APD/GBA (Belgium) - 141/2022

APD/GBA - 141/2022
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 17 GDPR Article 17(3) GDPR Article 17(3)(a) GDPR Article 89 GDPR
Type:	Complaint
Outcome:	Rejected
Started:	19.02.2021
Decided:	04.10.2022
Published:	04.10.2022
Fine:	n/a
Parties:	n/a
National Case Number/Name:	141/2022
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	French
Original Source:	Gegevensbeschermingsautoriteit (in FR)
Initial Contributor:	Enzo Marquet

The Belgian DPA dismissed a complaint for reasons of expediency, since the lack of evidence would require disproportionate resources for the investigation compared to the importance of the complaint.

English Summary

Facts

A picture of the data subject's house was used in a news article about a 'lock-down' party. This article was posted on the website of a newspaper (controller). The data subject first contacted the newspaper and requested the removal or correction of the article. According to the data subject, it contained several mistakes, such as the fact that the lock-down party had not taken place in this house. He also stated that the publication of the photo was in essence the same as the publication of his address. As a result, he was discredited by the local community and received hateful messages on social media.

The data subject also contacted the controller's DPO, requesting it to either delete the published information or to correct it. The data subject specifically requested the deletion of the photo of his house, as he felt that it was disproportionate and not necessary for the article. The controller responded that after looking into the matter with the journalist, it confirmed that the information was in the article was in fact accurate.

Holding

The DPA dismissed the complaint for reasons of expediency pursuant to Article 95(1)(3) LCA (Act establishing the data protection authority). Despite the presence of elements that could lead to a sanction, the DPA did not deem further investigation of the case appropriate in the light of the priorities as illustrated in its Discontinuance Policy.

The DPA stated it would balance the personal impact for the fundamental rights and freedoms of the data subject against the effectiveness of action taken by the DPA, in order to decide if it was expedient to continue the proceedings.

Erasure request and balancing exercise

The DPA stated that the request of the data subject was a request for erasure from an online archive, belonging to a press organisation. The DPA reiterated that Article 89 GDPR acknowledged the importance of processing personal data for archiving purposes in the public interest. The DPA also stated that, according to the case law of the CJEU, internet archives were protected under Article 10 ECHR and Article 11 of the Charter. The DPA also added the GDPR provided an exception to its own, specifically Article 17(3)(a) GDPR, ⁣ which prescribes that Article 17(1) GDPR is not applicable when processing is necessary for the freedom of expression and information. For this exception, a balancing exercise has to be conducted between the freedom of expression and the right to data protection. The DPA also referred to the Google Spain case and stated that the rights of privacy and data protection (Article 7 and 8 of the Charter) usually prevail in this balancing test. However, this balancing exercise can in special cases depend on the nature of the specific information and the sensitivity of this information for the privacy of the data subject, as well as the public’s interest in having access to this information, which can vary depending on the role of the data subject in public life. (C-131/12, par 81).

The DPA determined that the sole wish from data subject to be removed from the online archive was not sufficient. Digital archives contain valuable information for which accessibility must be preserved. Archives also contribute to democratic opinion-forming. Any measure preventing access to these archives must be justified with particularly compelling reasons. The DPA also added that the ECHR had stated that there is more room for balancing conflicting interests when the archived information relates to past events than when it relates to current or recent events.

The DPA stated that the photo of the house constituted personal data, because the data subject was the owner of the house, which made him indirectly identifiable. Therefore, the data subject was entitled to use Article 17 GDPR to request removal, if any of the requirements in Article 17 GDPR were applicable. However, the DPA determined that the processing in this case fell under the journalistic exception. The controller could have a legitimate interest for the processing of this information. In general, erasure request were also thoroughly reviewed by the controller using journalistic ethical rules, especially regarding the truthfulness of the information and confidentiality of used sources.

The data subject's position was that the lockdown party did not take place in his building, but he did not provide any evidence. The controller stated that this was incorrect, after checking this fact with the responsible journalist internally. The DPA determined that the positions of both parties were opposites. Without decisive evidence, a balancing act pursuant to Article 17(3)(a) GDPR was deemed impossible.

The DPA continued by stating that at first glance, the complaint was not precise enough and provided too little evidence to enable the DPA to make a decision without starting an investigation. The DPA determined that it was not expedient to enlist the help of its investigation service. An investigation would not be proportionate, looking at the resources necessary to make the investigation a success. Also, at first glance, the DPA determined that it would not be able to gather evidence in this case, unless it would interview the journalist and ask him to reveal his sources. This kind of investigation is normally not a priority for the DPA.

