APD/GBA (Belgium) - 75/2023: Difference between revisions
From GDPRhub
No edit summary |
m (Mg moved page APD/GBA (Belgium) - DOS-2021-07350 to APD/GBA (Belgium) - 75/2023: consistency) |
(No difference)
| |
Latest revision as of 08:55, 29 June 2023
| APD/GBA - DOS-2021-07350 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 6(1)(f) GDPR Article 12(2) GDPR Article 12(3) GDPR Article 15(1)(a) GDPR Article 17(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | 14.06.2023 |
| Fine: | 10000 EUR |
| Parties: | n/a |
| National Case Number/Name: | DOS-2021-07350 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | GBA (Belgium) (in NL) |
| Initial Contributor: | n/a |
Publicly available information of tens of thousands of doctors across Belgium were collected and processed without a legitimate basis. Their information were published on an online platform consisting of profiles for doctors. The interests of the data subjects outweighed the controller’s interests. The controller was fined 10,000 EUR for its GDPR violations.
English Summary
Facts
A provider of an online platform (the controller) collected on a large scale - without consent - publicly available contact data on tens of thousands of doctors. This data was then published on the controller's online platform. The platform distinguished between “free profiles” and “paying profiles” of doctors. With regard to the paying profiles, the doctors and the controller have a contract in place which is not the case in regard to the free profiles.
A group of doctors (the complainants), that did not have a contract with the controller, made an erasure requests under Article 17(1) GDPR to the controller via a registered letter on 25 Oct 2021.
The controller stated that the letter was not received by it at the time, and stated that the letter was sent during a lockdown period during which employees and the manager worked from home. The controller claimed to eventually have received the erasure requests on 13 January 2022, as the letter of the complainants was then found within a pile of mail, whichafter, the controller acted on them on 14 January 2022.
Thereafter, the complainants filed a complaint with the Belgian DPA against the controller. The complainants alleged that the controller breached Articles 5(1)(a), 5(2) and 6 GDPR. Moreover, they claimed that the controller violated the GDPR by deleting their personal data, too late.
The controller claimed that, with regard to "free profiles", it has a legal basis under Article 6(1)(f) GDPR, as the it has legitimate interests to process the data. The claimed interests by the controller were 1) freedom of expression and information under Article 11 of the Charter and the Belgian Constitution, as well as, 2) the controller's economic interest, based on freedom of enterprise.
Holding
The DPA recalled that pursuant to Article 5(1)(a) GDPR, personal data must be processed lawfully. This means that the processing must have a legal basis under Article 6 GDPR. As the controller had claimed to have legitimate interests pursuant to Article 6(1)(f) GDPR, with regard to the “free profiles”, to process the information: the DPA proceeded to assess the balance of interests of the controller and the complainants.
When it comes to assessing the balance of interests, under CJEU case law (C-708/18, ECLI:EU:C:2019:1064, para 56), the controller must take into account the reasonable expectations of the data subject that their personal data will not be processed, when they cannot reasonably expect further processing. In this case, the DPA found, that the complainants could not reasonably expect that their data would be further processed for other purposes, since, initially, the contact information of the doctors, were published, with their consent, on their own, their group practice's, or hospital's website.
Furthermore, the DPA emphasized that the freedom of enterprise, as recognised in Article 16 of the Charter, is not unlimited and stops where other fundamental rights - such as the right to protection of personal data - begin. Thereafter, it was found that the interests raised by the controller did not override those of the complainants. Consequently, the controller could not invoke a legitimate interest, because the interests of the complainants outweigh the interests of the controller or the third party.
Consequently, the DPA held that the controller breached Article 6(1)(f) GDPR with regard to the “free profiles”. As far as “paying profiles” were concerned, the DPA notes that the complaint only concerns the processing of personal data in the context of free profiles with regard to doctors who precisely do not want such agreement (paid profiles) with the controller.
With regard to acting on the complainants’ erasure request on a timely manner, it was noted by the DPA, that during lockdown period, telecommuting was strongly recommended, not mandatory. Therefore, the DPA held that the controller was not unable to follow up on mail. The controller was not found to have taken appropriate measures to facilitate the data subject's right to data erasure, which constitutes a violation of Article 12(2) GDPR. As a result, the right to data erasure was not implemented in a timely manner, in accordance with Article 12(3) GDPR. This non-compliance was found to be the result of the failure to facilitate the exercise of the data subject rights. Consequently, DPA found that there has been a breach of Article 12(2) GDPR.
Eventually, the controller was fined 10,000 EUR for breaching Articles 5(1)(a) and 6(1)(f) GDPR as regards the lawfulness of the processing, as well as, 12(2) GDPR and 17(1) GDPR for not taking appropriate measures to facilitate the exercise of their rights by data subjects.
Comment
In a case with similar facts, of the German Supreme Court (BGH - VI ZR 60/21), the court came to an opposite conclusion that an online platform collecting and publishing personal data of doctors does not violate the provisions of the GDPR. See a summary of this case on the GDPRHub here.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/26
Litigation room
Decision on the substance75/2023 of 14 June 2023
File number : DOS-2021-07350
Subject: Processing of personal data on a platform
The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke
Hijmans, chairman, and Messrs. Dirk Van Der Kelen and Jelle Stassijns, members;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of
personal data and on the free movement of such data and revocation of
Directive 95/46/EC (General Data Protection Regulation), hereinafter GDPR;
Having regard to the law of 3 December 2017 establishing the Data Protection Authority,
hereafter WOG;
Having regard to the rules of internal order, as approved by the Chamber of
Representatives on 20 December 2018 and published in the Belgian Official Gazette on
January 15, 2019;
Having regard to the documents in the file;
Made the following decision regarding:
The complainants: Healthcare providers X represented by Mr. Ann Dierickx, office clerk
at 3000 Leuven, Mechelsestraat 107-109, hereinafter “the complainants”;
The defendant: Y, represented by 'Mr. Emmanuel Cornu and Mr. Eric DeGryse,
with offices at 1050 Brussels, Avenue Louise 250/10, hereinafter “de
defendant”. Decision on the substance 75/2023 - 2/26
I. Factual Procedure
1. On November 23, 2021, the complainants submit a complaint to the
Data Protection Authority against the Defendant.
2. On November 25, 2021, the complaint will be declared admissible by the First Line Service on
pursuant to Articles 58 and 60 WOG and the complaint is dismissed pursuant to Article 62, § 1 WOG
submitted to the Disputes Chamber.
3. On December 10, 2021, in accordance with Article 96, § 1 WOG, the request of the
Disputes Chamber to carry out an investigation submitted to the Inspection Service,
together with the complaint and the inventory of the documents.
4. The investigation by the Inspectorate will be completed on February 2, 2022, it will be
report is appended to the file and the file is reviewed by the Inspector General
sent to the Chairman of the Litigation Chamber (Article 91, § 1 and § 2 WOG).
The report contains findings regarding the subject of the complaint and decision
that:
1. there is a violation of Article 5 (1) (a) and (2) and Article 6 (1) GDPR; and that
2. there is a violation of article 12, paragraph 1, paragraph 2 and paragraph 3, article 17, article 19, article
24 (1) and Article 25 (1) GDPR.
