APD/GBA (Belgium) - 103/2024

APD/GBA - 103/2024
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 17(3)(a) GDPR Article 21(1) GDPR Loi du 2 mai 1995
Type:	Complaint
Outcome:	Rejected
Started:	28.10.2021
Decided:	14.08.2024
Published:
Fine:	n/a
Parties:	Cumuleo.be
National Case Number/Name:	103/2024
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	French
Original Source:	APD-GBA (in FR)
Initial Contributor:	fb

The DPA held that a website that publishes the salary of public companies' managers rightfully rejected an erasure request, since the publication of this data is necessary for exercising the right of freedom of expression and information.

English Summary

Facts

The data subject is a manager of a company owned by the Belgian and French governments. Pursuant to the Law of 2 May 1995 on the obligation to file a list of mandates, functions and professions and a declaration of assets (Loi du 2 mai 1995 relative à l’obligation de déposer une liste de mandats, fonctions et professions et une déclaration de patrimoine/Wet betreffende de verplichting om een lijst van mandaten, ambten en beroepen, alsmede een vermogensaangifte in te diene), the data subject was obliged to file a declaration mentioning all her mandates, management functions or professions and how much she was earning from these positions. This information is then published on the Belgian Official Journal (Moniteur Belge - Belgisch Staatsblad) and on the website of the Court of Auditors of Belgium.

The controller, a private entity, collects these pieces of information and publishes them on its website. The main purpose of this website is promoting transparency in the public institutions and displaying people holding multiple offices in Belgium.

The data subject's data was published as well. On 28 September 2021, the data subject objected to the processing according to Article 21(1) GDPR and, therefore, filed an erasure request pursuant to Article 17 GDPR.

On 18 October 2021, the controller refused to erase the data, arguing that:

• the publication of this information on its website contributes to the transparency essential to the proper functioning of democracy with regard to the attribution of certain mandates, functions and professions;
• the information is available on the website of the Court of Auditors and of the Official Journal and its publication in these websites is compulsory by law.

The data subject filed a complaint with the French DPA (Commission nationale de l'informatique et des libertés - CNIL). Given that the main establishment of the controller is located in Belgium, the complaint was forwarded to the Belgian DPA (Autorité de protection des données/Gegevensbeschermingsautoriteit - APD/GBA) pursuant to Article 56(1) GDPR.

Holding

First, the DPA noted that the right to erasure is not an absolute right and must be balanced with the fundamental rights granted by the Charter. In order to do so, Article 17(3) GDPR sets some exceptions to the right to erasure.

More specifically, according to Article 17(3)(a) GDPR the right to erasure does not apply to the extent that the processing is necessary for exercising the right of freedom of expression and information.

Therefore, the DPA analysed whether the processing at hand could fall into the scope of this exception.

The DPA pointed out that the controller is not a professional journalist. However, the DPA also noted that both the CJEU and the European Court of Human Rights held that the same role of the press and professional journalists - i.e. being "public watchdogs" in a rule-of-law State - can also be exercised by private citizens or entities (see ECtHR, 20/06/2018, Falzon v. Malta, para. 57; CJEU, C-345/17, Buivids, para. 57; CJEU, C-73/07, Satakunnan Markkinapörssi et Satamedia, para. 61).

Therefore, the DPA considered that the processing at hand can fall into the scope of Article 17(3)(a) GDPR.

Moreover, the DPA took into account that the necessity for this data to be made public and known by the citizenship has been decided, for transparency purposes, by the Belgian legislator with the Law of 2 May 1995.

However, the DPA underlined that the online publication of this data does not imply that the information at hand does not fall anymore into the definition of personal data set by Article 4(1) GDPR. Therefore, a legal basis for the processing is needed. In the case at hand, the DPA emphasised that processing activities of journalists can be based on the legitimate interest connected to the fundamental rights of expression.

The DPA pointed out that, according to the CJEU, it is necessary to balance the data subject's right to the protection of personal data with other rights, e.g. the freedom of expression and the right of the public opinion to know how public money is used (see C-465/00, Österreichischer Rundfunk, para. 85).

The DPA took into account the fact that the controller only re-publishes data that is already publicly available online. In addition, the purpose of the controller in the case at hand is exactly the same, i.e. increasing awareness among the citizenship regarding how public money is spent.

Moreover, the DPA noted that the data subject is a "public figure" according to the WP29 (see WP29, 'Guidelines on the implementation of the Court of Justice of the European Union judgement on "Google Spain and Inc v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González" C-131/12, 14/EN WP 225, p. 13).

On these grounds, the DPA held that the controller rightly refused to erase the data, since the exception provided for by Article 17(3)(a) GDPR applies.

Since the complaint had been filed in France, the DPA sent a draft of the decision to the French DPA pursuant to Article 60(3) GDPR. The French DPA did not object to this draft decision.

Pursuant to Article 60(8) GDPR, it is for the French DPA to issue a decision rejecting the data subject's complaint.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/22

Contentious Chamber

Decision on the merits 103/2024 of 14 August 2024

Draft decision of 20 June 2024 pursuant to Article 60.3 of the GDPR

As lead authority, the Contentious Chamber, the body of the DPA, has prepared

this draft decision which it communicated on 20 June 2024 to the CNIL, the supervisory

authority to which the complaint was lodged, pursuant to Article 60.3 of the

GDPR. This draft proposes to dismiss this complaint without further action pursuant

to Article 100.1., 1° of the LCA, which corresponds to the rejection of the complaint in the

terminology of the GDPR. In accordance with Article 60.8 of the GDPR, the CNIL has confirmed this

rejection decision and adopted a final decision on this basis on 7 August 2024.

File number: DOS 2022-01749

Subject: Complaint following the publication of remuneration on the Cumuleo.be website

The Litigation Chamber of the Data Protection Authority, consisting of Mr. Hielke

Hijmans, President, and Mr. Romain Robert and Mr. Yves Poullet;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and

on the free movement of such data, and repealing Directive 95/46/EC (General Data

Protection Regulation), hereinafter "GDPR";

Having regard to the Law of 3 December 2017 establishing the APD (hereinafter LCA);

Having regard to the Law of 30 July 2018 on the protection of individuals with regard to the

processing of personal data (hereinafter "LTD");

Having regard to the internal regulations as approved by the Chamber of Representatives on 20
December 2018 and published in the Belgian Official Gazette on 15 January 2019;

Having regard to the documents in the file; Draft decision of 20 June 2024 pursuant to Article 60.3 of the GDPR – 2/22

Adopts the following draft decision within the meaning of Article 60.3 of the GDPR concerning:

The complainant: X, hereinafter "the complainant".

The defendant: Y, publisher of the Cumuleo.be website, represented by Me Audrey Adam and

Me Jacques Englebert, whose office is located at Rempart de la Vierge 2/7,

5000 Namur, Belgium, hereinafter: "the defendant" Draft decision of 20 June 2024 pursuant to Article 60.3 of the GDPR – 3/22

I. Facts and procedure

I.1. The facts

1. On 28 October 2021, the complainant filed a complaint with the National Commission for

Information Technology and Civil Liberties (hereinafter "CNIL") against the defendant.

