APD/GBA (Belgium) - 54/2021: Difference between revisions
From GDPRhub
(→Facts) |
|||
| Line 79: | Line 79: | ||
==== The notion of processing of personal data within the meaning of Article 4 GDPR ==== | ==== The notion of processing of personal data within the meaning of Article 4 GDPR ==== | ||
Very briefly, the | Very briefly, the litigation chamber begins by recalling that the fact of having accessed this information constitutes processing of personal data within the meaning of Article 4(2) GDPR irrespective of whether this processing is lawful within the meaning of the Regulation. | ||
Furthermore, the | Furthermore, the litigation chamber holds that in this case the voluntary intervening entity must be considered as a controller, and the defendant as a processor of the voluntary intervener. | ||
==== Legal basis of processing under Article 6 of the GDPR ==== | ==== Legal basis of processing under Article 6 of the GDPR ==== | ||
The | The litigation chamber of the Belgian data protection authority points out that the defendant and the voluntary intervener base the processing on Article 6(1)(c) GDPR (processing made necessary by virtue of a legal obligation). Recalling that the concept of 'necessity' is an autonomous concept in EU law, the litigation chamber emphasises that the principle of necessity implies that the authority adopting a measure that infringes a fundamental right of the individual in order to achieve a justified objective must demonstrate that this measure is the least restrictive in order to achieve that objective. Furthermore, recalling the case law of the European Court of Human Rights, the notion of necessity implies that there is a compelling social need. | ||
Furthermore, the Belgian authority relies on Opinion 03/2019 of 23 January 2019 of the European Data Protection Committee (EDPS), which sets out the conditions under which this basis for lawfulness can be applied: | Furthermore, the Belgian authority relies on Opinion 03/2019 of 23 January 2019 of the European Data Protection Committee (EDPS), which sets out the conditions under which this basis for lawfulness can be applied: | ||
| Line 99: | Line 99: | ||
* In addition, the Order of 25 April 2019 of the Brussels-Capital Region and the Order of 4 April 2019 lay down the conditions for the granting of social supplements (these supplements being conditioned by the household income). | * In addition, the Order of 25 April 2019 of the Brussels-Capital Region and the Order of 4 April 2019 lay down the conditions for the granting of social supplements (these supplements being conditioned by the household income). | ||
The | The litigation chamber concludes that, in other words, prior to the granting of the family allowance and supplement, it was the responsibility of the family allowance funds (of which the voluntary intervener was one) to identify, in application of the various aforementioned texts, the beneficiaries and their household income. This verification of the household income requirement (and therefore of who was part of it) was, in this case, done by identifying the composition of the complainant's son's household by consulting the National Register. | ||
However, the | However, the litigation chamber notes that it is not clear from the legal texts what date the composition of the household was to be taken into consideration. Yet, this precision would have been precious, in accordance with the principle of clarity and predictability of the law, as derived from the jurisprudence of the Court of Justice of the European Union and the European Court of Human Rights. | ||
The | The litigation chamber considered that, in any event, this history of the complainant's son's "household composition" data could have been consulted back to the date on which entitlement to benefits/social supplements to these benefits began, and that, in any event, the consultation of the complainant's son's entire history without any time limit was disproportionate and unnecessary for the voluntary intervener to comply with its legal obligation. Access to this complete history of the complainant's son was therefore disproportionate and the data consulted were not relevant to the purpose pursued, i.e. to determine the composition of the household at a given point in time, which must be taken into account when granting family allowances and the social supplement. | ||
Consequently, the | Consequently, the litigation chamber held that there had been a breach of Article 6 GDPR, in that the processing was not necessary for its legal obligation. In addition, the chamber found a breach of Article 5 GDPR, in that the data collected could not be considered relevant to the purpose. | ||
However, the complainant raised a second consultation in the course of the proceedings, dated 21/04/2020. In this respect, the DPA notes that the defendant and the voluntary intervener rely on their legitimate interest (article 6(1)(f) GDPR), the consultation being justified, according to them, by the needs of the present proceedings. In this respect, the DPA recalls that it has already considered that legal defence is a legitimate interest that can be validly invoked by data controllers, provided that the cumulative conditions of necessity of the processing operation for the achievement of the legitimate interest pursued and of proportionality (i.e. that the fundamental rights and freedoms of the data subjects do not prevail over the interest pursued) are met. But as it is not the case in fact, the Chamber rejected this argument and considered that the processing was not justified. | However, the complainant raised a second consultation in the course of the proceedings, dated 21/04/2020. In this respect, the DPA notes that the defendant and the voluntary intervener rely on their legitimate interest (article 6(1)(f) GDPR), the consultation being justified, according to them, by the needs of the present proceedings. In this respect, the DPA recalls that it has already considered that legal defence is a legitimate interest that can be validly invoked by data controllers, provided that the cumulative conditions of necessity of the processing operation for the achievement of the legitimate interest pursued and of proportionality (i.e. that the fundamental rights and freedoms of the data subjects do not prevail over the interest pursued) are met. But as it is not the case in fact, the Chamber rejected this argument and considered that the processing was not justified. | ||
| Line 115: | Line 115: | ||
==== Sanctions ==== | ==== Sanctions ==== | ||
In view of these failings, the | In view of these failings, the litigation chamber reprimanded the voluntary intervener and ordered the publication of the decision on the Belgian data protection authority's website with the deletion of the parties' direct identification data. | ||
In addition, the | In addition, the litigation chamber stresses that it is important that an appropriate response be found quickly to the problem raised by the complaint, in order to allow limited consultation, in compliance with the GDPR, of the history of the "household composition" data (as well as the history of other data in the National Register, if applicable). | ||
== Comment == | == Comment == | ||
Revision as of 07:58, 5 May 2021
| APD/GBA - 54/2021 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 4 GDPR Article 5 GDPR Article 6 GDPR Article 24 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 22.04.2021 |
| Published: | |
| Fine: | None |
| Parties: | n/a |
| National Case Number/Name: | 54/2021 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | French |
| Original Source: | Autorité de la protection des données (in FR) |
| Initial Contributor: | Fra-data67 |
The Belgian DPA reprimanded an entity in charge of paying family allowances to its members for failure to comply with Articles 4, 5, 6 and 24 GDPR.
English Summary
Facts
In July 2019, an entity (voluntary intervener in the proceedings, hereinafter "the voluntary intervener") in charge of paying family allowances to its affiliates who have children consulted the data of the complainant's son in the National Register, in particular the "household composition" data and its history. This consultation took place in order to manage the family allowance file of the complainant's son, one of its affiliates, and to determine the amount of family allowance that he would be entitled to receive. This consultation was carried out via the TRIVIA application, developed by the BCSS, made available to the family allowance funds. This consultation was done on the basis of the National Register number of the affiliated person, son of the complainant.
It is this consultation of the history of the composition of the complainant's son's household that is the subject of the complaint. During this consultation, the volunteer intervener was given access to the information that the complainant had been part of her son's household at one time in his life. The complainant complains that this consultation of personal data concerning him had no basis of valid legitimacy within the meaning of Article 6 of the GDPR.
On 24 September 2019, the Supervisory Authority of the family allowance funds for the Brussels-Capital Region (IRISCARE/FAMIFED) received a request for information from the complainant via the contact form on its website. With this request for information, the complainant asked the Supervisory Authority about the consultation of his data on 9 and 17 July 2019.
Following several unsuccessful exchanges, and in the absence of a satisfactory response, the dispute was brought before the Belgian Data Protection Authority’s dispute chamber.
