved by other means

    are achieved without processing of personal data or without an unnecessarily invasive one

    processing for data subjects.



44. Based on the purpose, being the performance of computer tests, the Dispute Chamber serves

    establish that the defendant asserts that, where possible, dummy data or

    anonymous data is used (e.g. in case of changes where different

    systems or applications are involved and that require a unique reference, such as the

    policy number). Only when there is no other option will personal data be used to collect the

    to be able to realize the intended change or development. Possible possibilities for (a

    further) limitations of data processing are constantly being researched and progressive

    introduced as part of the project 'data anonymization in non-production environments'. Furthermore

    Strict access controls are introduced on the IT environments where the IT tests are carried out

    executed. Procedures are also established for how these IT tests should be carried out

    are carried out, which must be taken into account by all concerned.




45. The Disputes Chamber notes that the defendant states that he only uses personal data

    when there is no other option. During the hearing, Y stated that the tests are always taking place

    based on dummy data, but that the test phase determines the extent to which with

    such data can be tested. After all, in some cases the boundaries of the

    opportunities to do data masking. This has to do with the life cycle of

    the tests, namely gradually dummy data can be used in IT testing, but

    sometimes the processing of personal data is required in order to ensure the interaction between

    to be able to insure applications. The Disputes Chamber is of the opinion that the defendant does so

    reasonably plausible that the computer systems are not always based on Decision on the merits 57/2021 - 16/36




      anonymized or pseudonymized data can be tested. To the second

      condition is thus fulfilled, by showing that the principle of minimal

      data processing (Article 5.1. c) GDPR) has been complied with. Nevertheless, the Disputes Chamber notes

      note that for purposes of clarification as to the customers concerned, the defendant might

      consider providing some brief explanation of the case in the privacy statement

      in which the defendant has no choice but to perform computer tests with personal data.



  46. In order to verify whether the third condition of Article 6.1, f) GDPR - the so-called

      “Balancing test” between the interests of the controller, on the one hand, and the


      fundamental freedoms and fundamental rights of the person concerned, on the other hand - can be fulfilled, should

      reasonable, in accordance with Recital 47 GDPR

      expectations of the data subject. More specifically, it should be evaluated whether “data subject

      at the time and in the context of the collection of the personal data is reasonably permitted
                                                                  4
      expect that processing can take place for that purpose ”.



  47. The Disputes Chamber is of the opinion that when collecting personal data in the framework

      it can be assumed that the policyholder is taking out an insurance policy

      at that time can reasonably expect that his data will be

      used to perform computer tests. After all, customers expect a correct one

      execution of their insurance contracts, which is accompanied by a safe and correct

      management of IT systems. The interest of the customers thus requires that the functionalities of


      the IT environment are tested for this purpose.




  48. Accordingly, the Disputes Chamber decides that the defendant applies for processing for the

      Purpose “conducting computer tests” may rely on the legal basis contained in

      Article 6.1 f) GDPR.




  49. Regarding the purpose “monitoring the quality of the service” and “the

      compiling statistics on coded data, including big data ”, states the


      defendant that this comprises three parts and determines that:



    - For the section “Statistics and quality tests”



        “Context of the processing purpose






4 Recital 47 GDPR. Decision on the merits 57/2021 - 17/36



      Y, as an insurer, is subject to prudential supervision. This means, among other things, that they

      is bound to overall control of its company and its performance, including,

      but not limited to, the audit of the sales performance, performance and fees

      certain hospital networks and the coverages / reimbursements. This relates to the


      general control of the quality of the services and the performance of the

      insurance company to ensure its continuity. This processing purpose

      includes both one-off and recurring reports with or without use

      made of big data methodologies. These are mainly aggregated or

      anonymised reports, unless specific statistics are required (by category

      eg per age group). ”




50. With regard to the first condition (the so-called “target test”), the Disputes Chamber of

    judgment that the context of the processing purpose should be as described by the defendant

    are considered performed for a legitimate interest. The importance that the

    defendant as controller may in accordance with recital 47

    GDPR can be considered justified in itself. The first is therefore satisfied

    condition contained in Article 6.1, f) GDPR.



51. In order to fulfill the second condition, it must be demonstrated that the processing

    necessary for the achievement of the objectives pursued. This means more

    stipulates that the question should be asked whether the same result can be achieved by other means

    are achieved without processing of personal data or without an unnecessarily invasive one

    processing for data subjects.



52. The Disputes Chamber notes that the defendant only justifies that it is for him

    is necessary to compile statistics and perform quality testing, as the

    financial viability, quality of service, premium setting and the

    performance cannot be determined without actively measuring it. The Disputes Chamber misunderstands

    by no means the need for the defendant to have statistics and

    quality tests, but the defendant mainly limits himself to asserting that

    aggregated or anonymized reports are prepared, unless specific statistics

    required (per category such as eg per age group). Moreover, the defendant proposes that

    the format of those reports may or may not be using big data methodologies.



53. To what extent the statistics still contain personal data or allow to proceed with

    re-identification of a data subject will be further explained during the hearing. The

    defendant states that there are still very few statistics containing personal data. The Decision on the merits 57/2021 - 18/36




      statistics do not contain names and certainly no health data. The statistics

      do contain codes, but they are mass aggregated, segmented data.
                                                                                   5
      Also requires the directive (EU) 2016/97 on insurance distribution and the Belgian

      implementing legislation of this Directive that provided for specific reporting

      personal data are processed. Sometimes policy data is processed in the reporting,

      but with that no further processing in the statistics takes place. Each report has one

      purpose and the processing may not go beyond that. A register is kept of

      those reports and their purpose, which are strictly regulated through the data warehouse and

      which requires "approvals" to deviate from it.