5. On February 4, 2022, the Litigation Chamber will decide on the basis of Article 95, § 1, 1° and Article 98
WOG that the file is ready for treatment on the merits.
6. On 4 February 2022, the parties involved will be notified by email of the
provisions as stated in Article 95, § 2, as well as those in Article 98 WOG. Also
they are informed of the time limits for their
to file defenses.
The deadline for receipt of the statement of defense from the defendant was
hereby recorded on 18 March 2022, this for the statement of reply of the complainants
April 8, 2022 and this one for the defendant's rejoinder on April 29, 2022.
7. On 8 February 2022, the complainants will electronically accept all communication regarding the case
and ask the complainants for a copy of the file (article 95, § 2, 3° WOG), which was sent to them
transferred on February 9, 2022.
8. On February 17, 2022, the defendant electronically accepts all communications regarding the
case. The defendant hereby makes a reasoned statement to the Disputes Chamber
request to change the procedural language from Dutch to French, as well
the defendant asks for a copy of the file (Article 95, § 2, 3 ° WOG), which was given to her
transferred on 14 March 2022. Substantive decision 75/2023 - 3/26
9. On February 21, 2022, the Disputes Chamber receives a request from the complainants on the
to keep Dutch as the language of proceedings.
10. On March 7, 2022, the Disputes Chamber will inform the parties about the retention of the
Dutch as a procedural language in accordance with its language policy, as there is only 1
procedural language. However, the Disputes Chamber states that the parties can turn to it
address in the national language of their choice and that the Dispute Chamber will respond to the
parties in the language they prefer. The Disputes Chamber makes adjusted terms for this
for the parties to submit conclusions about.
11. On March 14, 2022, the Disputes Chamber receives the defendant's objection to the
retention of Dutch as a procedural language and that proposed by the Disputes Chamber
language arrangement. On the same day, the Disputes Chamber will send adjusted deadlines
submit claims to the parties.
The deadline for receipt of the statement of defense from the defendant was
hereby recorded on 25 April 2022, this for the conclusion of the complainants' reply on 16
May 2022 and those for the defendant's rejoinder on 6 June 2022.
12. After assessing the objection regarding the language of the proceedings of the defendant, the
Litigation Chamber on March 22, 2022 the decision regarding the preservation of the
Dutch as the language of the proceedings to the parties, with adjusted deadlines for submission.
The deadline for receipt of the statement of defense from the defendant was
hereby set on 3 May 2022, those for the statement of reply of the complainants on 24
May 2022 and those for the defendant's statement of defense on 14 June 2022.
13. On March 18, 2022, the Disputes Chamber will receive the statement of defense from the
defendant. First, the defense alleges a violation of Articles 41 and 42 of the
coordinated laws on the use of languages in administrative affairs for the sake of preservation
of Dutch as a procedural language. On the merits, the defendant argues that the processing
constitutes lawful data processing. Subsequently, the defendant claims that she
has proceeded to the deletion of the personal data from the first knowledge
of the data erasure request.
14. On 17 May 2022, the Disputes Chamber will receive the statement of reply from the complainants. The
The complainants argue that the defendant complied with the rules in the contested processing
from articles 5, paragraph 1, a), 5, paragraph 2 and 6 GDPR has not been complied with.
indicates that the defendant has belatedly proceeded to a complete removal of the
personal data in question violated the provisions of the GDPR.
15. On 13 June 2022, the Litigation Chamber received the statement of rejoinder from the
defendant in which she repeats her arguments from the statement of defense and Decision on the substance 75/2023 - 4/26
additionally notes that the complaint was filed on behalf of the practitioners, but the
statement of reply was submitted on behalf of Z comm.v.
16. On September 28, 2022, the parties will be notified that the hearing will
take place on November 18, 2022.
17. On November 18, 2022, the parties appearing will be heard by the Disputes Chamber.
18. On November 21, 2022, the minutes of the hearing will be sent to the parties
transferred.
19. On January 26, 2023, the Disputes Chamber receives some from the defendant
remarks with regard to the official report which it decides to include in
her deliberation.
20. On 16 May 2023, the Disputes Chamber informed the defendant of its intention
made to proceed to the imposition of an administrative fine, as well as the
amount thereof in order to give the defendant the opportunity to defend himself,
before the sanction is effectively imposed.
21. On June 5, 2023, the Disputes Chamber will receive the response of the defendant to the
intention to impose an administrative fine, as well as the amount
of them.
II. Motivation
II.1. Decision on Dutch as a procedural language
22. As already explained, the defendant objected to the Dutch als
procedural language. The defendant argues that Dutch should be retained as the language of proceedings
is contrary to Articles 41, §1 and 42 of the Royal Decree of 18 July 1966 containing
coordination of the laws on the use of languages in administrative matters (hereinafter: SWT).
has complied.
23. In view of the above, the question arises which language legislation applies to the
procedure before the Litigation Chamber.
24. With regard to the procedural language for the GBA, Article 57 of the WOG in the
within the framework of the dispute resolution procedure that "[t]e DPA uses the language in which the
procedure is conducted according to the needs specific to the case".
Pursuant to this Article 57 WOG, read in conjunction with Article 60 WOG, the
procedure conducted in one of the national languages. However, this article 57 WOG is general
1
B.S. August 2, 1966. Decision on the substance 75/2023 - 5/26
formulated and does not provide for any general foreseeable regulation of the procedural language
the parties to a multilingual procedure.
25. The Marktenhof has already discussed some elements regarding the language used in the proceedings
clarified before the Litigation Chamber. It has determined that the law of 15 June 1935 on
the language used in court cases does not apply to the Disputes Chamber:
"It is incontestable that the language law of 15 June 1935 does not apply to
conducted the procedure before the GBA. In principle, every person/legal entity must oppose
those who are prosecuted for a complaint have the opportunity to defend themselves in their own language
(and not in that of the complainant).”
26. The Marktenhof continues: “[t]e GBA, which is an autonomous government service with
legal personality, is a central service whose scope covers the entire country
within the meaning of the laws of 18 July 1966 on the use of languages in administrative matters. Out of service
it is in its relations with the public, individuals and private companies
subject to the provisions of Articles 40 to 45 of the aforementioned
language laws.”2
27. These articles read as follows:
“Art. 41. - § 1. - The central services for their relations with private individuals
use of those of the three languages used by those concerned.”
“Art.42.-Decentralized services draw up deeds, certificates, declarations, authorisations
and licenses in those of the three languages of which the private individual concerned uses
asks.”
28. In a recent interim judgment dd. March 8, 2023, the Market Court has determined that there
there is disagreement about the applicability of this language legislation to the procedures
for the Dispute Chamber. The Marktenhof considers in this regard: “[t]end a
create a clearer framework and provide foreseeability for the parties in this regard,
the Marktenhof should rule on this, possibly after questioning it
Constitutional Court". However, the Disputes Chamber notes that this judgment dates from after the
decisions of the Disputes Chamber to use Dutch as the language of proceedings,
therefore not taken into account in those decisions.
29. In its judgment dd. July 7, 2021, the Market Court has in any case clearly stated that in
in principle every person/legal entity against whom a complaint is being prosecuted, the
must have the opportunity to defend himself in his own language (and not that of the complainant).
