APD/GBA (Belgium) - 137/2023: Difference between revisions
From GDPRhub
mNo edit summary |
|||
| Line 67: | Line 67: | ||
}} | }} | ||
The Belgian DPA held that | The Belgian DPA held that a data processing agreement cannot be applied retroactively, as this would allow for the circumvention of [[Article 28 GDPR#3|Article 28(3)]] GDPR. Moreover, the DPA clarified that both the controller and processor are responsible for concluding the data processing agreement. | ||
== English Summary == | == English Summary == | ||
Latest revision as of 11:38, 11 October 2023
| APD/GBA - 137/2023 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 12(1) GDPR Article 14 GDPR Article 14(5)(c) GDPR Article 28(1) GDPR Article 28(3) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 04.09.2020 |
| Decided: | 29.10.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 137/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | French |
| Original Source: | Autorité de protection des données (in FR) |
| Initial Contributor: | Enzo Marquet |
The Belgian DPA held that a data processing agreement cannot be applied retroactively, as this would allow for the circumvention of Article 28(3) GDPR. Moreover, the DPA clarified that both the controller and processor are responsible for concluding the data processing agreement.
English Summary
Facts
On 20 May 2020 the data subject received a parking fine from a municipality, the controller, for a parking violation.
On 6 July 2020, the data subject requested evidence of the parking violation in question and received several photographs of their vehicle. They also sought information on how their personal data was being processed and wanted to obtain the agreement concluded between the municipality (the controller) and a third-party service (the processor) used in the establishment and collection of the fee requested from them. Following their request, the data subject found that there was no data processing agreement in place at the time of the events.
On 4 September 2020, the data subject submitted a complaint against both controller and processor for violation of Article 28(3) GDPR, which obliges controllers to implement a data processing agreement. On 20 November 2020, the DPA opened an investigation and transmitted the case to the Inspection Service (SI). On 11 May 2021, the SI's investigation was closed, and the case was transferred back to the DPA. The SI found that the processing contract between the controller and the processor was only entered into on 27 July 2020. The investigation found that at the time of processing of the data subject's data, no contract existed.
However, the contract of 27 July 2020 included a retroactivity clause.
Holding
The Belgian DPA found a violation of Articles 28, 14 and 12 GDPR.
The Belgian DPA noted that Article 28(1) GDPR mandates a processor to provide sufficient guarantees to protect the rights of data subjects. Article 28(3) GDPR obliges controllers to implement a data processing agreement. The DPA held that including a retro-activity clause in the agreement does not remedy the absence of the contract at the time of the event. Such an admission would allow for the circumvention of the application of the obligations of Article 28(3) GDPR which aims to ensure the protection of the rights and freedoms of the data subjects. The DPA concluded that both the controller, as well the processor, were responsible for ensuring that a data processing agreement was timely put into place.
The DPA also found violations for lack of transparency under Article 12(1) GDPR and Article 14 GDPR, as the controller had failed to fulfill the informational obligations under Article 14 GDPR. The municipality argued that the exception under Article 14(5)(c) GDPR applied to it. The municipality cited the law of 22 February 1965, which permits municipalities to set parking charges to motor vehicles, and the Order of 22 January 2009 relating to the enforcement of parking charges. The DPA rejected this, noting that exceptions must be interpreted restrictively. The legislation cited by the municipality did not contain any exceptions to disclosure obligations. As such, the DPA held that the legislation invoked by the municipality was insufficiently concrete. The DPA added that even if the exemption were to apply, the controller was still required to inform the data subject about sources and recipients of their personal data unless legally prohibited.
As such, both the municipality and third-party were reprimanded for breach of Article 28(3) GDPR, and the municipality was reprimanded for violations of Article 14 GDPR and Article 12(1) GDPR for failure to take appropriate measures to fully inform the data subject.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/16
ChamberLitigation
Decision on merits 137/2023 of September 29, 2023
File number: DOS-2020-04511
Subject: Complaint relating to the absence of a subcontracting contract (article 28.3. of the GDPR)
and the absence of sufficient information by a public authority (article 14 of the GDPR)
The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke
Hijmans, president, and gentlemen Romain Robert and Christophe Boeraeve, members;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the
protection of natural persons with regard to the processing of personal data and
to the free movement of these data, and repealing Directive 95/46/EC (General Regulation on the
data protection), hereinafter “GDPR”;
Having regard to the Law of December 3, 2017 establishing the Data Protection Authority (hereinafter
ACL);
Considering the internal regulations as approved by the House of Representatives on 20
December 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Has taken the following decision regarding:
The complainant: Mr.
