APD/GBA (Belgium) - 66/2021: Difference between revisions

Revision as of 09:38, 7 July 2021

APD/GBA (Belgium) - 66/2021

Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 4(3) GDPR
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	04.06.2021
Published:	04.06.2021
Fine:	None
Parties:	Federal Governmental Agency: Financial
National Case Number/Name:	66/2021
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Dutch
Original Source:	Beslissing ten gronde 66/2021 van 04 juni 2021 (in NL)
Initial Contributor:	Enzo Marquet

The Litigation Chamber of the Belgian DPA ordered the Belgian Special Tax Inspectorate to comply with a complainant's requests to exercise their rights under Articles 14, 15, 16, and 18 GDPR. The Chamber held that subjective information can constitute personal data under the GDPR, and that restrictions to data subject rights in a Belgian income tax law are formulated too broadly and are therefore not applicable.

English Summary

Facts

The complainant is an accountant in Luxembourg. On 18 July 2019 and 9 August 2019, the complainant issued a request for information, access, rectification, and restriction of the processing of their personal data to the Belgian Special Tax Inspectorate ("Directie Algemene Administratie van de Bijzondere Belastinginspectie"), following the mention of their name in various files concerning investigations into tax payers. According to the complainant, the Tax Inspectorate had wrongly referred to them as a 'straw man' ("stroman") for a company alleged to have committed tax evasion.

When the Tax Inspectorate rejected the complainant's requests in a letter dated 28 October 2019, the complainant filed a complaint with the Belgian DPA.

Among other things, in its submissions, the Tax Inspectorate argued that the words 'straw man' and 'suspected straw man' do not constitute personal data as defined by the GDPR, since they concern an opinion or viewpoint of the Tax Inspectorate regarding the relation of the complainant to the relevant company. The complainant is therefore not entitled to request rectification of this data, or restriction of its processing.

Further, the Tax Inspectorate argued that, in accordance with Article 322 §1 of the Income Tax Law 1992 ('wetboek van de inkombelastingen', or 'WIB92') it is entitled to take a position on relevant tax issues to ensure the correct collection of tax. Specifically, this means that it is entitled to state that the complainant is suspected of acting as a 'straw man'. It argued a different reading of Article 322 §1 WIB92 would be contrary to Article 322 §1 WIB92 itself, as well as to a civil servant's freedom of expression within the meaning of Article 10 ECHR.

The Tax Inspectorate also argued that it had indeed satisfied the complainant's right to information under Article 14. This is because Law of 3 August 2012 containing provisions on the processing of personal data by the Tax Inspectorate in connection with its tasks, specifies a derogation which provides that the right of information may be restricted in order to safeguard the public interest objectives of monetary, budgetary, and fiscal matters. Specifically, it refers to the processing of personal data that has at its purpose the aim of preparing, organising, and monitoring activities which may result in an administrative fine or penalty. The restriction applies during the period of which the relevant individual is subject to investigation.

Holding

Firstly, the Litigation Chamber of the Belgian DPA held that the Tax Inspectorate had not executed the complainant's request for information, access, rectification, and restriction of processing, within good time - that is, within one month of the request - thereby infringing Article 12(3) of the GDPR, as well as 11 §3, 11/1 §3, 11/2 §3 and 11/3 §3 of the Act of 3 August 2012.

With regard to the complainant's right to rectification, the Litigation Chamber emphasised that, contrary to the Tax Inspectorate's assertion, the description of the complainant as a 'straw man' qualifies as personal data, which, in line with Article 4(1) and Recital 26 GDPR, as well as Opinion 4/2007 of the WP29 and the case law of the CJEU, must be interpreted broadly to include elements characterising the physical, physiological, genetic, mental, economic, cultural, or social identity of the individual. Importantly, personal data includes subjective information, such as the term 'straw man' irrespective of whether or not this information is correct. The litigation Chamber highlighted that in its opinion 04/2017, the WP29 pointed out that data protection rules take into account the possibility that such subjective information is inaccurate, and give the data subject the right of rectification, which is possible. In this regard, the Litigation Chamber noted that since it is not in a position to check the accuracy of the contested information ('straw man'), and cannot take the place of the Tax Inspectorate in this, it recommends the Tax Inspectorate rectify the personal data by allowing the complainant to add a statement to the file to the contrary.

The Litigation Chamber further held that the Tax Inspectorate cannot rely on the derogations provided for in the Act of 3 August 2012 and is therefore obliged to facilitate the complainant's data subject rights.

This is because these derogations must satisfy certain conditions, based on Article 52 of the Charter of Fundamental Rights of the EU, read in line with Article 8 of the same law, as well as CJEU case law. The Litigation Chamber notes that these conditions are not satisfied, in particular because the derogations are very broadly formulated, and go beyond what is provided for in Article 23 GDPR on restrictions to the GDPR. That Act not only allows the rights of data subjects to be restricted, but also makes it possible to exclude them altogether and deprive the data subject of any right. By incorrectly relying on these derogations, and failing to inform the complainant of the lack of applicability of the derogations, the Tax Inspectorate violated Article 12(2) GDPR, in conjunction with Articles 14, 15, 16, and 18 GDPR.

The Litigation Chamber ordered the Tax Inspectorate to comply with the complainant's requests to exercise their rights, in particular her right to information and access under Articles 14 and 15 GDPR and Articles 11 and 11/1 of the Act of 3 August 2012.

In line with Articles 16 and 19 GDPR, the Litigation Chamber also ordered the Tax Inspectorate to inform any recipient to whom the personal data concern were disclosed of this rectification. It emphasised the Tax Inspectorates obligation under Article 5(1)(d) GDPR to ensure personal data processed are accurate and up to date, and take steps to ensure all inaccurate data are rectified without delay.

It also issued a reprimand in accordance with Article 58(2)(b) GDPR and Article Article 100, §1, 5° WOG in addition to these corrective measures. It takes into account that the Tax Inspectorate is a public authority which has an exemplary function in terms of compliance with legislation on the protection of personal data, and which, as a tax authority, also processes a large amount of personal data. In accordance with the principle of 'lead by example' it must therefore ensure that it acts in conformity with the GDPR at all times and in particular with the provisions regarding the rights of data subjects.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

1/33

Dispute room

Decision on the merits 66/2021 of 04 June 2021

File number : DOS-2020-00818

Subject : Processing of personal data by the Federal Public Service

Finance - request for information, access, rectification and limitation of the

processing

The Dispute Chamber of the Data Protection Authority, composed of Mr Hielke

Hijmans, chairman, and Messrs Yves Poullet and Jelle Stassijns, members;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

on the protection of natural persons with regard to the processing of

personal data and on the free movement of such data and revocation of

Directive 95/46/EC (General Data Protection Regulation), hereinafter GDPR;

In view of the law of 3 August 2012 containing provisions regarding the processing of

personal data by the Federal Public Service Finance in the context of its assignments,

hereinafter “the law of 3 August 2012” ;1

In view of the law of 3 December 2017 establishing the Data Protection Authority,

hereinafter WOG;

Having regard to the internal rules of procedure, as approved by the Chamber of

Members of Parliament on December 20, 2018 and published in the Belgian Official Gazette on

January 15, 2019;

1As amended following the entry into force of the GDPR by the Law of 5 September 2018 establishing the
Information Security Committee and amending various laws concerning the implementation of Regulation (EU) 2016/679 of

27 April 2016 of the European Parliament and of the Council on the protection of individuals with regard to the
processing of personal data and on the free movement of such data and repealing Directive 95/46/EC,
BS 10 September 2018. Decision on the merits 66/2021 - 2/33

Having regard to the documents in the file;

has made the following decision regarding:

.
- Mrs X, , hereinafter referred to as “the complainant”; and
.
- the Federal Public Service Finance (Directorate General Administration of the
.
Special Tax Inspectorate), Koning AlbertII-laan 33bus 49 - 1030 Schaerbeek, met

company number 0308.357.159, hereinafter referred to as “the defendant”.