2 Brussels Court of Appeal, Marktenhof section, 7 July 2021, 2021/AR/320, p. 19-20.
3 Brussels Court of Appeal, Marktenhof section, 8 March 2023, 2023/AR/184, p. 12. Decision on the substance 75/2023 - 6/26
evading the prosecuted party to his or her language may, among other things, be a violation
form part of the rights of defence.
30. Since only one official procedural language can apply
The Disputes Chamber must therefore decide whether this should be Dutch or French in the present case
are.The Litigation ChamberdecidedtoretainDutchasprocedurallanguage.Hereby
decision, the Disputes Chamber took into account the following elements: the
The defendant's registered office is located in (bilingual) Brussels
Capital Region, the articles of association of the defendant are drawn up in Dutch, de
the defendant is active throughout the territory of Belgium, and the complainants are Dutch-speaking.
The Disputes Chamber points out that it has not taken this into account in this assessment
with the objections regarding French as the procedural language formulated by the lawyer
of the complainants as stated in the letter dd. February 4, 2022 it was determined that “if a
the defendant wishes to file a reasoned objection to the use of this language
make it possible to do so within a period of 14 days after the sending of this letter, at
preferably via litigationchamber@apd-gba.be or via the contact details above
this letter” (own underlining).
31. The Disputes Chamber has also taken the findings into account in this decision
of the Marktenhof that any natural or legal person against whom a complaint
persecuted must have the opportunity to defend themselves in their own language. The
The Disputes Chamber has therefore proposed a regulation by analogy with Articles 41,
§1 and 42 SWT. First of all, the Litigation Chamber reminds that these articles only refer to the
regulating language use between the private individual and the central government department, that is in this case
respectively each party and the Disputes Chamber, by extension the GBA. These articles
therefore do not regulate in which language the parties must communicate with each other.
The proposed language regime was as follows. By analogy with the above
position of the rights of defense of the defendant, states the
Disputes Chamber in the first place that both must be able to turn to the Disputes Chamber
their own language. The parties were therefore free to submit procedural documents and conclusions to
the Litigation Chamber in their language of choice. These procedural documents filed by a party
would not, however, be translated by the Litigation Chamber for the benefit of the
other party; nor would it be liable for the related costs incurred by the parties
with the translation of these documents. The parties also did not have to provide translations of their own
provide procedural documents for the other party. Both sides would too
simultaneously receive the decision in their preferred language.
At the start of the hearing at the Litigation Chamber, the Chairman also stated
indicated that the parties could express themselves in the language they preferred. Decision on the substance 75/2023 - 7/26
32. The Disputes Chamber notes that the defendant has submitted claims in Dutch
submitted and expressed himself during the hearing in Dutch, as a result of which the
Disputes Chamber, in accordance with the above regulation, is also in Dutch until the
parties.
33. The Disputes Chamber therefore rules that, in accordance with the case law of the
Marktenhof, the rights of defense had not been violated since the defendant
could defend itself in its own language, and the Litigation Chamber would also address the
parties in their chosen language. This is also evident from the fact that the letters
containing the deadlines for submissions received after the first objection of the
defendant about the language of the proceedings, by the Disputes Chamber in both languages
parties were transferred.
II.2. Identity of the complainant
34. The Disputes Chamber notes that the complaint was filed on behalf of a number of individuals
appointed professionals who were all represented by the same
counselor. The conclusion of reply dd. May 13, 2022 have been filed due to the
limited partnership Z of which the professionals who have the complaint
be a retired member.
35. The Disputes Chamber finds that comm.v. Z, on whose behalf the submissions of reply were made
filed, no party is involved.
II.3. Article 5 (1) (a) and (2) and Article 6 (1) GDPR.
36. In its conclusions, the defendant argues that a distinction must be made
between the free profiles on the one hand and the paying profiles on the other hand. The
Litigation Chamber will first assess the legality of the free profiles and
then the legality of the paying profiles.
II.3.1. Article 6(1)(f) GDPR (Free Profiles)
37. The Litigation Chamber recalls that pursuant to Article 5(1)(a) GDPR personal data
must be lawfully processed. This means that the processing must be done on
based on the processing grounds as set out in Article 6 GDPR.
38. The Inspectorate maintains that the defendant has fulfilled the obligations imposed by Article 5(1)
a) and has not complied with paragraph 2 of the GDPR and Article 6 of the GDPR. To this end, the
Inspectorate applies that the fact that personal data of certain data subjects such as
the Complainants are publicly accessible on certain professional websites, does not imply
that those data subjects can reasonably expect that those personal data
then by the defendant systematically and without their consent on a Substantive Decision 75/2023 - 8/26
large-scale manner be made available to anyone who accesses its website
used and processed further.
39. The defendant argues in its conclusions that it does not invoke the authorization for the
processing of the personal data, as this is organizationally difficult to achieve.
However, the defendant argues that the processing is lawful under Article 6(6).
1, f) GDPR (legitimate interest) with regard to the free profiles.
40. In order to be able to rely on the
legal basis of the “legitimate interest”, the
to demonstrate to the controller that:
1) the interests it pursues with the processing can be justified
be recognized (the “goal test”);
2) the intended processing is necessary for the fulfillment of these interests
(the “necessity test”); and
3) the balancing of these interests against the interests, fundamental
freedoms and fundamental rights of data subjects in favor of the
controller or a third party (the “balancing test”). 4
41. The Disputes Chamber will check whether these conditions have been met with regard to the
litigious processing.
(i) Is there a legitimate interest? (target key)
42. The first condition is that the defendant pursues the interests of itself or a third party
that qualify as justifiable. The interests must be on the date of processing
be real, current, and not hypothetical. A legitimate interest must
lawful, sufficiently clear, real and not speculative.
43. The defendant puts forward three different interests:
a. the interest of a third party (the potential patient): namely increasing the
access to health care for patients and their free choice
facilitating health care providers through the right to freedom of expression, viz
granting the opportunity to write reviews about the healthcare provider (in
the case of paying profiles) on the one hand, the possibility to take note
4 CJEU, 4 May 2017, Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde t. Rigas pašvaldības SIA
'Rīgas satiksme', C-13/16; ECLI:EU:C:2017:336, para. 28-31 and CJEU Judgment of 11 December 2019, TK v/ Asociaţia
deProprietariblocM5A-ScaraA,C-708/18,ECLI:EU:C:2019:1064,para. 40-44. See also previous decisions in the same way
of the Disputes Chamber, including 21/2022 of February 2, 2022.
5
Some questions about the legitimate interest are supposed to be answered by the Court of Justice of the
European Union in case C-621:22 (KoninkijkeNederlandse Lawn Tennisbond v. Autoriteit Persoonsgegevens.
6 CJEU, 11 December 2019, Asociația De Proprietari Bloc M5a-Scara A, C-708/18, ECLI:EU:C:2019:1064, para 44.
7 Opinion 06/2014 on the concept of “legitimate interests of the data controller” in Article
7 of Directive 95/46/EC, 9 April 2014, Article 29 Data Protection Working Party, p.31. Decision on the substance 75/2023 - 9/26
of these reviews on the other hand. As for the interest of the potential patient
the defendant argues that through the platform it enables patients to
easy to find and contact a healthcare professional
record with him/her by sharing not only useful, but even
necessary information. The defendant argues that this contributes to the law
of each patient to access health care, as well as his right to free
choice of the professional he wishes to consult, as guaranteed
by Article 6 of the Law of 22 August 2002 on the rights of
patients. Secondly, the platform also allows patients to express an opinion
sharing about the healthcare provider (with a paying profile). It justified
interest here is to implement Article 11 of the Charter of the
Fundamental rights of the European Union in conjunction with Articles 19 and 25 of the Constitution in which the
right to freedom of expression is guaranteed.
b. the interest of the data subjects (i.e. the healthcare professionals in the
healthcare), namely attracting new patients and creating
of appointments via the platform; and
c. the defendant's own economic interest, based on the freedom of
entrepreneurship.
