Court of Appeal of Brussels - 2022/AR/549: Difference between revisions

Revision as of 10:58, 22 February 2023

Hof van Beroep - 2022/AR/549

Court:	Court of Appeal of Brussels (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 17(3)(e) GDPR
Decided:	29.04.2022
Published:	07.12.2022
Parties:	Controller ADP/GBA
National Case Number/Name:	2022/AR/549
European Case Law Identifier:
Appeal from:	APD/GBA (Belgium) 46/2022
Appeal to:
Original Language(s):	French
Original Source:	Cour d'appel (in French)
Initial Contributor:	n/a

The Court of Appeal annulled a Belgian DPA's decision that fined a controller €7,500 for restoring data on a former employee's work laptop without precisely specifying the elements of the infraction.

English Summary

Facts

The data subject was a former managing director of the controller. Following a complaint from the data subject accusing the controller of restoring data on his work laptop after termination, and thus violating his rights to access, erasure, restriction, and objection.

In its decision, the DPA held that, in principle, an employer could not consult private emails of his employees, even if the company forbade the use of its tools for personal use. The DPA outlined that there were exceptions to this principle, for example in the case of pending legal proceedings and that the legitimate interest in defending itself in court constituted a valid legal basis for the processing of data. The DPA therefore considered that the controller had a legitimate interest for the processing of the data subject's data for the five previous years. In conclusion, the Belgian DPA ordered the controller to comply with the GDPR and imposed a €7,500 fine.

The controller filed an appeal with the Belgian Court of Appeal arguing that the DPA’s decision was not reasonable and proportionate and, thus, had to be annulled.

The controller firstly pointed out that the DPA did not specify if the data targeted was exclusively the data relating to the data subject’s private life or the professional data. Furthermore, it stated that the DPA did not justify the choice of a five years time period for the validity of the legitimate interest. It considered that it continued to have a legal interest in the processing since two other proceedings were pending between the controller and the data subject.

In its defense, the DPA argued that its choice of setting the time limit for the legal basis of legitimate interests at five years was reasoned and based on a balancing test. It however left open the starting point of this period, which would be determined during the implementation of the corrective measures.

Holding

The Court noted that the contested decision did not fix the starting point for the five year period. According to the Court the DPA did not precisely determine the controller's infringing conduct. The DPA did not described which elements in the controller's behaviour constituted a breach of the GDPR. According to the Court, by fining the controller for a behaviour that the DPA did not precisely determined, the decision lacks motivation. The Court added that the fine had a criminal nature.

As a result, the Court annulled the Decision 46/2022 of the DPA, concerning the fine and ordered the DPA to pay the procedural damages of €1,680.

Comment

A summary of the first instance decision is available on the GDPRhub, https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_46/2022.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

Brussels Court of Appeal -2022/AR/549 p. 2

BECAUSE OF:

Y, [...];

petitioner

advised by My Fabienne Raepsaet [...] and Amaury Arnould [...] lawyers, Claeys &
Engels, whose practice is located at [...];

AGAINST:

The Data Protection Authority (hereinafter the "APO"}, located at 1000 Brussels, 35 Rue de
the press, BCE 0694.679.950,

gateAdv erse

having as counsel My Evrard de Lophem and Clara Delbruyère, lawyers, whose firm is
established at [...], [...].

IN THE PRESENCE OF

Mr. X, [...];

door called to the cause

defaulting,

Having regard to the pleadings and in particular:

the decision rendered by the Litigation Chamber of the Data Protection Authority,
April 2022 (decision number: 46/2022, file number: DOS-2020-02892}

Y's motion of April 29, 2022;

The schedule recorded at the introductory hearing of May 18, 2022;

IPAGE 01-00003026497-0002-0025-02-01-�

L_JCourt of Appeal Brussels -2022/AR/549 p. 3

Y's appeal summary conclusions of September 12, 2022;

Mr. X's conclusions of withdrawal of action of October 4, 2022;

the APO's summary conclusions of October 10, 2022;

the records of exhibits filed by the parties;

Heard counsel for the Y parties and the APO at the public hearing of November 2, 2022.

1. The Impugned Decision

1.