  54. The Disputes Chamber decides that the defendant has made the necessary efforts to resolve the

      limit data processing for this purpose to what is strictly necessary. To the second

      condition is thus fulfilled by showing that the principle of minimal

      data processing (Article 5.1. c) GDPR) has been complied with.




  55. In order to verify whether the third condition of Article 6.1, f) GDPR - the so-called

      “Balancing test” between the interests of the controller, on the one hand, and the

      fundamental freedoms and fundamental rights of the person concerned, on the other hand - can be fulfilled, should

      reasonable, in accordance with Recital 47 GDPR

      expectations of the data subject. More specifically, it should be evaluated whether “data subject

      at the time and in the context of the collection of the personal data is reasonably permitted

      expect that processing can take place for that purpose ”.




  56. The Disputes Chamber follows the defendant's position that if a person has a

      enters into an insurance agreement with Y, he can reasonably expect that Y will be intern

      performs checks and compiles statistics to ensure that Y is contractual

      fulfill obligations.




  57. Accordingly, the Disputes Chamber decides that the defendant applies for processing for the

      Purpose “Statistics and Quality Requirements” can invoke the legal basis included in

      Article 6.1 f) GDPR.



    - For the section “Satisfaction surveys”








5 Directive (EU) 2016/97 of the European Parliament and of the Council of 20 January 2016 on insurance distribution

(recast), OJ L 26/19. Decision on the merits 57/2021 - 19/36



      “Context of the processing purpose

      This processing purpose includes determining the NPS ("Net Promoter Score"), the

      satisfaction factor of the customers based on an external survey by a third party to determine the

      to safeguard anonymity of the query. This factor is calculated with regard to the follow-up


      by the Y Contact Center and the claims department (claims handling)



58. With regard to the first condition (the so-called “target test”), the Disputes Chamber of

    judgment that the processing purpose should be as described by the defendant

    considered performed for a legitimate interest. The importance that the


    defendant as controller may in accordance with recital 47

    GDPR can be considered justified in itself. The first is therefore satisfied

    condition contained in Article 6.1, f) GDPR.



59. In order to meet the second condition, it must be demonstrated that the processing

    necessary for the achievement of the objectives pursued. This means more

    stipulates that the question should be asked whether the same result can be achieved by other means

    are achieved without processing of personal data or without an unnecessarily invasive one

    processing for data subjects.



60. Based on the purpose of conducting satisfaction surveys, the

    Disputes Chamber to determine that the defendant asserts that the customer through this questioning

    can give an opinion anonymously and thus assert his interests. The results

    are aggregated and processed by an outside company so that the anonymity of the

    those involved can be indemnified. During the hearing it is added that the

    customers always have the choice whether or not to participate in the survey, as they always have

    have the right to object. The Disputes Chamber finds that the customers thus over

    have the necessary freedom of choice and that the results of those who participate in the

    survey in anonymous form will be made available to the defendant.

    The second condition is thus fulfilled by showing that the principle of

    minimum data processing (Article 5.1. c) GDPR) has been complied with.



61. In order to verify whether the third condition of Article 6.1, f) GDPR - the so-called

    “Balancing test” between the interests of the controller, on the one hand, and the

    fundamental freedoms and fundamental rights of the person concerned, on the other hand - can be fulfilled, should

    reasonable, in accordance with Recital 47 GDPR

    expectations of the data subject. More specifically, it should be evaluated whether “data subject Decision on the substance 57/2021 - 20/36




      at the time and in the context of the collection of the personal data is reasonably permitted
                                                                  6
      expect that processing can take place for that purpose ”.



  62. The Disputes Chamber is of the opinion that when collecting personal data in the framework

      it can be assumed that the policyholder is taking out an insurance policy

      at that time can reasonably expect that his data will be provided by the defendant

      will be used to gauge his satisfaction with the service provided by the

      defendant.





  63. Accordingly, the Disputes Chamber decides that the defendant applies for processing operations for the

      purpose “conducting satisfaction surveys” can rely on the legal basis

      included in Article 6.1 f) GDPR.



    - For the part “Quality tests operations”


        “Context of the processing purpose

        This processing purpose relates to the general control of the quality of

        the operational services and performance of Y. This is about quality checks where

        every employee involved must perform 2 random checks per week for up to

        the correct underwriting or performance of the insurance contract and applicable

        instructions and procedures for this purpose. "




  64. With regard to the first condition (the so-called “target test”), the Disputes Chamber of

      judgment that the processing purpose should be as described by the defendant

      considered performed for a legitimate interest. The importance that the

      defendant as controller may in accordance with recital 47

      GDPR can be considered justified in itself. The first is therefore satisfied

      condition contained in Article 6.1, f) GDPR.



  65. In order to fulfill the second condition, it must be demonstrated that the processing

      necessary for the achievement of the objectives pursued. This means more

      stipulates that the question should be asked whether the same result can be achieved by other means


      are achieved without processing of personal data or without an unnecessarily invasive one

      processing for data subjects.