In this case, the defendant is the shared service center of the voluntary intervening entity. In this respect, the defendant was responsible for monitoring the personal data protection of all the family allowance funds in the group.
When he submitted his conclusions on 9 June 2020, the complainant underlined that a new consultation of his data, still without any legitimate basis according to him, had taken place on 21 April 2020. When questioned in this respect, the defendant answered to the complainant that this consultation was part of the management of the present case pending before the dispute chamber.
Dispute
- Is access to the information that the complainant had been a member of his son's household at one time in his life considered processing of personal data within the meaning of Article 4 GDPR and is it justified on the basis of Article 6 GDPR?
- Can the controller raise the argument that the application used and imposed by a third party does not allow it to comply with provisions of the GDPR ?
Holding
The Belgian data protection authority found a violation of the GDPR, and gave the following reasons for its decision:
The notion of processing of personal data within the meaning of Article 4 GDPR
Very briefly, the litigation chamber begins by recalling that the fact of having accessed this information constitutes processing of personal data within the meaning of Article 4(2) GDPR irrespective of whether this processing is lawful within the meaning of the Regulation.
Furthermore, the litigation chamber holds that in this case the voluntary intervening entity must be considered as a controller, and the defendant as a processor of the voluntary intervener.
Legal basis of processing under Article 6 of the GDPR
The litigation chamber of the Belgian data protection authority points out that the defendant and the voluntary intervener base the processing on Article 6(1)(c) GDPR (processing made necessary by virtue of a legal obligation). Recalling that the concept of 'necessity' is an autonomous concept in EU law, the litigation chamber emphasises that the principle of necessity implies that the authority adopting a measure that infringes a fundamental right of the individual in order to achieve a justified objective must demonstrate that this measure is the least restrictive in order to achieve that objective. Furthermore, recalling the case law of the European Court of Human Rights, the notion of necessity implies that there is a compelling social need.
Furthermore, the Belgian authority relies on Opinion 03/2019 of 23 January 2019 of the European Data Protection Committee (EDPS), which sets out the conditions under which this basis for lawfulness can be applied:
- The obligation must be imposed by legislation;
- The legislation must meet all the conditions required to make the obligation valid and binding;
- The legislation must comply with applicable data protection law, including the principles of necessitý, proportionalitý and purpose limitation ;
- The legal obligation itself must be sufficiently clear about the processing of personal data it requires; and
- The controller should not have an unjustified margin of discretion as to how to comply with the legal obligation.
In the present case, the Belgian DPA notes the following points in this respect:
- Under the provisions of the General Law on Family Allowances of 19 December 1939, the family allowance bodies and the ministerial departments responsible for the implementation of that law are obliged to consult the national register of natural persons in order to obtain the information required by the law, which includes, inter alia, data relating to the composition of the household and its successive changes (the history).
- In addition, the Order of 25 April 2019 of the Brussels-Capital Region and the Order of 4 April 2019 lay down the conditions for the granting of social supplements (these supplements being conditioned by the household income).
The litigation chamber concludes that, in other words, prior to the granting of the family allowance and supplement, it was the responsibility of the family allowance funds (of which the voluntary intervener was one) to identify, in application of the various aforementioned texts, the beneficiaries and their household income. This verification of the household income requirement (and therefore of who was part of it) was, in this case, done by identifying the composition of the complainant's son's household by consulting the National Register.
However, the litigation chamber notes that it is not clear from the legal texts what date the composition of the household was to be taken into consideration. Yet, this precision would have been precious, in accordance with the principle of clarity and predictability of the law, as derived from the jurisprudence of the Court of Justice of the European Union and the European Court of Human Rights.
The litigation chamber considered that, in any event, this history of the complainant's son's "household composition" data could have been consulted back to the date on which entitlement to benefits/social supplements to these benefits began, and that, in any event, the consultation of the complainant's son's entire history without any time limit was disproportionate and unnecessary for the voluntary intervener to comply with its legal obligation. Access to this complete history of the complainant's son was therefore disproportionate and the data consulted were not relevant to the purpose pursued, i.e. to determine the composition of the household at a given point in time, which must be taken into account when granting family allowances and the social supplement.
Consequently, the litigation chamber held that there had been a breach of Article 6 GDPR, in that the processing was not necessary for its legal obligation. In addition, the chamber found a breach of Article 5 GDPR, in that the data collected could not be considered relevant to the purpose.
However, the complainant raised a second consultation in the course of the proceedings, dated 21/04/2020. In this respect, the DPA notes that the defendant and the voluntary intervener rely on their legitimate interest (article 6(1)(f) GDPR), the consultation being justified, according to them, by the needs of the present proceedings. In this respect, the DPA recalls that it has already considered that legal defence is a legitimate interest that can be validly invoked by data controllers, provided that the cumulative conditions of necessity of the processing operation for the achievement of the legitimate interest pursued and of proportionality (i.e. that the fundamental rights and freedoms of the data subjects do not prevail over the interest pursued) are met. But as it is not the case in fact, the Chamber rejected this argument and considered that the processing was not justified.
Accountability within the meaning of Article 24 GDPR
The Belgian data protection authority also concludes that the voluntary intervener failed to comply with Articles 24 and 5.2 of the GDPR when it was not able to put in place the technical measures intended to implement the GDPR. Indeed, the controller cannot therefore raise the argument that the application used - even if its use is imposed by a third party - does not allow it to comply with the GDPR.
Consequently, in application of its obligation of accountability and documentation, the voluntary intervener should at least have alerted the relevant authorities to the situation in which the forced use of the TRIVIA application placed it in relation to its obligations under the GDPR.
Sanctions
In view of these failings, the litigation chamber reprimanded the voluntary intervener and ordered the publication of the decision on the Belgian data protection authority's website with the deletion of the parties' direct identification data.
In addition, the litigation chamber stresses that it is important that an appropriate response be found quickly to the problem raised by the complaint, in order to allow limited consultation, in compliance with the GDPR, of the history of the "household composition" data (as well as the history of other data in the National Register, if applicable).
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
Decision on the merits 54 / 2021-1 / 23
Litigation Chamber
Decision on the merits 54/2021 of 22 April 2021
File No .: DOS-2019-06237
Subject: Complaint relating to an illicit consultation of the National Register in the
context of the allocation of family allowances
The Contentious Chamber of the Data Protection Authority, made up of Mr. Hielke
Hijmans, chairman, and of Messrs. Y. Poullet and C. Boeraeve, members, taking up the case in this
composition;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the
protection of individuals with regard to the processing of personal data and the
free movement of such data, and repealing Directive 95/46 / EC (general regulation on the protection
data), hereinafter GDPR;
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter LCA);
Having regard to the Rules of Procedure as approved by the Chamber of Representatives on December 20
2018 and published in the Belgian Official Gazette on January 15, 2019;
Having regard to the documents in the file;
Took the following decision regarding:
The complainant: Mr X1, (hereinafter "the complainant");
The defendant: Y1, (hereinafter “the defendant”);
In the presence of: Y2 ASBL, (hereinafter "the voluntary worker"); Decision on the merits 54 / 2021-2 / 23
Both advising Maître Paul Van den Bulck and Maître Andrine Like, lawyers at the Bar
of Brussels, whose office is established at Rue des Colonies 56 box 3 in 1000 Brussels.