The defendants: Municipality Y1, hereinafter: “the first defendant”;
The company Y2, represented by Maître Louis Leurquin, lawyer, whose
firm is established avenue Brugmann, 435 à 1180 Brussels (Uccle), hereinafter:
“the second defendant”;
Hereinafter referred to together as “the Defendants”. Decision on merits 137/2023 – 2/16
I. Facts and procedure
1. On September 4, 2020, the complainant lodged a complaint with the Protection Authority
data (APD) against the defendants.
2. The subject of his complaint concerns, on the one hand, the absence of a subcontracting contract between the
first and second defendants in relation to the processing of the complainant's data
as well as, on the other hand, the manner in which the complainant's data were processed within the framework
of the establishment and collection by the first defendant of a royalty
parking due by the complainant.
3. The facts giving rise to the complaint can be summarized as follows.
4. The plaintiff states that he received a royalty from the first defendant for a
parking dated May 20, 2020 on the Place (...). This parking fee
was sent to his home and includes his first and last name, his address and the license plate
registration of his vehicle.
5. On July 6, 2020, the complainant contacted the Tax department of the first
defendant to obtain proof of the parking violation attributed to him.
In response, the complainant was sent several photographs of his vehicle. He has
then questioned the said Tax department of the first respondent on the manner in which
the personal data concerning him were processed within the framework of
the establishment and collection of the fee claimed from him.
6. Informed in response that the first defendant would use the services of third parties, including
second defendant, the plaintiff requested to obtain the agreement concluded with this
last. It is, by the first defendant’s own admission, proven that the subcontract
contract which was to link it to the second defendant did not exist at the time of the facts
concerning the complainant.
7. The Litigation Chamber mentions here from the outset that it was on July 27, 2020 that a
“Personal data processing agreement” (CTDCP) was signed between
the defendants. Article 2 of this CTDCP defines the role of each party. The second
defendant is described there as a computer engineering company which develops and
markets software, which manages IT infrastructures and provides its expertise
intended for both public and private clients. As part of its activities, it may be
required to carry out processing of personal data belonging to its
client such as the first defendant in this case, particularly in the context of the exercise of
its installation, support and/or maintenance and hosting activities. The contract
continues by indicating that in the context of the treatments carried out, the second defendant Decision on the merits 137/2023 – 3/16
acts as a subcontractor while its client, the first defendant in
the species, acts as controller.
8. On October 23, 2020, the complaint was declared admissible by the First Line Service (SPL)
of the ODA on the basis of articles 58 and 60 of the LCA and the complaint is transmitted to the Chamber
Litigation under article 62, § 1 of the LCA.
9. On November 20, 2020, in accordance with article 96, § 1 of LCA, the request of the Chamber
Contentious to carry out an investigation is transmitted to the Inspection Service (IS).
10. On May 11, 2021, the IS investigation was closed, the report was attached to the file and it was
transmitted by the Inspector General to the President of the Litigation Chamber (art. 91, § 1 and § er
2 of the LCA).
11. This inspection report makes the following findings:
has. Violation of article 28.3. of the GDPR by the first defendant: the SI establishes that
the subcontracting contract between the first defendant in its capacity as
data controller and the second defendant in its capacity as sub-processor
contract was concluded on July 27, 2020. The SI therefore notes that at the time of the
facts denounced and the processing of the complainant's data within the framework of
the establishment and collection of the parking fee for May 20, 2020,
such a contract did not exist, in violation of article 28.3 of the GDPR. The SI adds
that the retroactivity clause contained in said subcontracting contract cannot be
prejudice the rights of third parties, in particular those of the complainant.
b. Violation of articles 12.1 and 14 of the GDPR by the first defendant: the IS establishes
that the exemption from information provided for in (article 14.5. c) of the GDPR invoked by the
first defendant cannot be accepted in this case. In support of the Lines
guidelines on transparency of the European Committee for the Protection of
data (EDPS), the SI concludes that the texts 2 invoked by the first
defendant, if they establish the lawfulness of the processing, do not require it to obtain (or
to receive communication) of the data that it processes within the framework of the
collection of the royalty in question and above all, do not contain
1
European Data Protection Board (EDPS), Guidelines on transparency under the UIE Regulation)
2016/679 of April 11, 2018. These guidelines adopted by Group 29 (WP 260) were adopted by the
EDPS during its inaugural session on May 25, 2018: https://ec.europa.eu/newsroom/article29/items/622227.