6 Recital 47 GDPR. Decision on the merits 57/2021 - 21/36




  66. Based on the purpose, being the general control of the quality of the operational

      services and performance of Y, the Disputes Chamber must determine that the defendant is late

      apply that Y is subject to the insurance distribution directive (EU) 2016/97

      and the Belgian implementing legislation that the insurance companies oblige them

      tailor services to the desires and needs of their customers. As indicated

      during the hearing, the defendant does not invoke his legal obligation (Article 6.1

      c) GDPR) as the legal basis for the processing, given the nature and scope of the reporting

      is not explicitly imposed as such by law. Hence, the defendant for that

      processing its 'legitimate interest under that legislation' as the legal basis.


      The second condition is thus fulfilled by showing that the principle of

      minimum data processing (Article 5.1. c) GDPR) has been complied with. The processing of

      personal data is necessary in order to actively measure the quality of the service.



  67. In order to verify whether the third condition of Article 6.1, f) GDPR - the so-called

      “Balancing test” between the interests of the controller, on the one hand, and the

      fundamental freedoms and fundamental rights of the person concerned, on the other hand - can be fulfilled, should

      reasonable, in accordance with Recital 47 GDPR

      expectations of the data subject. More specifically, it should be evaluated whether “data subject

      at the time and in the context of the collection of the personal data is reasonably permitted

      expect that processing can take place for that purpose ”. 7




  68. The Disputes Chamber is of the opinion that when collecting personal data in the framework

      it can be assumed that the policyholder is taking out an insurance policy

      at that time can reasonably expect that his data will be

      used to carry out internal quality control to ensure that Y hair

      comply with legal and contractual obligations.



  69. Accordingly, the Disputes Chamber decides that the defendant applies for processing operations for the

      purpose “quality testing operations” can rely on the legal basis included in Article

      6.1 f) GDPR.



  70. With regard to the purpose of “training personnel”, the defendant states the following:




    “Context of the processing purpose








7 Recital 47 GDPR. Decision on the merits 57/2021 - 22/36



  This includes the organization and follow-up of training courses, awareness-raising sessions ("awareness") and

  training for Y employees who come into contact with (personal data of) customers.

  Training courses include:

  • insurance technical aspects (eg with regard to Y products);


  • technical aspects (eg the use of Office 365 applications, training on

  information security, etc.);

  • "on the job" training courses (training for new employees as well as training with the aim of increasing the

  to continuously improve service quality); and

  • more general aspects such as compliance topics (eg the GDPR, IDD, etc.). ”



71. With regard to the first condition (the so-called “target test”), the Disputes Chamber of

    judgment that the processing purpose should be as described by the defendant

    considered performed for a legitimate interest. The importance that the

    defendant as controller may in accordance with recital 47

    GDPR can be considered justified in itself. The first is therefore satisfied

    condition contained in Article 6.1, f) GDPR.



72. In order to fulfill the second condition, it must be demonstrated that the processing

    necessary for the achievement of the objectives pursued. This means more

    stipulates that the question should be asked whether the same result can be achieved by other means

    are achieved without processing of personal data or without an unnecessarily invasive one

    processing for data subjects.



73. Based on the purpose, being the training of personnel, the Disputes Chamber should be established

    to argue that the defendant argues that in exceptional cases the cases are used

    contain, or become, personal data of customers for the training

    personal data of customers used for the preparation of the training material. The

    defendant argues that the underlying material (cases), however, is generally complete

    is anonymized.



74. The Disputes Chamber notes that the defendant states that in the context of training courses the

    cases only contain personal data of customers in exceptional cases or

    personal data of customers are used for the preparation of the training material.

    However, the defendant fails to clarify in which cases he would be required

    offer training to staff based on customers' personal data.

    The defendant does not reasonably demonstrate that staff training is not always on

    could be provided on the basis of anonymised data. To the second Decision on the merits 57/2021 - 23/36




      condition is thus not fulfilled because it has not been demonstrated that the principle of minimal

      data processing (Article 5.1. c) GDPR) has been complied with.



  75. In order to verify whether the third condition of Article 6.1, f) GDPR - the so-called

      “Balancing test” between the interests of the controller, on the one hand, and the

      fundamental freedoms and fundamental rights of the person concerned, on the other hand - can be fulfilled, should

      reasonable, in accordance with Recital 47 GDPR

      expectations of the data subject. More specifically, it should be evaluated whether “data subject

      at the time and in the context of the collection of the personal data is reasonably permitted

                                                                  8
      expect that processing can take place for that purpose ”.



  76. The Disputes Chamber is of the opinion that when collecting personal data in the framework

      it cannot be assumed that the policyholder takes out insurance

      at that time can reasonably expect that his data will be

      used for staff training. A policyholder can only expect to

      normal management of his customer file, which only requires access to the information contained therein

      information by the personnel who have to perform tasks therein for the benefit of the person concerned

      customer. When information from concrete files is shared in the context of a course,

      the processing of that information is not limited to those who have to perform tasks in

      the relevant file.




  77. Accordingly, the Disputes Chamber decides that the defendant applies for processing operations for the

      purpose "training of personnel" cannot rely on the legal basis "justified."

      interest "and there is therefore a violation of article 6.1 f) GDPR. The Disputes Chamber observes

      in addition to that if the defendant nevertheless wishes to receive personal data of customers

      use for staff training, he can rely on another legal basis

      being the consent (Article 6.1 a) GDPR).