1. Feedback from the procedure
In view of the mediation request filed on December 8, 2019 by the complainant with the Autorité de
data protection (DPA);
Given the failure of the mediation attempt communicated to the complainant on February 20, 2020 by the
First Line (SPL) of ODA;
Considering the agreement given by the complainant on February 20, 2020 for his request to be transformed into a complaint
in application of Article 62.2. LCA;
Considering the decision of March 9, 2020 of the SPL declaring the complaint admissible and the transmission of it to the
Litigation Chamber;
Having regard to the letter of April 8, 2020 from the Litigation Chamber informing the parties of its decision to
consider the case to be ready for treatment on the merits on the basis of Article 98 LCA and their
providing a timetable for the exchange of conclusions. In this letter, the Litigation Chamber
in particular specified the following to the parties:
Without prejudice to any arguments you may wish to develop, you will ensure that you shed light on the
Litigation Chamber on the data processing involved, on the role of the various
possible stakeholders and their quality with regard to the regulations for the protection of
data as well as on the precise legal basis of the disputed consultation of the data of the
complainant. You will also ensure that you explain the measures put in place to guarantee
access only to data justified by the processing of files and the traceability of such access.
You will also inform the Litigation Chamber of what is concretely understood by
the terms "induced and involuntary consultation" used in the attachments to the complaint
in the light of the specific facts.
Having regard to the main conclusions filed on May 22, 2020 by the defendant as well as by Y2
(the voluntary intervenor) who intervenes voluntarily to the cause by this means (see below
point 30 and following);
Having regard to the arguments of the complainant of June 9, 2020; Decision on the merits 54 / 2021-3 / 23
Having regard to the additional and summary conclusions of the defendant and the voluntary intervener of 3
July 2020;
Having regard to the invitation to the hearing sent by the Litigation Chamber to the parties on December 10, 2020;
Having regard to the hearing during the session of the Litigation Chamber of January 19, 2021 in the presence of the complainant
and Mr. A. Like, representing both the Respondent and the Volunteer Intervenor;
Having regard to the letter sent by counsel for the defendant and the voluntary worker on January 26
2021;
Having regard to the minutes of the hearing and the observations made thereon by the parties who have
been attached to these minutes.
2. The facts and the subject of the request
2.1. Preliminary remarks
1. For a good understanding of its decision and of all the actors to whom the parts
procedure and the files of the parties refer, the Litigation Chamber specifies the following:
- FAMIFED is the federal agency for family allowances. FAMIFED was to insure until
December 31, 2019 the management of family allowances, including in the Region of
Brussels-Capital.
th
- IRISCARE has, under the 6 state reform, become, in place of FAMIFED,
the supervisory authority for family allowance funds for the Brussels-Capital Region.
IRISCARE is responsible for setting up and managing the family allowances system of the
Brussels-Capital Region.
- During a period of transition, the two structures coexisted so that the relay of the mission
legal process can switch from FAMIFED to the new regional authorities, including, as mentioned,
for the Brussels-Capital Region, IRISCARE. In the context of this decision,
IRISCARE and FAMIFED are referred to as the "Supervisory Authority".
- The complainant includes the Crossroads Bank for Social Security (BCSS) among the “stakeholders”
revolving around the disputed data processing indicating that it was the BCSS which, at the time
facts, develops the TRIVIA application. The TRIVIA application allows benefit funds Decision on the merits 54 / 2021-4 / 23
family to consult the available files of integrated actors, to integrate themselves
actors and create files and obtain, through the intervention of the BCSS, access to the various
sources of the social security network.
2. The defendant is the shared service center of group Y. It provides administrative services
to the various entities of Group Y. In this regard, it notably monitors the protection
personal data of all family allowance funds in the group. It
has a Data Protection Officer (DPO) as well as a "Corporate Compliance 1
Officer ”and“ Information Security Officer ”.
3. Y2, here a voluntary intervening party, aims in particular to pay family allowances to
its affiliates who have children.
4. Mr. X2 is the son of the complainant, affiliated with Y2, voluntarily intervened in the cause (see below.
points 30 et seq.).
2.2. The facts at the origin of the dispute
5. In July 2019, the voluntary worker consulted the data of the complainant's son in the Register
national, in particular the "household composition" data and its history. This consultation
took place in order to manage the family allowances file for the complainant's son, one of his affiliates, and
determine the amount of family allowances - including any supplement - that it would be
entitled to receive from January 1, 2020. This consultation was done via the TRIVIA application,
developed by the BCSS, made available to family allowance funds, including the worker
voluntary, by the supervisory authority. This consultation was made on the basis of the register number
affiliate's national, Mr. X2.
6. It is this consultation of the history of the household composition of Mr. X2 that is the subject of
of the complainant's complaint. Indeed, during this consultation, the volunteer worker had access
to the information that the complainant had been part of his son's household at some time
his life. The complainant complains that this consultation of personal data
concerning was not based on any valid basis of legitimacy within the meaning of Article 6 of the GDPR (see.
title 2.3; point 23 et seq.).
1
Deliberation 18/008 of 9 January 2018 on the communication of personal data by the Agency
federal for family allowances (Famifed) and various other social security institutions to the Ministry of
the German-speaking Community, in the context of the transfer of powers to follow up on the sixth reform
status - use of the TRIVIA application. Decision on the merits 54 / 2021-5 / 23
7. This research of the history of the composition of the household is called by the supervisory authority
"search P028". It is carried out via the TRIVIA application already mentioned. During this
research, the history of the household composition of Mr. X2 showed the complainant as
having been part of his household in the past and this, as head of household.
8. On September 24, 2019, the Supervisory Authority received a request for information from the complainant
via the contact form on its website. By this request for information, the complainant
asked the Supervisory Authority about the consultation of its data on July 9 and 17, 2019.
9. There followed an exchange of e-mails between the complainant and the Supervisory Authority. The latter informed
the complainant of the nature of the research P028 which had led to access to certain data on
concerning and invited him, if necessary, to approach the family allowance fund (either
the voluntary worker), in order to inquire more about the reason for the access to his data
as they appeared in her son's household composition history.
10. On 7 October 2019, the complainant sent his request for information to the
data of the volunteer worker via the address "[...]".
11. On 10 October 2019, the defendant, which ensures, as mentioned above in point 2, the follow-up
on the protection of personal data of all family allowance funds
group, acknowledged receipt and responded a first time to the request for information from
complainant.
12. On October 14, 2019, the defendant replied to the complainant a second time. This answer was
following a request for acknowledgment of receipt from the complainant regarding his request for information, which
acknowledgment of receipt had been sent by the defendant on 10 October 2019 (see point 11 below
above).
13. On November 6, 2019, the Complainant wrote again to the Respondent. On the same day, the
defendant replied a third time to the complainant and confirmed having responded promptly to the
October 10 and 14, 2019 at his request of October 7, 2019.
14. On November 7, 2019, the complainant, still addressing the respondent, developed his fears
and raised the following question:
"That one checks his tax flow [read the tax flow of Mr. X2] does not ask me personally
no problem and that seems normal to me since his household is beneficiary / beneficiary
Family Allowances. Decision on the merits 54 / 2021-6 / 23
BUT, what are the legal bases that allow you to consult my own
private data and tax flow? "
15. On November 7, 2019, the defendant replied a fourth time to the complainant and confirmed that the
the tax flow of the complainant had not been examined and that only the identification data of the
complainant had appeared while viewing her son's household history.
16. On 12 November 2019, the complainant confirmed receipt of the registered letter from the
defendant by which the latter provided proof of the sending of her emails of the 10th and 14th
October 2019.