2. The complaint filed by the complainant denounces the publication of the remuneration of her

private professional activity on the defendant's website.

3. For the proper understanding of this draft decision, the Litigation Chamber specifies

1
that the law of 2 May 1995 requires a series of public officials and senior civil servants

to file an annual declaration with the Court of Auditors of all their

mandates, functions or professions exercised during the previous year, as well as

a declaration of assets where applicable. This obligation to declare mandates and

remuneration falls to natural persons who have exercised one of the mandates within

an administration, a public institution or a body linked to the public authorities

listed in Article 1 of this law (hereinafter "taxable mandate"). Persons who have

exercised one of the taxable mandates are required to also declare all other

mandates or functions that they have exercised in the same year, regardless of whether

they are remunerated or not, whether they fall within the public or private

sector and whether they were exercised in Belgium or abroad. The law of 14 October 2018 amended the law of 2 May 1995 to extend its scope
4
of application to public administrators and to incorporate the obligation to declare

remuneration. The declaration must therefore indicate the name of each activity, the name

of the institution or body, the remuneration that is linked and the start and end date of the

mandate. With regard to the obligation to declare remuneration, the law provides for a

distinction between taxable mandates, for which the gross annual remuneration

must be declared, and other mandates, functions or professions, for which an

order of magnitude of the remuneration is only required, within ranges set by law. 7

These lists of mandates and declarations of assets are then published in the Moniteur

1
Law of 2 May 1995 on the obligation to file a list of mandates, functions and professions and a declaration of
assets, Belgian Official Journal of 26 July 1995, available at:
http://www.ejustice.just.fgov.be/eli/loi/1995/05/02/1995021222/justel (hereinafter “Law of 2 May 1995”).

2 Art. 2, § 1, of the Law of 2 May 1995.
3Law of 14 October 2018 amending the legislation on declarations of mandates and assets with regard to the transparency of remuneration, the extension to public administrators, electronic filing and control, Belgian Official Journal of 26 October 2018, available at:

https://www.ejustice.just.fgov.be/cgi loi/change lg.pl?language=fr&la=F&table name=loi&cn=2018101414 (hereinafter Law of 14 October 2018). This law, which notably introduces transparency of remuneration, was adopted following recommendation iii of GRECO in the context of the 4th evaluation cycle of Belgium.
4Art. 2, b), Law of 14 October 2018: "members, who receive remuneration directly or indirectly for this purpose,
of boards of directors, advisory boards and management committees: (...) b) legal persons over
which one or more public authorities directly or indirectly exercise a dominant influence".
5
6 Art. 3, Law of 14 October 2018.
"1.4 - What must you declare?", Vade-mecum of the Court of Auditors relating to the filing of lists of mandates and
declarations of assets, version 6 of 15 June 2023, available at:
https://www.ccrek.be/sites/default/files/PDF/VademecumAssujetti.pdf.
7See art. 2, § 1, of the law of 2 May 1995 where the legislator specifies the different ranges. Draft decision of 20 June 2024 pursuant to Article 60.3 of the GDPR – 4/22

8 9
Belgian as well as on the website of the Court of Auditors in accordance with Article 7, § 3,

of the special and ordinary law of 26 June 2004. 10

4. During the period of the disputed processing, the complainant exercised two mandates which

made her subject to the declaration obligation provided for by the aforementioned law of 2 May 1995. 11

In accordance with this legal obligation, the complainant had to communicate to the Court of

Auditors the list of her subject mandates as well as all her other activities, each time

mentioning the remuneration received in the form of an order of magnitude or
12
the precise amount depending on the case. During this period, the complainant's statements

were therefore published and are publicly available to date in the Belgian Official Journal and on

the website of the Court of Auditors. 14

5. The website Cumuleo.be, for which the defendant is the data controller,

has as its main theme the accumulation of mandates in Belgium (hereinafter "Cumuleo" or "the

defendant's website"). This site provides its visitors with free

information relating to the mandates, functions or professions exercised in particular by

agents subject to the law of 2 May 1995. The defendant updates the database of

its site on the basis in particular of the declarations of mandates published in

accordance with this law, in the Belgian Official Journal or on the website of the

Court of Auditors. The content of the site is therefore

essentially a reproduction of the information from these public and official

sources. However, the defendant also carries out work to verify and correct

any errors or gaps. Public officials also have the

possibility to publish or supplement the information on Cumuleo themselves.

6. A search on the Cumuleo site using the complainant's name provides access to a file

of the various mandates, functions and professions that she has exercised during the

same calendar year from 2018 to date. Each of these activities is accompanied by the

remuneration received in the same form as that indicated in the complainant's

declarations published in the Belgian Official Gazette or on the website of the Court of Auditors. 16

8 Since 2023, the list of these declarations has only been published on the website of the Court of Auditors.
9
"Lists of mandates and declarations of assets", website of the Court of Auditors, available at:
https://www.ccrek.be/fr/listes-de-mandats-et-declarations-de-patrimoine .
10 Special law of 26 June 2004 implementing and supplementing the special law of 2 May 1995 relating to the obligation to file a
listedemandats,fonctionsetprofessionsetunedéclarationdepatrimoine, Belgian Monitor of 30 June 2004, available at:
https://www.ejustice.just.fgov.be/eli/loi/2004/06/26/2004021083/justel. Please note that this implementing law was not
amended during the 2018 revision of the law it implements.
11
12 Law of 2 May 1995, op. cit., Belgian Official Gazette of 26 July 1995.
See, supra, footnote no. 7.
13See, for example, the declarations relating to the mandates exercised by the complainant in 2018, “Final list of mandates,
functions and professions exercised during all or part of the year 2018”, Belgian Official Gazette of 14 February 2020, First
Edition, p. (…), available on (…).
14See, for example, the declarations relating to the mandates exercised by the complainant in 2019, “Lists of mandates and

15asset declarations”, website of the Court of Auditors, available on: (…).
This was the case with the complainant’s file, the defendant modified the description of the position held (point 3 of the defendant’s
conclusions of 19 September 2022).
16See, above, footnotes 12 and 13. Draft decision of 20 June 2024 pursuant to Article 60.3 of the GDPR – 5/22

7. On 28 September 2021, the complainant contacted the defendant to request, on the basis of

Article 17 of the GDPR, the deletion from Cumuleo of her personal data relating to the

remuneration of her professional activity at Z. The complainant states that the data

in question relate to a private professional activity as an employee and that,

according to her, there is no compelling legitimate reason that would justify the continued processing of her

data. She therefore also expressed her opposition to the processing of said data

for reasons that relate to her particular situation, without specifying which ones. Subsequently, the complainant extended her request for erasure to cover all remuneration as an employee in the private sector between 2018 and 2020 (hereinafter “the

disputed information” or “private remuneration”).