  78. With regard to the purpose of “monitoring and reporting”, the respondent states the following:



       “Context of the processing purpose

       This processing purpose includes the preparation of reports for the purpose of checks


       can perform in the context of:

       • IFRS 17 accounting standards for insurance contracts and the Belgian, general

       accepted accounting rules ("Belgian GAAP");






8 Recital 47 GDPR. Decision on the merits 57/2021 - 24/36



     • calculating the reserves (in the context of, for example, the law of 13 March 2016 on

     the status and supervision of insurance or reinsurance companies (Solvency

     II law), etc.); or

     • profitability monitoring or reporting in the context of major damage claims.


     These reports are created for both internal audit and reporting purposes

     to the Y1 Re group (of which Y is a part). This keeps recurring reports as well

     one-off ad hoc reports. Only fully aggregated,

     anonymised, or if not otherwise possible pseudonymized reports prepared in

     in the context of major claims or ad hoc reports regarding specific cases or outliers. ”



79. With regard to the first condition (the so-called “target test”), the Disputes Chamber of

    judgment that the context of the processing purpose should be as described by the defendant

    are considered performed for a legitimate interest. The importance that the

    defendant as controller may in accordance with recital 47

    GDPR can be considered justified in itself. The first is therefore satisfied

    condition contained in Article 6.1, f) GDPR.



80. In order to meet the second condition, it must be demonstrated that the processing

    necessary for the achievement of the objectives pursued. This means more

    stipulates that the question should be asked whether the same result can be achieved by other means

    are achieved without processing of personal data or without an unnecessarily invasive one

    processing for data subjects.



81. Based on the purpose, being monitoring and reporting, the Disputes Chamber must determine

    argue that the defendant asserts that the various general financial and

    insurance law regulations (in the context of, for example, the law of 13 March 2016

    on the status and supervision of insurance or reinsurance undertakings

    (Solvency II law)) cannot be complied with without compiling the necessary reports

    or to monitor. As indicated at the hearing, the

    here too, the defendant does not rely on his legal obligation (Article 6.1 c) GDPR) as legal basis

    for the processing, since the nature and scope of the reporting is not explicitly stated as

    imposed by law as such. Hence, the defendant for those processing operations

    Uses "legitimate interest under that legislation" as the legal basis. To the second

    condition is thus fulfilled by showing that the principle of minimal

    data processing (Article 5.1. c) GDPR) has been complied with. The processing of personal data

    is necessary as legislation cannot be complied with without the

    necessary reports are drawn up or monitoring is carried out. Decision on the merits 57/2021 - 25/36




  82. The defendant adds that only fully aggregated, anonymized, or if

      not otherwise possible pseudonymized reports are prepared in the context of large

      claims for damages or ad hoc reports related to specific cases or outliers. To the

      second condition is thus fulfilled by showing that the principle of minimal

      data processing (Article 5.1. c) GDPR) has been complied with.



  83. In order to verify whether the third condition of Article 6.1, f) GDPR - the so-called

      “Balancing test” between the interests of the controller, on the one hand, and the

      fundamental freedoms and fundamental rights of the person concerned, on the other hand - can be fulfilled, should


      reasonable, in accordance with Recital 47 GDPR

      expectations of the data subject. More specifically, it should be evaluated whether “data subject

      at the time and in the context of the collection of the personal data is reasonably permitted
                                                                 9
      expect that processing can take place for that purpose ”.



  84. The Disputes Chamber is of the opinion that when collecting personal data in the framework

      it can be assumed that the policyholder is taking out an insurance policy

      at that time can reasonably expect that his data will be

      used for the fulfillment of the legal and contractual obligations of the defendant.



  85. Accordingly, the Disputes Chamber decides that the defendant applies for processing operations for the

      purpose “monitoring and reporting” can rely on the legal basis included in article 6.1


      f) GDPR.





  86. Regarding the purpose “the storage of video surveillance recordings during the

      legal period ”, the defendant states that:



      “Context of the processing purpose

      It concerns the processing of personal data by means of the cameras that are located

      within Y's premises with the aim of customer security, data security and the

      protection of the company's assets. "




  87. With regard to the first condition (the so-called “target test”), the Disputes Chamber of

      judgment that the processing purpose should be as described by the defendant

      considered performed for a legitimate interest. The importance that the






9 Recital 47 GDPR. Decision on the merits 57/2021 - 26/36




      defendant as controller may in accordance with recital 47

      GDPR can be considered justified in itself. The first is therefore satisfied

      condition contained in Article 6.1, f) GDPR.



  88. In order to fulfill the second condition, it must be demonstrated that the processing

      necessary for the achievement of the objectives pursued. This means more

      stipulates that the question should be asked whether the same result can be achieved by other means

      are achieved without processing of personal data or without an unnecessarily invasive one

      processing for data subjects.



  89. Based on the purpose, being the provision of video surveillance, the Disputes Chamber serves

      establish that the defendant asserts that the images are stored in a secure

      surroundings. Both the space and the affected IT servers are subject to strict

      access protection. The images are accessed according to strict procedures. The


      storage of the images is also limited to the legal retention period (in principle 30 days).



  90. The second condition is thus fulfilled in that it was established that the principle of

      minimum data processing (Article 5.1. c) GDPR) has been complied with.