44. With regard to this first condition, the Litigation Chamber is of the opinion that the platform
which is controlled by the defendant an interest of the controller,
the healthcare providers and a general interest of the patients of the platform.
45. First of all, the collection of data about healthcare providers can be regarded as
an expression of freedom of information under Article 11 of the Charter of the
fundamental rights of the EU (hereinafter: Charter), both in its active and passive
dimension, namely actively adding the data as well as consulting the
facts. In addition, there is also a social desirability of the platform.
Thanks to this platform, patients can make a more informed choice about their treatment
healthcare providers. The right of users to spread opinions is also one
fundamental right enshrined in Article 11 of the Charter.
46. Next, the interest of the data subject is to gain more visibility and
easy to find, also an interest that can be regarded as legitimate.
47. Finally, the operation of the platform also forms part of the provisions of Article 16 of the
Charter enshrined fundamental right of entrepreneurship of the
controller. In this case, the Litigation Chamber determines that the defendant
within the framework of the exercise of its commercial activities
interests. Decision on the substance 75/2023 - 10/26
48. In view of the above, the Litigation Chamber finds that the defendant meets the first
condition has been met a priori.
(ii) Is the processing necessary? (necessity test)
49. The Court of Justice has ruled on this, inter alia, in the TK judgment
condition of necessity:
“With regard to the second condition of Article 7(f) of Directive
95/46, namely that the processing of personal data must be necessary
for the protection of the legitimate interest, the Court recalled
brought that the exceptions to the protection of personal data and the
its limitations must remain within the limits of what is strictly necessary
(judgment of 4 May 2017, Rīgas satiksme, C‑13/16, EU:C:2017:336, paragraph 30 et seq.
cited case law).
In assessing this condition, the referring court must verify whether it
legitimate interest of the data processing that is pursued
with the video surveillance at issue in the main proceedings and which essentially consists of the
to ensure the safety of goods and persons and to prevent criminal offences
cannot reasonably be achieved as effectively with others
means that are less detrimental to fundamental freedoms and
rights of the data subjects, in particular the right to respect for the
private life and the right to protection of personal data as guaranteed
8
by Articles 7 and 8 of the Charter.”
50. The Court of Justice also notes that the condition relating to the necessity of
the processing, moreover, must be examined in conjunction with the principle of
'minimum data processing' laid down in Article 6(1)(c) of the Directive
95/46. According to that provision, personal data must be 'adequate, relevant
and are not excessive [...] in relation to the purposes for which they are collected or
for which they are subsequently processed”. 9 The Court of Justice has also
clarifies that if there are realistic and less invasive alternatives, the treatment
is not "necessary".
51. This case law formulated in relation to Article 7(e) of Directive 95/46/EC
remains relevant to this day. Article 6(1) of the GDPR takes over the wording from
Article 7 of Directive 95/46/EC.
8 CJEU, 11 December 2019, Asociația De Proprietari Bloc M5a-Scara A, C-708/18, C-708/18, ECLI:EU:C:2019:1064, para
46-47.
9
CJEU,11December2019,AsociațiaDeProprietariBlocM5a-ScaraA,C-708/18,C-708/18,ECLI:EU:C:2019:1064,para46.
10CJEU, 9 November 2010, Volker & Markus Schecke GbR and Hartmut Eifert v. Land Hessen, , merged affairs
C‑92/09 and C‑93/09, ECLI:EU:C:2010:662. Decision on the substance 75/2023 - 11/26
52. In this context, the defendant refers to the personal data stated on the platform
are exclusively professional and public data, which also apply to others
professional websites can be found. In addition, the defendant also has the
e-mail addresses of the complainants that are only used internally to be involved
inform the professional via the so-called performance mails. Finally, the
the defendant that there are several such professional websites that
association of professionals, such as the websites of the Order of Doctors or of the
Psychologists Committee.
53. The Litigation Chamber notes that the second condition also appears to be met,
since the surname, first name, specialty of the healthcare providers involved are necessary
to enable users of the website to contact them.
(iii) Balancing of Interests
54. Finally, the interests or fundamental rights of the data subject should not be overridden
outweigh the interests of the controller or the third party around them
to be able to successfully rely on Article 6 (1) (f) GDPR, which must always be assessed
in the light of the specific circumstances of the case. The Court of Justice
notes that the seriousness of the
infringement, nature of the personal data involved, the nature and concrete manner of
processing of the data concerned and the reasonable expectations of the data subject
that his personal data will not be processed if he has no reasonable need for further processing
12
processing can be expected.
55. As regards the balancing of interests, the defendant argues that only an absolute
minimum of professional data of the data subjects are processed, that these
personal data are not sensitive in nature and that these personal data are already public
available on the websites of third parties, or by some data subjects on their own
website. The defendant argues that it is within the reasonable expectations of the person concerned
falls that their personal data is processed by a platform such as that of the
defendant, in view of the fact that the complainants themselves are involved in the establishment of
such a platform. The defendant points out that the legitimate interest pursued by
its pursuit does not differ from the legitimate interest of similar ones
platforms. The defendant argues that its platform is more easily accessible to
the patients, since it is an easily navigable database in which care providers are selected
all kinds of specializations of the health sector are included.
11
CJEU, 11 December 2019, Asociația De Proprietari Bloc M5a-Scara A, C-708/18, ECLI:EU:C:2019:1064, para 56.
12 CJEU, 11 December 2019, Asociația De Proprietari Bloc M5a-Scara A, C-708/18, ECLI:EU:C:2019:1064, para 57 and 58 ;
Opinion 06/20214 on the concept of “legitimate interest of the data controller” in
article 7 of Directive 95/46/EC, 9 April 2014, Article 29 Data Protection Working Party, p. 50 et seq. can be consulted via
https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf. Decision on the substance 75/2023 - 12/26
56. The Disputes Chamber is of the opinion that there has been a serious breach of the
fundamental rights of data subjects. The defendant collects on a large scale – without
consent – personal data of tens of thousands of professionals in the
healthcare. This data is then published on the platform of the
defendant from which it derives commercial profits. As for the nature of the
contact details, the Disputes Chamber notes that these are indeed public
facts. The public nature of the personal data does not prevent the
processing continues to require appropriate safeguards. The fact that personal data for
being publicly available is a factor that can be taken into account in the assessment
especially if its disclosure was accompanied by a reasonable expectation
of further use of the data for certain purposes. 13In this context, the
Litigation Chamber that the disputed processing is not within the reasonable expectations of
the person falls. 14 The contact details of the professionals
published on their own website or that of their group practice or hospital, with their
consent to that processing. It is not within their reasonable expectation that this
data is further processed for other purposes, such as the publication of this
personal data by commercial parties (in this case based on commercial interest
of the defendant).