8. On 18 October 2021, the respondent refused to grant the complainant’s request for erasure and opposition on the grounds, in particular, that the publication of this information on its website contributes to the transparency essential to the proper functioning of democracy

with regard to the allocation of certain mandates, functions and professions. The defendant
argued that the information processed on its site comes from public and

official sources since the complainant is subject to the obligation to declare its mandates and

remuneration by the law of 2 May 1995. The defendant explains that the removal from its

site of the disputed information, the transparency of which the Belgian legislator

expressly wanted to ensure to the general public, would go against its fundamental right to freedom

of expression and information.

I.2. The European cooperation procedure with the CNIL

9. This complaint was subject to a procedure for identifying the lead authority in

accordance with Article 56 of the GDPR. At the meeting of 13 June 2022, the Litigation Chamber recognised the APD

as the lead supervisory authority within the meaning of Article 56.1 of the GDPR, while the

CNIL declared itself the “relevant supervisory authority” within the meaning of Article 4.22, b) and c) of the

GDPR.

10. The GDPR contains a special regulation for the handling of complaints relating to

cross-border processing. The lead supervisory authority is the one that will continue

processing the case on the merits. In this context, it regularly informs the relevant supervisory authorities of the status of the case and—in accordance with the cooperation mechanism

established in Article 60 of the GDPR—also involves them in taking a final decision.

Cases in which the aforementioned European cooperation mechanism applies

17See email of 28 September 2021 sent by the complainant to the respondent in which the exercise of the right of objection is
succinctly formulated in the following terms: "I hereby object to the processing of my personal data
pursuant to Article 21, paragraph 1 of the General Data Protection Regulation, for reasons relating to my
particular situation". 18In particular in the complainant’s letter to the Litigation Chamber of 10 October 2022. Draft decision of 20 June 2024 pursuant to Article 60.3 of the GDPR – 6/22

are often complex, for the following reasons: several national supervisory authorities

are involved in the case and they are each subject to their own national procedural

rules (which concern, for example, the role of the complainant in a

control and sanction procedure in the event of non-compliance with the

regulations, or even with regard to the use of languages).

11. As lead authority, the Litigation Chamber, the body of the DPA, prepared a

draft decision based on the arguments of the parties concerned, and had to submit it to the

CNIL, the authority concerned, in order to obtain its opinion (Article 60.3 of the GDPR). The CNIL has the authority to examine the draft submitted to it by the APD. The CNIL may

formulate a relevant and reasoned objection within the meaning of Article 60.4 of the GDPR.

12. On 20 June 2024, the Litigation Chamber shall submit, in accordance with Article 60.3 of the GDPR,

its draft decision to the relevant supervisory authority, the CNIL, in order to obtain its opinion.

I.3. The invitation to conclude addressed to the parties

13. On 13 June 2022, the Litigation Chamber decides, pursuant to Article 95, §1, 1° and Article 98 of the LCA, that the case may be dealt with on the merits.

14. On 20 July 2022, the parties concerned were informed by registered mail of the

provisions as set out in Article 95, § 2 and Article 98 of the LCA. They were

also informed, pursuant to Article 99 of the LCA, of the deadlines for submitting

their submissions. The deadline for receipt of the respondent's submissions in

response was set at 19 September 2022, that for the complainant's submissions in

reply at 10 October 2022 and that for the respondent's submissions in reply at 31

October 2022.

15. On 20 July 2022, the complainant agreed to receive all communications relating

to the case electronically and expressed her intention to use the possibility of being

heard, in accordance with Article 98 of the LCA.

16. On 25 July 2022, the defendant agreed to receive all communications relating to

the case electronically and expressed its intention to use the possibility of being

heard, in accordance with Article 98 of the LCA.

17. On 19 September 2022, the Litigation Chamber received the submissions in response from

the defendant. In summary, the latter argued as follows:

- It should be considered that the defendant is processing the complainant's personal

data for journalistic purposes within the meaning of Article 24 of the LTD.

- Consequently, the disputed processing benefits from the exception for journalistic

purposes and the complainant cannot object by exercising her right under Article 21.1 of the

GDPR. Draft decision of 20 June 2024 pursuant to Article 60.3 of the GDPR – 7/22

- The right to erasure does not apply in accordance with Article 17.3.a) of the GDPR because

the disputed processing is necessary for the exercise of the right to freedom of expression and the

right to information of the public. The dissemination of his remuneration for his

“private” professional activities is necessary for the right of information of citizens to enable them

to become aware of all types of activities carried out by public

officials.

- The decision of the DPA cannot constitute a violation of the right to freedom of

expression of the defendant. The interference requested by the complainant is not necessary in a

democratic society to achieve the legitimate aim pursued in light of the

specific principles relating to the making available to the public of official

information. The infringement

invoked by the complainant could not justify the seriousness of the interference with freedom

of expression and would constitute a violation of the principle of proportionality.

18. On 20 September 2022, the complainant requested a copy of the file (art. 95, §2, 3° LCA),

which was sent to her on 30 September 2022.

19. On 10 October 2022, the Litigation Chamber received a letter in reply from the
complainant. In summary, here is what the complainant defends:

- The publication on the defendant's website of her remuneration as an employee in

the private sector between 2018 and 2020 does not contribute to a fair and proportionate balance

between the citizens' right to information and her right to the protection of her personal data.

20. On the same date, the complainant requested that the decision in this case not be

published or that it be at least anonymised. On 21 October 2022, the

Litigation Chamber recalled the importance of transparency regarding the decision-making process

of the Litigation Chamber, and that its decisions are always published on the

website of the Data Protection Authority. It also explained to the complainant that it

would, however, take note of her request for anonymisation, on which it would rule in

the decision itself.

21. On 31 October 2022, the defendant informed the Litigation Chamber that the complainant’s letter did not call for any reply from it. The defendant informed it that the conclusions

communicated to the Litigation Chamber on 19 September remained unchanged. Draft decision of 20 June 2024 pursuant to Article 60.3 of the GDPR – 8/22

II. Grounds

II.1. As to the territorial jurisdiction of the Litigation Chamber

22. In view of Article 77 of the GDPR, the complainant – domiciled in France – has the right to lodge

a complaint with the supervisory authority of its choice, even if the latter is

located in the territory of a Member State in which the complainant has

his habitual residence or place of work.

23. Pursuant to Article 56.1 of the GDPR, the DPA is competent to act as lead authority

with regard to cross-border data processing carried out by the

controller(s) whose main establishment or sole establishment is located

on its territory. In this case, the territorial jurisdiction of the DPA, and therefore of the

Litigation Chamber, is not in dispute since the defendant, the controller

of the Cumuleo website, has its sole establishment in Belgium.

II.2. As to the merits of the request for deletion following the exercise of the right
of opposition

24. In view of the content of the complaint, it is for the Litigation Chamber to assess whether

the defendant was right to refuse to respond favourably to the request

for deletion following the exercise of a right of opposition relating to the disputed content

currently available on the defendant's website.

19
25. The Disputes Chamber recalls that under Article 17.1.c) of the GDPR, the data subject

has the right to obtain from the data controller the erasure, without undue

delay, of personal data concerning him or her when (…) "c) the data

subject objects to the processing pursuant to Article 21, paragraph 1, and there are

no compelling legitimate grounds for the processing, or the data subject objects to the

processing pursuant to Article 21.2 of the GDPR". The data controller has

the obligation to erase these personal data without undue delay when

this ground applies.