1. Facts and procedure

1. On 6 February 2020, the complainant submits a complaint to the

Data protection authority against the defendant.

2. The subject of the complaint concerns a request for information, inspection, rectification and

restriction of the processing of personal data addressed by the complainant to the

defendant on July 18, 2019 and August 9, 2019. The complainant specifies that she is active

as a bookkeeper in the Grand Duchy of Luxembourg. This sets the aforementioned

to have made requests to the defendant in response to the mention of

his name in various files concerning tax investigations regarding

taxpayers, executed by the defendant. More specifically, the complainant states

that it is incorrectly mentioned as “straw man” in the relevant files where, in

on the part of the taxpayers concerned, there would be tax evasion.

The complainant specifies that the request to exercise her rights by the

defendant was rejected by letter dated 28 October 2019, as a result of which

submitted this complaint to the Data Protection Authority.

3. On February 20, 2020, the complaint will be declared admissible on the basis of Article 58

in conjunction with article 60 of the WOG, the complainant is informed in accordance with

Article 61 WOG and the complaint pursuant to Article 62, §1 WOG is forwarded to

the Disputes Chamber.

4. On March 23, 2020, the Disputes Chamber will decide on the basis of Articles 95, §1, 1°, and 98

WOG that the complaint is ready for treatment on the merits.

5. By letter dated 23 March 2020, the parties are informed that the

complaint is ready for treatment on the merits and these are also

Article 99 WOG of the deadline to submit their defences. Decision on the merits 66/2021 - 3/33

6. On April 24, 2020, the defendant submits its statement of defense.

7. In its conclusion of the answer, the defendant states that it provided information on January 4, 2018

obtained from abroad under the Common Reporting Standards. He

specifies that an investigation was launched on the basis of the aforementioned information, in which

the official concerned carried out searches in internal and external databases,

including Orbis, Mémorial Luxembourgeois, POW and Sitran.

8. The defendant specifies that the results of this preliminary investigation and the position of

the case officer were subsequently included in a document that

was classified in file X, in which the following data and positions relate to:

regarding the complainant were included:

"Mrs. X is the founder and director of […] SA.
(…)

[…] SA has its registered office in […] It is therefore located in this […].
It was founded on […] by […] SaRL (represented by […]) and
Mrs X […]).

The capital at incorporation amounted to […] ([…]), of which […]and X each 50% ([…])
to own.
Upon incorporation (Constitution), the following persons are appointed as directors

appointed:

• […] SARL
• Mrs. X

• […] SARL

[…] SA SPF was transformed into […] with effect from […] (…)

Mrs. X is the founder and director of […]SA.
She has Belgian nationality and was domiciled in Belgium until […].
Since 2003 she has had her domicile in […] at the address: […]. She has mandates in

[…], but also in Belgium. (…)
- Director of […] since […];

- Director of […] ([…]) since […];
- (Managing) Director of […] (…) since […];
- Director of […] (…) since […].

When looking for X in Mémorial Lux we find […], mainly mandates like
driver.
(…)

When reviewing its mandates, we find that most companies
are located in […] at these 3 addresses:
oh […]

oh […]
oh […]
Mrs. X is […]of several “SA SPF” companies in […]. Presumably occurs

them as “...”
(…)
She owns .. […] real estate in Belgium (POW):

- […] Decision on the substance 66/2021 - 4/33

- 1/2 full ownership (together with spouse) in 3 apartments in […]

- […]
(…)

However, no file has yet been opened on behalf of Ms. X”.

9. The defendant specifies that, on the basis of the preliminary investigation, a tax investigation

was started to person Y but not to the complainant herself.

10. With regard to the request for information, access, rectification and restriction of the

processing submitted by the complainant on July 18, 2019, the defendant states that access

was granted on August 21, 2019 both under the law on

public administration and on the basis of privacy legislation. He points out that

it was hereby clarified to the complainant that no specific investigation regarding

of the latter was opened, which can also be read in the report of the

preliminary investigation.

11. The defendant argues that on 8 August 2019, the complainant filed a similar request for

exercise of its rights addressed to the Data Protection Officer

of the Information Security and Protection of Personal Information

Defendant's privacy. The latter specifies that this request was made on 28 October

2019 was rejected as access has already been granted and since the

personal data were collected only for a specific legitimate purpose and the

processing was necessary for the performance of the legal tasks of the

defendant.

12. In its conclusion of response, the defendant asks the Dispute Chamber for a complaint

filed by the complainant to be unfounded and hereby submits the following:

resources on:

• Means 1: the words “straw man” or “presumed straw man” do not constitute a

personal data

13. The defendant argues that the law of 3 August 2012 containing provisions regarding

the processing of personal data by the Federal Public Service Finance in

does not define the term “personal data” in the context of its assignments. The

defendant refers to the definition of the aforementioned term in the GDPR.

14. The defendant argues that what the complainant in

identifies file X and in the letter to person Y, her name and national number is Decision on the merits 66/2021 - 5/33

but that the statements “straw man” or “presumably she acts as a straw man” are not

constitute personal data within the meaning of the law or the GDPR. He adds that this

concerns a position or opinion of the defendant with regard to the intervention

of the complainant in company Z.

15. The defendant argues that, in accordance with its legal mandate, it is entitled to

to take a position on tax-relevant data in order to determine the correct levy

of the tax and points out that this follows from article 322, §1 WIB92 that

states: “The administration may, with regard to a particular taxable person,

collect written attestations, hear third parties, conduct an investigation, and within the

period specified by it, which may be extended for lawful reasons, from

natural or legal persons, as well as associations without legal personality

to request all information it deems necessary to determine the correct levying of the tax

to ensure."

16. The defendant submits that, therefore, in a prior notice of

indications of tax evasion with regard to person Y may state that

The complainant is suspected of acting as a front man and argues that a different reading of

the aforementioned provision would not only be contrary to Article 322 WIB92 itself, but

also with the civil servant's right to freedom of expression within the meaning of Article

10 ECHR.

17. The defendant argues that it is the jurisdiction of the tax courts to decide

to do with regard to disputes concerning the tax law and, consequently, whether

the former qualified the complainant rightly or wrongly as a 'straw man'.

18. The defendant adds that the complainant, on the pretext of the

processing of personal data cannot prevent the officials of

take the former position on tax-relevant data. The

the defendant reiterates in this regard that an opinion formulated by him does not

personal data, so that the complainant does not have the rectification, limitation or

may ask for a change.

19. Finally, the defendant argues that it should be noted that the report of the

preliminary investigation in which the position of the civil servant with regard to a particular tax

problem is displayed, there is no processing of personal data that is in

a file has been included or is intended to be included therein (article Decision on the merits 66/2021 - 6/33

4, § 6 GDPR) and that the report itself is not a structured set of

constitutes personal data that is accessible through criteria.

• Agent2: the [defendant] has provided [defendant] with sufficient information

20. The defendant argues that the complainant's right to information was respected

and that sufficient information has been provided to the latter in accordance with Article 14 GDPR

provided.

21. The defendant points out in this regard that “The Law of 3 August 2012 in Article 11

a derogation [specifies] that the right to information may be limited

to achieve the general interest objectives of monetary, fiscal and fiscal

to ensure matters.

In particular, reference is made to the processing of personal data that

The purpose of this is the preparation, organisation, management and follow-up of the

the investigations conducted, among others, by AABBI that can lead to an administrative

fine or administrative sanction.

In the event of a restriction of the right to information, these personal data may be

be kept for a maximum of 1 year after the final termination of the judicial,

administrative and extrajudicial proceedings.

This limitation of the right to information applies (1) during the period in which the

the person concerned is the subject of (2.1.) an inspection or (2.2.) an investigation or the

related preparatory work carried out by in this case

the AABBI and (2) the period during which the documents will be processed to initiate prosecutions

set.

This limitation applies where the exercise of the right would be prejudicial

for the control, investigation or preparatory work or secrecy

of criminal investigation or threatens to violate the safety of persons”.