57. When balancing interests, the Litigation Chamber also takes into account the principle of
data minimization. In this context, the Disputes Chamber refers to the retention periods of
these personal data determined by the defendant. In the privacy policy states
the defendant the following:
“[The Respondent] will store the personal data it collects in electronic and/or
keep the printed form for the time absolutely necessary to comply with the
the aforementioned processing purposes and for as long as such retention becomes necessary
deemed for us to comply with our legal obligations or to comply with our legal obligations
defend interests in court.”
58. This wording allows the controller to process these personal data
indefinitely, and possibly even indefinitely. Considering it
The Disputes Chamber therefore concludes above that the processing is not in
proportionate to the goal.
59. The Litigation Chamber therefore also concludes that the service provided by the defendant exists
from the collection of personal data from public sources and the processing thereof
13Article 29 Working Party, Opinion 06/2014 on the “Notion of legitimate interests of the data controller under Article 7 of
Directive 95/46/EC, p.3, available at https://ec.europa.eu/justice/article-29/documentation/opinion-
recommendation/files/2014/wp217_en.pdf.
14 See also decision on the merits 84/2022 dd. May 24, 2022, available at
https://www.dataprotectionauthority.be/publications/besluit-ten-gronde-nr.-84-2022.pdf. Decision on the substance 75/2023 - 13/26
on its platform. For the collection and processing of that personal data, the
defendant did not ask for consent, although the consent was the most
constitutes an appropriate legal basis to the extent that the processed personal data relates
have on individual natural persons. The freedom of enterprise as recognized
in Article 16 of the Charter of Fundamental Rights of the European Union is not unlimited
and upholds where other fundamental rights – such as those protected in Article 8 of the Charter
right to protection of personal data – start. Consequently, the Litigation Chamber
considers that the interests raised by the defendant do not prevail over those of
The involved.
60. Under these circumstances, the Litigation Chamber is of the opinion that the defendant is not
can successfully invoke a legitimate interest. Consequently, there is one
infringement of Article 6 (1) f) GDPR with regard to the free profiles.
II.3.2. Article 6(1)(b) GDPR (paying profiles)
61. With regard to the paying profiles, the processing is lawful according to the defendant
based on Article 6(1)(b) GDPR (execution of a contract). The professionals
can choose to enter into an agreement with the
defendant. Within the framework of this agreement, these professionals can oppose
payment participate in the shaping of their profile on the platform by eg
adding a CV or by indicating which languages they speak. In addition, there are one
series of other benefits such as better visibility on the platform, a
management instrument to save time when making agreements, an instrument to
send appointment reminders, etc.
62. The Disputes Chamber finds that the complaint and the inspection report only concern
have on the processing of personal data in the context of free profiles
after all, concerns doctors who do not want to conclude such an agreement with the
defendant. The Disputes Chamber will therefore not proceed to the assessment of the
lawfulness of the data processing in the context of the paying profiles.
II.4. Article 12(1),(2) and (3), Article 17, Article 19, Article 24(1) and Article 25(1)
AVG
63. Article 12 (1) GDPR stipulates that the controller must take appropriate measures
must take in order for the data subject to receive the information in connection with the processing in a
concise, transparent, intelligible and easily accessible form and in clear and
simple task. Article 12 of the GDPR regulates the way in which the data subjects receive their
be able to exercise rights and stipulates that the controller shall exercise them
of those rights by the data subject (Article 12(2) of the GDPR), and him
without delayin any eventwithin one monthafterreceiptoftherequestinformationDecision on the substance 75/2023 - 14/26
give information about the measures taken in response to his request (Article 12, par
3 GDPR).
64. A data subject should have the right to request the erasure of his or her personal data
if they are processed in violation of the GDPR. Article 17 (1) GDPR sums up
a number of cases in which the data subject has the right to without unreasonable
delay in having his personal data deleted by the
controller, such as in the situation where personal data is unlawful
have been processed.
65. Article 24 GDPR requires the controller, taking into account the
nature, scope, context and purpose of the processing, appropriate technical and
takes organizational measures to ensure and be able to demonstrate that the
processing is carried out in accordance with this Regulation.
66. Article 5(2) and Article 24 GDPR impose general accountability obligations and
compliance requirements to data controllers. More specifically, these require
provisions of controllers that they take appropriate measures to
prevent any violations of the rules of the GDPR in order to protect the right to
to ensure data protection.
67. Finally, Article 19 GDPR stipulates that the controller must inform each recipient
to whom personal data has been disclosed, of any deletion of
personal data in accordance with Article 17 (1) of the GDPR, unless this proves impossible
or disproportionate effort.
II.4.1. Findings in the Inspection Report
68. The Inspectorate finds that there is a violation of the above articles and refers
to the following elements:
a. the defendant did not provide the Inspectorate with any supporting documents
how the request to remove the complainants was answered;
b. the defendant did not provide any supporting documents to the Inspectorate
that on January 14, 2022, the necessary steps were effectively taken to reduce the
delete personal data of the complainants;
c. the defendant did not provide any supporting documents to the Inspectorate
that it was effectively unable to comply with the request for removal of the complainants
was sent by registered mail. Decision on the substance 75/2023 - 15/26
II.4.2. Defendant's position
69. The defendant disputes this finding and maintains, in essence, that it is indeed an effect
has given to the complainants' data erasure request on 14 January 2022. Om
to begin with, the defendant points out that it only became aware of it on 13 January 2022
of the data erasure request of the complainants. The registered letter dd. 25
October 2021 addressed to the registered office and delivered there on October 26
2021 was not received by (an employee of) the defendant. The
the defendant's business manager, to whom the letter was addressed, has it
receipt not signed. In this context, the defendant argues that in Belgium
that was currently in a lockdown period with mandatory homework, so that the employees
and the defendant's business manager could not receive the registered letter
to take. The defendant therefore argues that the actual knowledge of the request for
data erasure took place on January 13, 2022 and that it was being implemented
given to that request on January 14, 2022. The defendant puts forward various claims in this regard
documents, such as a statement from the employee who provided the personal data
has removed. In addition, the defendant also takes screenshots of the internal
management platform which states that on January 14, 2022, this data has the status “removed from
[defendant]".
70. The defendant further states that there is a memorandum in the intern with regard to almost all complainants
management platform is included reminding that she will not be in touch again
with the relevant professional. In this respect, the defendant refers to the
Guidelines 5/2019 “on the criteria for the right to be forgotten in the
search engine matters under the GDPR”. 15 To the extent that one can the defendant
consider it a search engine for healthcare professionals, can
a request addressed to it can also be regarded as a request for delisting, whereby
complete deletion of data does not take place and the search engine is therefore useful
can give to the request of the complainants never to be contacted again. The
the defendant states that, pursuant to the conclusions of the reply dd. May 13, 2022, also this note
has removed and provides evidence to this effect. This results in the defendant
can no longer guarantee that the complainants will never be contacted again, because,
now that this information no longer exists, they can no longer know that the practitioner is in
issue has requested never to be contacted again.