26. However, the right to the protection of personal data is not an absolute right, it must be considered in relation to its function in society and balanced against other fundamental rights. In this regard, publications on the Internet do indeed fall within the

content protected by the right to freedom of expression and information (Article 10 of the

19Article 17 of the GDPR is not among the rights of the data subject whose exercise the Belgian legislator purely and
simply excludes in the event of processing for journalistic purposes under Article 24.2 LTD, see points 52 to 56 of
this decision.
20Recital 4 of the GDPR. Draft decision of 20 June 2024 pursuant to Article 60.3 of the GDPR – 9/22

European Convention on Human Rights (ECHR) and Article 11 of the Charter of Fundamental

Rights of the EU). 21

27. Article 17.3. a) of the GDPR provides that Article 17.1 does not apply to the extent that the

processing is necessary for the exercise of the right to freedom of expression and information, 22

thus providing in the very terms of Article 17 of the GDPR for an exceptional regime which

involves a balance of interests between the fundamental right to freedom of expression and

information on the one hand and the fundamental right to the protection of personal data

on the other. In its “GoogleSpain” judgment of 13 May 2014, the CJEU stated that

as a general rule the rights of the data subject enshrined in Articles 7 and 8 of the

Charter of Fundamental Rights of the European Union (i.e. the right to privacy and the

protection of personal data) prevail. However, “this balance may

however depend, in particular cases, on the nature of the information in question and

its sensitivity to the private life of the person concerned as well as on the public interest in

having that information, which may vary, in particular, depending on the role played by
23
that person in public life”.

28. For its part, the European Court of Human Rights (hereinafter “the Eur. Court

HR”) has also developed in the course of its case-law a series of relevant criteria which

must be taken into consideration in order to balance the competing fundamental

rights, namely the contribution to a debate of general interest, the notoriety

of the person concerned, the subject of the reporting, the previous conduct of the person

concerned, the content, form and impact of the publication, the manner and

circumstances in which the information was obtained and its truthfulness. 24

In its recent “Buivids” judgment, the CJEU made direct reference to these criteria established

by the Eur. Court HR.

29. Furthermore, the Eur. Court HR has regularly stressed in its case-law the

indispensable role of the press and other “public watchdogs” in a State governed by the rule of law.

Indeed, as the Court frequently points out, the press’s main function is to be

a vehicle for disseminating debates of general interest, but it also fulfils a

secondary role, that of revealing and bringing to the public’s attention information

likely to arouse interest and give rise to such a debate within society.

Consequently, the Eur. Court HR warns that the utmost caution should be exercised

21Eur. Court HR, 10 March 2009, Times Newspaper Limited v. the United Kingdom.

22
23The Litigation Chamber emphasises.
24CJEU, 13 May 2014, C-131/12, Google Spain and Google, ECLI:EU:C:2014:317, paragraph 81.
See Court of Human Rights, 27 June 2017, Satakunnan Markkinapörssi Oyet Satamedia Oyc. Finland, paragraph 165; Court of Human Rights, 10 November 2015, Couderc and Hachette Filipacchi Associés v. France (GC), paragraph 93; Eur. Court of Human Rights, 7 February 2012, Von Hannover v. Germany (no. 2) (GC), paragraphs 109 to 113; Eur. Court of Human Rights, 7 February 2012, Axel Springer AG v. Germany (GC),
paragraphs 90 to 95.
25CJEU, 14 February 2019, C-345/17, Buivids, ECLI:EU:C:2019:122, paragraphs 65 to 66.
26See in particular, Eur. Court HR, 23 April 1992, Castells v. Spain, paragraph 43.
27
See Eur. Court HR, 10 November 2015, Couderc and Hachette Filipacchi Associés v. France (GC), paragraphs 89 and 114. Draft decision of 20 June 2024 pursuant to Article 60.3 of the GDPR – 10/22

when it comes to examining restrictions likely to dissuade citizens from

participating in the discussion of problems of legitimate general interest. Therefore, any measure 28

which would limit access by the public to this information – which has the right to receive it – must be

29
justified by particularly compelling reasons.

30. If in the case-law of the Eur. Court D.H., the role of “public watchdogs” is
30
generally assumed by the press and professional journalists, the Court

is gradually recognising this function to individuals. The Court considers that the

role of these actors may be similar in importance to that of the press 32 and that they may

33
therefore benefit from the high level of protection usually afforded to the latter. The Court

considers in particular that:

“Given that websites contribute greatly to improving

public access to current events and, in general, to facilitating the

dissemination of information, the function of bloggers and popular users of

social media may also be assimilated to that of a “public watchdog” as regards
35
the protection afforded by Article 10”.

31. Similarly, the CJEU gives a broad interpretation to concepts related to freedom of

expression, such as journalism. In its “Buivids” judgment of 14 February 2019, the CJEU

did not set out any requirement as to the professional status of the person or

organisation that invokes the benefit of the journalistic exception: the video

recording of members of the police in a police station and the publication of these

images on a website were considered to be processing of personal data carried out

for the purposes of journalism. In this judgment, the Court took into account the “development and

multiplication of means of communication and dissemination of information”. Similarly, in the “Satamedia” judgment, the CJEU considered that the purpose of journalistic processing included “the

disclosure to the public of information, opinions or ideas, by any means of

transmission whatsoever”, and that such a purpose could be pursued by “any

39
person”, without imposing requirements as to the status of journalist or the absence of a

28
29See Eur. Court HR, 20 May 1999, Bladet Tromsø and Stensaas v. Norway (GC), paragraph 64.
  Cour eur. D.H., 10 March 2009, Times Newspaper Limited c. United Kingdom, 41 points ; Cour eur. D.H., November 27, 2007,
Timpul Info-Magazin et Anghel c.Moldova, point 31.
30Cour eur. D.H., December 17, 2004, Pedersen and Baadsgaard c. Denmark (GC), 71 points.
31Cour eur. D.H., June 20, 2018, Falzon v. Malta, 57 points.
32
  Cour eur. D.H., 22 April 2013, Animal defenders international c. United Kingdom (GC), points 102-103 ; Cour eur. D.H., 1st
December 2009, Karsai v. Hungary, point 35 ; Cour eur. D.H., 8 November 2016, Hungarian Helsinki Bizotsag c. Hungary (GC),
point 159, 165 to 168 ; Cour eur. D.H., 8 July 1999, Baskaya et Okcuoglu c. Turkey (GC), points 61 to 67; Cour eur. D.H., 22
October2007,Lindon,Otchakovsky-LaurensetJuly c.France(GC),point48; Coureur.D.H.,27June2017,Medzelisislamske
zajednice brcko et al c. Bosnia and Herzegovina, point 86.
33
34Cour eur. D.H., December 1, 2009, Karsai v. Hungary, 35 points.
  Cour eur. D.H., June 16, 2015, Delphi AS c. Estonia (GC), 133 points.
35Coureur.D.H.,8November2016,HungarianHelsinkiBizottsagc.Hungary(GC),point168 ;Coureur.D.H.,20June2018,Falzon
c. Malta, point 57. ; Cour eur. D.H.,July 26, 2020, Center for Democracy and the Rule of Law c. Ukraine, 87 points.
36Voy. also considering 153 of the GDPR.
37
38CJEU, 14February 2019, C-345/17,Buivids, ECLI:EU:C:2019:122, point 56.
  CJUE,16December 2008,C-73/07,SatakunnanMarkkinapörssietSatamedia(Satamedia),ECLI:EU:C:2008:727,point61.
39Ibidem, point 58. Draft decision of 20 June 2024 implementing Article 60.3 of the GDPR – 11/22


       but lucrative. Beyond the quality of the processing officer, the CJEU retains the criterion

       according to which the processing must have for “sole purpose disclosure to the public

       information, opinions or ideas” . In other words, the purpose of the publication should be


       that of a journalist inspired by general interest and the presence of other motivating elements

       the publication will be decisive.