The DPA suggested the option to data subject that he could select a more appropriate legal remedy.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/7







                                                                        Litigation Chamber



                                                       Decision 141/2022 of October 4, 2022



File number: DOS-2021-00827



Subject: Complaint relating to the publication of personal data in the press




The Litigation Chamber of the Data Protection Authority, made up of Mr Hielke

Hijmans, President, sitting alone;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and

to the free movement of such data, and repealing Directive 95/46/EC (general regulation on the

data protection), hereinafter GDPR;

Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter

ACL);


Having regard to the Law of 30 July 2018 relating to the protection of natural persons with regard to

processing of personal data (hereinafter LTD);

Having regard to the Rules of Procedure as approved by the House of Representatives on 20

December 2018 and published in the Belgian Official Gazette on January 15, 2019;


Considering the documents in the file;




Made the following decision regarding:

The complainant: Mr. X, hereinafter “the complainant”;

The defendant: Y, hereinafter “the defendant”. Decision 141/-2/7


I. Facts and procedure


    1. The complainant filed a complaint with the Data Protection Authority (DPA) on 19

        February 2021 regarding the publication of the photo of the house he owns in

        the online pages of the defendant's newspaper. This photo illustrated an article relating

        a “lock-down” party in an Ardennes village that took place in said house, according to
        the press article “lockdown party at [locality] – (…)”.



    2. The complainant contacted the newspaper to request the deletion or rectification of

        the article which according to him gives erroneous information:

        - The lockdown party would not have taken place in that accommodation;

        - The people responsible for a lockdown party in the village would never have

            wanted to organize a seminar.




    3. The Complainant believes that publication of the photo is equivalent to publication of his address
        and deplores having suffered damage following this publication: “we have suffered

        degradation of the local population to one of our lodgings, messages of hatred rang out on

        social networks ; we are very badly regarded in the commune”.



    4. Prior to filing his complaint, the complainant contacted the delegate for
        protection of the defendant's data to claim the deletion and/or the

        rectification of the data published, in particular the deletion of the photo estimating this

        disproportionate and unnecessary data for press information on the holding of a

        lockdown party in a Belgian border village, with the corollary, according to the complainant, the

        suspicion of having imported the virus there. In his email of February 16, 2021 to the defendant,
        the plaintiff considered it "unacceptable for the press to throw out erroneous data, without verifying

        their accuracy and without measuring the impact on the lives of its targets, while the information

        brings nothing to the public, neither safety nor useful information”. The defendant has

        replied that after investigation with the journalist concerned, the information

        mentioned in the article are exact and have been treated on the basis of article 24 § 2 of the LTD.



II. Motivation


    5. Based on the facts described in the complaint file as summarized above, and on

        basis of the powers attributed to it by the legislator under Article 95.1.

        LCA, the Litigation Chamber decides to proceed with the classification without follow-up of the

        complaint, in accordance with article 95.1, 3° LCA, for the reasons set out below. Decision 141/-3/7



    6. In terms of classification without follow-up, the Litigation Chamber must justify its decision by

        step and:


        - to pronounce a classification without technical continuation if the file does not contain or not

                sufficient elements likely to lead to a sanction or if it includes a

                technical obstacle preventing him from rendering a decision;


        - or pronounce a classification without further opportunity, if despite the presence

                elements likely to lead to a sanction, the continuation of the examination of the

                file does not seem to him to be appropriate given the priorities of ODA such as

                specified and illustrated in the Chamber's Discontinued Classification Policy

                Litigation. 2





    7. In the event of dismissal on the basis of several reasons (respectively, dismissal

        without technical and/or opportunity follow-up), the reasons for the classification without follow-up must be

        treated in order of importance.



    8. In the present case, the Litigation Chamber proceeds to a dismissal for

        motive of opportunity. Indeed, the Litigation Division notes that the grievances raised by the

        complainant do not meet the high general or personal impact criteria, such as

        defined by the DPA in its note on the classification policy without follow-up of June 18, 2021.



    9. Furthermore, the Litigation Chamber weighs the personal impact of the circumstances

        of the complaint for the fundamental rights and freedoms of the complainant and the efficiency of his

        intervention, to decide whether it considers it appropriate to deal with the complaint in a

        thorough.