71. Next, the defendant argues that it cannot be criticized for not having the
has taken the necessary technical and organizational measures, in view of the
15EDPB, Guidelines 5/2019 on the criteria for the right to be forgotten in the search engine business
pursuant to the GDPR, dd. July 7, 2020, available at
https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201905_rtbfsearchengines_afterpublicconsultation
_nl.pdf. Decision on the substance 75/2023 - 16/26
notification system to the Google search engine that the defendant has integrated into
its internal management platform. This notification procedure is triggered as soon as a
employee processes the request for data erasure on the management platform. The
actual removal by the search engine (of the search results related
to the) personal data is normally done after 15 days, depending on the
priorities/capacities of the search engine, this may take longer in certain cases. It
the fact that the results can still be found on Google is due to a reactivity problem
with Google itself and not with the defendant.
72. Finally, the defendant claims that it has not fulfilled the obligations arising from Article 12(1)(2)
and paragraph 3 GDPR has complied. She actually has the request for data erasure
received on January 13, 2022, it complied with it on January 14, 2022 and it
informed those involved on 7 February 2022. The same applies
for the additional request to delete the internal note mentioned above. This one has
received by the defendant through the conclusions of the reply dd. May 13, 2022, she has this
implemented on May 17, 2022 and on May 23, 2022, it advised the lawyer of the
concerned are hereby informed. In this context, the defendant notes that the list
of those involved in the complaint was more limited in number than the letter dd. October 25, 2021. Op
May 13, 2022, via the statement of defense, the defendant learned that in the registered
write dd. October 25, 2021, 5 other professionals were also mentioned
of which it had not yet deleted the data. The defendant has in good faith
always complied with all requests for data erasure that it has received.
73. In a secondary order, the defendant argues that there is no error, nor
negligence. After all, the complainants themselves decided to cancel their request by email during the lockdown period
send by registered mail. However, the defendant sends to the
professionals whose e-mail address she has, a performance mail in which she
are informed about the statistics of their profile, and through this mail they also receive
access to their profile where they can change or delete their data
to ask. The relevant healthcare practitioner can use a button at the bottom of the performance mail
unsubscribe from the emails. A request for data erasure can also be sent
to the e-mail address mentioned above in the privacy policy. The defendant argues
therefore more efficient and reliable options were available to the complainants,
thenonly a request by registered letter.The reference to decision 74/2020of
the Disputes Chamber by the Inspectorate is therefore incorrect, since the defendant
offers data subjects various options for exercising their rights.
74. Only after receipt of the letter from the Inspection Service dated 13 January 2022 in the building where
its offices are located, the defendant was able to take note of the registered letter
dd. October 25, 2021 after finding it in a pile of advertising mail. The letter was there Decision on the substance 75/2023 - 17/26
apparently deposited by a third party, a neighbor or the postman himself, and the
the defendant cannot be held liable.
75. Finally, the defendant argues that it was under no obligation to comply with the
request for data erasure, since none of the cases from Article 17, paragraph 1a)-d) GDPRop
apply in this case. In addition, Article 17(3)(a) GDPR provides for an exception
to the right to data erasure insofar as the processing is necessary for the right to freedom
of expression and information.
II.4.3. Review by the Litigation Chamber
76. In section II.3, the Litigation Chamber has determined that the personal data of the complainants
were processed unlawfully with regard to the free profiles. The defendant served
therefore pursuant to Article 17 (1) (d) GDPR to delete the personal data, if
that was requested.
77. Based on the above, the controller must make an arrangement
to enable data subjects to exercise their rights easily and simply
to practice. A controller is not allowed any unnecessary thresholds
raise for data subjects to exercise the aforementioned rights. When a
controller has a policy that prevents the exercise of the said
interferes with rights and actively propagates this policy, there may be
violation of article 12, second paragraph, of the GDPR.
78. Recital 59 of the GDPR further clarifies the standard in Article 12 of the GDPR:
“There should be arrangements in place to enable the person concerned to exercise his rights
under this Regulation, such as mechanisms to
request, in particular, access to and rectification or erasure of
personal data and, if applicable, to obtain it free of charge, as well as to
to exercise the right to object. [...]”
79. In view of the above, the Disputes Chamber concludes that the defendant indeed
provides variousopportunitiestoperformtherighttodatawipe.Hereby
the Disputes Chamber notes that the possibility to delete the data via the
profile implies that the data subjects should make use of the unlawful
createdprofiletodeletethisprofile,whichcannotbetheintention. The same
can be said about the unsubscribe button in the performance mails. The defendant points
Please note that the data erasure request can also be sent to the email address
stated in the privacy policy. However, it is more difficult to receive an e-mail
check. The Litigation Chamber points out that the defendant writes in its privacy policy
that data subjects can exercise their rights by writing to the mentioned e-mail
e-mail address or the stated postal address. Consequently, the data subjects must also be able to use Decision on the substance 75/2023 - 18/26
making a registered letter, whether or not with acknowledgment of receipt, since this
is a very common means of official and formal communication and those involved
guarantees that it will be received by the recipient.
80. The defendant argues that the registered letter was sent during a
lockdown period during which the employees and the manager worked at home. The
Litigation Chamber notes that teleworking was strongly recommended in the period October 2021,
and not mandatory. The defendant was therefore not unable to organize itself
to perform certain activities, such as tracking mail. The Dispute Room
finds that the defendant has not taken the appropriate measures for the right to
facilitate data erasure of the data subject, which constitutes a violation of Article 12, paragraph
2 GDPR.
81. Due to the lack of facilitation of the exercise of the right to
erasure, the right to erasure was not exercised in time,
in accordance with Article 12 (3) GDPR. The Litigation Chamber finds that this non-compliance
is the result of inadequate facilitation of the exercise of the rights, and that the
the defendant soon after receipt of the letter from the Inspectorate dated. January 13, 2022
acted as well as for subsequent requests soon after becoming aware of them
has.
82. The Inspectorate also finds a violation of Article 19 GDPR, but justifies this
determination not. Nor does she submit documents in this regard. The Dispute Room
therefore considers this infringement to be unproven.
83. In view of the above, the Disputes Chamber concludes that there has been an infringement
to Article 12 (2) GDPR.
II.5. Sanctions and corrective measures
II.5.1. General
84. On the basis of the documents in the file, the Disputes Chamber establishes that there is
following infringements:
a. Article 5, paragraph 1, a) j° Article 6, paragraph 1, f) with regard to the lawfulness of the
processing of personal data; and
b. Article 12 (2) GDPR j° Article 17 (1) GDPR for not taking the appropriate
measures to facilitate the exercise of their rights by data subjects.
16https://www.info-coronavirus.be/nl/news/occ-2610/. Decision on the substance 75/2023 - 19/26
85. Pursuant to Article 100 of the WOG, the Disputes Chamber has the authority to:
1° to dismiss a complaint;
2° to order the exclusion of prosecution;
3° to order a suspension of the judgment;
4° propose a settlement;
5° formulate warnings and reprimands;
6° to order that the data subject's requests to exercise his rights be complied with
to practice;
7° order that the data subject be informed of the security problem;
8° order that the processing be temporarily or permanently frozen, restricted or prohibited;
9° order that the processing be brought into compliance;
10° rectification, restriction or deletion of data and notification
to recommend it to the recipients of the data;
11° to order the withdrawal of the accreditation of certification bodies;
12° to impose penalty payments;
13° to impose administrative fines;
14° the suspension of cross-border data flows to another State or
to recommend an international institution;
15° transfer the file to the prosecutor's office of the public prosecutor in Brussels, who
informs it of the follow-up given to the file;
16° decide on a case-by-case basis to publish its decisions on the website of
the Data Protection Authority.