• Ground 3: the right of access was respected. Decision on the merits 66/2021 - 7/33

22. With regard to the complainant's request to exercise the right of access,

the defendant that it provided the necessary explanation on 21 August 2019 regarding

the processing of the complainant's personal data and has granted access.

23. He maintains that this was supplemented by a statement from the official for

data protection that states that no tax investigation is conducted into the

complainant but an investigation is being conducted into person Y, in the context of which

complainant by name.

24. The defendant states that the complainant was specifically mentioned in the report

of the preliminary investigation, which the latter was submitted to, as well as in the letter addressed to

the taxpayer concerned. As for this letter - which the complainant herself has

obtained (document 7) – the defendant states that he can invoke the

ground for exception of article 11/1 of the law of 3 August 2012.

25. The defendant hereby specifies that it has the right to claim in whole or in

partially restrict it if it is feared that the right of access may adversely affect

would have consequences for the investigation. He believes that this is directly

more can be limited in case of danger of collusion and argues that here

it is not required that a specific investigation be conducted into the complainant, but only

that it is involved in the subject of the investigation.

• Remedy 4: the right to rectification and the right to limitation of

personal data does not apply

26. With regard to the request for rectification of the personal data by the complainant,

the defendant first of all reiterates that the opinion of the official in question that the

complainant would probably act if straw man does not constitute personal data in the in

sense of the GDPR, so that the data subject cannot request rectification.

27. The defendant adds that the complainant does not correctly spell her

name and thus does not contest the correctness of the personal data, as a result of which there is no

reason to proceed with any restriction on the processing of the

personal data of the complainant.

28. In subordinate order, the defendant invokes the grounds for exception of the

Articles 11/2 and 11/3 of the law of 3 August 2012.

• Means 5: there is no reason to delete the personal data of the
complainant Decision on the merits 66/2021 - 8/33

29. The defendant argues that it is entitled to request the erasure of data

refuse, as these fall within the scope of the exceptions to Article 17

GDPR falls.

30. The defendant specifies that, in accordance with the tax provisions - including

Articles 317 and 322 WIB92 – may use the personal data of third parties in the

as part of its tax investigation in order to ensure the correct levying of taxes

to ensure. He argues that the processing of the complainant's personal data

meets the objectives of the GDPR and is sufficiently proportional.

31. He argues that whether or not the defendant correctly describes the complainant as

(presumed) straw man, falls under the jurisdiction of the tax courts.

32. The defendant concludes that he therefore sees no reason to keep the personal data

from the complainant.

33. Finally, in this plea, the defendant submits that it also considers that the

erasure of the personal data would in this case create an obstacle to “official”

or judicial investigations and would adversely affect the

prevention, detection, investigation or prosecution of criminal offences”. He

specifies that, in this case, the data subjects by deleting their data

(possible) involvement in tax malpractice already in the course of the investigation

erase, which may not be the intention.

• Ground 6: The claim for a penalty is without object

34. Finally, the defendant argues that the complainant's claim for periodic penalty payments

unfounded, as the former has correctly provided information to the

complainant with regard to the processing of her personal data and access

has granted. It reiterates that the claims for rectification, limitation of the

data processing and data erasure are unfounded.

35. On 8 May 2020, the complainant submitted her statement of reply.

36. In its conclusion, the complainant argues that, without any apparent reason, in internal

documents of the defendant concerning tax investigations on behalf of other

taxpayers are listed as “straw”, whereby -by means of this statement of

the complainant - on behalf of the aforementioned taxpayers, it is decided to Decision on the merits 66/2021 - 9/33

existence of indications of tax evasion. The complainant makes this

evidence about.

37. The complainant further states that on 18 July 2019, it filed a request for access to the

administrative file of the defendant addressed to the latter, as well as a request een

to information, access, rectification and restriction of the personal data of the

complainant.

38. The complainant argues that the above requests were not complied with

within the one month period, as required by Article 12 GDPR.

39. The complainant further argues that the defendant failed to act on its

requests for information, rectification and restriction of processing.

40. The complainant requests the Disputes Chamber to declare her claim admissible and well-founded

declare and hold that the defendant has complied with Articles 5, 12 to 18, 21 and 23

GDPR as well as Article 11 of the Law of 3 August 2012 as well as

order that requests to exercise its rights are complied with, on

penalty of a penalty of EUR 1000 per day of delay.

41. On 25 May 2020, the defendant lodged its statement of defense.

42. By e-mail of 3 May 2020, the complainant requests, pursuant to Article 98, 2° WOG

to be heard. The defendant also requests to be heard in his opinion.

43. On January 18, 2021, the parties shall, in accordance with article 53 of the Rules of

internal order heard by the Disputes Chamber.

44. On 29 January 2021, in accordance with Article 54 of the Rules of Internal

the minutes of the hearing are forwarded to the parties.

45. By e-mail dated 4 February 2021, the complainant makes her comments regarding

this report.

2. Justification

2.1. The concept of “personal data” and the competence of the Disputes Chamber Decision on the merits 66/2021 - 10/33

2.1.1. The concept of “personal data” (Article 4.1 of the GDPR)

46. In its statement of defense and reply, the defendant first of all points out that the

terms “straw man” and “presumed straw man” do not constitute personal data in the

sense of the GDPR, but that this is only a position taken by the

defendant with regard to the complainant's intervention in certain

companies. The defendant argues that, as a result, the complainant has exercised its right to

rectification and restriction of processing in this regard.

47. The defendant argues that it is up to the tax administration to take a position

on tax matters in accordance with its legal powers and that it is up to the

jurisdiction of the tax courts should rule on any

disputes regarding these positions. The defendant decides that the

In this case, the data protection authority is not competent to make a decision.

48. Article 4.1 GDPR defines the term “personal data” as being “all information

about an identified or identifiable natural person ("the data subject"); if

identifiable is a natural person who can directly or indirectly

be identified, in particular by means of an identifier such as a name,

an identification number, location data, an online identifier or of one or more

elements characteristic of the physical, physiological, genetic, psychological,

economic, cultural or social identity of that natural person”. This definition

thus includes four constitutive and cumulative elements:

i. "all information"

ii. "about"

iii. “an identified or identifiable”

iv. "natural person"

i. "All information"

49. The Disputes Chamber points out that the term “personal data”, as explained in

Article 4.1 GDPR, Recital 26 GDPR as well as Group Opinion 4/2007

Data protection and the case law of the Court of Justice should be broad

interpreted and that this includes both objective and subjective information, regardless of

whether or not this information is correct or proven. The concept of “all information”

2FOCQUET, A. and DECLERCK, E., Data protection in practice, Intersentia, Antwerp, 2019, p. 6; C. DOCKSEY and H.
HIJMANS, “The Court of Justice as a Key Player in Privacy and Data Protection: An Overview of Recent Trends” in Case Law at

the Start of a New Era of Data Protection Law, EDPL Review 2019, p. 302-304. Decision on the merits 66/2021 - 11/33

used in Article 4.1 GDPR must therefore be interpreted literally and this en

regardless of the nature, content or form of the information.

50. Recital 26 GDPR emphasizes this extensive interpretation of the term

“personal data” and states that “the principles of data protection for everyone”

data concerning an identified or identifiable person [must]

apply". 3

51. This has also already been confirmed by the Data Protection Working Party in its Opinion

4/2007 on the concept of personal data, in which it states the following in this regard:

“In terms of the nature of the information, “personal data” includes all types

statements about a person. Also “subjective” information, opinions and judgments

fall below. (…) To be classified as “personal data”, it is not necessary
4 5
that the information is true or proven.”

52. The foregoing was also emphasized several times by the Court of Justice of the

European Union. In its judgment of 20 December 2017 Nowak, the Court stated in this regard

more specifically:

“The use of the words “any information” in the definition of the term

Indeed, “personal data” (…) indicates that it is the intention of the EU legislature

was to give a broad meaning to this concept, which is not limited to sensitive

or personal information but potentially extends to any kind of information, whether

objective information as subjective information in the form of opinions or

assessments, provided that this information ‘relates to’ the data subject”.