    10. According to Article 17.1.c) of the GDPR, a data subject has the right to obtain from the controller

        the processing the erasure, as soon as possible, of personal data the

        concerning when one of the conditions of application of this article applies,

        thus in particular, when the personal data are no longer necessary for the

        with regard to the purposes for which they were collected or otherwise processed

        (Art. 17.1.a) GDPR).








1
2Cour des marchés (Brussels Court of Appeal), September 2, 2020, 2020/AR/329, p. 18.
   See Discontinued classification policy of the Litigation Chamber, 06/18/2021, available at
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
litigation.pdf. Decision 141/-4/7



    11. In this case, the Litigation Chamber is entitled to check whether a person responsible for

        processing has, in its response to the exercise of his right of erasure by a person

        concerned, correctly applied Article 17 of the GDPR. This control also covers

        whether or not it is appropriate to use Article 17.3 of the GDPR, which requires the controller to

        treatment (i.e. the defendant) to operate a balance of interests to conclude or not to

        the need for treatment in the name of freedom of expression.



    12. The Litigation Chamber understands that in this case, the request for erasure concerns

        on the online archives of a press organ. The Litigation Chamber reminds this

        respect that the GDPR recognizes the importance of the processing of personal data for

        archival purposes in the public interest in Article 89. Such processing is subject to

        appropriate safeguards for the rights and freedoms of data subjects.

        In accordance with the case law of the European Court of Human Rights, the 3

        Internet archives are indeed content protected by the right to freedom of expression

        and information (Article 10 of the European Convention on Human Rights (ECHR) and

        Article 11 of the EU Charter of Fundamental Rights).



    13. Article 17.3.a) of the GDPR adds that Article 17.1 will not apply insofar as this

        processing is necessary for the exercise of the right to freedom of expression and information,

        thus providing, under the very terms of Article 17 of the GDPR, an exceptional regime which

        implies a balance of interests between two fundamental rights (the right to freedom

        of expression and the protection of personal data). 4



        In its “Google Spain” judgment of 13 May 2014, the Court of Justice of the European Union

        sets out that, as a general rule, the rights of the data subject enshrined in Articles

        7 and 8 of the Charter of Fundamental Rights of the European Union (EU) (i.e. the right to life

        privacy and the protection of personal data) prevail. Nevertheless, "this

        balance may however depend, in particular cases, on the nature of the information in

        issue and its sensitivity to the privacy of the data subject as well as

        the interest of the public in having this information, which may vary, in particular,

        depending on the role played by that person in public life”.5



    14. As the European Court of Human Rights has repeatedly pointed out,

        the wish of a (concerned) person to erase his past is not sufficient to justify a

        measure of modification of the archives precisely because these archives participate, at the


3
 eur. D.H., HURBAIN v. Belgium, 22 June 2021, req. No. 57292/16. ; see also Litigation Chamber, Decision
439/21, available at https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-139-2021.pdf.
 Litigation Chamber, Decision 139/21, available at https://www.autoriteprotectiondonnees.be/publications/decision-
quant-au-fonds-n-139-2021.pdf.
5C.J.U.E., May 13, 2014, C-131/12, Google Spain and Google judgment, paragraph 81. Decision 141/-5/7



        same title as the initial publication, to the effectiveness of the freedom of expression and

        information as mentioned above. Digital archives are a

        valuable source of information whose accessibility must be preserved. They participate in

        the formation of democratic opinion and any measure limiting access by the public – which

        has the right to receive them – must be justified by particularly compelling reasons .6



    15. The European Court of Human Rights adds that a wider latitude exists for

        balancing competing interests when information is archived

        and relate to past events only when they relate to events

        current, recent..7



    16. In the present case, the image which the complainant requests to be deleted, namely the

        photograph of a house he owns, allows, according to the complainant, to identify him

        indirectly, in connection with the facts reported in the newspaper. This image therefore constitutes a

        personal data within the meaning of the GDPR and the complainant is entitled to request the deletion

        of this data if he demonstrates the conditions of application of Article 17 of the GDPR.



    17. The processing of this data seems to fall within the scope of the journalistic exception

        referred to above and the press organization may have a legitimate interest in processing this

        information. The request for erasure of a journalistic article by the press organ

        itself is subject to the rules of journalistic ethics, in particular with regard to

        concerns the veracity of the data and the secrecy of the sources.