 32. An analysis of the case law of the CJEU and the Court of Appeal. D.H., does reveal that exercise


       of a journalistic activity, and the protection that flows from it should not be

       exclusively reserved for professional journalists. However, this same analysis

       also reveals that anyone who practices journalism and who understands

       beneficiary of the high level of protection afforded to freedom of the press is held by

       respect, at least, the most obvious ethical rules.   41


 33. In this regard, the Council of Journalistic Ethics (hereinafter "CDJ"), consider it also

       that the rules of journalistic ethics are also intended to apply to

       Unprofessional journalist. Indeed, the French-speaking Code of Journalistic Ethics

       and germanophone defines the notion of journalist as "anyone who contributes

       directly to collection, editorial processing, production and/or dissemination

       information, through a media, to an audience and in the interest of

       those » . The CDJ therefore considers that “the ethical obligation arises from the exercise of a

       activity that has a repercussion in society” and not the fact “of being a professional of the

       journalism” . The same goes for the Raad voor de Journalistiek which has already spoken


       repeatedly on compliance with the rules of journalistic ethics by
                                         44
       non-professional journalists .

 34. In particular, apart from the relevant criteria to be taken into account according to the


       case law specified by the CJEU and the Court. D.H., and with the support of all

       elements presented to it, the Content Chamber points out that in the case

       of cash the result of the balance of interests to be operated, in accordance with Article 17.3. a) black

       GDPR, between the right to data protection, on the one hand, and the right to freedom

       of expression and information, on the other hand, the GDPR leans in favor of freedom

       expression and information. The Content Chamber indeed considers that the

       publication on the defendant's website of the complainant's remuneration as an employee





40
  CJEU, 14 February 2019, C-345/17, Buivids, ECLI:EU:C:2019:122, point 59 ; CJEU, 16 December 2008, C-73/07, Satakunnan
41rkkinapörssi et Satamedia (Satamedia), ECLI:EU:C:2008:727, point 62.
  Cour eur. D.H., December 1, 2009, Karsai v. Hungary ; Cour eur. D.H., 8 November 2016, Hungarian Helsinki Bizotsag c.
Hungary (GC) ; Cour eur. D.H., June 27, 2017, Medzelis islamske zajednice brcko et al c. Bosnia and Herzegovina.
42Conseildedeontologiejournalistique,Codededeontologie2013,3meéd.,LescarnetsduCDJn°5,PartieII,«Définitions»,
p. 11.
43« Definition & Scope of Action of the CDJ », website of the Council for Journalistic Ethics, available on:
https://www.lecdj.be/fr/deontologie/definition-champ-daction-du-cdj/ (accessed 25March 2024).
44
  Voy. in particular, the following decisions of the Council for Journalism: HRM Focus and HRMBlogs and Ernst; Bashar t /
Belemturktv.com ; Engelbosch t/Trudocs.be ; Wings t/ Heistonline.                                          Draft decision of 20 June 2024 implementing Article 60.3 of the GDPR – 12/2



       in the private sector already willed by the legislature is necessary to the exercise of the right to

       freedom of expression and information.


 35. First of all, the Litigation Chamber takes into account the fact that litigation

       consists essentially of transcribing on Cumuleo the statements of warrants and

       of plaintiff’s earnings that are publicly available. As a result, the plaintiff

       has served two terms subject to the obligation to declare his terms and

       remuneration provided for by the Act of 2 May 1995 so that his remuneration has been

       published in the Belgian Monitor as well as on the website of the Court of Auditors under

       this legal obligation (points 3 to 4). In examining the purpose and proportionality of the

       litigious treatment, the Content Chamber has taken into account that the remuneration of

       the complaint, which the defendant relayed on its website, were initially broadcast

       publicly by virtue of this legal obligation, because the legislature deemed it necessary in

       unconcerned with the transparency of public management.

       November 2017 which resulted in the aforementioned law of October 14, 2018, the legislature

       explains the transparency objective pursued by these laws:

                "Allow all citizens to learn about public mandates and

                private as well as professional activities of public officials. Being

                given the revelations that have enameled political life both at the federal level and

                regional, it will be essential to strengthen measures aimed at improving the

                transparency of Belgian political life” 45(The Contention Chamber emphasizes).


 36. The Litigation Chamber finds that the complainant is subject to this obligation to

       statement, because she held, and still holds, two high leadership roles with

       of a company held essentially by the Belgian and French States. Now, the law October 14

       2018 heard the obligation to declare to administrators so-called "public" 46which exercises

       certain functions with companies on which one or more public authorities

       exerting a dominant influence:


                “This statement will increase transparency in a concern for good governance.

                The public authority holds a stake in several companies and in

                several organizations. These serve as examples and need a framework of

                modern governance in which the public authority shows reserve to

                operational and human resources issues. This means

                that it is appropriate that their administrators have more responsibilities, than all



45
  Bill of 29 November 2017, amending the legislation on declarations of powers and assets
in terms of transparency of remuneration, its extension to public administrators, electronic filing and
the control of its respect, DOC 54 2810/001, Developments, p.   3, available
at https://www.dekamer.be/FLWB/pdf/54/2810/54K2810001.pdf .
46Art. 2(b) of the Act of 2 May 1995: “members, who directly or indirectly receive remuneration for this purpose,
boards of directors, advisory boards and steering committees: (...) b) moral persons on
in which one or more public authorities directly or indirectly exercise a dominant influence.                                           Draft decision of 20 June 2024 implementing Article 60.3 of the GDPR – 13/2


                 confusion of interests be avoided and that their remuneration corresponds to a job

                 actually carried out” (The Content Chamber emphasizes).


 37. If the Content Chamber does not proceed, in the case submitted, to put

       in question the proportionality of the publication of the private remuneration of agents


       publics provided for in the law, it nevertheless regrets the lack of clarity of the laws organizing

       this publication. In particular, there is confusion in these texts as to the obligation

       to publish all information (statements of mandates AND remuneration

       statements) on the website of the Court of Accounts.