53. Furthermore, the Working Party on Data Protection and the Court of Justice specified that these

information can relate both to the personal life of the data subject
6
if its professional or public activities: “Include “Personal Data”

information relating to a person's private or family life in

strict sense, but also information about all kinds of activities that a person undertakes,

for example about a person's professional relationships or economic or social behaviour. It's alright

3The Disputes Chamber underlines.
4
Working Party on Data Protection Article 29, Advice 4/2007, 20 June 2007, p. 6.
5The Disputes Chamber underlines.

6Cf. ECtHR 16 February 2000, no. 27798. Decision on the merits 66/2021 - 12/33

so here to provide information about persons, regardless of their position or capacity

persons (consumer, patient, employee, customer, etc.).” 7

54. More specifically, the Court of Justice ruled in its Nowak judgment that the evaluation and evaluatie

comments from an examiner with regard to a test taken by the person concerned

exam if personal data within the meaning of current Article 4.1 of the GDPR must be

considered.

55. The Court points out that the non-classification of these data as being

personal data would completely remove this information from the protection of

the principles and safeguards relating to personal data and in particular to the

rights of access, rectification and opposition as well as the supervision of the

supervisory authorities. 8

56. The Disputes Chamber establishes on the basis of the above that, contrary to what

is stated by the defendant in his statement of defense and reply, also in this case

the information processed by the defendant falls within the scope of

Article 4.1 GDPR and should be regarded as personal data within the meaning of

aforementioned article. In particular, the documents at issue, on the one hand, mention the name and

first name of the complainant as well as her national registration number, and, on the other hand, the

statement as if the person concerned would act as a “straw man”.

ii. "About"

57. A second constitutive element of the definition of the term “personal data”

of Article 4.1 GDPR means that the information must be “about” a natural person

person, the person concerned. In its Opinion 4/2007, the Data Protection Working Party

points out that this may be the case either directly or indirectly, to the extent that the information

“refers to the identity, characteristics or behavior of a person or if

such information is used to inform the way that person is treated
9
or judged to determine or influence”.

7
Working Party on Data Protection Article 29, Advice 4/2007, 20 June 2007, p. 7. See also in the same sentence the conclusion of
Advocate General E. Sharpston delivered on 12 December 2013 in Joined Cases C-141/12 and C-372/12 (Y.S.), para. 45.
8
Nowak, par. 49.
9Data Protection Group Article 29, Advice 4/2007, 20 June 2007, p. 10. Decision on the substance 66/2021 - 13/33

58. The Data Protection Group specifies in this regard that information that is not directly

relates to a natural person as yet as “information about” the person concerned

natural person can be considered in the following two cases:

1) When the data will be used or can be expected to be

used for the purpose of assessing the data subject,

treat or influence his status or behavior; or

2) When the use of the data is expected to have an impact on

certain persons, where it is irrelevant whether this impact is large or small. The

The Data Protection Group would like to point out that, as long as the possibility exists

that, for example, the data subject will be treated differently as a result of the

processing of the data concerned, there is an impact on the

person. 10

59. This was also confirmed by the Court of Justice, which stated in this regard that these

second condition “is fulfilled when the information because of its content, purpose or
11
consequence is associated with a particular person”.

60. In the present case, it must be noted that the processing of the data concerned - i.e.

the complainant's identification details in combination with the qualification

'(probable) straw man' - and the use of this data (e.g. its mention

in the notifications) can be unequivocally linked to the complainant and a

may have an impact on the latter.

iii. “Identified or Identifiable”

61. A person is considered “identified” when that person

distinguishable from other persons within a certain group, by means of one

12
or multiple identifiers.

62. In view of the fact that the complainant, in addition to being qualified by the defendant

if “straw man” is also mentioned by name and first name in the relevant documents

as well as the national registration number of the complainant, the

10Group Data Protection Article 29, Advice 4/2007, 20 June 2007, p. 11-12.
11
CJEU, C434/16, Nowak, para. 35.
12Data Protection Group Article 29, Advice 4/2007, 20 June 2007, p. 13. Decision on the merits 66/2021 - 14/33/

The Court of Appeal finds that the person concerned was indeed identified and the

the information processed by the defendant in this case relates to a

“identified or identifiable person” within the meaning of Article 4.1 GDPR.

iv. "A natural person"

63. The Disputes Chamber notes that, although the information processed by the defendant verweer

also relates to the complainant's companies, it also appears that

it also relates to the person of the complainant herself, as the latter

expressly stated in the relevant documents, as stated above, by

by stating her name, first name and national register number.

64. It must therefore be stated that the fourth constitutive element in

case is present.

2.1.2. The jurisdiction of the Disputes Chamber

65. On the basis of the above, it must be concluded that the processing at issue is

well within the scope of the AVG, therefore, the jurisdiction of the

Data Protection Authority - and in particular the Disputes Chamber - falls.

66. The Disputes Chamber points out in this regard that, in accordance with Article 4, §1 WOG, the

Data Protection Authority is competent for “supervising compliance with the

basic principles of the protection of personal data, in the context of this

law and of the laws containing provisions for the protection of the

processing of personal data” and that the supervision of the law of 3 August 2012

therefore also falls under its jurisdiction, as it relates in its entirety to

to the processing of personal data by the Federal Public Service Finance.

67. The Disputes Chamber also points out that, in the context of this task, it

monitor compliance with the provisions of the GDPR and the laws

containing provisions on the protection of the processing of

personal data assigned to it by the European (Article 58 GDPR) and the

Belgian legislator (article 4WOG), the facts presented by the plaintiff and both Decision on the merits 66/2021 - 15/33

has investigated in the light of the provisions of the GDPR mentioned by the latter

and other data protection legislation mentioned in the complaint form

as well as in light of the legal provisions of which the violation was alleged in

the statement of the latter's reply.

68. The Disputes Chamber emphasizes - as it already did in its decisions

19/2020 and 38/2021 - after all, the complainant cannot be expected to

his complaint indicates in a precise and exhaustive manner the legal provisions

defendant (possibly) have been infringed. This task of qualifying the facts rests

at the Inspectorate and the Disputes Chamber of the GBA.

69. If the Disputes Chamber should refuse to take into account the complainant in the

charges brought forward during the proceedings, it would prejudice

the effectiveness of the right of complaint contained in Article 77 GDPR.

70. In the present case, the Disputes Chamber finds, however, that the . submitted by the complainant

complaint form including its appendices already contains a very detailed and

detailed statement of the facts as well as the alleged violations

of the GDPR and of the law of 3 August 2012 and that the reply statement is not

contains new indictments. Consequently, the Disputes Chamber points out

that the defendant has had the opportunity ab initio, both in writing and

to defend orally with regard to the integrality of the indictments.

2.2. Identification of the controller (Article 4.7 GDPR)

71. In accordance with Article 4.7 of the GDPR, the controller should be

considered: the “natural or legal person, government agency, service or

other body which, alone or jointly with others, has the purpose and means of

the processing of personal data”.

72. In its case-law, the Court of Justice has used the concept of

“controller” has been interpreted broadly on several occasions in order to

ensure effective and full protection of data subjects. 13

13
See, inter alia, ECJ, 5 June 2018, C-210/16 - Wirtschaftsakademie Schleswig-Holstein, ECLI:EU:C:2018:388, recitals 27-29. Decision on the merits 66/2021 - 16/33

73. In accordance with Opinion 1/2010 of the Data Protection Working Party, the

capacity of the data controller(s) concerned in concrete terms

be assessed. 14

74. In the present case, the Disputes Chamber first finds that the defendant has

of personal data within the meaning of Article 4.2 GDPR, in particular “a

operation or set of operations relating to personal data or

a set of personal data, whether or not carried out by automated means

processes, such as collecting, recording, organizing, structuring, storing, updating

or modify, request, consult, use, provide by means of

transmit, distribute or otherwise make available, align or

combining, blocking, deleting or destroying data”. 15 The Defendant

collected the complainant's personal data (surname, first name,

national register number) and included it in the report of his preliminary investigation as well as

in the notification sent to the taxpayer(s) concerned.