  91. In order to verify whether the third condition of Article 6.1, f) GDPR - the so-called

      “Balancing test” between the interests of the controller, on the one hand, and the

      fundamental freedoms and fundamental rights of the person concerned, on the other hand - can be fulfilled, should

      reasonable, in accordance with Recital 47 GDPR

      expectations of the data subject. More specifically, it should be evaluated whether “data subject

      at the time and in the context of the collection of the personal data is reasonably permitted

      expect that processing can take place for that purpose ”. 10



  92. The Disputes Chamber is of the opinion that with the collection of personal data in the framework

      it cannot be assumed that the policyholder takes out insurance


      at that time can reasonably expect that his data will be

      used for video surveillance. The purpose of video surveillance is unrelated to the

      conclusion of an insurance contract, so that the policyholder does not adhere to it

      can expect that his personal data is provided in response to a

      insurance contract will be used in the context of video surveillance. Only at

      there is video surveillance when physically entering the defendant's premises and then it suffices






10
  Recital 47 GDPR. Decision on the merits 57/2021 - 27/36



    that the camera law is complied with, including the obligation to affix a

    icon with information to notify the data subject.



93. Accordingly, the Disputes Chamber decides that the defendant applies for processing operations for the


    purpose “the storage of video surveillance recordings during the legal period” does not

    can rely on the legal basis "legitimate interest" and thus there is an infringement

    to Article 6.1 f) GDPR.



94. For the sake of completeness, the Disputes Chamber adds that if a controller

    wishes to use surveillance cameras, these are legal obligations

    ensuing from the law of 21 March 2007 regulating the placement and use of

    security cameras must comply. As soon as a controller uses

    of surveillance cameras, arise from the aforementioned law obligations regarding

    data processing, so that the controller can rely on article 6.1 c)

    GDPR. In that regard, the defendant stated at the hearing that in

    the necessary pictograms have been affixed in accordance with this law.





      c) Model of balancing of interests



95. For each of the foregoing purposes, the defendant argues that the

    processing purpose is permissible because of the quantitative score calculated by the model

    balance of interests that Y uses is lower than 30. The defendant argues that on the basis of that

    model the processing purposes can be based on the legitimate interests

    of the controller as long as this score does not exceed 30.



96. In this regard, the Disputes Chamber should note that the model used by Y is a

    is a purely internal instrument that can at most act as a guideline within the company,

    but from which no legal arguments can be drawn to support the assessment against the

    legal basis of Article 6.1 f) GDPR. To the scores calculated on the basis of that model

    therefore no legal value can be attached.





      d) All legal grounds included in Article 6.1 GDPR



97. The defendant is of the opinion that the Disputes Chamber in its decision 24/2020 would have stated that

    he can only rely on consent as a legal basis (Article 6.1 a) GDPR) for the Decision on the merits 57/2021 - 28/36



          processing purposes included in point 4.3. of the old privacy statement and not on

          the other legal grounds of Article 6.1 GDPR.



      98. The Disputes Chamber explains that the following was made in this regard in the decision 24/2020


          mention:

          The Disputes Chamber is therefore of the opinion that the violation of art. 6.1. AVG is proven,

          since the data processing is for the purposes stated in sections 1, 2, 3, 4, 6 and

          7 of point 4.3. of the privacy statement, without any demonstrated legitimate interest,

          should be based on the consent of the complainant in the absence of any other possible

          applicable legal basis in art. 6.1. AVG. ”



      99. From this the defendant deduces, albeit incorrectly, that the Dispute Chamber is the only one

          legal basis for the purposes specified therein precedes the consent. The defendant

          however, ignores the fact that the Disputes Chamber reaches that decision, precisely because the

          defendant fails to demonstrate any legitimate interest and thus in

          fails to demonstrate that the applicable conditions have been fulfilled to comply with this

          legal basis in Article 6.1 f) GDPR. The Disputes Chamber stated in its decision

          after all expressly that the defendant has in no way demonstrated from what

          legitimate interest or would exist and also failed to demonstrate to what extent his interest

          would outweigh the interests and fundamental rights of the complainant, although the defendant

          is obliged to do so on the basis of its accountability obligation (Article 5.2 GDPR). The

          Accordingly, the Disputes Chamber could not withhold article 6.1 f) GDPR as a valid legal basis. On base

          of the factual elements leading to the decision 24/2020 was the only remaining

          legal basis the consent.



      100. The Disputes Chamber emphasizes that every controller, including the

          defendant, can invoke any possible legal basis of Article 6.1 GDPR, but that the

          applicable conditions for the legal basis invoked must be fulfilled.





2. Legal basis for transfers to third parties




      101. First, the defendant claims that a transfer to third parties does not have a processing purpose

          is itself, but is merely a form of processing of personal data within the meaning of Article

          4.2 GDPR. The defendant states that he only draws up balances of interests per

          processing purpose, but not per processing. Decision on the merits 57/2021 - 29/36



      102. The Disputes Chamber states that it follows from article 5.1 a) GDPR that personal data must be

          processed for a specific purpose and that such processing must be lawful in the sense

          of Article 6.1 GDPR. So it is clear that any processing must be done within the framework

          of a specific, explicit and justified purpose and that


          processing must be based on a legal ground for it to be lawful

          considered. It is of course possible to perform multiple processing operations within the meaning of Article 4.2 GDPR

          for the same purpose, but this does not alter the fact that the

          data processing for a specific purpose can only be considered lawful

          labeled if there is a legal basis for doing so.