2The first defendant invokes the following texts: article 6 of the royal decree of July 20, 2001 relating to
the registration of vehicles which provides that the investigation and criminal prosecution of crimes, misdemeanors and contraventions are
the purposes for which which personal data in the directory may be processed; the law
of February 22, 1065 allowing municipalities to establish parking fees applicable to vehicles
engine ; the fee regulation relating to its municipal parking policy voted by the Municipal Council on the date
of [….] which allows parking fees to be established when a vehicle does not comply with the relevant legislation and
the order of January 22, 2019 (chapter VII) – parking fees and monitoring of compliance with the rules of
parking. Decision on merits 137/2023 – 4/16
appropriate measures to protect the legitimate interests of the person
concerned as required by article 14.5.c) of the GDPR in order to be mobilized.
The SI notes that the first defendant also invokes the AF deliberation
23/2013 of July 25, 2013 of the Federal Authority Sector Committee (CSAF) of the 3
Commission for the Protection of Private Life (CPVP) providing single authorization and
amending with regard to private concessionaires of municipalities
Brussels, the autonomous Brussels municipal rules and the Brussels Agency
parking of the Brussels-Capital Region deliberation AF 12/2009
bearing a single authorization for access to the DIV directory for purposes
identification of persons who are debtors, due to the use of a
vehicle, of remuneration, which according to it retains its validity in accordance with
section 111 of the LCA. The SI notes that this deliberation specifically requires
provide information to the person concerned via the website
of the data controller as well as on payment requests. The IS
notes that such information is neither provided on the website of the first
defendant nor on the payment requests sent (2nd reminder). The IS
also points out that the fact of the first respondent being authorized to
access the DIV (Vehicle Registration Department - directory of
vehicles) does not exempt it from the information obligation.
er
12. On July 9, 2021, the Litigation Chamber decides, under Article 95, § 1, 1° and
article 98 of the LCA, that the file can be processed on its merits.
13. On the same date, the parties are informed by registered mail of the provisions such
as set out in article 95, § 2 and article 98 of the LCA. They are also informed, in
under section 99 of the LCA, deadlines for transmitting their conclusions. The deadline
for receipt of submissions in response from the defendants was set for September 6
2021, that for the conclusions in the complainant's reply as of September 28, 2021 and that for
the defendants' reply submissions as of October 20, 2021.
14. Still under the terms of this letter of July 9, 2021, the Litigation Chamber specifies that
the first respondent is invited to put forward its arguments in light of the findings
carried out in his regard by the IS. In addition, she invites him to put forward his arguments with regard to the
compliance with articles 5.2. and 24 of the GDPR as soon as a proven breach of one or the other
3The Commission for the Protection of Private Life (CPVP) was the Belgian data protection authority within the meaning of the article
28 of Directive 95/46/EC. The Data Protection Authority (DPA) succeeded it on May 25, 2018 in execution
of article 3 of the LCA.
4
Article 36bis of the LVP provided that any electronic communication of personal data by a public service
federal or by a public body with legal personality which comes under the federal authority requires authorization from
principle of the CSAF unless the communication has already been the subject of authorization in principle from another committee
sector created within the CPVP. The mission of the CSAF is to check whether the communication complies with the provisions
legal and regulatory. Decision on merits 137/2023 – 5/16
of articles 28, 12.1 and/or 14 of the GDPR retained by the IS is likely to constitute, by
as a result, a breach of these provisions (articles 5.2. and 24 of the GDPR) consecrating
the principle of accountability.
15. At the start of the complaint filed by the complainant (which also denounces a potential
breach of its obligations arising from the GDPR by the second defendant – see point
1), the Litigation Chamber also invites the latter to present its arguments to the
with regard to article 28 of the GDPR and the obligation to supervise its relationship with the
first defendant by a subcontracting contract compliant with article 28.3. of the GDPR.
16. On September 2, 2021, the Litigation Chamber receives the conclusions in response from the
first defendant:
- As for the complaint based on a violation of article 28.3. of the GDPR, the first defendant
does not deny that there was in fact no contract or other legal act linking it to the
second defendant at the time of the facts giving rise to the complaint. The first one
defendant, however, emphasizes that this contract - the signature of which had not been judged
priority, particularly in the absence of high risk for the people concerned and
given the context of the covid 19 pandemic requiring priority - a
was concluded on July 27, 2020 and that the situation is now regularized, including
for the past, taking into account the retroactivity clause to May 25, 2018 provided for by
article 3 of the said contract (article 3).