75. Still in accordance with Opinion 1/2010 of the Data Protection Working Party

the concepts of “the goal” and “the means” are treated inseparably together and

it must be determined who is the 'why' (the goal) and the 'how' (the

resources) of the processing concerned. 16

76. The Disputes Chamber further finds that the defendant de facto set the purpose and

means certain of the processing of personal data concerned,

as, first of all, it initiated the processing by the personal data

from the complainant through the sources listed above as well as the

to qualify the complainant as being a “straw man” and, secondly, by deciding the

to include collected data in the preliminary investigation report as well as the

notification sent to the concerned taxpayer(s).

77. The defendant is also de jure referred to as being the

controller of the personal data concerned and this more

determined by articles 2 and 3 of the law of 3 August 2012 on the

processing of personal data by the Federal Public Service Finance in the

14
See Group 29, Opinion 1/2010 on the concepts of “controller” and “processor”, 16 February 2010 (WP 169),
as clarified by the DPA in a note “Overview of the concepts of controller/processor in the light
of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection
of natural persons in connection with the processing of personal data (GDPR) and some specific applications for
liberal professions such as lawyers”.
15
The Disputes Chamber underlines.
16Group 29, Opinion 1/2010 on the concepts of “controller” and “processor”, 16 February 2010 (WP 169), p.
15. This opinion has been replaced by Guidelines 7/2020 of the EDPB. Decision on the merits 66/2021 - 17/33

within its missions, which stipulate: “The Federal Public Service Finance is the

person responsible for the processing referred to in this chapter of

personal data” and “The Federal Public ServiceFinance collect processed

personal data to carry out its legal tasks. the collected

data may not be used by the Federal Public Service Finance for other

purposes other than for the performance of its legally defined assignments

used".

78. Moreover, the defendant disputes its status as controller

not for the personal data concerned.

79. On the basis of the above, the Disputes Chamber decides that the defendant must

are considered a controller within the meaning of Article 4.7 GDPR

for the processing of personal data that is the subject of the

complaint. He is therefore there in this capacity in accordance with the provisions of Articles 5.2

and 24 GDPR accountability to ensure compliance with the

principles of the GDPR .

2.3. With regard to requests to exercise its rights formulated by the

complainant

2.3.1. Processing time for requests (Article 12.3 GDPR and Article 11 Law 3

August 2012)

80. In accordance with Article 12.3 GDPR, the controller must

data subject “without undue delay and in any event within one month of receipt of the

request under Articles 15 to 22” to provide information about the

action given to the request. 17Depending on the complexity of the

requests and of the number of requests, that period may be extended by an additional two if necessary

months to be extended. The controller should inform the data subject

17
The Disputes Chamber underlines. Decision on the merits 66/2021 - 18/33

if necessary, within one month of receipt of the request

of such extension.

81. Article 12.4 GDPR states that “when the controller fails to act

gives the request of the person concerned, he the latter without delay and at the latest within

one month after receipt of the request [shall state] why the request

has been unsuccessful, and informs him of the possibility of lodging a complaint

should lodge an appeal with a supervisory authority and a judicial remedy”.

82. The Law of 3 August 2012 also specifies in its Article 11 §3 (right to

information) , 11/1 3 (right of access) , 11/2 §3 (right to rectification) and 11/3 §3 (right

restriction of processing) that “the data protection officer of

the controller [informs] the data subject in writing, without undue delay,

and in any event within one month of receipt of the request, on any

refusal or limitation of his right (…) to the personal data concerning him

as well as the reasons for such refusal or restriction. (…) Depending on the

complexity of the requests the number of requests and the deadline if necessary

be extended for a further two months. The controller states

inform the data subject of this within one month of receipt of the request

extension and of the reasons for the postponement.”

83. It is apparent from the documents in the file that the first request for access by the

The complainant was filed on the date of July 18, 2019. On August 7, the . shared

defendant informed the complainant that his request should be addressed to

the Information Security and Personal Protection Service

lifestyle. It appears from the documents in the file that the complainant denied her request

next day, on August 8, 2019, to the aforementioned service. at 26

September 2019, the complainant addressed a reminder to the defendant

concern the aforementioned request. 18

84. By decision of 28 October 2019, the defendant replied to the request for

information, access, rectification and restriction of processing, submitted on behalf of

the complainant by her counsel, as follows:

18
cf. documents 1-5 of the complainant's bundle of documents. Decision on the merits 66/2021 - 19/33

“It appears from the elements of the file that your client herself is not the subject

is part of an investigation by the [defendant]. There were no

investigative acts performed on behalf of your client. The [defendant] has to

as a result of some tax investigations with regard to third parties, information

from public sources about your client. The information that your client

has mandates in various companies comes from public sources.

On August 7, 2019, the [defendant] already provided an explanation and inspection of the

administrative file of your client allowed under the law of 11 April

1994 on open government. During this inspection, which

took place on 21 August 2019, barring misunderstanding, you have already

requested relevant data.

Your client's personal data were only legalized for a specific purpose

purpose collected.

Finally, the right to erasure on the basis of Article 17, paragraph 3 b) GDPR is not

applies as the processing is necessary for the fulfillment of a

legal processing obligation of the [defendant].”19

85. It follows from the foregoing that the defendant withdrew the request to exercise the

rights of the complainant not within the scope of Article 12.3 and 12.4 GDPR and by the

law of 3 August 2012 prescribed period of one month treated e,norn

has informed the latter within the aforementioned period in connection with a

possible extension due to the complexity of the request.

86. The Disputes Chamber points out that the access to the

framework of the legislation on public access to government the latter is not released from being

obligation in accordance with Articles 12.3 and 12.4 GDPR as well as the law of 3 August

2012 to inform the complainant within the time limit provided for the

action given to the request to exercise its rights

pursuant to the GDPR, which furthermore concerned not only a request for access but

also a request for information, rectification and limitation of the

data processing.

19
cf. piece 6 piece bundle complainant. Decision on the merits 66/2021 - 20/33

87. The Disputes Chamber therefore finds that the defendant has thus committed an infringement

committed to Article 12.3 and 12.4 GDPR as well as to Articles 11 §3, 11/1 § 3, 11/2§3

and 11/3 §3 of the law of 3 August 2012 .

2.3.2. With regard to the defendant's response to the requests of the

complainant pursuant to Articles 14, 15, 16 and 18 GDPR

i. The request for information (Article 14 GDPR)

88. The complainant, by means of her letter dated 18 July 2019, first addressed a

request for information to the defendant in accordance with Article 14 GDPR, which

contains the information to be provided to the data subjects in the event

in which the personal data concerned were not collected by the latter itself

obtained.

89. With regard to this request made by the complainant under Article 14 GDPR

for information, the defendant first argues that it has sufficient information informatie

provided to the person concerned. The defendant hereby refers to its privacy policy

published on the website https://financien.belgium.be/nl/over_de_fod/privacy

and states that it provides extensive information about the processing of

personal data by the defendant.

90. Second, the defendant argues that in the present case it can rely on the

derogation contained in article 11 of the law of 3 August 2012 .