The Litigation Chamber of the APO issued the contested Decision on April 1, 2022, the operative part of which is

worded as follows

“FOR THESE REASONS the Litigation Chamber of the Data Protection Authority

issues, after deliberation:

On the basis of article 100, § 1, 9 of the LCA, a compliance order such as

wording above, including the establishment of a charter as set out in point 56
Based on article 83 of the GDPR and articles 100, 13° and 101 of the LCA, a fine

from 7500 EUR

Under article 108, § l of the LCA, this decision can be appealed

with the Court of Markets within thirty days of its notification,

with the Data Protection Authority as defendant. »

1 PAGE □1- □□□ 03026497-0003-0025- □2- □1- �

!
� �
L � _J Court of Appeal Brussels-2022/AR/549 p. 4

ll. Factual background and procedural background

2.

According to the DPA, the Court taking into account in its deliberation all the facts of the file, the facts
relevant can be summarized as follows:

({

1. (...).

2. The intervening party, Mr. X, practiced within the applicant, of which he was the shareholder
unique for several years, the function of Managing Director from October 15, 2004
until 2019. On this date, Mr. X sold all of his shares to the

S.A de droit al/emand Z and has ceased his functions as a director. Z then surrendered all his
rights and obligations to the Luxembourg company W .

3. Mr. X was subsequently engaged by the Applicant as an employee, beginning in 2019.

4. On November 26, 2019 and December 14, 2019, Mr. X and shareholder company W

exchange letters concerning shortcomings invoked by the two parties with regard to
of the share transfer agreement.

5. On April 23, 2020, Mr. X summons the companies Zet W before the Court of First Instance

francophone in Brussels, before whom the dispute is still pending. Mr. X criticizes the
applicant to owe him an unpaid balance following the sale of his shares, while the
applicant is claiming compensation from him relating to the debts of the acquired company. The applicant
argues that these shortcomings are due to the fact that Mr. X concealed and truncated

certain information for the transfer of shares. The sums at stake are significant, and
are the subject of discrepancies between the parties. Mr. X strongly disputes the breaches
alleged, and also summoned the applicant before the Turkish courts for

defamation, unfair dismissal, and payment of damages (the plaintiff is also
active in Turkey).

6. Furthermore, the impugned decision details the facts as follows:

(((...)

5. The facts giving rise to the complaint to the APO are as follows. On February 18, 2020, Ie
p/loving [M. X] is terminated by the defendant [Y]. Before handing over your equipment

following his dismissal, the complainant erased the data
present on his professional laptop. He claims to have erased only his private data
(private email boxes}, while the defendant argues that I / would have erased /'entirety of
emai/s boxes (all professional/private). The only evidence put forward in this regard

IPAGE □ 1-□□□□ 3026497- □□□ 4- □□25- □ 2-□ 1-�

�
L g� ...JCourt of Appeal Brussels -2022/AR/549 p. 5

consist of two testimonies of employees submitted by the defendant, affirming that
all mailboxes would have been erased.

6. The Complainant then became aware of the Respondent's intention to proceed with the
recovery of data previously present on his laptop, and gives formal notice to the
defendant, on February 26, 2020 to suspend all processing of its personal data
personal, as long as the information under article 14 of the GDPR is not

provided. He also requests the exercise of his right to erasure, the limitation of the
processing, and opposition.

7. On February 28, 2020, the defendant refuses to respond to the plaintiff's requests, on
based on the employment contract that bound them, as well as on the basis of article/e 6.1.f of the GDPR
(interest/legitimate) justifying the processing of the personal data of the p/
loving.

8. On March 4, 2020, the defendant challenges the legality of the processing by the defendant, in

particular concerning his purely private data, as well as those professional
prior to June 1, 2019 (period not covered by the employee employment contract
on which the defendant relied, contract dated June 01, 2019). He also puts
the defendant in formal notice to transmit to him its subcontracting contract with the

S.A V (having recovered the data previously present on the laptop of the
complainant).

9. On March 7, 2020 the defendant refuses to suspend the processing for the data to
personal character (professional) of the p/aignant prior to June 01, 2019, advancing
its legitimate interest in the continuity of its activities, and in order to verify breaches
alleged in his capacity as a worker.

10. The defendant adds that although for the period prior to June 01, 2019
the complainant was not under an employee contract, he exercised management functions and
was using the laptop in question. It deduces that for data prior to June 01, 2019,
the /legitimate interest does indeed constitute a lawful basis for processing.