- As for the complaint based on a violation of articles 12.1 and 14 of the GDPR, the first
defendant declares, based on the conclusions of the SI on this point, to take note of
what article 14.5. c) of the GDPR would not apply and indicates having modified its
website by adding a text containing the elements of information required by
article 14 of the GDPR and adapted payment request letters within the framework of
parking fees by adding an informative clause.
17. On September 3, 2021, the second defendant notified the Litigation Chamber that she
refers and adheres to the arguments developed by the first defendant in its
conclusions in response of September 2, 2021 (point 16), which conclusions can be
considered to be filed in his name and on his behalf as well.
18. On September 4, 2021, the Litigation Chamber receives the conclusions in response to the
complainant:
- The complainant welcomes the fact that the first defendant recognizes the breaches
what to blame her for while doubting her good faith when she invokes “the excuse
too easy” according to him of the epidemic of the covid 19 virus to explain his delay in
signing of a subcontracting contract. It notes in this regard that the GDPR was in Decision on the merits 137/2023 – 6/16
in force since May 25, 2016, i.e. even before the award of the public contract by the
first respondent to the second respondent in late 2016.
- The plaintiff also points out that the first defendant minimizes the data
personal information which it communicates to the second defendant. Only the plate
registration of offenders would be sent to him while the IS report
mentions that other personal data concerning him (such as
photographs of his vehicle) are also communicated. Generally speaking, the
complainant denounces the lack of exemplarity and transparency of the first
defendant as a public administration.
- Finally, the complainant wishes to be made aware of the harm he has suffered as a result of his non-
respect for personal data both morally and financially
evaluating its shortfall at €1,500.00 ex aequo et bono with regard to time and
energy devoted to this matter.
19. On September 30, 2021, the Litigation Chamber receives the conclusions in response to the
first defendant. As for the compensation claimed by the plaintiff for damage suffered,
the first defendant argues that the plaintiff's data was not used to
purposes not provided for by law and that he cannot have suffered damage due to improper use
of these. It also emphasizes that public authorities are exempt from
administrative fines.
20. Also on September 30, the Litigation Chamber received a final reaction from the
complainant. This reaction is submitted out of time, the complainant having already had the opportunity to
conclude (point 18) and the last word goes to the defendants. The complainant insists
in particular on the fact that the fee could only be established through communication
contrary to the GDPR of data concerning him which, from his point of view, invalidates the
royalty as such. He also recalls that if the public authorities are
exempt from administrative fines, non-pecuniary administrative sanctions
may be imposed on them as well as criminal sanctions. The complainant finally recalls his
claim for compensation.
II. Motivation
II.1. As for the breach of article 28.3. of the GDPR by the first and second
defendants
21. Article 28.1. of the GDPR provides that when processing must be carried out on behalf
of a data controller, the latter only uses subcontractors who
present sufficient guarantees regarding the implementation of technical measures and Decision on the merits 137/2023 – 7/16
appropriate organizational measures to ensure that the processing meets the requirements of the
GDPR and guarantees the protection of the rights of the data subject.
22. Pursuant to article 28.3. of the GDPR, such processing must be governed by a contract or by
another legal act under Union law or the law of a Member State, which binds the
subcontractor with regard to the controller, defines the purpose and duration of the processing,
the nature and purpose of the processing, the type of personal data and the
categories of data subjects as well as the obligations and rights of the person responsible
of treatment. This contract or other legal act must also provide in particular for
burden of the subcontractor the series of obligations listed in letters a) to h) of article 28.3.
of the GDPR.
23. In this case, the Litigation Chamber characterizes the first defendant as “responsible for
processing” within the meaning of Article 4.7. of the GDPR. It is the entity that defines the purposes and
means of the processing complained of (i.e. the processing of personal data
relating to the complainant for the purposes of establishing and collecting a payment fee
parking), as part of the exercise of a competence which has been legally granted to him
entrusted. This characterization is not contested by the defendants.
24. The Litigation Chamber qualifies the second defendant as a “subcontractor” within the meaning of
Article 4.8. of the GDPR in that it acts on instructions from the defendant. This
qualification is also not contested by the defendants.