      103. The Disputes Chamber notes that any transfer to third parties must be determined with the

          in view of the purpose for which the transfer takes place. To be able to verify whether the transfer is to

          third parties can be regarded as lawful, it must thus be determined for what purpose

          which is passed on to third parties.




      104. As the defendant rightly points out, the legal basis for the transfer to processors (which

          however, no third parties within the meaning of Article 4, 10) GDPR) are the same as for the

          data processing by the defendant himself. After all, the processing purpose remains

          unchanged, as the processor only processes the personal data for the benefit of the

          defendant as controller.




      105. If the personal data are transferred to a third party within the meaning of Article 4. 10)

          GDPR with a view to the purpose of enabling that third party to provide the relevant personal data

          to process it for your own purposes, then that transfer must cease for that specific purpose

          considered themselves and requires a separate legal basis. With a view to

          transparency should become the processing basis for all transfers in the privacy statement

          stated that the defendant fulfills his obligation under art. 13.1 c) would comply with GDPR. This is

          However, this is not the case, so that the Disputes Chamber is of the opinion that there is a

          infringement of art. 13.1. c) GDPR in conjunction with Article 5.1 a) GDPR and Article 5.2 GDPR.





3. Transparency principle




      106. Notwithstanding the fact that Article 13.1 d) GDPR requires the controller to send the

          provides the data subject with information about his legitimate interests, if the processing

          is based on Article 6 (1) (f), the defendant maintains that it suffices

          for the purposes of the privacy statement referred to in point 4.3, as well as for the purposes of 6 of the Decision on the merits 57/2021 - 30/36



    data transfers based on Article 6 (1) (f) GDPR only

    state that personal data is processed on the basis of the legitimate interest of

    the defendant without indicating exactly what that legitimate interest would consist of.




107. The defendant argues that the balancing of interests concerns internal documents that have not been handled by Y

    made public or included in its Privacy Statement, in view of the

    business sensitive information they contain. Moreover, this involves bulky, rather privacy-

    technical documents that are typically not included in a privacy statement.



108. For transmission to “the companies of the group Y1 Re to which Y belongs, for monitoring

    and reporting ”, the defendant confirms that this is a transfer to another

    controller, indicates the defendant demonstrating his legitimate interest

    consists in its conclusion under the processing purpose “monitoring and reporting”, but late

    after clarifying his legitimate interest in the privacy statement.



109. Furthermore, the defendant also refers to recital 48 of the GDPR which states that

    controllers that are part of a concern or group of institutions

    associated with a central body may have a legitimate interest in the

    forwarding of personal data within the group for internal administrative purposes,

    including the processing of personal data of customers or employees.



110. The Disputes Chamber acknowledges that consideration 48 applies to the defendant, but this

    does not prevent the defendant from being transparent about this in his privacy statement and

    also in such a case must indicate the legal basis and must make it clear where it is

    legitimate interest exists, which is not the case in the old privacy statement.




111. Responsible for transfers to “subcontractors in the European Union or abroad

    for processing activities defined by Y ”, the defendant argues that it concerns

    processors of Y.



112. The Disputes Chamber therefore restates the reasoning in this regard from its decision

    24/2020 to decide on an infringement of Article 13.1 d) GDPR in conjunction with Article 5.1 a) GDPR

    and Article 5.2 GDPR. The privacy statement only mentions that for those referred to in 4.3. listed

    purposes personal data are processed on the basis of the legitimate interest of the

    defendant without indicating exactly what that legitimate interest would consist of,

    while art. 13.1. d) GDPR does require the controller to comply

    obliged to provide the data subject with information about his legitimate interests,

    if the processing is based on Article 6 (1) (f). Decision on the merits 57/2021 - 31/36







  113. The Disputes Chamber also refers to the Guidelines of the European Committee for the

      data protection (EDPB) on transparency according to Regulation (EU)

      2016/679, who stress the need to identify the specific interest in question

      for the benefit of the data subject.





  114. Also with regard to point 6. of the privacy statement, the defendant does not indicate why

      legitimate interest, on which he relies, would exist to obtain personal data from the

      to process the complainant for the purpose of transferring it to “The companies of the Y1 RE group

      to which Y belongs, for monitoring and reporting ”and“ Subcontractors in the European Union

      or beyond, responsible for processing activities defined by Y ”. However

      requires art. 13.1. d) GDPR in fact that the controller is the data subject

      must provide information about his legitimate interests, if the processing

      is based on Article 6 (1) (f). The Disputes Chamber refers again to the

      Guidelines on transparency in accordance with Regulation (EU) 2016/679 and the

      stated above in this regard.





  115. The Disputes Chamber stated in its decision 24/2020 that as best practice the

      controller also, before becoming personal data of the data subject

      collected, can provide the data subject with information about the assessment to be made

      created in order to be able to use Article 6 (1) (f) as a legal basis for the processing.

      To avoid information fatigue, this information can be included in a layered

      privacy statement / notice. 12 The information provided to data subjects should make clear

      that these data subjects can receive information about the assessment upon request. This is

      essential for effective transparency when data subjects have doubts about the

      fairness of the consideration made as to whether to submit a complaint to a supervisory authority

      authority.