11. The defendant nevertheless also undertakes not to process the private mailboxes of the

p/aignant, but only professional boxes. It also undertakes to cease the
active processing of personal data found for the analysis of mailboxes
professionals of the p/aignant, but refuses to erase them.

12. The defendant also refuses to produce the subcontract, on the grounds that
The subcontractor would not have processed personal data by proceeding with the recovery
mailboxes.

13. On March 16, 2020, the defendant informs the defendant that he/she has no/legitimate interest in

process his personal data prior to the last five years, and invites you to limit Ja
period of time for Jaquelle she processes her emails in the last five years
(corresponding to the limitation period for the liability of company directors).

14. He also requests the exercise of his right of access and copy to all emails processed
by the defendant.

f PAGE 01- □0 □□3 □26497-0005-0025- □2- □1- ;i

L_J Court of Appeal Brussels-2022/AR/549 p. 6

15. On April 7, 2020, the defendant refuses to limit the processing of the data to the five
years, on the basis of his/her legitimate interest in the treatment. She adds that the
requests for erasure, opposition and limitation cannot be followed, likewise, on

basis of the exception of compelling / legitimate reasons (interest / legitimate defense in court,
to ensure the continuity of the company's services, and potential/Ie questioning of the
professional and criminal liability of the plaintiff).

16. She also accepts the applicant's request for access, but indicates that she/he cannot

comply within the same period of one month, but three months (due to the complexity of
the request and the circumstances /related to the health crisis).

17. On May 25, 2019, the plaintiff disputes the /legitimate interest as put forward by the
defendant as the basis for the lawfulness of the processing, arguing that these interests are neither
current or precise, and that he/she has not carried out the balance of interests, nor taken into account the

imbalance between the plaintiff and herself in the context of their relationship as ex-employee to ex-employee
employer.

18. He also accuses it of violating the principles of minimization, insofar as
data older than five years was not relevant for the purposes

continued.
19. He also accuses him of having breached the principle of necessity, by arguing that other

less invasive measures would have enabled the defendant to have the data

necessary while sparing its interests (a sorting of emai/s could for example have been operated by
a third party in the presence of the p/relative, in order to deliver only the relevant emai/s to the
defendant, instead of a complete restoration).

20. The parent reiterates his requests for the suspension of treatment, as well as the exercise of
his rights to erasure, limitation, opposition (particularly for data dating from

more than five years).

21. On June 5, the defendant replies to the plaintiff that it maintains its position as to its
legitimate interest in the processing, as well as concerning the absence of obligation to transmit to it
The outsourcing contract with V. She repeats that she/he will not process the mailboxes
private of the p/aignant nor the emails found on his professional mailboxes

from these (private) email addresses.

22. On June 15, 2020, the defendant sent the plaintiff a letter containing a list of
personal data it holds about him (complainant's exhibit 11).

23. On June 16, 2020, the p/aplain informs the defendant of his intention to file a p/aplaint at
the Data Protection Authority (APO below}, what it does on June 17, 2020 » 1•

1
Impugned Decision, Exhibit 36, §§ 1 - 24.

1 PAGE 01-00003026497-0006-0025-02-01-�

L_JCourt of Appeal Brussels -2022/AR/549 p. 13

IV. the subject of the appeal

10.

At the end of its last pleadings, the applicant asks the Court of Markets to

((
declare this appeal admissible and founded and therefore:

o annul decision 46/2022 rendered on April 1, 2022 by the Litigation Chamber of
the Data Protection Authority (file number: DOS-2020-02892);

o order the Data Protection Authority to pay the costs, including
the procedural indemnity liquidated at EUR 1,680.00;

o condemn the Data Protection Authority to pay to the Belgian State (FPS Finances)
the appeal fee of EUR 400”.

11.

the APO asks the Court of Markets to:

“Declare the appeal admissible, but unfounded,
Order the plaintiff to pay all the costs of the proceedings, including the procedural indemnity of
€1,680 (basic amount)”.

12.
Mr X, at the end of his main conclusions, asked the Court to:

“Mainly:

Declare Y's appeal admissible but unfounded;
dismiss Y;

Alternatively, take a new decision declaring the requests made by

MrX;
In any event, order Y to pay all the costs and expenses of the proceedings, insofar as
including the procedural indemnity liquidated at €1,680.00”.