48
38. However, the Litigation Chamber wishes to recall, as it has done in the past,

that the fact that the disputed information is publicly available on the

internet does not cause it to lose its status as personal data and its processing is in

principle subject to all the rules of the GDPR, including the condition of lawfulness and

proportionality of the processing. Thus, any data processing requires an adequate legal

basis, for example, the legitimate interest of the data controller (art. 6.1. f of the

GDPR).

The Litigation Chamber argues that a journalistic approach may be based on

the legitimate interest of the data controller in the context of its fundamental right to

freedom of expression, or its legitimate interest in exercising a digital right of

reply.

39. The CJEU has repeatedly clarified the criteria for balancing the right to data

protection with the right to freedom of expression in the context of the
49
reuse of public data. For example, in the Österreichischer Rundfunk

judgment, the CJEU clarified that the rules on the protection of personal data 51

apply to public data (salary data of employees of a semi-public company): the processing of these personal data for purposes other

than those for which they were initially collected (in this case, for the purposes of

budgetary transparency) is subject to compliance with the principle of finality and compatibility

of any subsequent data processing, except for legally regulated exceptions.

40. That being said, the defendant claims that the purpose of the publication of the complainant's remuneration is the same as that intended by the legislator through the laws governing the obligation to declare and publish mandates and remuneration (points 37 and 38). The

47Proposal for a Law of 29 November 2017, amending the legislation on declarations of mandates and assets
with regard to the transparency of remuneration, its extension to public administrators, electronic filing and

monitoring of its compliance, DOC 54 2810/001, Developments, p. 3, available
48r https://www.dekamer.be/FLWB/pdf/54/2810/54K2810001.pdf .
Contentious Chamber, Decision on the merits 13/2022 of 27 January 2022, available at
https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-13-2022.pdf
49C. DOCKSEY, “Four fundamental rights”, International Data Privacy Law, 2016, vol. 6, nr. 3.
50CJEU, 20 May 2003, C-465/00, C-138/01 and C-139/01, Österreichischer Rundfunk e.a., ECLI:EU:C:2003:294.
51At the time of this judgment, the Charter had not yet become binding, the CJEU therefore relied on Article 8 of the
ECHR as well as on Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the

protection of natural persons with regard to the processing of personal data and on the free movement of such data. Draft decision of 20 June 2024 pursuant to Article 60.3 of the GDPR – 14/22

publication of the disputed information does not pursue purposes other than those for

which they were initially collected under the legal obligation to which the

complainant is subject, in this case, for the purposes of transparency in public management.

The defendant describes the purpose of the Cumuleo website as follows:

"Cumuleo publishes rigorous and public interest data on the mandates,

functions and professions of public officials and senior civil servants.

Having an independent and persistent source of documentary information

allows citizens, journalists, politicians, etc. to refer to it at any time

to define, feed or refine their reflections on the theme, taken in the broad

sense, of the accumulation of mandates.

More than truths of opinion, Cumuleo publishes truths of fact in order to give the

visitor the freedom to define his own opinion and the autonomy of his decision-making

(...)

The objective of Cumuleo is to be an actor of transparency and the promotion

of integrity in the management of society.

Cumuleo believes in transparency, truly. It is the barometer of democracy.

The more transparent the management of the company, the stronger the democracy and the more the

company develops.

The publication of the mandates, functions and professions of political

representatives and senior civil servants on which Cumuleo is currently

focusing is a step in the execution of this mission. In this specific case,

transparency makes it possible to combat conflicts of interest, the misappropriation of public

resources for private purposes and corruption" (The Litigation Chamber emphasizes).

41. The Litigation Chamber notes that the request for erasure is not directed against

an established press journal, but against a citizen website administered by the
53
defendant who is not a professional journalist. However, the Litigation Chamber

considers that the disputed processing was indeed carried out for journalistic purposes within the meaning of the

aforementioned case law of the CJEU and the Court of Human Rights (paragraphs 31 to 35). Indeed, the

Litigation Chamber considers that the defendant made the complainant's remuneration available free of charge on its

website in order to inform the public and draw its attention to the

aforementioned issue of public interest. The Litigation Chamber does not detect

any other elements motivating the publication of the disputed information and it therefore follows that

the sole purpose of this processing is to inform the public on these issues of interest

52
"Objective, Vision and Values of the Cumuleo project", website of the defendant, available at:

https://www.cumuleo.be/objectif-vision-valeurs.php (accessed 30 March 2024).
53The defendant himself acknowledges that he is not a professional journalist in point 13 of his conclusions of 19 September 2022. Draft decision of 20 June 2024 pursuant to Article 60.3 of the GDPR – 15/22

public. In addition, the Litigation Chamber notes that the defendant has complied with certain essential rules of journalistic ethics by verifying and, where appropriate, correcting the information he relays from official and public sources (point 5).

42. The Litigation Chamber also takes into account the contribution of the disputed publication to the debate of general interest and to the achievement of legal objectives in terms of transparency in public management. The Litigation Chamber considers the important role,

comparable to that of the press, played by the defendant in this public debate insofar

as Cumuleo makes information relating to this debate more readable and

more easily accessible to the general public than official publications. In this regard, the

Council of Europe has notably recognised the important contribution of the defendant’s

citizens’ initiative to the prevention of corruption among parliamentarians, judges and

prosecutors in an evaluation report on Belgium:

“Concerning the declarations of mandates and remunerated functions of

parliamentarians, while the publicity of the information is to be welcomed,

on the other hand, its accessibility remains difficult (…). For the time being, the EEG notes that it is at the initiative of a citizen that an unofficial site – www.cumuleo.be – aims to make information more easily accessible and comparable. It includes the history of the situation of the agents subject to the law, the public information communicated (mandates, functions, professions). The site also lists the agents in default (parliamentarians and other functions subject to the duty of declaration) 54 (The Litigation Chamber underlines). 

43. The Litigation Chamber notes that the complainant does not understand how the publication of her remuneration as an employee in the “private” sector contributes to the transparency that should surround the award of mandates in the public sector (point 20). The Litigation Chamber considers, however, that the exercise of the right to erasure concerns the processing

of information that contributes to this debate of general interest and is therefore of interest to the

public. The public’s interest in having this information is all the more important in

the present case, because the complainant, as a person subject to the above-mentioned

declaration obligation, plays a role in Belgian public life and is a public figure within the
55
meaning of the Article 29 Group Guidelines (point 38). Furthermore, the Litigation

Chamber notes that the objective of transparency in public management sought by the

defendant and a fortiori by the legislator, when it adopted the above-mentioned laws,

54“Prevention of corruption of parliamentarians, judges and prosecutors”, Evaluation Report Belgium, adopted
by GRECO at its 63rd Plenary Meeting, 24-28 March 2014, p. 20, available at
https://rm.coe.int/CoERMPublicCommonSearchServices/DisplayDCTMContent?documentId=09000016806c2c3e .
55
Article 29 Working Party, Guidelines on the implementation of the judgment of the Court of Justice of the European Union in the case of Google Spain and Inc. v Agencia espanola de proteccion de datos (AEPD) and Mario Consteja Gonzalez (C-131/12,
adopted on 26 November 2014, p. 15: “politicians, senior civil servants, business people and members of the (regulated) liberal professions can generally be considered as playing a role in public life”. Draft decision of 20 June 2024 pursuant to Article 60.3 of the GDPR – 16/22

requires that all types of remuneration, whether public or private, be accessible to the public. The Litigation Chamber takes into account the fact that only

private salary ranges of the complainant are published on Cumuleo (points 3

and 6 ). The public interest in having the disputed information is to highlight,

in particular, a potential conflict of interest (point 38). While it is true that the publication of

the functions exercised would already allow a conflict of interest to be exposed to a certain

extent, the Litigation Chamber is of the opinion that in this context, the

publication of the ranges of other salaries received by a public

administrator such as the complainant is not disproportionate. This is because it allows the public to

form a more complete view of potential conflicts of interest and to make

relevant comparisons between private and public income. The legislator has also held that the

publication of remuneration makes it possible to hold public administrators

accountable (naming and shaming) and constitutes an indicator of good governance

of parapublic structures (point 38).