17. On 20 November 2019, the Respondent informed the Complainant that a request for clarification had
still requested from the Supervisory Authority regarding the consultation of its data. The
Defendant's DPO returned the same day (i.e. a fifth time) with said clarification of
the supervisory authority. In the response that the defendant sent to the complainant, the Supervisory Authority
confirms that it appeared that there had been access to the complainant's identification data,
this one being mentioned as having been part of the household of his son and that it was necessary to understand
that this consultation was "induced and not voluntary" (in other words, that it was a
incidental access via the history of the household composition of the complainant's son).
18. The same day, after receiving this response (see point 17 above), the complainant filed
defendant in default to justify the legal grounds for the consultation of its data.
19. On November 27, 2019, the defendant returned to the complainant for a sixth time, specifying that
the provisions of the General Law on Family Allowances (hereinafter "LGAF") justified the
consultation of the history of the household composition of Mr. X2 (complainant's son) with
of the National Register (i.e. Articles 51 and 54 LGAF). Literally, she indicated, for the
good understanding of the complainant, that the mission of the family allowance funds included
verification of entitlement to allowances including verification of "the history of the
family composition for which the funds have the right to query the National Register ”.
20. On December 8, 2019, the complainant lodged an application with the APD in the following terms:
"I noticed that (Y2- Brussels) [read the volunteer worker] had consulted my data
personal without any valid reason in my eyes since I am a pensioner, without
responsible for more than 10 years and that I live in Wallonia.
After questions from those in charge, I received an answer that does not satisfy me in any way.
given that the family composition history of one of my sons' household - including Decision on the merits 54 / 2021-7 / 23
household apparently benefits from family allowances in Wallonia - does not have to lead to
an induced and involuntary manner regardless because the legal references, unless I am mistaken
part, do not allude to it) on queries of my private data which are not at all
concerned.
In my view, this is not a normal procedure but a malfunction (or a
pirate query) which I cannot accept. "
21. On February 3, 2020, the defendant replied to the SPL's questions in connection with the attempt
mediation conducted by this service of the ODA. In essence, the defendant responded to the DPA which
had already been answered to the complainant by the Supervisory Authority, i.e. a P028 search had been
carried out and that the consultation was non-voluntary but resulted from the consultation
- necessary in the exercise of its legal missions - consultation of the history of the
household composition of the complainant's son.
22. When communicating his conclusions on 9 June 2020, the complainant complained that a new
consultation of his data, still without a legitimate basis according to him, had taken place on April 21
2020. Interested on June 3 in this regard, the defendant on June 15, 2020, indicated to the complainant that
this consultation was part of the management of this case pending before the DPA.
The Litigation Chamber specifies from the outset that it will also rule on this second
consultation, the legality of which is called into question by the complainant in terms of its conclusions as soon as
when it is closely linked to the facts denounced by the complainant under the terms of his form
complaint.2
2.3. The subject of the complaint
23. In these same conclusions of June 9, 2020, the complainant specifies the subject of his complaint and expresses
which his son, Mr. X2, has not resided with him since 2006. Consultation of the history
the household composition of the latter - even necessary for the granting of allowances - must according to
be subject to a time limit taking into account (1) either the day on which the person whose
"history of household composition" data is consulted is potentially
beneficiary / beneficiary of allowances / supplement, (2) either from the day of the birth of the child
beneficiary. Access to the history of "household composition" since the birth of the one
whose history is consulted - as happened in this case - is irrelevant and
disproportionate in relation to the purpose pursued (the granting of family allowances).
2 See. in this sense, points 18 and s. of Decision 38/2021 of the Contentious Chamber:
https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-38-2021.pdf Decision on the merits 54 / 2021-8 / 23
According to the complainant, this access constitutes an all the more unacceptable security breach:
- that it emanates from public bodies;
- that it potentially affects millions of people (beyond himself, his
wife and all the people with whom her son has, at some point in his
life, lived under the same roof);
- that the useful data (i.e. the date / dates opening (s) the right to benefits
family and from which the consultation of the history of
management composition could be relevant) is / are available in the Cadastre
family allowances;
- that the research system "P028" replaced an earlier system which
allowed relevant and targeted research. The complainant quotes in this regard the passage
following extract from the “Specific functional description of message P028” sheet:
1.2.1.1. P028 Historical consultation of household composition
Principle
The P028 message is used to request data relating to the history of the
household composition in the National Register on the basis of a register number
national. This flow can be subsequently extended with data from the registry of the
BCSS.
This consultation flow combines the old consultation messages P036 and P038
in a single message. Unlike consultation message P036, this flow displays
the complete history, whether or not the person sought is the head of the household. It is not
therefore it is no longer necessary to carry out several consultations for this purpose. (…)
24. Finally, still in his conclusions of 9 June 2020, the complainant makes a series of requests to
the Litigation Chamber, namely (page 11 of its conclusions):
- To jointly and indivisibly condemn the defendant, the voluntary intervener,
the Supervisory Authority, the FPS Interior (National Register), the Crossroads Security Bank
social (BCSS), or even any dishonest perpetrators responsible for access and processing
of its data, in accordance with articles 221 to 230 of the Law of 30 July 2018 on the
protection of individuals with regard to the processing of personal data
staff ;
- Inform the King's Prosecutor of any breaches noted and inform the complainant of this
Steps ; Decision on the merits 54 / 2021-9 / 23
- To ensure that the necessary corrections have been made to remedy the shortcomings
denounced and this under penalty of penalty;
- Obtain proof that their tax data has not been processed within the framework of the
consultation denounced;
- Obtain the necessary explanations regarding the consultations of July 9, 2019 and April 21, 2020
by FAMIFED in the National Register;
- Obtain the identification and full contact details of all persons who have had access
to his personal data and failing that condemn the defendant, the voluntary intervener and
other contributors to periodic penalty payments;
- To invite those responsible in the broad sense of the illegal processing, or even the possible perpetrators
indelicate, to compensate him for the material and moral damage suffered.
2.4. Position of the defendant and the voluntary worker
25. The defendant and the voluntary intervener request, in support of their conclusions,
that the Litigation Chamber declare the complainant's complaint, if admissible, unfounded, the
consultation of the household composition of Mr X2, son of the complainant, being from their point of
perfectly legal and legitimate view. They therefore request that the complaint of the
Complainant without follow-up. The defendant and the voluntary intervener add that if by impossible,
the ODA had to consider that in the circumstances of the case, access to the history of the
composition is illegal, it should be the cause of both the National Register and the Authority
supervision insofar as they are the ones who determine the data accessible during a
search P028 (page 11 of the additional and summary conclusions of the defendant and
the volunteer worker).
3. The hearing of January 19, 2021
26. During the hearing on January 19, 2021 - of which the minutes were drawn up - the parties stated
the arguments they had developed by their respective conclusions.
27. The following elements were particularly highlighted by the parties:
- the status of data controller of the voluntary worker;
- the deliberate choice, according to the complainant, to set up research which won the
consultation of potentially irrelevant data and the seriousness of the problem at
with regard to the number of people who may be affected by this structural failure; Decision on the merits 54 / 2021-10 / 23
- the absence of any legal impact of the "induced" and "non-voluntary" nature of the access
irrelevant data on the qualification of processing within the meaning of Article 4.2. of the GDPR;
- the demonstration by the defendant and the voluntary intervener of the obligation to resort to
the TRIVIA application and the impossibility for them to modify the parameters to consult the
only historical data relating to a targeted period of time.