IPAGE □1- □□□□ 3026497-0013-0025-02- □ 1-�

L_JCourt of Appeal Brussels -2022/AR/549 p. 14

Mr. X, however, filed conclusions of discontinuance of the action on October 4, 2022, at

at the end of which he asks the Court:

"To give (him) (...) an act that he withdraws the action brought by Y on April 29, 2022 before the
Court of Appeal of Brussels, section Court of Markets registered under the number of RG:
2022/AR/546;

To award each of the parties its own costs and expenses, including indemnities for
procedure provided for in article 1022 of the Judicial Code”.

v. Claimant's pleas

13.

The applicant, at the end of its pleadings, develops the following two arguments:

1. The decision of the Litigation Chamber of the Data Protection Authority is not
sufficiently reasoned and must be annulled on this basis

2. The decision of the Litigation Chamber of the Data Protection Authority is not
proportional and must be annulled on this basis

Vl. Resources of the APO

14.

The following means are invoked by the APD:

((

A. REGARDING THE WORD/VATION OF DEC/5/0N (FIRST COMPLAINT OF THE APPLICANT}

1. Ground 1: The Applicant misreads the decision

First branch: The choice to fix the /imit tempore/Ie of the base of /iceity of
"legitimate interests" in the last five years is justified

Second branch: With regard to the calculation of the time limit/Ie of five
So, the applicant is misreading the decision

r PAGE □1- □□□ 03026497-0014-0025- □2- □1- �

L_JCourt of Appeal Brussels -2022/AR/549 p. 15

2. Ground 2: The Impugned Decision is Properly

B. As regards the amount of the fine (second complaint by the applicant)

1. Means 3: Effective protection of the right to the protection of personal data presupposes
that the authority can impose “effective, proportionate and dissuasive” sanctions; nor the
GDPR, nor the LCA provide that the fine would have a subsidiary character

2. Plea4: The decision to impose a fine is the subject of detailed reasons in the
the contested decision"

VII. Admissibility of the request

16.

The contested Decision was taken by the DPA on April 1, 2022.

It is undisputed that the motion was filed with the court office within the 30-day period referred to in
article 108 § 1 of the law of 3 December 2017 establishing the Authority for the protection of
data.

The request is admissible in that it is directed against the DPA.

17.
The applicant called Mr. X to the cause. However, it makes no request
particular to him.

In accordance with the case law of the Court of Markets, the appeal is only admissible, in that it is
directed against Mr. X, that insofar as it is purely protective and tends to

give him the common and enforceable stop to intervene.

VIII. Discontinuance of action by Mr. X

18.

It is appropriate to acknowledge Mr. X's withdrawal as expressed in his
submissions of discontinuance of the action of October 4, 2022, the Court noting that the party

applicant and the DPA do not object to this.

1 PAGE 01-00003026497-0015-0025-02-01-�

tee
�
L_JCourd'appel Brussels -2022/AR/549 p. 16

IX. Discussion - Decision of the Court of Markets

19. As to the applicant's first plea: failure to state reasons for the contested decision

19.1. Applicant's argument

The applicant's first plea can be summarized as follows:

" Place

In its decision of February 16, 2022, the Markets Court considered that the decision of the Chamber

Litigation of the Data Protection Authority based on contradictory motivation
(similar to a lack of motivation) had to be annulled. (•...)

Actually

The decision contested by the concluding party is not sufficiently clear and reasoned as to the ob/igations
that it imposes on him and to the reasons of cel/es-ei. It is also contradictory. The Authority of
Data Protection cannot therefore be followed when it indicates on this subject in its conclusions
of appeal that the applicant would not raise a lack of reasoning for the decision.
While emphasizing "that in principle, an emp/oyeur cannot freely consult the emai/s d'ordre

of its employees, even if it has prohibited the use of company tools for personal purposes.
This principle nevertheless suffers from exceptions, within a strict and foreseeable legal framework, as forums of a
pending legal proceedings”, that “Recital 65 of the GDPR also includes the exception of
the legal defense as provided for in article 17.3.e of the GDPR to the right to erasure", that the dispute
during "is linked to the exchange of information (and emails) between the plaintiff, the defendant, and

third parties" and that "the legitimate interest for legal defense constitutes a valid basis of lawfulness
on the part of the defendant", the Litigation Chamber considers without bringing the slightest
development on this subject that the conception would only have a basis of validity valid for
Mr. X's data more recent than 5 years.
The concluding party emphasizes first of all that the Litigation Chamber does not specify that/the data
are specifically targeted. Is it ex/usively private data (versus Ie data to

professional nature?) The contested decision is therefore not at all void on this specific point,
yet capita/.