  116. As the defendant points out, he is unwilling to apply the aforementioned best practice,

      because, according to him, it concerns internal privacy-technical documents with company-sensitive

      information.








11
  EDPB, Guidelines of the Article 29 Working Party on Data Protection on Transparency under Regulation (EU)
2016/679, approved November 29, 2017, last revised and approved April 11, 2018, p. 42.
12See paragraph 35 of the guidelines referred to in footnote 6. Decision on the substance 57/2021 - 32/36




      117. The Disputes Chamber argues that even if the defendant refuses to follow this best practice,

           he is at least obliged to notify the data subject on a

           concise, transparent, intelligible and easily accessible form and in clear and

           provide simple language information about his legitimate interest for each of the


           purposes for which he relies on that legal basis. It is by no means to comply with this

           requires privacy-technical documents to be made public, but it is

           requires that information about the legitimate interest is provided in clear

           wording that can be easily understood by a customer or potential customer of the defendant



      118. The Disputes Chamber finds that the information required by Article 13.1 d) GDPR is in no way whatsoever

           is made available by the defendant, so that the infringement of Article 13.1 d)

           GDPR in conjunction with article 5.1 a) GDPR and article 5.2 GDPR.








4. Administrative fine




      119. The fact that the defendant does indeed commit the infringements of Articles 5.1 a), 5.2, 6.1, 12.1, 13.1

           c) and d) and 13.2 b) GDPR, brings the Dispute Chamber to the administrative

           fine. This sanction does not extend to an offense committed

           but with a view to vigorous enforcement of the rules of the GDPR. As


           is clear from recital 148 of the GDPR, the GDPR states that in the event of any serious infringement

           - including when an infringement is first established - penalties, including administrative ones
                                                                                              13
           fines are imposed in addition to or instead of appropriate measures. After this, the

           Disputes Chamber states that the breaches committed by the defendant against Articles 5.1 a),

           5.2, 6.1, 12.1, 13.1 c) and d) and 13.2 b) GDPR in no way concern minor infringements, nor that the

           a fine would cause a disproportionate burden on a natural person as referred to in

           Recital 148 GDPR, whereby a fine can be waived in either case.

           The fact that it is a first finding of an infringement committed by the defendant in the






    13
      Recital 148 states: “With a view to more vigorous enforcement of the rules of this Regulation, penalties,
    including administrative fines, to be imposed for any breach of the Regulation, in addition to or instead of
    appropriate measures imposed by the supervisory authorities under this Regulation. If it comes
    for a minor infringement or if the foreseeable fine would cause a disproportionate burden on a natural person,
    instead of a fine, a reprimand can be chosen. However, the
    nature, gravity and duration of the infringement, including the intentional nature of the infringement, with measures to mitigate damage,

    with the degree of responsibility, or with previous relevant breaches, with the manner in which the breach became known to the
    supervisory authority has come up with compliance with the measures taken against the
    controller or processor, with affiliation to a code of conduct and any other aggravating or
    mitigating factors. Imposing penalties, including administrative fines, should be subject to
    appropriate procedural safeguards in accordance with general principles of Union law and the Charter, including a
    effective remedy and due process. [own underlining] Decision on the merits 57/2021 - 33/36




      GDPR, does not in any way affect the possibility for the Disputes Chamber

      to impose an administrative fine. The Disputes Chamber explains the administrative

      fine in accordance with article 58.2 i) GDPR.



  120. The Disputes Chamber emphasizes once again that the instrument of administrative fine

      is in no way intended to end infringements. To this end, the AVG and the WOG provide for a

      number of corrective measures, including the orders referred to in Article 100, §1, 8 ° and 9 °

      WOG. She also emphasizes that the administrative fine is one of the sanctions foreseen

      in article 58.2 GDPR and article 100 WOG. Neither EU law nor national Belgian law

      has a hierarchy with regard to the sanctions to be imposed. It stands as the Dispute Chamber

      body of an independent data protection authority as referred to in Article 51

      AVG is free to choose the most appropriate sanction. The Disputes Chamber is of the opinion that, in view of the

      accountability of the controller, the imposition of a

      administrative fine for violation of the GDPR could be expected. 14



                                                                  15
  121. Taking into account article 83 GDPR and the case law of the Marktenhof, the

      Disputes Chamber imposing an administrative sanction in concrete terms:

        - The seriousness of the infringement: the reasoning below shows the seriousness of the infringement.

        - The duration of the infringement: the infringements are assessed for this aspect in

             in light of the date on which the GDPR became applicable, namely May 25

             2018. The defendant's privacy statement appears to have remained unchanged since

             the GDPR becoming applicable until such time as, following the

             complaint, a new privacy statement has been drawn up. The new privacy statement constitutes

             however, not the object of assessment by the Dispute Chamber, so that they themselves

             also does not comment on the extent to which the new privacy statement is consistent

             is with the GDPR.

        - The necessary deterrent effect to prevent further infringements.