PLACE
As a preliminary
✓ As for the quality of the parties
28. Both in terms of her conclusions and of the hearing (see section 3 above), the intervener
volunteer declares himself responsible for processing within the meaning of Article 4.7. of the GDPR with regard to
disputed consultation, consultation which she furthermore qualifies as an incident. The defendant is for
its part qualified as a subcontractor of the voluntary worker (page 10 of the conclusions and page 11
additional and summary conclusions of the defendant and the voluntary intervener).
29. The Contentious Chamber takes note of this and does not see, in the context of its own analysis with regard to
to the factual elements submitted to it and having regard to the applicable legal elements, no
reason for not recognizing these respective qualities in the voluntary intervenor and the defendant.
With regard to the voluntary worker more particularly, she defines in fact, at the start of her
own mission, the purposes and means of the data processing it operates within the meaning of
Article 4.7 of the GDPR which defines the data controller.
✓ As for voluntary intervention
30. The Contentious Chamber takes note of Y2's voluntary intervention in this procedure. This
intervention is the result of the decision of Y2 who, voluntarily, and for the needs of the cause,
intervened in the proceedings by way of pleadings (see title 1).
31. The Litigation Chamber specifies that neither the LCA nor the Internal Rules of the APD
explicitly provide for the mechanism of (voluntary) intervention by a party that has not been
challenged by the complainant.
32. Nevertheless, in the exercise of its competences, it is incumbent on the ODA, and therefore on
the Litigation Chamber in the exercise of the powers devolved to it, to facilitate
the exercise of the rights recognized to persons concerned by the GDPR, including the right to
complaint (Article 77 of the GDPR - also recognized in Article 8.3. of the Charter of Rights Decision on the merits 54 / 2021-11 / 23
fundamental as part of the essence of the right to data protection). In this
perspective, filing a complaint should remain an easy process for people
data subjects whose personal data are processed and with regard to the processing of which they
believe that there has been a breach of data protection rules.
33. As it has already had the opportunity to develop in its Decision 17/2020, the authorities of
data protection must therefore play an active role through the missions and powers
which are assigned to them under Articles 57 and 58 of the GDPR.
34. In the same way that the complainant cannot be expected to identify straight away, from the terms
4
of his complaint, all the legal grievances relevant to the facts denounced, the same
so he cannot be expected to identify with certainty the controller
concerned. To assert the contrary would be to seriously jeopardize the right of complaint of the
complainant. Indeed, the identification of the controller, even in support of the definition
provided for in Article 4.7. GDPR, is a process that can be particularly complex. Certainly
detailed guidelines have already been published several times by the European Committee
of Data Protection (EDPS) and its predecessor the Article 29 Group, on it. 5
Nevertheless, it is clear that this identification often remains thorny. It requires
sometimes even recourse to the Inspection Service in the most difficult cases.
35. In support of the foregoing considerations, in order to give effective effect to the right to lodge a complaint,
and through it, to contribute to the effective application of the GDPR, the Litigation Chamber
therefore naturally accepts this voluntary intervention. She specifies that, of course, the debate
contradictory has developed with the latter as well. In these circumstances, the House
Litigation is able to impose sanctions on the voluntary intervenor, if necessary.
✓ As to the competence of the APD and the Litigation Chamber
36. The Contentious Chamber specifies here at the outset, with regard to the measures requested by the
complainant (see point 24), that it is in any case not competent to grant a
any compensation even in the event of shortcomings noted. Indeed, this
3Decision 17/2020: https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-17-
2020.pdf See. also Decision 80/2020 of the Contentious Chamber:
https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-80-2020.pdf
4 Decision 38/2021 of the Contentious Chamber:
https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-38-2021.pdf
5 See EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR, on edpb.europa.eu. Decision on the merits 54 / 2021-12 / 23
jurisdiction is not listed among the corrective measures and sanctions that it may decide on
application of Articles 58.2. of the GDPR and 95 and 100 LCA.
4. As for breaches of the GDPR
37. The Litigation Chamber notes that it emerges from the above statement of facts that the complainant
criticizes the voluntary intervener for having accessed personal data on
concerning and this, in its terms, without valid legal basis.
38. The Contentious Chamber notes that the parties do not dispute that during the consultation of
the history of the household composition (National Register) of Mr. X2 in July 2019,
the voluntary worker did have access to the information that the complainant had, at
a time, is part of his son's household as head of household.
39. Having access to this information constitutes processing of personal data
within the meaning of Article 4.2 of the GDPR regardless of whether the person responsible for
treatment that accessed it - in this case the voluntary worker - intended to seek
this information or if there was access incidentally, fortuitously, during the
search for data relating to a separate person, in this case the complainant's son. that
the voluntary worker had the intention or not to process this personal data,
whether or not she then used it to make her decision, all of these are irrelevant
on the qualification of "treatment" within the meaning of Article 4.2. of the GDPR.
40. The Litigation Chamber recalls that any processing of personal data must
rely on one of the bases of lawfulness provided for in Article 6 of the GDPR.
41. Article 3, paragraph 1, 9 ° of the Law of 8 August 1983 organizing a National Register of Persons
physical (hereinafter the RN Law) provides that for each person registered in the National Register, the
"household composition" data is recorded and kept as well as the modifications
successive dates provided to this information as well as their effective date; this is
the history (article 3 paragraph 2 of the RN Law). The royal decree of January 8, 2006 determining
the types of information associated with the information referred to in Article 3, paragraph 1, of the law
of August 8, 1983 organizing a national register of natural persons precise as to
6 See. article 4.2 of the GDPR: "processing", any operation or any set of operations carried out or not using
automated processes applied to data or sets of personal data, such as
that the collection, recording, organization, structuring, conservation, adaptation or modification,
the extraction, consultation, use, communication by transmission, dissemination or any other form of
provision, reconciliation or interconnection, limitation, erasure or destruction. Decision on the merits 54 / 2021-13 / 23
him in Article 1, 9 ° that the information "household composition" is associated with the data
following: "household reference person" on the one hand and "household member" on the other
go.
42. Consequently, consultation of the “household composition” data from the National Register of
son of the complainant may, de facto, take cognizance of personal data
other people than the son himself, such as members of his household. Personal data
that appear in the household composition and its history are both data of a
personal data relating to the person whose National Register is consulted AND personal data
personnel relating to persons who are included in the composition and history of its
housework. There will therefore be processing of personal data of third parties.
(separate from the one for which the "household composition" data is consulted, in this case the son
of the complainant) when they are or have been part of the household of the person for whom
the "household composition" data is consulted (as here the complainant). The result is
however, not necessarily an absence of a basis of lawfulness for the processing of personal data.
these third parties such as the complainant in this case.
43. Provided it is validly invoked, the legal basis for consulting the data
"Household composition" (and its history) of the person concerned (in this case the son of
complainant) includes the consultation of the data included under this information, including therefore
members of his household, including the complainant. In this case, the basis of lawfulness in support of which
consultation of the history of the household composition of the complainant's son is legitimate
potentially also access - even induced as described by the defendant and
the voluntary worker - to the data relating to the complainant according to which he was part of the household
of his son.
44. The Litigation Chamber recalls that in addition to the required legal basis (Article 6 of the GDPR),
personal data must, in accordance with the principle of minimization expressed in Article 5.1.c)
of the GDPR, be adequate, relevant and limited to what is necessary with regard to the purposes for
which they are processed (principle of minimization).