91. The aforementioned article provides in its §1 as follows:

“By way of derogation from Articles 13 and 14 of Regulation (EU) 2016/679 of 27 April

2016 of the European Parliament and of the Council on the protection of

natural persons in connection with the processing of personal data and

on the free movement of such data and repealing Directive

95/46/EC (General Data Protection Regulation), the right to

information will be deferred, restricted or excluded as to

processing of personal data for which the Federal Public Service

Finance controller is to achieve the objectives of general

safeguard the importance of monetary, budgetary and fiscal matters, and

to the extent that Article 14(5)(d) cannot be invoked in the specific case.” Decision on the merits 66/2021 - 21/33

ii. The request for access (Article 15 GDPR)

92. By letter dated 18 July 2019, the complainant also addressed

a request for access to the defendant:

The client also has the right to (sic) inspect the personal data

that are processed and of the following information (i.e. the right of access in accordance with

article 15 GDPR):

- the processing purposes;

- the categories of personal data concerned;

- the recipients or categories of recipients to whom the personal data is or

will be provided, in particular to recipients in third countries or international

organizations;

- if possible, the period during which the personal data is expected

will be stored, or if that is not possible, the criteria to meet that deadline

determine;

- that the data subject has the right to request from the controller that

personal data are rectified or erased, or that the processing of him

concerning personal data is restricted, as well as the right against that

to object to processing;

- that the data subject has the right to lodge a complaint with a supervisory authority

authority;

- where the personal data is not collected from the data subject, all

available information about the source of that data;

- the existence of automated decision-making, including those referred to in Article 22,

profiling referred to in paragraphs 1 and 4 and, at least in those cases, useful information about

the underlying logic, as well as the importance and expected consequences of that

processing for the data subject.

On the basis of the aforementioned established processing of personal data,

client to obtain information about the processed personal data and to

obtain in the documents in which it is mentioned. She also wishes to

in particular to obtain explanations from your Administration about the

processing purposes, the recipients of this information and any available

information about the source of the personal data. (…) ”20

20
Piece 1 bundle of documents complainant. Decision on the merits 66/2021 - 22/33

93. In its statement of defense, the defendant submits, with regard to that request

for inspection that the latter gave the complainant access on 21 August 2019

and has provided the necessary explanations regarding the processing of

personal data.

94. Furthermore, also with regard to this right, the defendant invokes the derogations provided for

article 11/1 of the law of 3 August 2012 (cf. supra edge no. 80), and this in the

particularly with regard to the document that the complainant herself has from third parties

obtained 21 – and in which no access was granted by the defendant. The

Defendant argues that it may fully or partially deny the right of access

restrict it if it fears that this will be detrimental to the research and states that

casu was feared for collusion. The defendant further argues that it is not required

that an investigation be conducted into the person concerned himself so that he

could legally invoke the aforementioned deviations.

iii. The request for rectification (Article 16 GDPR)

95. The complainant also addressed a correction request to the defendant.

In accordance with Article 16 of the GDPR, the data subject has the right to obtain “from the

controller without delay rectification of inaccuracies concerning him

obtain personal data”.

96. The complainant invokes the aforementioned right as it is of the opinion that the

personal data processed by the defendant – and in particular the qualification as

Plaintiff's 'straw man' – incorrect and in no way substantiated by the defendant.

The complainant hereby points out that on the defendant as controller

pursuant to Article 5.1 d) GDPR, there is an obligation to ensure that the

processed personal data “are correct and updated if necessary;” and all

[must take] reasonable steps to protect the personal data that, in view of the

purposes for which they are processed are incorrect, delete them without delay or

rectify (“correctness”)”.

97. In its statement of defense and reply, the defendant argues that the right to

rectification in this case does not apply as 1° the term 'straw man' is not used as a

personal data can be considered within the meaning of Article 4.1 GDPR and 2° in

21
Piece 7 bundle of documents complainant. Decision on the merits 66/2021 - 23/33

subordinate order, the defendant can invoke the ground for exception

contained in article 11/2 of the law of 3 August 2012 (cf. supra paragraph 80).

iv. The request for restriction of processing (Article 18 GDPR)

98. Finally, the complainant also made a request for limitation of the

processing to the defendant, pursuant to Article 18 .1 a) GDPR, which provides:

“The data subject has the right of the controller to restrict

obtain the processing if one of the following applies:

a) the correctness of the data is disputed by the data subject, during

a period that allows the controller to verify the accuracy of the

check personal data; (…)”

99. In its statement of defense and reply, the defendant argues that the right to

limitation of the processing in this case also does not apply as 1° the term

'straw man' cannot be regarded as personal data within the meaning of Article 4.1

GDPR and 2° in subordinate order, the defendant can invoke the

grounds for exception contained in Article 11/3 of the Law of 3 August 2012 (cf. supra

marginal number 80).

v. Judgment by the Disputes Chamber regarding points i to iv

100. The defendant thus invokes the . provided for under Article 23 GDPR

restrictions on the rights of data subjects provided for in the law of 3 August

2012 which further regulates the processing of personal data by the former.

These derogations are contained in particular in Articles 11 §1 (right to information),

11/1 §1 (right of access), 11/2 § 1 (right of rectification) and 11/3 §1 (right of limitation

of the processing).

101. As regards (inter alia) the rights exercised by the complainant, Article

23 GDPR in particular that:

“the scope of the obligations and rights referred to in Articles 12 to

22 and Article 34, as well as in Article 5, insofar as the provisions of those Articles Decision on the substance 66/2021 - 24/33

correspond to the rights and obligations referred to in Articles 12 to

with 20, [may] be limited by means of Union or Member State law

provisions applicable to the controller or processor,

provided that such limitation affects the substance of the fundamental rights and

fundamental freedoms and in a democratic society a samenleving

necessary and proportionate measure to ensure: (…)

d) the prevention, investigation, detection and prosecution of criminal offenses or

the enforcement of sentences, including protection against and

prevention of dangers to public safety;

(e) other important objectives of general interest of the Union or of a Member State,

in particular an important economic or financial interest of the Union or of a Member State,

including monetary, budgetary and fiscal matters, public health

and social security; (…)”.2

23
102. Under this provision, the Belgian legislature provided for the derogations

included in the articles mentioned above.

103. In accordance with the aforementioned Article 23 GDPR, as explained in recital 73

GDPR, however, the rights of data subjects can only be limited under

the conditions and within the limits set out in this provision, which are based

is on Article 52 of the Charter of Fundamental Rights of the European Union and

should be read in the light of the case law of the Court of Justice and

Article 8 of the European Convention on Human Rights (ECHR).

104. These restrictions should in particular be necessary in order to

economic or financial interest and must be justified and

to be proportionate. Article 2 3 GDPR hereby specifies in accordance with 52 of the

Charter that the restrictions concerned are the substance of the rights

should be left untouched.

105. The Disputes Chamber notes, however, that the restrictions included in the law

of 3 August 2012 are very broadly formulated and go further than what is beingword

provided by Article 23 GDPR . First of all, this law does not only allow the

rights of the data subjects are limited but also makes it possible

22
The Disputes Chamber underlines.
23M.n. the former Article 13 of Directive 95/46 of the European Parliament and of the Council of 24 October 1995 on the
protection of natural persons with regard to the processing of personal data and on free movement
of that data. Decision on the merits 66/2021 - 25/33

exclude them completely and deny any right to the data subject (“can it

right(…) to be deferred, limited or excluded") . In addition, there is no clear

time limitation attached to this complete exclusion of the rights of

25
involved.

106. The former Commission for the Protection of Privacy

(hereinafter: CPP) stated in this regard in its Recommendation 02/2012 of 8 February 2012

and in its Opinion 11/2012 of 11 April 2012 that “with regard to the suspension of the

rights of the data subject, in particular the right to information, access and opposition,

due caution [should be] shown ” and states that they are “the

[makes] the greatest reservations regarding the lack of criteria allowing

determine from which moment a tax investigation starts and ends

(period during which the right to information, access and opposition is exercised)

denied to the data subject)”. Furthermore, the CPP emphasized that “these rights

after all [constitute] an extremely important protection mechanism” and that it

denying the rights of data subjects raises questions as a

tax research can extend over a long period of time.

107. The Council of State also pointed to the (too) far-reaching limitation of the rights of
26
stakeholders in his advice on the preliminary draft law of 21 May 2012 and suggested

in particular that Article 11 “thus has the effect that any taxable person

the right to information is denied as well as the right of access and the right to

opposition / improvement” while “Article 13 of Directive 95/46 of the European

Parliament and the Council of 24 October 1995 “on the protection of

natural persons in connection with the processing of personal data and
27
on the free movement of such data', transposed into Belgian law at the

the aforementioned law of December 8, 1992, the only exceptions and limitations

enumerated that the Directive allows with regard to the right to

information, the right of access and the right to rectification”.