4
Brussels, 16 February 2022, R.G. n1363,

IPAGE □1- □0 □□ 3026497- □□ 16- □□ 25- □ 2-□ 1-;-i

L ..JCourt of Appeal Brussels -2022/AR/549 p. 17

Nor does the Litigation Chamber seem to impose limits on the measures it
intends to take against the concluding party in connection with the exercise of Mr. X's rights.
conclusive note, however, that the latter could by definition, for example, not have access to
data containing confidential information of the concluding party, or data of a personal nature
personnel of other workers and/or clients of the conc/uant.

The conclusive also raps that she must defend herself in two pending legal proceedings
(one in Turkey and another in Belgium). The legal procedure in Belgium concerns in particular
the warranties and indemnities related to the sale of Y by Mr. X (who presented in a
inaccurate the financial and legal situation of Y}, while the legal proceedings

in Turkey concerns in particular the following elements: defamation, damage to reputation and
detriment to the freedom to work. It is therefore more than necessary for the designer to have

of items older than 5 ons.
(...)
It follows from the foregoing that the concluding party has a legitimate interest in being able to continue to dispose of the
encrypted information recovered by V as long as the various legal prescription de/ais

criminal law, civil law, social/society law, commercial law and tax law will not have come to
deadline and as long as the two pending court proceedings in Be/gigue and Turkey are not
not c/6turated (and not "ad vitam aeternam" as I claim without any reason/justification
the Data Protection Authority in its conclusions of appeal). There would also be a serious
discrimination between Mr. X and the claimant (as well as a flagrant violation of the rights of the
defence) if only I first could attempt to justify the merits of its claims by stating
items dating back more than 5 years.

Despite these various elements, the Litigation Chamber does not specify to whom/the data it is
reference and does not justify either on the basis that it should be limited to a die/ai of 5 ons. There
Chambre Litigation has no knowledge of the pending legal proceedings; she was not
therefore not in a position (and moreover it was not his r6/e nor his competence) to appreciate what is or
irrelevant so that the claimant can pursue its interests in court. The Authority of

Data Protection cannot reasonably be followed /when he/she merely indicates to this
subject in its conclusions of appeal that "the choice of an identical temporal limit (...) is explained by
the will of the APD to remain consistent" and to refer to it only for the choice of the limit
tempore/Ie to the “considerations which were developed in the Impugned Decision”.

f PAGE □1- □□□□ 3026497-0017- □025-02-01- �

L_JCourt of Appeal Brussels -2022/AR/549 p. 19

By the second part of its first plea, the DPA claims that the applicant carries out a
misreading of the decision as regards the calculation of the 5-year time limit. APO

sets out in particular:

“It is appropriate here to re-explain the point of view of the ODA /when it sets” a temporal limit /ie to the
period during which the legal defense can establish the legitimate interest of the defendant, and
10,
thus constitute the basis of /icness of the /contentious processing” as soon as this point seems
misunderstood by the applicant.

This assertion means that the lawful basis of the processing, namely the legitimate interests of the

applicant (and more specifically: his legal defense in the context of the dispute between him and Mr.
X), allows the latter to process the personal data of the complainant
relating to the last five years.

It does not mean, however, that these data could only be used for five
years, regardless of the length of the proceedings between the applicant and Mr. X.

Indeed, to decide otherwise would mean that if the procedure were to last, for example,

until 2028 (which is not inconceivable in the event of an appeal), the applicant
would be justified in exploiting, this year-/to, only old data from the year 2023 at the earliest. That
would not make sense as soon as Mr X no longer works for the applicant since the

of February 2020, and that, consequently, it is hardly conceivable that in 2023,
personal data relating to these parties, which are likely to be useful for the
legal proceedings, exist.

On the contrary, APO's point in the Impugned Decision is to indicate to the applicant that the
basis of the lawfulness of its processing, such that it is based on Article 6, §1, f) of the GDPR, constitutes
a valid basis allowing him to exploit the data relating to the last five years,
as long as this basis of lawfulness exists.