45. Finally, pursuant to Article 24 of the GDPR, it is the responsibility of the controller to implement
implement the appropriate technical and organizational measures to ensure and be able to
to demonstrate (as required by Article 5.2. of the GDPR) that the processing he carries out complies
to the GDPR.
46. It follows from the foregoing that it is for the Contentious Chamber to verify whether the consultation
(whose legality is contested by the complainant) - by the voluntary intervener in her capacity as Decision on the merits 54 / 2021-14 / 23
data controller - the "household composition" data of the complainant's son, in this
including the complete history thereof, met in this case the conditions of treatment imposed
by the GDPR.
4.1. As to the basis of legality and respect for the principle of minimization
47. The Contentious Chamber notes that the defendant and the voluntary intervener rely on
Article 6.1.c) of the GDPR to legitimize the contested data processing. Article 6.1.c) authorizes the
data processing necessary for compliance with a legal obligation to which the person responsible for
7
treatment is submitted.
48. The Contentious Chamber recalls as it did in its recent decisions 37/2021 and
38/2021 that in its Huber judgment, the Court of Justice of the European Union (CJEU) has, in view of
of this condition of necessity, specified that it was an autonomous notion of the right
Community which must be interpreted in a way that fully meets the purpose of the
8
Directive 95/46 / EC applicable at the time of this judgment.
9
49. According to the conclusions he filed in this case, the Advocate General explains to this
considering that "the concept of necessity has a long history in Community law and it is
established as part of the proportionality test. It means that the authority which adopts
a measure which infringes a fundamental right in order to achieve a justified objective must
demonstrate that this measure is the least restrictive allowing this objective to be achieved. Otherwise,
whether the processing of personal data may be likely to infringe the fundamental right to
respect for private life, Article 8 of the European Convention for the Protection of
man and fundamental freedoms (ECHR) which guarantees respect for private and family life,
also becomes relevant. As the Court stated in the Österreichischer Rundfunk and others judgment,
if a national measure is incompatible with Article 8 of the ECHR, this measure cannot
meet the requirement of Article 7 (e) of the Directive. Article 8, paragraph 2, of the ECHR
provides that an interference with privacy may be justified if it pursues one of the objectives therein
listed and "in a democratic society, is necessary" for any of these purposes. The courtyard
7 See. decisions 37/2021 and 38/2021 of the Contentious Chamber which explain what is meant by
necessary for compliance with a legal obligation: https://www.autoriteprotectiondonnees.be/publications/decision-
quant-au-fond-n-37-2021.pdf https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-
38-2021.pdf
8
CJEU, December 16, 2008, Heinz Huber v. Bundesrepublik Deutschland, C-524/06, ECLI: EU: C: 2008: 724, para. 52.
9
Opinion of Advocate General Poiares Maduro delivered on 3 April 2008 in the proceedings before
the CJU resulting in the judgment cited in footnote 15 above (C-524/06). Decision on the merits 54 / 2021-15 / 23
European Human Rights Council has ruled that the notion of "necessity" implies that a "need
imperative social "is in question".
50. This case-law, formulated admittedly in the light of Article 7 (e) of Directive 95/46 / EC, applies to
all the bases of lawfulness which retain this condition of necessity. She remains today
relevant even though Directive 95/46 was repealed since this condition of necessity
is maintained under Article 6.1 b) to f) of the GDPR and therefore in Article 6.1.c) invoked in
the species. Article 6.1 of the GDPR in fact reproduces the terms of Article 7 of Directive 95/46 / EC
10
of which it is the equivalent.
51. The Article 29 Group also referred to the case law of the European Court of
human rights (Eur. D.H. Court) to define the requirement of necessity 11 and concludes that the adjective
"Necessary" therefore does not have the flexibility of terms such as "admissible", "normal", "useful",
"Reasonable" or "expedient". 12
52. More precisely with regard to the basis of legitimacy which rests on the legal obligation to which would be
held by the controller, the European Data Protection Board (EDPB -
13
EDPS) has set out the conditions under which this basis of lawfulness can be applied:
- the obligation must be imposed by law;
- the legislation must meet all the conditions required to make the obligation valid and
binding;
- the legislation must comply with the applicable data protection law,
in particular the principles of necessity, proportionality and limitation of purpose;
- the legal obligation itself must be sufficiently clear about the data processing
of a personal nature that it requires;
- and the controller should not have an unjustified margin of appreciation as to
how to comply with the legal obligation.
10 Note that the only differences to be noted are the addition to Article 6.1.d) of the GDPR of the vital interest of another
natural person as the data subject as well as the deletion in Article 6.1.e) of the GDPR of the "third party to which
the data is communicated ", the mission of public interest or falling within the exercise of public authority before
be that of the sole controller. In addition, a slight wording difference exists between the article
7.1. f) e Directive 95/46 / EC and Article 6.1. f) of the GDPR without modifying the scope of this provision.
All these modifications do not affect the condition of necessity.
11 Article 29 Group, Opinion 06/2014 of April 9, 2014 on the notion of legitimate interest pursued by the person responsible
data processing within the meaning of Article 7 of Directive 95/46 / EC, WP 217.
12Court eur. D.H., March 25, 1983, Silver and others v. United Kingdom, para 97.
13European Data Protection Board (EDPS), Opinion 03/2019 concerning questions and answers on
the interaction between the regulation on clinical trials and the general data protection regulation
(GDPR) [article 70, paragraph 1, point b)] of 23 January 2019 (point 11):
https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_opinionctrq_a_final_fr.pdf Decision on the merits 54 / 2021-16 / 23
53. In the present case, the defendant and the voluntary intervener put forward several provisions
which, from their point of view, required them to proceed with the disputed treatment.
54. The Contentious Chamber notes in this regard the following:
- The granting of the social supplement in addition to the ordinary allowances is governed by the General Law
relating to family allowances (LGAF) of 19 December 1939, in particular Articles 51, 54 and
173quater. Article 173 quater explicitly provides that family allowance organizations and
the ministerial services, responsible for the execution of this law, are required to contact the Register
national of natural persons to obtain the information referred to in Article 3, paragraphs 1 and 2,
of the Law of August 8, 1983 organizing a national register of natural persons. Among these
data show the household composition and its successive modifications (ie history). The
recourse to another source is only permitted insofar as the necessary information is not
cannot be obtained from the National Register.
- Jurisdiction over the granting of family allowances and social supplement is regionalized
and the complainant's son was listed as residing in the Brussels-Capital Region at the time
14
of the consultation of the denounced National Register. In this regard, the Litigation Chamber notes
that Article 9 of the Ordinance of 25 April 2019 of the Brussels-Capital Region regulating the granting
15
family benefits specifies that the basic family allowance is increased by a supplement
social under certain conditions, especially when the annual household income does not reach
not a certain threshold. In other words, the granting of the supplement is conditioned by the income of the
housework.
- Regarding the granting of this social supplement, Article 10 of the Ordinance of April 4, 2019 provides
that "the assembled College sets the conditions under which the payment of social supplements is
carried out provisionally, pending tax data establishing the annual income of the
cleaning allowing a final decision to be taken ”. As a result, the assembled College of the Commission
Community Commune has set the conditions for granting social supplements and certain
supplements provided for in the General Law on Family Allowances in a Decree of 24
October 2019.
14 The complainant states in this regard that his son has been living in Wallonia since a date much earlier than that of this
consultation (i.e. since July 2018). The voluntary worker and the defendant indicate that this change
of domicile had not been notified to them on the date of the P028 consultation and that now the voluntary worker
no longer manages the family allowances file of the complainant's son. The Litigation Chamber takes note of this.