44. Furthermore, the Litigation Chamber also takes into account the fact that the

disputed information is not particularly sensitive and its dissemination by the

defendant does not have significant repercussions, in particular because it is

already publicly available and was actively communicated by the complainant

itself in order to fulfil its obligations; it could therefore not be unaware that this

information was intended to be published by the Court of Auditors. The Litigation

Chamber is aware that publication on Cumuleo may create additional risks

compared to official publication insofar as the scope of this publication as well as the accessibility

of the disputed information is amplified.

However, for the reasons already set out, the Litigation Chamber considers that in this case

the risks are limited and would not justify a restriction on the legitimate rights of third parties to

have access to this information of public interest. Given that the information relayed by

the defendant on its website comes from official sources and that the complainant is

herself the source of this information, the Litigation Chamber takes into account the fact that

the accuracy of the disputed information is not called into question. Finally, the Litigation Chamber notes that the disputed information is recent and therefore still relevant since it refers to the professional activities carried out by the complainant since 2018.

45. For the reasons set out above, the Litigation Chamber considers that the defendant's website, by relaying and grouping the disputed information in a way that makes it more accessible to the public than official sources, is participating in a debate of public interest on the issue of transparency in public management and the fight against conflicts of interest and corruption. The Litigation Chamber takes into account the elements of

the case and considers that a restriction likely to dissuade participation in this debate Draft decision of 20 June 2024 pursuant to Article 60.3 of the GDPR – 17/22

of general interest and which would limit public access to the disputed information would not be

justified in this case. Consequently, with regard to the balance of interests

at stake, the Litigation Chamber considers that the publication on the defendant’s

website of the complainant’s remuneration as an employee in the private sector is

necessary for the exercise of the right to freedom of expression and information pursuant to Article 17.3. a)

of the GDPR.

46. Therefore, the Litigation Chamber is of the opinion that the defendant rightly refused

and continues to refuse to comply with the complainant’s request for erasure of

the disputed information.

II.3. Additional considerations

47. The Litigation Chamber is aware that the defendant, in support of its refusal to respond

to the complainant’s exercise of the right to object, invoked Article 24.2 of the LTD taken in

implementation of Article 85.2 of the GDPR. The defendant considers that the disputed processing

benefits from the exception of processing for journalistic purposes provided

by this provision of Belgian law and that it therefore does not have to justify any

"compelling reason" to maintain the disputed processing carried out on the

basis of Article 6.1.f) of the GDPR.56

48. Article 85 of the GDPR offers Member States the

possibility of reconciling, through their national law,

different fundamental rights such as the right to the protection of

personal data, on the one hand, and the right to freedom of

expression and information, on the other hand. Member States are free to provide for this

purpose in their national law, a special regime applicable to the processing of

personal data for journalistic purposes or freedom of expression, in the form of

exemptions or derogations from certain rules of the GDPR. For example, data processors

for journalistic purposes may be exempted from their obligation to provide

prior information to the persons concerned (Chapter III of the GDPR).

49. In Belgian law, Article 24 of the LTD was adopted in implementation of Article 85 of the GDPR. This provision

defines in its first paragraph the notion of processing carried out for journalistic

purposes in the following terms:

"Processing of personal data for journalistic

purposes means the preparation, collection, writing, production, dissemination or

archiving for the purpose of informing the public, using any media and

where the controller of the processing is subject to rules of journalistic ethics" (The

Contentious Chamber emphasizes).

50. This provision of Belgian law makes the invocation of the journalistic exception

conditional on the taking into account of rules of ethics and would therefore in principle

fall within the context of professional journalism. It proposes a definition of journalistic purpose

that is certainly more restrictive than that envisaged by the GDPR and the case law of the CJEU

and the European Court of Human Rights (paragraphs 31 to 35).

51. The Litigation Chamber recalls that Article 24.2 of the LTD provides that in the event of

processing for journalistic purposes, Articles 7 to 10, 11.2, 13 to 16, 18 to 20 and 21.1 of the

GDPR do not apply. However, Article 85.2 of the GDPR provides that such derogations or

exemptions are only possible to the extent that they prove to be “necessary”

to reconcile the right to the protection of personal data and freedom

of expression and information.

52. In this context, the CJEU stated in the aforementioned “Buivids” judgment:

“It should be recalled that the exemptions and derogations provided for in Article 9

of Directive 95/46 (mutatis mutandis similar to Article 85.2 of the GDPR)

must be applied only to the extent that they prove necessary to reconcile two fundamental rights, namely the right to the protection of

private life and the right to freedom of expression” (The Contentious Chamber emphasizes).

53. Following this judgment of the CJEU, a Belgian bill aimed to amend Article 24 of the

LTD . This bill intended in particular to insert a new paragraph

specifying that the exemptions provided for in Article 24 of the LTD must satisfy the criterion

of necessity. The APD Knowledge Center issued an opinion on this subject in this sense:

"The Authority obviously shares the observation made by the developments of the

proposed law according to which the automatic nature of the exemptions

granted to the data controller who carries out data processing for

journalistic purposes is not in accordance with Article 85 of the GDPR. It is

indeed appropriate to review Article 24 of the LTD in order to remove the automatic

derogations and exemptions it contains. The legislator must, in fact, ensure

that the regulations grant, in compliance with the principle of foreseeability, only

the derogations and exemptions that are actually necessary to achieve a

fair balance between the right to data protection and freedom of expression,

57The Contentious Chamber emphasizes
58CJEU, 14 February 2019, C-345/17, Buivids, ECLI:EU:C:2019:122, paragraph 63; see also CJEU, 16 December 2008, C-73/07, Satakunnan Markkinapörssi and Satamedia (Satamedia), ECLI:EU:C:2008:727, paragraph 55.
59Doc. Parl., Ch., sess. ord. 2021-2022, 55-2694/001. Draft decision of 20 June 2024 pursuant to Article 60.3 of the GDPR – 19/22

in particular when used in the context of a journalistic activity

"60 (The Contentious Chamber emphasizes).