This time limit of five years differs completely from a time limit of conservation
"classic" data, as long as there is no reason to delete the data while the
bases of lawfulness are always valid (du main, with regard to data of a personal nature

personnel relating to the last five years).

10
Impugned decision, § 36.

rPAGE □1- □□□□ 3026497-0019- □□ 25- □2- □1-�

L _J Brussels Court of Appeal -2022/AR/549 p. 21

The expression “satisfactory” means that the decision is supported by the motivation 13•

The purpose of the obligation to state reasons is to give such an overview of the reasons for this decision that the
person in respect of whom the decision was taken is able to correctly assess whether he is

judicious to defend itself against this decision with the means at its disposal by law.
Anyone who knows the reasons for a decision which must be formally motivated, even if this

decision is not formally motivated, cannot usefully invoke the violation of the obligation to
motivation because, in such a case, the aim of the formal obligation to motivate is achieved, namely to
raise awareness of the reasons for the decision14.

To achieve the objective of the obligation to state reasons, the decision must state clearly and

concretely the reasons which may justify it, the explanation provided cannot be taken into account
in the context of the legal proceedings subsequently initiated 1•

It is sufficient that the reasons are clearly, if necessary concisely, stated in the decision
herself. If reference is made to opinions or reports, it is sufficient to briefly state the subject and

the content of these documents, without it being necessary to reproduce them in their entirety or
attach to the decision16.

19.3.2.

It follows from a reading of the applicant's first plea that the central complaint which is the subject of her
dispute relates to the time limit for data processing, and its limitation to 5 years.

The Court notes that the reasoning of the Impugned Decision, in that it orders a
compliance of data processing does not seem to be, as such, the subject of a

objection by the requesting party.

It sets out the following in terms of summary conclusions

“The designer emphasizes from the outset that she immediately set up a computer cerrte in
within it following the decision of the Data Protection Authority of April 1, 2022 (it had not
yet had occasion to do so; it was Mr. X - who finally complained - who should have done it
when he was CEO of the company, after the new management only had 8 but before the p/

Saint of Mr X). The designer also points out that she had provided the essential information
to Mr. X concerning the processing of his personal data in his employment contract
employment (employment contract and appendix, exhibit 12).

13see: Cass. 12 November 2015, APT 2016, 94; http://www.cass.be on its date, judgment n• C.13.0257.N; TBO 2016, 152; also: Cass. 7
2017 Sep, APT2018, 174; http://www.cass.be on its date, judgment n· C.16.0360.N.
14Council of State n•. 40.442, September 22, 1992, Arr. R.v.St. 1992, z.p.; Not. 1995, IV, 21; BREED. 1992, z.p.
15Compare with: Council of State., 3 June 1993, n.v. Syndicaat Machiensteen en n.v. Swenden, nr. 43.154. Also: Council of State May 17, 1993,
No. 42,968.
16Council of State no. 43.526, June 29, 1993, Arr. R.v.St. 1993, z.p.; BREED. 1993, z.p.; TBP 1994, 225.

rPAGE 01-00003026497-0021-0025- □2- □1-�

�Jl.�
�
L ..JCourt of Appeal Brussels -2022/AR/549 p. 22

The concluding party also specifies that a meeting was organized at its head office on August 24, 2022
with Mr. X and his counsel. On this occasion, the concluding party gave Mr. X all the
personal data concerning him. All professional and private e-mails dating from

more than five years before the signing of the acquisition agreement in 2019 have also been
deleted by the concluding party (although the concluding party had no obligation to do so as long as the
appeal procedure was still pending).

19.3.2.
The contested Decision mentions several times the period of 5 years, which it retains as
making it possible to assess the lawfulness of the disputed processing.

The Court emphasizes in particular the following passages of the Impugned Decision:

“... 55. The Litigation Chamber concludes in view of the foregoing and in accordance with the

above-mentioned case law of both the CJEU and the ECHR, that the defendant could not

(understand the processing of data referred to in the complaint and older than five years on its

legitimate interest of the defense in court, if these treatments are not necessary for the
meaning of Article 6.1.f) of the GDPR. This legitimate interest nonetheless constitutes a basis for

lawfulness for the complainant's personal data relating to the period prior to five

years.