15M.B., May 8, 2019.
https://bruxelles.famifed.be/sites/default/files/uploads/20190509_ordranteiegezinsbijslag_NLFR.pdf: Decision on the merits 54 / 2021-17 / 23
- In accordance with the aforementioned Decree of October 24, 2019, the preparatory measures that the funds
family allowances were to be taken from 2019 in order to be able to establish, for each household
Brussels resident, the correct amount of family allowances to which he would be entitled from the 1st
January 2020, as well as the procedure to be followed for the granting of social supplements from
2020, were decreed in the CO PF2 Circular of July 5, 2019 relating to the granting procedure
provisional social supplements in the Brussels-Capital Region from January 1, 2020 ,.
- The defendant and the voluntary intervener rely on this Circular of July 5, 2019 relating to
the procedure for provisionally granting social supplements in the Brussels-Capital Region to
from 1 January 2020, in particular on its articles 2.2 and 7 to legitimize their consultation of
the history of the household composition of the complainant's son.
- This circular provides that the establishment of the right to a supplement in the Brussels-Capital Region
will be done in two phases, namely:
Phase 1: A decision on the provisional payment of the supplement is taken in "time
real ": in other words, it is automatically granted on a provisional basis if the conditions are met.
Also, the supplement can be granted on a provisional basis following a request from the household
accompanied by supporting documents relating to the current gross income of the household.
Phase 2: Two years later, the taxable income of all households is verified using
of the tax flow and the definitive establishment of the right to the social supplement is carried out on the basis
tax data made available by the authentic source.
- As for the concept of household retained, the circular specifies that "this identification is made according to
the notion of household as described in article 2 of the decree of October 24, 2019. This decree
provides in Article 1 that it is to be understood by:
"1 ° member of the cohabiting household: any person who is neither a relative nor an ally
up to the third degree inclusive, with which the recipient cohabits and forms a
de facto household;
2 ° household members: the beneficiary and, where applicable, the spouse with whom he
cohabits and / or any other member of the cohabiting household ”
55. The Litigation Chamber concludes that in other words, prior to the granting of the supplement
adequate social security from 1 January 2020, it went to the family allowance funds (including
the voluntary worker), to identify, in application of the various aforementioned texts, from July 2019,
beneficiaries and their income, more particularly that of their household as this concept is
defined in article 2 of the decree of 24 October 2019. Decision on the merits 54 / 2021-18 / 23
56. This verification of the income condition of the household (and therefore of who was part of it) is, in
the occurrence, through an identification of the household composition of the complainant's son via the
consultation of the National Register. It is also not disputed that the allowance funds
family, including the volunteer worker, were duly authorized to consult the National Register.
57. The Litigation Chamber notes that it is not clear from the legal texts invoked which
are the income that should be taken into account and hence, depending on the phase in which
the consultation took place, what was the date of the household composition to be taken into
consideration (current calendar year, backtracking by 2 years by analogy with the final calculation
which will take place two years later as mentioned by the defendants and the intervener
voluntary during the hearing (see Articles 2.1. and 2.2. of the circular of 5 July 2019)?). This
precision would have been invaluable, it is also required by the principle of clarity and predictability of
the "law", a principle long required by the case law of the European Court of Human Rights
16
man, as well as the CJEU.
58. The Litigation Chamber considers that at most, this history of the “composition” data
household "of the complainant's son could have been consulted by going back to the opening date
right to allowances / social supplement to these allowances and that in any event, the consultation
the entire history of the complainant's son without a time limit was disproportionate
and not necessary for the voluntary worker to comply with her legal obligation.
59. However, as the complainant denounces, the “P028 search” which was carried out prevails
systematically consulting the history of household composition in its entirety,
or since the birth of the person whose National Register is consulted. Access to this history
of the complainant's son was therefore disproportionate and the data consulted was not
relevant with regard to the objective pursued, namely the determination of the composition of
household at a time T which must be taken into account in the granting of family allowances
and the social supplement.
60. Accordingly, the Contentious Chamber concludes that, even if it invokes that the TRIVIA application which it
had to use did not allow consultation of a time-limited history
(see point 63), the voluntary worker did not carry out the processing necessary for her obligation
legal and therefore cannot invoke Article 6.1.c) as a basis of lawfulness. The Litigation Chamber
therefore finds a breach of Article 6 of the GDPR on its part, in the absence of any other basis
valid lawfulness and without prejudice to the obligation of the controller to identify a basis
16Court eur. D.H., May 4, 2000, Rotaru v. Romania; CJEU, Joined cases C-511/18, C-512/18 and C-520/18,
La Quadrature du Net and others, ECLI: EU: C: 2020: 791, para 121. Decision on the merits 54 / 2021-19 / 23
17
legality and not several depending on the circumstances. The Litigation Chamber also concludes
also for a breach of Article 5.1.c) of the GDPR, the data of which the intervener has
acquainted with it on the occasion of its illegal consultation (in the absence of a legal basis to legitimize it)
therefore also irrelevant with regard to the aim pursued.
61. As for the consultation held on April 21, 2020, the Litigation Chamber notes that the
the defendant and the voluntary intervener are based on their legitimate interest (article 6.1.f) of the GDPR),
the consultation being justified according to them by the needs of the present procedure. Bedroom
Litigation recalls in this regard that it has, in the past already, considered that the defense in court
18
is a legitimate interest that can validly be invoked by data controllers to
as much as the cumulative conditions of necessity of the treatment for the realization of the interest
lawful pursuit and proportionality (i.e. that the fundamental rights and freedoms of
concerned do not prevail over the interest pursued) are met.
62. Without calling into question the fact that legal defense may indeed constitute an interest
legitimate within the meaning of Article 6.1.f) of the GDPR, the Litigation Chamber concludes no less, for
the same reasons as those underlying its conclusion regarding the initial consultation (see.
points 57-60), that this consultation during the proceedings pending before the DPA was
also illegal.
4.2. As for the principle of accountability
63. The Litigation Chamber takes note of what the voluntary intervener declares on the one hand that it
is required to use the TRIVIA application and on the other hand that it is impossible for him to target in time
his request to consult the history of the "household composition" data in the Register
national. The Litigation Chamber is not insensitive to this and refers on this point to the measures
corrective measures that it decides to take as detailed in points 69 et seq. (title 5).
64. Notwithstanding this last point, the fact remains that in his capacity as responsible
processing, the voluntary worker could not rely on Article 6.1.c) of the GDPR and did not have
as was concluded in points 60 and 62 above from no valid basis of lawfulness to access
the complainant's data via the consultation of the complete history of household composition
of his son.
17 See. Decision 38/2021 of the Contentious Chamber:
https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-38-2021.pdf
18 See. the Decision 03/2020 of the Contentious Chamber:
https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-03-2020.pdf Decision on the merits 54 / 2021-20 / 23
65. The Contentious Chamber also finds a breach of Articles 24 and 5.2. of
GDPR on the part of the voluntary worker when she has not been able to put
put in place the technical measures intended to implement the GDPR. Here again, the House
Litigation is not unaware of the lack of control of the application by the voluntary worker. This
circumstance is not, however, such as to eliminate any breach on his part
given his capacity as data controller.