61
54. Therefore, in line with previous decisions, the Contentious Chamber

questions the compliance with the GDPR of the current Article 24 of the LTD. While this article

provides for automatic exemptions, Article 85 of the GDPR and the case law of the CJEU

require a balancing exercise of the two fundamental rights of freedom of

information and expression and the right to data protection operates in

concreto. The Contentious Chamber could in this regard, in support of the case law of the
62
CJEU, decide to set aside Article 24 LTD if it considered it to be inconsistent with the GDPR. As

the CJEU has repeatedly held, the duty to disapply national legislation

that is contrary to Union law falls not only to national courts, but

also to all State bodies, including administrative authorities, responsible

for applying, within the framework of their respective powers, Union law. 63

55. Notwithstanding the foregoing, the Contentious Chamber notes that Article 17 of the GDPR is

not among the rights of the data subject whose exercise the Belgian legislature

purely and simply excludes in the event of processing for journalistic purposes under the said

Article 24.2 LTD. Thus, Article 17.1.c) of the GDPR invoked by the complainant, even if it is

a consequence of the exercise of a right of opposition (Article 21.1. of the GDPR which is admittedly

included in the list of excluded rights) would therefore be fully applicable, admittedly within the

limits of Article 17. 3. a) of the GDPR. Since Article 17 of the GDPR is not covered by Article 24.2. LTD, it

cannot be impacted by the fact that Article 21.1. of the GDPR is, on the other hand.

56. The foregoing considerations remain, however, superfluous since in

this case, the Litigation Chamber concluded that, in application of Article 17. 3.a) of the GDPR, the

right to freedom of expression and information should prevail and that the

defendant rightly refused (and continues to refuse) to grant the complainant’s

request for erasure.

60
Opinion of the APD Knowledge Center, No. 38/2023 of 9 February 2023, point 25.
61 See in particular, Contentious Chamber, Decision on the merits 139/2021 of 10 December 2021;

Contentious Chamber, Decision 45/2024 of 7 March 2024; Contentious Chamber, Decision 141/2022 of 4 October 2022.
62In its guidelines, the European Data Protection Board (EDPB) has highlighted the role of data protection authorities with regard to legislation that does not comply with the requirements of the GDPR. In support of Article 58.5.
of the GDPR, the European Data Protection Board thus recalled, referring to recital 50 of the judgment of the CJEU in Case C-378/17 that “according to the principle of supremacy of EU law, the duty to disapply national legislation that is contrary to EU law is owed not only by national courts but also by all organs of the State – including administrative authorities – called upon, within the exercise of their respective powers, to apply EU law” (EDPB, Guidelines 10/2020 on

63 restrictions under Article 23 GDPR, adopted on 13 October 2021, point 73).
See to this effect, CJEU, 4 December 2018, C-378/17, ECLI:EU:C:2018:979, paragraph 38, citing the judgments of 22 June 1989, 103/88, Costanzo, EU:C:1989:256, paragraph 31; of 9 September 2003, C-198/01, CIF, EU:C:2003:430, paragraph 49; of 12 January 2010, C-341/08, Petersen, EU:C:2010:4, paragraph 80, and of 14 September 2017, C-628/15, The Trustees of the BT Pension Scheme, EU:C:2017:687, paragraph 54; CJEU, 6 October 2015, C-362/14, Schrems, ECLI:EU:C:2015:650. Draft decision of 20 June 2024 pursuant to Article 60.3 of the GDPR – 20/22

III. As regards corrective measures and sanctions

57. Under Article 100 LCA, the Contentious Chamber has the power to:

1° dismiss the complaint;

2° order that there be no further action;

3° order a suspension of the judgment;

4° propose a transaction;

5° issue warnings or reprimands;

6° order compliance with the requests of the person concerned to exercise these rights;

7° order that the person concerned be informed of the security problem;

8° order the temporary or permanent freezing, limitation or prohibition of processing;

9° order the processing to be brought into compliance;

10° order the rectification, restriction or erasure of data and the notification of

these to the recipients of the data;

11° order the withdrawal of the accreditation of certification bodies;

12° impose periodic penalty payments;

13° impose administrative fines;

14° order the suspension of transborder data flows to another State or an
international organisation;

15° forward the file to the Public Prosecutor's Office of the Brussels

King's Prosecutor, who shall inform it of the follow-up given to the file;

16° decide on a case-by-case basis to publish its decisions on the website of the

Data Protection Authority.

58. In matters of dismissal without further action (Article 100.1.1° LCA), the Litigation Chamber must
64
justify its decision in stages and:

- pronounce a dismissal without technical action if the file does not contain or

not enough elements likely to lead to a sanction or if it contains a

technical obstacle preventing it from rendering a decision;

- or pronounce a dismissal without further action of opportunity, if, despite the presence of

elements likely to lead to a sanction, the continuation of the examination of the file does not seem to

64Cour des marchés (Court of Appeal of Brussels), 2 September 2020, 2020/AR/329, p. 18. Draft decision of 20 June 2024 pursuant to Article 60.3 of the GDPR – 21/22

not appropriate given the priorities of the APD as specified and illustrated

in the Dispute Resolution Policy of the Litigation Chamber. 65

59. In the event of a complaint being dismissed on the basis of several grounds (respectively,

dismissal of technical and/or expediency), the grounds for dismissal must be

treated in order of importance.

60. In light of the above and on the basis of the powers conferred on it by

the legislator under Article 100.1. of the LCA, the Litigation Chamber therefore decides to

dismiss the complaint, in accordance with Article 100.1., 1° of the LCA.

In this case, in light of the complaint filed by the complainant, the Litigation Chamber was asked to decide whether the defendant was right to refuse to comply with the complainant’s request for deletion and opposition in light of the disputed information on the defendant’s website. It follows from the analysis above that the defendant was indeed right to refuse to comply with the complainant’s requests (paragraphs 25 to 57). 61. In this case, the Litigation Chamber therefore pronounces a technical dismissal of the case

pursuant to Article 100.1., 1° of the LCA since, following the examination of

the complaint and the facts it reports, the Litigation Chamber concludes that it does not have

any evidence likely to lead to a finding of a violation of the GDPR on the part of the

defendant.

IV. Draft decision under the one-stop shop mechanism in execution of

Article 60.3. of the GDPR – applicability of Article 60.8. of the GDPR

62. In doing so, the Litigation Chamber adopts a draft decision pursuant to Article

60.3. of the GDPR. Therefore, the Disputes Chamber will communicate this draft decision to the data protection authorities that have declared themselves concerned by this complaint, including the CNIL to which the complaint was lodged.

63. This draft decision rejects the complainant's complaint as it stands within the meaning of Article 60.8. of the

GDPR. Article 60.8. of the GDPR provides in this case as follows: "By way of derogation from paragraph

7, where a complaint [read a complaint] is refused or rejected, the supervisory authority

to which the complaint was lodged shall adopt the decision, notify it to the author of the

complaint and inform the controller thereof".

65 Policy on classification without further action of the Litigation Chamber, 18/06/2021, available at
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-

66ntentieuse.pdf.
Policy on classification without further action of the Litigation Chamber, 18/06/2021, point 3 (“In which cases is my complaint likely to be classified without further action by the Litigation Chamber?”), available at
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
contentieuse.pdf.