108. Although the above cannot be blamed on the defendant, the

The Disputes Chamber that the law of 3 August 2012 provided for

derogations, which imply a restriction on the fundamental right to

24Cf. § 1, first paragraph, of Articles 11, 11/1, 11/2 and 11/3 of the Law of 3 August 2012.
25
The relevant provisions of the law of 3 August 2012 only specify that the preparatory
activities may not last longer than one year from the receipt of a request to exercise the rights by
a person concerned. However, no maximum period has been set within which the check or investigation must be completed
closed (and after which the rights can be exercised again).
26
RvS, advice no. 51.291/2 of 21 May 2012, https://www.dekamer.be/FLWB/pdf/53/2343/53K2343001.pdf, 20.
27Current Article 23 GDPR. Decision on the merits 66/2021 - 26/33

data protection , should be made restrictive by the latter

interpreted and applied in accordance with the higher legal standard and,

in particular Article 23 GDPR, quod non in casu (see below).

109. Thus, Article 11, § 2 of the Law of 3 August 2012 specifies - with regard to

right to information (cf. art. 11/1 §2, 11/2 §2 and 11/3 §2 for respectively the right of access,

rectification and restriction of processing) - that the

derogations only “apply during the period in which the person concerned has the object”

forms part of an audit or investigation or the related

preparatory work carried out by the aforementioned services in the context of

of the execution of their legal tasks as well as during the period in which

the documents originating from these services are processed to enable prosecutions

in this regard”. 28 It follows from that provision that the

derogations can only be invoked in cases where the data subject himself/herself

is the subject of an audit, investigation or preparatory work

of the defendant.

110. This is also apparent from the preparatory work of the Law of 3

August 2012, expressly specified in the Explanatory Memorandum

that the provisions in question “establish an exception to the right to information,

on access and on correction when the natural person is the subject of a
29
control or investigation” and that “the Administration, however, respects the principle of these rights

not [shall] erode by invoking a control option. The access can

only be refused if an audit or investigation is already underway, or if the

preparations have already been made”. 30

111. As regards the rationale of the restrictions in question, the Explanatory Memorandum states

further that the performance of the defendant's duties could be adversely affected

influenced “by the exercise of the right of access of those who want the tax”

and who, thanks to the access, could have knowledge of the data contained in
31
be the property of the administration”.

112. That the restrictions on the rights of data subjects pursuant to Article 11 et seq. of

the law of 3 August 2012 should be interpreted restrictively,

28The Disputes Chamber underlines.

29DOC 53 2343/001, p. 3 and p. 9-10 (The Disputes Chamber underlines).
30
DOC 53 2343/001, p. 12.
31DOC 53 2343/001, p. 11. Decision on the substance 66/2021 - 27/33

also confirmed by the judgment 51/2014 of the Constitutional Court of 27

March 2014, whereby this partially annulled the former Article 11 as it ruled

that it was contrary to the principle of equality and non-discrimination in so far as

it “allows the data controller to

to refuse the exercise of [the rights] in respect of personal data that

independent of the purpose of the ongoing investigation or audit and in

to the extent that it does not provide for a time limitation on the possibility to

to make an exception to the application of those rights which is justified by the

performing work in preparation for an audit or investigation .2

113. In the present case, however, it is apparent from the file in the file that it is not the complainant but

third parties - in particular other taxpayers - were the subject of the

investigations in the context of which, however, the complainant's personal data

were processed. In particular, this is expressly stated by the defendant in

the disputed document was also communicated to the complainant's counsel via

its letter of 28 October 2019, in which it states:

“It appears from the elements of the file that your client herself is not the subject

is part of an investigation by the [defendant]. There were no

investigative acts performed on behalf of your client. The [defendant] has to

as a result of a number of tax investigations with regard to third parties, information

from public sources about your client.”

114. Articles 11 et seq. of the law of 3 August 2012 also provide in their § 1 that the

derogations from the exercise of the rights described above may

be applied if the data subject would be the subject of

“preparatory work” in connection with an investigation or

control of which the data subject is or will be the subject. From the

documents of the file, it does not appear – for obvious reasons – whether this is too much or not in the present case

was not the case.

115. However, in its § 2, Article 11 of the Law of 3 August 2012 (as well as the

Articles 11/1, 11/2 and 11/3 with regard to the right of access, rectification and

restriction of processing) from now on that the duration of the aforementioned

preparatory work, during which a deviation from the aforesaid

rightscontained in articles 14 to 18 GDPR can be applied, “no longer [may]

32GwH 51/2014, March 27, 2014, p. 15.
33
cf. supra marginal 8. Decision on the merits 66/2021 - 28/33

exceed one year from receipt of the request [to exercise the

rights]”.

116. Regardless of whether or at the time of the invocation of the law of August 3

2012 contained deviations by the defendant whether or not preparatory

activities were ongoing with a view to initiating an investigation into

with regard to the complainant, should therefore, on the basis of the above, be

concluded that the defendant is no longer relying on the aforementioned deviations

can appeal, since the period of one year from receipt of the request for

exercise of the rights by the complainant has expired.

117. In addition, it was found during the hearing that the defendant did not

informed of the lifting of the invoked derogations, as required

by Articles 11, 11/1, 11/2 and 11/3, §2 in conjunction with § 3 of the Law of 3 August 2012.

After all, the aforementioned provisions state that “the duration of the preparatory

activities, referred to in paragraph 2, second paragraph, during which the articles

13 and 14 of the General Data Protection Regulation do not apply,

may not exceed one year” and “when the Federal Public Service

Finance has made use of the exception provided for in paragraph 1, first paragraph,

and with the exception of the situations referred to in paragraphs 6 and 7 of paragraph

3 , the exception rule [is] lifted immediately after the closure of the

control or of the investigation. The data protection officer of the

controller shall inform the data subject of this without undue delay”.

In the present case, however, the one-year period was already amply exceeded without

that the complainant was informed of the withdrawal of the invoked

deviations.

The above should not only be regarded as a violation of the

relevant provisions but also as a violation of Article 12. 2 GDPR, that

imposes an obligation on the controller to exercise the

facilitate the rights of data subjects.

118. The Disputes Chamber also determines on the basis of the statements of the defendant

during the hearing that the latter does not seem to have an internal procedure

to have a complete overview of all personal data

of a data subject, in this case the complainant , who processes it . During the hearing

34I.e. “when a file is transferred to another service of the Federal Public Service Finance or to the

competent institution to decide on the findings of the investigation”. Decision on the merits 66/2021 - 29/33

after all, the defendant stated that “there are many different departments within the

[defendant] ” and that “not all documents prepared by all concerned

officials can be screened or indexed to verify that the name de

of the complainant or other personal data were used”. The

The Disputes Chamber points out, however, that the defendant as

controller of the personal data concerned

in accordance with the accountability obligations set out in Articles 5.2 and 24 GDPR

and the principle of data protection by design contained in Article 25 GDPR

the obligation rests on the “appropriate technical and organizational measures [to

take] (…) with the aim of complying with data protection principles, such as minimum

data processing, in an effective manner and the necessary

incorporate safeguards into processing to comply with the requirements of this

Regulation and to protect the rights of data subjects” and such

also be able to demonstrate. The controller should therefore:

to ensure that it is technically possible to request personal data in all

systems within his organization, especially when these are on a large scale

processing personal data. The Disputes Chamber emphasizes that this

accountability is one of the cornerstones of the GDPR, in that the defendant

as a public service, it has an exemplary function in terms of compliance with the

data protection principles.