66. Indeed, the objective of the principle of accountability, or "principle of responsibility" in its translation
French (Article 5.2. of the GDPR), is to make data controllers accountable - whether it is
private companies or public authorities or bodies -, and allow the authorities to
data protection monitoring such as ODA to verify the effectiveness of the measures taken
applying it. Risks must be identified by setting up action plans and
control procedures and these organizations must be able to prove without difficulty that they have
carried out an identification, an assessment and a framework of the risks in terms of protection
of personal data with regard to the processing they carry out. This principle would be broadly
undermined, or even emptied of all substance if it was enough for a data controller to invoke,
once faced with a complaint lodged with the supervisory authority, the fact that the application
computer used - even its use imposed by a third party - does not allow it to comply
to the GDPR.
67. In accordance with its obligation of accountability and documentation, the voluntary worker
therefore, at a minimum, should have alerted the relevant authorities to the overhang situation
in which the constrained use of the TRIVIA application placed it in relation to its obligations
arising from the GDPR.
68. The Litigation Chamber is also aware of the care taken by the defendant to respond to
questions from the complainant and making contact with the supervisory authority to be able to explain to the
the situation better at the latter. But here again, these circumstances are not such as to
allow the Litigation Chamber to conclude that there was no breach. Bedroom
Litigation also noted that the intervener now undertook to contact
the Supervisory Authority.
5. Regarding corrective measures and sanctions
69. Under article 100 LCA, the Litigation Chamber has the power to:
1 ° dismiss the complaint;
2 ° order the dismissal;
3 ° pronounce a suspension of the pronouncement; Decision on the merits 54 / 2021-21 / 23
4 ° propose a transaction;
5 ° issue warnings or reprimands;
6 ° order compliance with the requests of the person concerned to exercise these rights;
7 ° order that the person concerned be informed of the security problem;
8 ° order the freezing, limitation or temporary or definitive prohibition of processing;
9 ° order that the processing be brought into conformity;
10 ° order the rectification, restriction or erasure of the data and the notification thereof
data recipients;
11 ° order the withdrawal of accreditation of certification bodies;
12 ° give periodic penalty payments; 19
20
13 ° issue administrative fines;
14 ° order the suspension of transborder data flows to another State or an organization
international;
15 ° send the file to the public prosecutor's office in Brussels, who informs them of the consequences
data on file;
16 ° decide on a case-by-case basis to publish its decisions on the website of the
data.
70. It is important to contextualize the shortcomings noted by the Litigation Chamber with a view to
to identify the most appropriate corrective measures and sanctions.
71. In this context, the Litigation Chamber will take into account all the circumstances of the case
and explanations provided by the parties. In this regard, the Litigation Chamber wishes
to specify that it belongs to it sovereignly as an independent administrative authority -
in compliance with the relevant articles of the GDPR and the LCA - to determine the measure (s)
corrective (s) and appropriate sanction (s). 21
72. Thus, it is not for the complainant to ask the Litigation Chamber to order such
or such corrective measure or sanction. If, notwithstanding the above, the complainant should
nevertheless ask the Litigation Chamber to pronounce one or the other measure and / or
19
https://www.autoriteprotectiondonnees.be/publications/politique-en-matiere-d-astreinte.pdf
20 The Contentious Chamber does not comment on the advisability of a possible administrative fine to
against the defendant. Given the latter's "public authority" status within the meaning of
Article 5 of the Law of 30 July 2018 on the protection of individuals with regard to processing
of personal data, read in conjunction with Articles 83.7. of the GDPR and 221 § 2 of the law of
July 30, 2018 cited above, the Litigation Chamber is in fact not authorized to impose such a fine on him.
21 Litigation Chamber, Decision on the merits 81/2020:
https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-81-2020.pdf Decision on the merits 54 / 2021-22 / 23
sanction, it is not up to the latter to justify why it would not retain one or
the other request made by the complainant. These considerations leave intact the obligation for
the Litigation Chamber to justify the choice of corrective measure (s) and / or sanction (s)
which it judges, (among the list of measures and sanctions made available to it by the articles
58 of the GDPR and 95.1 and 100.1 of the LCA recalled above) appropriate to condemn the party
in question. The Contentious Chamber recalls here, as it mentioned in point 36 above,
that it is not competent to grant any compensation.
73. The Litigation Chamber found a breach of Articles 6, 5.1.c) as well as of Articles 24
and 5.2. of the GDPR on behalf of the voluntary worker (points 60, 62 and 65).
74. In view of these shortcomings, the Litigation Chamber sends the voluntary intervener
22
a reprimand on the basis of Article 100.1, 5 ° LCA which constitutes, in view of the facts and
breaches noted, the effective, proportionate and dissuasive sanction as required by
the applicable article 83 of the GDPR. In this regard, the Litigation Chamber wishes to stress that it
is not in a position to issue a warning to the voluntary worker as soon as this
measure cannot be applied when a breach is found. Disclaimer applies
only when the planned processing operations are likely to violate the
provisions of the GDPR.
75. The Litigation Chamber is of the opinion that beyond the reprimand addressed to the intervener
voluntary, it is important that an adequate response be quickly found to the problem raised
by the complaint and this, in order to allow a limited consultation, respectful of the GDPR, of
the history of the "household composition" data (as well as the history of other data from the
National Register if applicable). The Contentious Chamber refers in this regard to the deliberations
of the Sectoral Committee of the National Register (CSRN) of the former Commission for the Protection of Life
private (OPC) under which the NISA grants access to limited historical data
over time in accordance with Article 4 § 1, 3 ° of the Privacy Law which then set out the principle
proportionality (now principle of minimization worded in Article 5.1, c) of the GDPR). 23 The
Litigation Chamber is also challenged by the document entitled "File - Description
specific function of the P028 message ”(in particular point 1.2.1.1.) highlighted by the
complainant, according to which it would have been waived to use an application more respectful of the
principle of minimization (see point 23).
22 See. Article 58. 2 b) of the GDPR which provides for sending a call to order to the controller when
"The processing operations have resulted in a violation of the provisions of this Regulation".
23
See. taking for example the deliberation of the sectoral committee of the National Register RN No. 20 of March 25, 2009. Decision on the merits 54 / 2021-23 / 23
76. For all these reasons, the Litigation Chamber will draw the attention of the APD Steering Committee
on this issue. Where appropriate, the ODA bodies could, in accordance with their
respective competences assigned to them by the LCA, decide to enter into a dialogue with the whole
of the bodies concerned and / or conduct an in-depth investigation of the issue
which arose during the complaint leading to this decision.
77. The Contentious Chamber also decides to send a copy of this decision to
services of the National Registry as well as to Famifed, Iriscare and the Crossroads Security Bank
social security (BCSS) mentioned by the complainant in the terms of his complaint.
6. Transparency
78. In view of the importance of transparency with regard to the decision-making process and
decisions of the Litigation Chamber, this decision will be published on the website of the APD
by deleting the direct identification data of the parties (either the defendant,
the voluntary worker and the complainant) and the natural persons mentioned. On the other hand, the Chamber
Litigation believes that it has no other possibility, for the proper understanding of this
decision, only to mention Famifed, Iriscare, the Banque-Carrefour de la sécurité
social (BCSS) and National Registry services.
FOR THESE REASONS,
THE LITIGATION CHAMBER
Decided
- To issue a reprimand against the voluntary intervener on the basis of the article
100.1, 5 ° LCA.
Under Article 108.1 LCA, this decision can be appealed to the Court of
contracts (Brussels Court of Appeal) within 30 days of notification, with
the Data Protection Authority as respondent.
(Sé) Hielke Hijmans
President of the Litigation Chamber