65. (...) In accordance with this position, in view of the fact that the defendant accuses the p/aignant

in the dispute before the Court of First Instance already during the communication

of truncated and/or false information, and that she also accuses him of misuse of the credit card

credit of the company under his mandate as director, the Litigation Chamber considers the
potentia / filing of criminal complaint with constitution of civil portie by the defendant

towards the plaintiff for breaches qualified as serious as a legitimate interest in the

head of the defendant (for the processing relating to the personal data of the

over the last five years only).

68. (...) As indicated above, in the absence of a basis of lawfulness, the Litigation Chamber

concludes that Article 5.1.a. of the GDPR in conjunction with Article 6 of the GDPR have not been complied with

with regard to the processing of data older than five years. Conversely, in what
concerns the complainant's personal data more recent than five years, the legitimate interest

does constitute a basis of /iceity.

IPAGE 01-00003026497-0022-0025-02-01-�

L_JCourt of Appeal Brussels -2022/AR/549 p. 24

19.3.3.
The Court notes that the Impugned Decision does not, however, set the starting point of the 5-year period.
on which it bases its reasoning. According to the facts submitted to the Court, it seems that this point of

departure could have been fixed either on the day of the termination of the employment contract existing between the parties, or on the
date of the end of Mr. X's term of office as director, which predates him.

It seems to be deduced from the DPA's thesis that the parties should agree on this decision.
during the period within the framework of the implementation of the corrective measures that it prescribes, what they
seem, at least partially, to have done after the Decision under appeal in the
framework of the transaction between them.

However, by leaving this question open, the Impugned Decision does not precisely determine
the offending behavior of the applicant which it considers, in addition to the corrective measures
prescribed, having to sanction by the application of a fine of 7,500.00 euros.

It cannot be accepted that the administrative authority imposes a fine, of a penal nature,
a behavior of which it does not precisely describe the irregular nature, the elements

constituting the breach of the GDPR that it intends to sanction are not explicitly stated
in the Impugned Decision.

By applying a fine to punish behavior that is not precisely defined, the Decision

contested is not adequately reasoned.

This lack of reasoning must be sanctioned by the annulment of the Contested Decision insofar as it

relates to the application of a fine of 7,500.00 euros to the applicant.

It is not necessary to examine the applicant's second plea, which could not result in
a fuller annulment of the Impugned Decision in this regard.

X. Costs

20.
In accordance with Article 1017, paragraph 1, of the Judicial Code, the request being partially founded,
the DPA is the unsuccessful party and is ordered to pay the costs, liquidated by the applicant at 1,680.00
euros (procedural compensation - case not assessable in money).

Any costs incurred by Mr. X will be waived to him.

IPAGE 01-00003026497-0024-0025-02-01-�

L ..JCourt of Appeal Brussels-2022/AR/549 p. 25

FOR THESE REASONS,
THE COURTYARD,

Having regard to the provisions of the law of 15 June 1935 on the use of languages in judicial matters,

Ruling by default with regard to Mr. X and contradictorily for the remainder,

Holds the appeal admissible with regard to Mr. X, solely insofar as it tends to return the present to him
common and enforceable judgment,

Holds the appeal admissible with regard to the DPA, and the said partially founded insofar as follows:

Annuls the Impugned Decision insofar as it imposes on Y a fine of 7,500.00 euros,

Orders the DPA to pay the costs of the applicant, including the procedural compensation paid by
it at 1,680.00 euros,

Notifies X of its discontinuance of the action and waives its possible costs,

Condemns the DPA to pay the right to appear before the Court of Appeal (€400.00} to the SPF
FINANCES, in accordance with article 269 § 1, of the Code of registration fees, mortgage
and graft.

Thus judged and pronounced at the public civil hearing of the 19th chamber A of the Court of Appeal of

Brussels, Market Court section, December 7, 2022.

Where were present

- Mr. F. FOGLI, Acting Counsellor. president,

- Ms A.-M. WITTERS, Advisor
- Mr. 0. DUGARDYN, Counselor
C. JOURDAN, Registrar

rPAGE 01- □□□□ 3□26497-0025-0025- □ 2-□ 1-;i

L..J

@@ Line 52: / Line 52: @@
 }}
+The Court of Appeal annulled a Belgian DPA's decision that fined a controller €7,500 for restoring data on a former employee's work laptop without precisely specifying the elements of the infraction.
-The Court of Appeal annulled a Belgian DPA's decision that fined a controller €7,500 for restoring data on a former employee's work laptop after termination.
 ==English Summary==