APD/GBA (Belgium) - 63/2023

APD/GBA - 63/2023
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 5(1)(c) GDPR
Type:	Complaint
Outcome:	Upheld
Started:	24.01.2023
Decided:	01.06.2023
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	63/2023
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	French
Original Source:	APD/GBA (in FR)
Initial Contributor:	n/a

An employer, informing the staff of the dismissal of some employees together with the reasons of the dismissal, breached the principle of data minimisation of Article 5(1)(c) GDPR.

English Summary

Facts

On 15 January 2023, an employer (controller) sent an email to his staff concerning the dismissal of two employees (data subjects). The email stated that the data subjects were being dismissed for serious misconduct.

Believing that it was not necessary to specify why they were being dismissed, especially as their job was to look after children and this could give the impression that they had committed a fault in relation to the children, the data subjects each lodged a complaint with the Belgian DPA.

Holding

As the two complaints concerned the same controller and the same facts, the DPA joined the complaints together.

The DPA recalled that, according to the principle of minimisation, personal data must be adequate, relevant and limited to what is necessary for the purposes for which it is processed.

In this case, the DPA considered that the controller did not have to specify the reason for the dismissal in order to inform the staff that the data subjects were no longer part of the team. The controller thus breached Article 5(1)(c) GDPR. The DPA therefore issued a warning.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/5





                                                                         Litigation Chamber


                                                            Decision 63/2023 of June 1, 2023





File number: DOS-2023-00504 attached to DOS 2023-00468


Subject: Complaint relating to the sending of an email by the ex-employer of the complainants to the ex-colleagues

of these, specifying the nature of their dismissal



The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke

Hijmans, chairman;


Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and
to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the

data protection), hereinafter “GDPR”;


Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, hereinafter

“ACL”;

Having regard to the internal regulations as approved by the House of Representatives on 20

December 2018 and published in the Belgian Official Gazette on January 15, 2019;


Considering the documents in the file;


Made the following decision regarding:



The complainants: Ms. X1, and Ms. X2 hereinafter “the complainants”; .

                                                                                                          .
                                                                                                          .
The defendant: Y, hereinafter: “the defendant” Decision 63/2023 – 2/5


I. Facts and procedure


 1. On January 24 and 27, 2023, the complainants filed a complaint with the Authority of

       Data Protection (hereinafter “the DPA”), against their former employer, the defendant.


       The subject of the complaint concerns the sending on January 15, 2023 to third parties (between twenty and thirty

       members of staff) of an email concerning the dismissal of the complainants by their ex-

       employer. The disputed email specifies that the complainants were dismissed for serious misconduct.

       However, the plaintiffs point out that specifying to third parties (their ex-colleagues) the nature of the

       dismissal, i.e. serious misconduct, was not necessary. They indicate that this can give

       the impression that they have committed a serious fault in relation to the children cared for by

       the institution of their ex-employer, while the reasons underlying the serious misconduct would be


       others.

 2. On February 15, 2023, the complaint was declared admissible by the Front Line Service on the

       basis of Articles 58 and 60 of the LCA and the complaint is forwarded to the Litigation Chamber

       under Article 62, § 1 of the LCA for file 2023-00504. On February 3, 2023, the

       complaintisdeclaredadmissiblebythePremiumLineServiceonthebasisofarticles58 and

       60 of the LCA and the complaint is transmitted to the Litigation Chamber under article 62,

          st 4
       § 1 of the ACL for file 2023-00468.

 3. On February 27, 2023, the Litigation Chamber sent a letter to the complainant in the

       file 2023-00504 to inform him that a complaint for the same facts against the same

       controller of another person was received in case 2023-00468.

       In this respect, for reasons of procedural economy and efficiency, the Chamber

       Litigation sent an e-mail to the two complainants, to indicate to them that unless the


       their part within 10 days, the two complaints will be joined. Following this, the two files have

       been joined.

 4. Pursuant to article 95 § 2, 3° of the LCA as well as article 47 of the rules of order

       inside the DPA, a copy of the file may be requested by the parties. If one of

       parties wishes to make use of the possibility of consulting the file, the latter is required to

       contact the secretariat of the Litigation Chamber, preferably via the address

       litigationchamber@apd-gba.be.