  122. With regard to the nature and seriousness of the infringement (art. 83.2 a) GDPR), the Disputes Chamber emphasizes

      that compliance with the principles set out in art. 5 GDPR - in the present case in particular the

      transparency principle including accountability, as well as the

      principle of legality - essential, because it is fundamental principles of

      data protection. The Disputes Chamber considers the defendant's infringement







14 With regard to the jurisdiction of the Disputes Chamber regarding the imposition of an administrative fine, see also decision no
55/2021 of April 26, 2021, available in French on the GBA website.
15
  Court of Appeal Brussels (section Marktenhof), Judgment 2020/1471 of 19 February 2020. Decision on the merits 57/2021 - 34/36



    the principle of legality specified in art. 6 GDPR and the transparency principle

    which is specifically laid down in Articles 12 and 13 GDPR, therefore as a serious violation.



123. An important element in determining the amount of the fine is the fact that the defendant


    subsequent infringements as motivated in decision 24/2020 not disputed and as a result thereof

    has already made efforts to address the new privacy statement on those points

    to comply with the GDPR:

      - Infringement of Article 13.1 c) GDPR due to lack of clear distinction between the

          processing health data on the one hand, and processing the other 'normal'

          personal data on the other hand and this for each of the purposes of 4.3. of the

          privacy statement, as for each of the 6. transmissions of the privacy statement.

      - Violation of Articles 12.1 and 13.2 b) GDPR in the absence of mention in the privacy statement

          of the possibility for the data subject to exercise his right of retention.

      - Infringement of Article 13.1 c) GDPR due to lack of indication of the legal basis for the

          transfer to each of the distinct categories of third parties in point 6. of the

          privacy declaration.




124. Although the changes made to the new privacy statement are a positive element

    when assessing the administrative fine, the Disputes Chamber emphasizes that it is there

    do not seek to rectify the infringements established. The

    infringements have been identified and cannot be reversed retroactively by the

    controller who still processes his data - albeit too late

    complies with the requirements of the GDPR.







125. In addition, the current decision also identifies infringements:

      - Violation of article 6.1 GDPR with regard to the purposes of “training personnel” and

          “The storage of video surveillance recordings during the legal period”.

      - Violation of art. 13.1. c) GDPR in conjunction with Article 5.1 a) GDPR and Article 5.2 GDPR.

      - Violation of article 13.1 d) GDPR in conjunction with article 5.1 a) GDPR and article 5.2 GDPR.




    Furthermore, the Disputes Chamber also takes into account the finding that the violation of Article 6.1

    AVG is limited to two processing purposes “staff training” and “the storage of

    recordings of video surveillance during the legal period ”and is therefore of a nature to be a

    justify a reduction in the amount of the fine. In addition, the established

    breaches of the principle of transparency and accountability are so serious Decision on the substance 57/2021 - 35/36




          that a substantial fine is required. This applies all the more in view of the large scale

          of the processing of non-health data by the defendant with

          decisive impact on all insured persons who have taken out hospitalization insurance

          affiliated with Y, which concerns a significant number of stakeholders. A decisive element

          this is also due to the fact that Y is a major player in the insurance market that may become

          expects the latter to duly and with the necessary conscientiousness align its privacy policy with the

          GDPR.



      126. With regard to the lack of transparency, the Disputes Chamber also points out that the GDPR is exactly

          has provided for a transition period of 2 years 16 to the end of each controller

          give the necessary time to prepare and adapt to the requirements set by the

          GDPR. The defendant's argument made at the hearing that the changes

          which the GDPR has implemented compared to the previous directive 95/46 / EC of the European

          Parliament and the Council on the protection of individuals with regard to the


          processing of personal data and on the free movement of such data to the

          based on the lack of transparency cannot therefore be accepted. The

          defendant argues that Articles 13 and 14 GDPR, in conjunction with Article 12 GDPR, and the precise manner of

          interpretation of it caused the difficulty. The transparency guidelines of

          Group 29 (now EDPB) were an auxiliary tool. Here too, the Disputes Chamber serves

          state that those guidelines date back to 29 November 2017, have been revised and adopted

          on April 11, 2018 and have remained unchanged since then. The defendant thus disposed of

          sufficient time, as required by its accountability (Article 5.2 GDPR)

          privacy statement to align with the GDPR.



      127. This leads the Disputes Chamber to reconsider the fine and reduce it to € 30,000.



      128. The totality of the elements set out above justifies an effective,

          proportionate and dissuasive sanction as referred to in art. 83 GDPR, taking into account the therein

          certain assessment criteria. The Disputes Chamber points out that the other criteria of art. 83.2.


          GDPR in this case are not such as to lead to a different administrative fine than

          those adopted by the Disputes Chamber in the context of this decision.





5. Publication of the decision








    16
      Article 99 GDPR Decision on the substance 57/2021 - 36/36



  129. Given the importance of transparency with regard to the decision-making process of the

     Disputes Chamber, this decision will be published on the GBA website. However, it is

     does not require that the identification data of the parties be directly

     announced.




FOR THESE REASONS,



the Dispute Chamber of the Data Protection Authority, after deliberation, will decide for her

to review decision 24/2020 of 14 May 2020 and to review the defendant pursuant to art. 100, §1, 13 ° WOG

and art. 101 WOG to impose an administrative fine of € 30,000.00 as a result of the infringements

to Articles 5.1 a), 5.2, 6.1, 12.1, 13.1 c) and d) and 13.2 b) GDPR.



On the basis of Article 108, §1 WOG, an appeal can be lodged against this decision within

a period of thirty days from the notification at the Marktenhof, with the

Data protection authority as defendant.





(Get) Hielke Hijmans

Chairman of the Disputes Chamber