II.5.2. Established infringement of Article 5(1)(a) j° Article 6(1)(f) and Article 12(2)
GDPR in conjunction with Article 17 (1) GDPR.
II.5.2.1. Administrative fine
86. In accordance with Article 101 WOG, the Disputes Chamber decides an administrative one
impose a fine on the defendant for the following infringements:
o Article 5, paragraph 1, a) j° Article 6, paragraph 1, f) with regard to the lawfulness of the
processing of personal data; and
o Article 12 (2) GDPR j° Article 17 (1) GDPR for not taking the appropriate
measures to facilitate the exercise of their rights by data subjects.
87. For a violation of Articles 5 and 6 of the AVG, the Disputes Chamber can, on the basis of
Article 83, fifth paragraph, a) GDPR Not to impose an administrative fine up to EUR 20,000,000 or for
a company up to 4% of the total worldwide annual turnover in the previous financial year, Decision on the substance 75/2023 - 20/26
if this number is higher. A violation of the aforementioned provisions therefore gives
in accordance with Article 83 (5) GDPR gives rise to the highest fines.
88. For a violation of Article 17 GDPR, the Disputes Chamber can, on the basis of Article 83, paragraph
5, b) AVG Also impose an administrative fine up to an amount of 20,000.00
EURorforacompanyupto4%ofthetotalworldwideannualturnoverintheprevious
fiscal year if that figure is higher.
89. The Disputes Chamber considers it appropriate to impose an administrative fine
amount of EUR 10,000 (article 83, paragraph 2, article 100, §1, 13°WO and article 101WOG).
fine is imposed for both the infringement of Article 5(1)(a) j° Article 6(1)(f) GDPR and
the infringement of Article 12 (2) GDPR and Article 17 (1) GDPR.
90. It should be pointed out in this context that the administrative fine does not matter
aims to end unified transgression, but requires a strong enforcement of
the rules of the GDPR. After all, as can be seen from recital 148 GDPR, the GDPR states
First of all, in the event of any serious infringement – including the first finding of an infringement –
penalties, including administrative fines, in addition to or instead of appropriate ones
17
measures are imposed. The Disputes Chamber then demonstrates that the infringements that
the defendant has committed on the aforementioned provisions of the GDPR by no means minor
infringements, nor that the fine would impose a disproportionate burden on a
natural person as referred to in recital 148 GDPR, where in either case
a fine may be waived. The fact that it is an initial determination of a
the defendant committed an infringement of the GDPR, does not affect this in any way
to the possibility for the Disputes Chamber to make an administrative decision
impose a fine. The Disputes Chamber will impose the administrative fine
application of Article 58(2)(i) GDPR. The instrument of administrative fine has
in no way intended to terminate infringements. To this end, the GDPR and the WOG provide for a
number of corrective measures, including the orders referred to in Article 100, §1, 8° and 9°
WOG.
17
Recital 148 provides: “In order to strengthen enforcement of the rules of this Regulation, penalties should be
including administrative fines, to be imposed for any breach of the Regulation, in addition to or instead
of appropriate measures imposed by the supervisory authorities pursuant to this Regulation
it concerns a minor infringement or if the expected fine would place a disproportionate burden on a
natural person, a reprimand can be chosen instead of a fine. However, it must be taken into account
be taken into account the nature, seriousness and duration of the infringement, the intentional nature of the infringement, with
harm reduction measures, with the degree of responsibility, or with previous relevant infringements, with the manner
on which the breach has come to the knowledge of the supervisory authority, with compliance with the measures that
were taken against the controller or processor, with adherence to a code of conduct and with
any other aggravating or mitigating factors. Imposing punishments, including administrative ones
fines, should be subject to appropriate procedural safeguards in accordance with the general principles of
Union law and the Charter, including effective remedy and due process. Decision on the substance 75/2023 - 21/26
91. In determining this amount, the Litigation Chamber bases itself on the 2021 annual report
which was deposited with the national bank on 8 July 2022 showing that the turnover was 605,865
amounts to EUR. The amount roughly corresponds to 4% of this annual turnover.
92. Taking into account Article 83 GDPR, the case law of the Marktenhof, as well as
the criteria set out in the EDPB guidelines on the calculation of the
19
administrative fines, the Litigation Chamber motivates the imposition of a
administrative fine in concrete terms, taking into account the following when assessing
elements:
Severity of the violation (Article 83(2)(a) GDPR)
93. The Litigation Chamber has established that, with regard to the free profiles,
personal data of tens of thousands of professionals throughout Belgium
collected and processed without lawful basis. The defendant cannot
successfully invoke Article 6 (1) (f) GDPR (legitimate interest) as they do not
meets the conditions as developed by the European Court of Justice
Union. The defendant collects data from various types of sources without this
within the reasonable expectation of the healthcare professionals involved. Although the
interests pursued by the defendant are legitimate, and the
processed personal data are limited to what is necessary to the litigious
processing, they do not prevail over those of the data subjects.
The number of data subjects (Article 83 paragraph 2, a) GDPR)
It involves tens of thousands of healthcare professionals, geographically
spread throughout Belgium.
Negligent or intentional nature of the breach (Article 83(2)(b) GDPR)
94. As to whether the infringement was intentional or negligent
was committed (article 83.2.b) of the GDPR), the Litigation Chamber reminds that "not
intentionally” means that it was not the intention to commit the infringement, although the
the controller had not complied with the duty of care pursuant to
the law rested upon him. In this case, the Disputes Chamber rules that the infringement is not of
is intentional in nature, because the defendant has indeed made an analysis in order to
determine which legal basis would be most appropriate in the present case. There is consequently
no - apparent - intention to violate the GDPR on the part of the defendant. This turns out
among other things from the argument of the defendant in which it argues that the applicability
of consent as a legal basis (Article 6(1)(a) GDPR) was examined for the
18Brussels Court of Appeal (Marktenhof section), X t. GBA, Judgment 2020/1471 of 19 February 2020
19Guidelines 04/2022 on the calculation of administrative fines under the GDPR, 12 Mon 2022 (version for public
consultation). Decision on the substance 75/2023 - 22/26
intended processing, but was found to be less suitable. In this context, the
Litigation Chamber, however, notes that the defendant has the contact details of the
data subjects – because they were collected to be placed on the platform
places – and that, as described in this decision, there is no doubt that
consentis the only proper legal basis for this processing
simply asked. After all, the defendant could use one
standard requestwith limited individualization as the case may be.TheLitigation Chamber
therefore considers that the infringement was committed through negligence.
The duration of the breach (Article 83(2)(a) GDPR)
95. The Litigation Chamber also refers to the duration of the infringement, namely since 25 May 2018
to date as it has not yet been terminated. This means that it is long-term
and structural violation of a basic principle (lawfulness) of the GDPR.
Aggravating circumstance (Article 83(2)(k) GDPR)
96. The Litigation Chamber also takes into account the fact that the defendant made a profit that
arises from the unlawful processing as an aggravating circumstance.