119. The Disputes Chamber rules on the basis of the above that the defendant

has committed an infringement of Articles 11 §1, 11/1 §1, 11/2 §1 and 11/3 §1 of the

Law of 3 August 2012 and thus Articles 12.2 in conjunction with Articles 14, 15, 16 and

18 GDPR has violated .

Conclusion on the defendant's infringements

120. Based on the above, the Disputes Chamber rules that:

- the defendant does not timely notify the complainant - i.e. within the period of one month -

inquired about the follow-up to the submitted by it on 18 July 2019

requests for information, access, rectification and restriction of processing ex

Articles 14, 15, 16 and 18 GDPR and thus infringed the

Articles 12.3 and 12.4 GDPR as well as Articles 11 §3, 11/1 § 3, 11/2 §3 and 11/3 §3 of the

law of 3 August 2012; and Decision on the substance 66/2021 - 30/33

- the defendant, with regard to the above-mentioned addressed to him by the complainant,

requests can no longer rely on the provisions of Articles 11, 11/1, 11/2 and 11/3 of the Act

derogations foreseen from 3 August 2012 and is therefore obliged to

requests to exercise rights by the complainant in accordance with the

to deal with the aforementioned articles. The defendant informed the complainant in this regard

does not agree with regard to the elimination of the invoked deviations, as required by the

Articles 11, 11/1, 11/2 and 11/3, §2 in conjunction with § 3 of the law of 3 August 2012, and

thus committed an infringement of the aforementioned provisions as well as of Article 12.2 GDPR

in conjunction with Articles 14, 15, 16 and 18 GDPR.

121. The Disputes Chamber therefore considers it appropriate to order the defendant that

the complainant's requests to exercise her rights are met,

in particular the right to information and access (Articles 14 and 15 GDPR and

articles 11 and 11/1 of the law of 3 August 2012) . The Disputes Chamber orders

the defendant, in particular the complainant in accordance with Articles 14.1 and 15.1

GDPR at least :

i) provide information about the processed personal data and more

determines the processing purposes, the recipients of the data subject

personal data and all available information about the source of the

data;

ii) allow access to all letters and/or communications in which the complainant

is stated and for which it is no longer possible to invoke the

derogations provided for in the law of 3 August 2012.

122. As regards the request to exercise the right to rectification (Article 16

GDPR and Article 11/2 of the law of 3 August 2012) by the complainant , emphasize t

the Disputes Chamber that the classification as a “straw man” of the complainant by the

defendant - contrary to what is stated by the latter - as a

personal data must be considered (cf. supra margin nos. 46-65). This

data cannot therefore be exempted from data protection and is

also subject to the provisions concerning the rights of the

involved. 35The Disputes Chamber, however, points out because this - contrary to

for example, the name of the e-mail concerned - “subjective” information, there

it concerns a conclusion or qualification by the controller. In

his judgment Nowak the Court of Justice there, with regard to this type

personal data, that the scope of the rights should be

assessed in function of the purposes for which the personal data was collected

35
Judgment Nowak, margin no. 49. Decision on the substance 66/2021 - 31/33

processed and that the purpose of data protection law is not to

ensure the correctness of a decision-making process.

123. The Data Protection Working Party, in turn, pointed out in its Opinion 04/2017

that data protection rules do take into account the possibility

that such subjective information is incorrect and gives the data subject the right to access

to improve that information. He hereby points out that rectification in this case

is possible by having different comments added, or by

the use of appropriate legal remedies, such as appeal procedures . 36

124. In view of the fact that the personal data in question in the present case is subjective

information relating to the complainant, the latter of which states that

it is incorrect and where the Disputes Chamber is not in a position to verify the correctness

of this fact and cannot take the place of the

defendant , it orders its rectification by admitting to the

complainant to allow a statement to the contrary in the files concerned

add, the latter indicating that it does not agree with the correctness of the

data involved. In accordance with Article 19 of the GDPR in conjunction with Article 16 of the GDPR, the

Dispute Chamber It is also appropriate to recommend the defendant to any recipient

notify who the personal data concerned was provided to

rectification. The application of Article 19 GDPR hereby results from the application

of Article 16 GDPR.

125. The Disputes Chamber emphasizes that the obligation rests on the defendant

pursuant to Article 5.1 d) GDPR to ensure that the processed data

personal data “are correct and updated if necessary;” and “all reasonable”

[must take] measures to protect the personal data that, in view of the purposes

for which they are processed are incorrect, erase or rectify without undue delay

(“correctness”)”.

126. The Disputes Chamber also considers it appropriate, in addition to this corrective

measure and, in accordance with Article 58.2 b) GDPR and Article 100, §1, 5° WOG a

to impose a reprimand. The Disputes Chamber takes into account the fact that

the defendant is a government agency that sets an example in terms of

compliance with data protection legislation and which, if

tax authorities, also processes a large amount of personal data.

36
Working Party on Data Protection Article 29, Advice 4/2007, 20 June 2007, p. 7. Decision on the merits 66/2021 - 32/33

Accordingly, in accordance with the “lead by example” principle, it should at all times be

to act in accordance with this legislation and in particular the above

the aforementioned essential provisions of the GDPR regarding the exercise of the

rights by data subjects.

Publication of the decision

127. In view of the importance of transparency with regard to the decision-making of the

Disputes Chamber, this decision is made in accordance with Article 95, §1, 8° WOG

published on the website of the Data Protection Authority and this with

indication of the identification data of the defendant in view of the general

importance of the present decision, on the one hand, and the inevitable re-identification of

the defendant in case of pseudonomisation, on the other hand.

FOR THESE REASONS,

the Disputes Chamber of the Data Protection Authority decides, after deliberation, to:

- a reprimand pursuant to Article 58.2 b) GDPR and Article 100, §1, 5° WOG

formulate in respect of the defendant for the infringements of Articles 11, 11/1,

11/2 and 11/3 § 2 in conjunction with § 3 of the law of 3 August 2012 and articles 14, 15, 16

and 18 GDPR (failure to inform the complainant about the withdrawal of the

invoked derogations and failing to comply with the requests to exercise

of the rights of the person concerned);

- pursuant to Article 58.2 c) GDPR and Article 100, § 1, 6° WOG, the defendant to

order that the complainant's requests to exercise her rights are complied with

to exercise, in particular the request for information and access (Art. 14 and 15 GDPR)

and this within the period of one month from the notification of this

decision and to notify the Disputes Chamber within the same period of

the follow-up given to the present decision;

- pursuant to Article 58.2 c) GDPR and Article 100, §1, 6° WOG, the defendant to

order that the complainant's request to exercise her rights is complied with

exercise, in particular the request for rectification (Art. 16 GDPR), and this within the

period of one month from the notification of this decision,

as well as to notify the Disputes Chamber within the same period of the

consequence of this decision. The Disputes Chamber orders Decision on the merits 66/2021 - 33/33

in this regard, in particular, allow the defendant to allow the complainant to

have a statement to the contrary added to the files concerned with

with regard to the qualification of “straw man” ; and

- pursuant to Article 58.2 c) GDPR and Article 100, §1, 10° WOG, the defendant to

recommend any recipient to whom the personal data concerned has been

provided to notify the aforementioned rectification (Art. 19 GDPR in conjunction with Art. 16

GDPR) and this within one month from the notification of

to notify this decision, as well as the Disputes Chamber within the same period

the follow-up given to this decision.

Under Article 108, §1 WOG, an appeal can be lodged against this decision within

a period of thirty days, from the notification, to the Marktenhof, with the

Data Protection Authority as Defendant.

(Get). Hielke Hijmans

Chairman of the Disputes Chamber

@@ Line 48: / Line 48: @@
 }}
-The Litigation Chamber of the Belgian DPA ordered the Belgian Special Tax Inspectorate to comply with a complainant's requests to exercise their rights under Articles 14, 15, 16, and 18 GDPR. The Chamber held that subjective information can constitute personal data under the GDPR, and that restrictions to data subject rights in a Belgian income tax law were formulated too broadly and are therefore not applicable.
+The Litigation Chamber of the Belgian DPA ordered the Belgian Special Tax Inspectorate to comply with a complainant's requests to exercise their rights under Articles 14, 15, 16, and 18 GDPR. The Chamber held that subjective information can constitute personal data under the GDPR, and that restrictions to data subject rights in a Belgian income tax law are formulated too broadly and are therefore not applicable.
 == English Summary ==