    18. The Litigation Chamber emphasizes - that in support of all the elements which have been

        presented - the complainant's request was the subject of a response from the newspaper. The complainant

        claims without further evidence that the incriminated "lockdown party" would not have taken place

        held in its building. The defendant's organ asserts the opposite after having checked

        this point internally with the journalist in charge



    19. The Litigation Chamber submits that the position adopted by the Complainant and the Respondent

        are diametrically opposed and that the absence of conclusive evidence prevents a

        balancing the interests to operate between the right to data protection on the one hand and the

        right to freedom of expression on the other hand pursuant to Article 17.3. a) GDPR.







6
 See. for example eur court. D.H., Timpul Info-Magazin and Anghel v. Moldova, 27 November 2007; judgment M.L. and W.W.
vs. Germany, June 28, 2008 and Times Newspapers Limited v. United Kingdom judgment, March 10, 2009.
7 European Court. D.H., Times Newspapers Limited v. United Kingdom, 10 March 2009, req. 3002/03 and 2676/03, point 45.
8 GDPR, Art. 6.1.f). Decision 141/-6/7



    20. Indeed, it seems prima facie that the complaint is not sufficiently precise and does not provide

        insufficient evidence to allow the Litigation Chamber to take a

        decision without recourse to an investigation by the Inspection Service. The Litigation Chamber

        considers that it is not appropriate to call on the Inspection Service to substantiate the complaint

        since an examination of the complaint would not be proportionate taking into account the means
                                                                                                 9
        necessary to put the complaint in a state of being examined and of the chances of success . Of
        In fact, it appears prima facie that the DPA would not have the possibility of collecting evidence on this

        subject except to question the journalist and ask him to reveal his sources. This guy

        examination, in principle, does not fall within the priorities of a supervisory authority such as

        ODA.



    21. Accordingly, the Litigation Chamber considers that it does not have the opportunity to rule on

        the existence of a breach of the GDPR based on the elements provided in the complaint.



    22. Furthermore, the Litigation Chamber recalls that the complainant has the possibility of choosing a

        more appropriate legal remedy (e.g. seize the Belgian courts and tribunals, demand a right of

        response and/or seize the ad hoc ethical bodies) in the context of a

        news publication.




III. Publication and communication of the decision


    23. Given the importance of transparency with regard to the decision-making process and the

        decisions of the Litigation Chamber, this decision will be published on the website of

        the Data Protection Authority. However, for this purpose it is not necessary that the

        identification data of the parties are directly communicated.



    24. In accordance with its policy of dismissal, the Litigation Chamber

        communicate the decision to the defendant(s).

        to communicate the decisions of classification without follow-up to the defendants by default. The

        However, the Litigation Chamber refrains from such communication when the complainant

        requested anonymity and when the communication of the decision to the defendant, even

        pseudonymized, risk of allowing the identification of the latter by the person in charge of the

        treatment. This is not the case in this case, the complainant having not requested anonymity.







9 See Discontinuance policy of the Litigation Chamber, “Title 3 – In which cases is my complaint
likely to be dismissed by the Litigation Chamber? », 06/18/2021.
10Cf Discontinued classification policy of the Litigation Chamber, “Title 5 - Will the discontinued classification be published?
will the opposing party be informed? », 06/18/2021. Decision 141/20-7/7






  FOR THESE REASONS,


  The Litigation Chamber of the Data Protection Authority decides, after

  deliberation to close the present complaint without follow-up pursuant to article 95.1,

  3° the Law of 3 December 2017 establishing the Authority for the Protection of


  data.




                                   er
Under Article 108, § 1 of the LCA, this decision may be appealed to the

Court of Markets within thirty days of its notification, with the Authority of

data protection as defendant.


Such an appeal may be introduced by means of an interlocutory request which must contain the

information listed in article 1034ter of the Judicial Code. The interlocutory motion must be

filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 12

via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).


To allow him to consider any other possible course of action, the Litigation Chamber sends

                                                                                                    13
the complainant to the explanations provided in its dismissal policy.








(Sé). Hielke Hijmans


President of the Litigation Chamber

















11The request contains on pain of nullity:
  (1) indication of the day, month and year;
  2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or

     Business Number;
  3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
  (4) the object and summary of the grounds of the application;
  (5) the indication of the judge who is seized of the application;
  6° the signature of the applicant or his lawyer.
12The request, accompanied by its annex, shall be sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.
13Cf. Title 4 – What can I do if my complaint is dismissed? of the Chamber's policy of classification without follow-up

Litigation.