Mitigating circumstance (Article 83(2)(k) GDPR)
97. The Litigation Chamber also takes into account the fact that the defendant has never before
was the subject of an enforcement procedure of the DPA (article 83, paragraph 2, e) GDPR).
98. The Litigation Chamber notes that the defendant has swiftly implemented the
right to erasure as soon as it has become aware of the request in question
of the data subject. With regard to the inadequate facilitation of the right to
data erasure of the complainants, the Disputes Chamber is of the opinion that no additional
fine must be imposed.
The categories of personal data affected by the breach (Article 83(2)
g) GDPR
As far as the contact details of the data subjects are concerned, these are public
personal data and no personal data of a special nature.
Conclusion
99. The whole of the elements set out above justifies an effective,
proportionate and dissuasive sanction as referred to in art. 83 GDPR, taking into account the
certain assessment criteria. The Litigation Chamber points out that the other criteria
of art. 83.2. AVG in this case are not of a nature that they lead to another administrative
fine than that which the Disputes Chamber has in the context of this decision
established. Decision on the substance 75/2023 - 23/26
100. In summary, the defendant argues in its response to the sanction form that:
(i) the seriousness of the offense cannot be deduced from the possibility of it
providing reviews on free profiles, as that option does not exist;
(ii) the number of people involved cannot be taken into consideration when determining
the fine, as the fulfillment of the interests pursued by the defendant
requires the largest possible number of data subjects and the Litigation Chamber recognizes this
the interests pursued are justified
(iii) the duration of the alleged infringement cannot be taken into consideration
the determination of the fine, now that the defendant could reasonably assume at all times
that there was no infringement, in view of authoritative foreign case law with
relating to an identical situation;
(iv) the defendant cannot be accused of negligence as it chose not to provide data
processing on the basis of consent, not because this is practically impossible
would be, but because an analysis showed that the legitimate interests of a
provided a more appropriate basis for the purposes of the intended processing;
(v) the processing of data by the defendant never reached the stated 'large
negative consequences' can have (and has never had) for those involved
(financial and reputational damage), which the Disputes Chamber deduces from the
review option of profiles, since this option does not exist for the
(free) profiles of those involved;
(vi) the personal data in the reviews has no potential financial consequences for the
data subjects may have since these reviews do not exist on their free
profiles.
101. The elements from the sanction form used by the Litigation Chamber
additional considerations are discussed below.
102. As the defendant notes in the sanction form, the review option is indeed
not present for the free profiles. This aspect is therefore no longer included in the
the Litigation Chamber's consideration of the seriousness of the breach and its potential consequences
of the data subjects in the context of the consideration of the administrative fine.
103. As for the argument that the number of people involved should not be taken into account
the Disputes Chamber notes that the interest pursued is indeed a broad one
possible database required. As already explained, the target test is only one of the three
conditions for a successful appeal to Article 6 (1) f) GDPR. The illegitimate
processing therefore concerns a large number of persons. Decision on the substance 75/2023 - 24/26
104. As to the argument that the duration of
the infringement and its negligent nature, the defendant refers to German case law
whereby a platform similar to that of the defendant was considered to be in
comply with the GDPR. The Litigation Chamber takes note of this, but
also refers to a previous decision dated 24 May 2022 on its website regarding a
similar referral website. The Disputes Chamber ruled in this decision
that such processing does not fulfill the conditions for a successful appeal
to Article 6(1)(f) GDPR. The Disputes Chamber takes account of the relatively recent developments
character of this decision.
105. On the basis of all the elements set out above, the
Litigation Chamber to adjust proposed sanction from EUR 20,000 to EUR 10,000.
The established infringements warrant an effective, proportionate and dissuasive
sanction as referred to in Article 83 GDPR, taking into account the provisions therein
assessment criteria. The Disputes Chamber is of the opinion that a lower fine in the
the present case would not meet the requirement of Article 83(1) of the GDPR
criteria, according to which the administrative fine is not only proportionate, but also
must be effective and deterrent.
II.5.2.2. Stop order
106. Pursuant to Article 100, paragraph 1, 8° and 9° WOG, the Litigation Chamber also orders
to the defendant to terminate the violation of article 5, paragraph 1 j ° article 6, paragraph 1, f) GDPR
and keep it terminated. The defendant can comply with this by processing
personal data of healthcare professionals with regard to the
to terminate free profiles on its platform or by, for example, consent,
in accordance with Article 4, 11) of the GDPR to be obtained from the data subjects for the
processing of personal data.
II.5.3. Other grievances
107. The Litigation Chamber proceeds to a deposit of the other grievances and findings of the
Inspectorate because, based on the facts and the documents in the file, they do not belong to the
conclude that there has been a breach of the GDPR. These grievances and
findings of the Inspectorate are therefore regarded as manifestly unfounded
within the meaning of Art. 57(4) GDPR.
20 Substance decision 84/2022 of 24 May 2022, which can be consulted at
https://www.dataprotectionauthority.be/publications/besluit-ten-gronde-nr.-84-2022.pdf.
21 See point 3.A.2 of the Dispute Policy of the Litigation Chamber, dd. June 18, 2021, available at
https://www.dataprotectionauthority.be/publications/sepotpolicy-van-de-geschillenkamer.pdf Decision on the merits 75/2023 - 25/26
III. Publication of the decision
108. Given the importance of transparency with regard to decision-making by the
Litigation Chamber, this decision will be published on the website of the
Data Protection Authority. However, it is not necessary for the
identification data of the parties are disclosed directly.
FOR THESE REASONS,
the Disputes Chamber of the Data Protection Authority decides, after deliberation, to:
- pursuant to Article 58, paragraph 2 GDPR and Article 100, §1; 13° WOG an administrative one
to impose a fine of EUR 10,000 for the infringement of Article 5, paragraph 1, a) j° Article 6,
paragraph 1, f) GDPR and the violation of Article 12, paragraph 2 in conjunction with Article 17, paragraph 1 GDPR;
- on the basis of Article 100, §1, 8° and 9° WOG order the violation of Article 5, paragraph 1,
a) j° terminate and keep terminated in Article 6 (1) f) GDPR, and then in a
provide a valid legal basis for the processing of the personal data;
- to dismiss the other grievances pursuant to Article 100, §1, 1° WOG.
Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the
notification against this decision may be appealed to the Marktenhof (court of
Brussels appeal), with the Data Protection Authority as defendant.
Such an appeal may be made by means of an inter partes petition
listed in Article 1034ter of the Judicial Code and must contain .The 22
a contradictory petition must be submitted to the Registry of the Market Court
22 The petition states, under penalty of nullity:
1° the day, month and year;
2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
enterprise number;
3° the surname, first name, place of residence and, if applicable, the capacity of the person to be
summoned;
4° the object and brief summary of the means of the claim;
5° the court before which the action is brought;
6° the signature of the applicant or his lawyer. Decision on the substance 75/2023 - 26/26
23
in accordance with article 1034quinquies of the Ger.W. , or via the e-Deposit
IT system of Justice (Article 32ter of the Ger.W.).
(get). Hielke HIJMANS
Chairman of the Litigation Chamber
23 The application with its annex is sent, in as many copies as there are parties involved, by registered letter
sent to the clerk of the court or deposited at the clerk's office.