1
 Pursuant to article 61 LCA, the Litigation Chamber informs the parties by this decision, of the fact that the complaint has been
declared admissible.
2 Pursuant to Article 95, § 2 LCA, by this decision, the Litigation Division informs the parties of the fact that following

of this complaint, the file was forwarded to him.
3 Pursuant to article 61 LCA, the Litigation Chamber informs the parties by this decision, of the fact that the complaint has been
declared admissible.
4
 Pursuant to Article 95, § 2 LCA, by this decision, the Litigation Chamber informs the parties of the fact that following
of this complaint, the file was forwarded to him. Decision 63/2023 – 3/5



II. Motivation


 5. The data minimization principle states that personal data

       must be adequate, relevant and limited to what is necessary for the purposes

       for which they are processed (article 5.1.c) of the GDPR).

 6. The Litigation Chamber considers that it is not necessary to specify the nature of the

       dismissal in order to inform employees of the dismissal of the complainants, the only

       mention of the departure being sufficient in this regard. Insofar as the purpose pursued

       could reasonably be achieved without disclosing this information, the Chamber

       Litigation finds that the defendant violated article 5.1.c) of the GDPR by specifying in

       the disputed email that the dismissal takes place for serious misconduct, instead of being limited to the

       notification of dismissal only.

 7. This decision is a prima facie decision taken by the Litigation Chamber

       in accordance with article 95 of the LCA on the basis of the complaint lodged by the complainants,

       within the framework of the “procedure prior to the substantive decision” and not a decision on the

       merits of the Litigation Chamber within the meaning of Article 100 of the LCA.


 8. The purpose of this decision is to inform the defendant, allegedly responsible for the

       processing, because it may have violated the provisions of the GDPR,

       in order to enable it to still comply with the aforementioned provisions.

 9. If, however, the defendant does not agree with the content of this decision

       prima facie and believes that it can make factual and/or legal arguments that

       could lead to another decision, it may send the Litigation Chamber a

       request for treatment on the merits of the case via the e-mail address litigationchamber@apd-

       gba.be, within 30 days of notification of this decision. The case

       applicable, the execution of this decision is suspended for the period

       aforementioned.


 10. In the event of further processing of the case on the merits, pursuant to Articles 98, 2° and 3°

       juncto article 99 of the LCA, the Litigation Chamber will invite the parties to introduce their
       conclusions and attach to the file all the documents they deem useful. If applicable, the

       this decision is permanently suspended.


 11. In the interests of transparency, the Litigation Division finally emphasizes that a

       dealing with the case on the merits may lead to the imposition of the measures mentioned in

       section 100 of the ACL.



5
 Section 3, Subsection 2 of the ACL (articles 94 to 97 inclusive).
6Art. 100. § 1. The litigation chamber has the power to
 1° dismiss the complaint without follow-up;
 2° order the dismissal; Decision 63/2023 – 4/5


III. Publication of the decision



  12. Considering the importance of transparency regarding the decision-making process of the Chamber

        Litigation, this decision is published on the website of the Protection Authority

        Datas. However, it is not necessary for this purpose that the identification data

        of the parties are communicated directly.






    FOR THESE REASONS,


    The Litigation Chamber of the Data Protection Authority decides, after

    deliberation:


        - Pursuant to Article 95, § 1, 4° of the LCA, to issue a warning with regard to

             the defendant to comply in the future with the requirements of Article 5.1.c) of the GDPR.







In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged,

within thirty days of its notification, to the Court of Markets (court

d'appel de Bruxelles), with the Data Protection Authority as defendant.


Such an appeal may be introduced by means of an interlocutory request which must contain the
                                                                             7
information listed in article 1034ter of the Judicial Code. The interlocutory motion must be









  3° pronouncing the suspension of the pronouncement;
  4° to propose a transaction;
  5° issue warnings and reprimands;
  6° order to comply with requests from the data subject to exercise his or her rights;
  7° order that the person concerned be informed of the security problem;
  8° order the freezing, limitation or temporary or permanent prohibition of processing;
  9° order compliance of the processing;
  10° order the rectification, restriction or erasure of the data and the notification thereof to the recipients of the

     data ;
  11° order the withdrawal of accreditation from certification bodies;
  12° to issue periodic penalty payments;
  13° to issue administrative fines;
  14° order the suspension of cross-border data flows to another State or an international body;
  15° forward the file to the public prosecutor's office in Brussels, who informs it of the follow-up given to the file;
  16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority.
7
 The request contains on pain of nullity:
  (1) indication of the day, month and year;
  2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
     Business Number;
  3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;

  (4) the object and summary statement of the means of the request;
  (5) the indication of the judge who is seized of the application;
  6° the signature of the applicant or his lawyer. Decision 63/2023 – 5/5


                                                                                                          8
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , Or

via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).









   (se). Hielke H IJMANS


   President of the Litigation Chamber


































































8The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.