25. The Litigation Chamber decides that both the first and second defendants
were required to conclude a subcontracting contract or to bind themselves by an act
legally binding regarding the exercise of the subcontracting mission that they
had established between them, in accordance with article 28.3. of the GDPR.
26. The Litigation Chamber endorses in this regard the position of the EDPS according to which “being
given that the Regulation establishes a clear obligation to conclude a written contract,
where no other relevant legal act is in force, its absence constitutes a
GDPR violation. Both the controller and the processor are responsible for
ensure that a contract or other legal act governs the processing. Subject to
provisions of Article 83 of the GDPR, the competent supervisory authority will be able to
5European Data Protection Committee (EDPS), Guidelines 07/2020 concerning the notions of responsibility
of processing and subcontractor in the GDPR, version 2.0. from July 7, 2021 https://edpb.europa.eu/system/files/2022-
02/eppb_guidelines_202007_controllerprocessor_final_fr.pdf
6It is the Litigation Chamber which underlines. Article 28, paragraph 3, does not apply only to those responsible for
treatment. When only the subcontractor is covered by the territorial scope of the GDPR (article 3), the obligation
is only directly applicable to the subcontractor. See. also in this sense the Guidelines 3/2018 of the Committee
European Data Protection Authority (EDPS) relating to the territorial scope of the GDPR, p. 12.
https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_3_2018_territorial_scope_fr.pdf. Decision on merits 137/2023 – 8/16
to impose an administrative fine on both the controller and the subcontractor,
taking into account the circumstances specific to each situation. 7
27. In other words, the obligation to conclude a contract or to be bound by a legal act
binding weighs both on the data controller (here the first defendant) and
on the subcontractor (hereinafter the second defendant) and not on the sole person responsible for
treatment. This is particularly important when, as is the case in this case, a
subcontractor offers its specialized services to a large number of managers
separate treatments. It would not comply with the GDPR (nor with the reality on the ground)
to consider that the initiative for concluding the contract (and its proposed content) does not
should only come from the data controller.
28. In the present case, the first and second defendants do not dispute that the contract of
subcontracting which was to bind them did not exist at the time of the facts reported. This contract has
was concluded on July 27, 2020, i.e. on a date subsequent to these facts and the processing of
subsequent data which, as a reminder, finds its origin in a parking lot at 20
May 2020. In the explanations she gave to try to justify this signature
late (point 16), the first defendant (followed by the second defendant – point 17)
indicates that at the time of the award of the public contract to the second defendant by a
deliberation at the end of 2016, the GDPR did not yet exist. On this point, the Contention Chamber
reminds the defendants that in reality, the GDPR was in force since May 25, 2016
(article 99.1. of the GDPR), i.e. for more than 6 months already at the time of the deliberation
award of the contract mentioned by the first defendant. Consequently, from
the award of the public contract by the first defendant to the second defendant, these
The latter had to comply with the GDPR and therefore sign as quickly as possible and
in any event, no later than May 24, 2018, a subcontracting contract in accordance with
Article 28.3. of the GDPR. The legislator had in fact expressly provided for a period
transitional period of 2 years to enable compliance with the GDPR, including the
regard to pre-existing situations following the application of the GDPR but which would persist beyond
this one.
29. With the SI (point 10), the Litigation Chamber is of the opinion that the retroactivity clause
provided for by the contract of July 27, 2020 is not likely to compensate for the absence of a contract in
time of the facts. If such retroactivity were to be admitted, it would de facto allow
circumvent the application over time of the obligation of article 28.3 of the GDPR which weighs thus
that it was developed in points 26 and 27 above, both on the data controller and
on the subcontractor. However, as has just been explained in point 28, the GDPR itself has provided
a period of 2 years separating its entry into force from its entry into force for implementation
in progressive compliance by all entities concerned (article 99 of the GDPR).
7It is the Litigation Chamber which underlines. Decision on merits 137/2023 – 9/16
The obligation to conclude such a contract is also intended to clearly distribute the
responsibilities of each of the defendants in their respective capacity as responsible for
processing on the one hand and the subcontractor on the other. As highlighted in recital 79 of
GDPR, this obligation also pursues the objective of guaranteeing the protection of rights and
freedoms of the persons concerned including the data which will be processed within the framework
of the relationship that the data controller chooses to create between them (here the
first defendant) and the subcontractor (here the second defendant) are thus
protected. This absence of protection - while it is required by the GDPR - cannot be
covered by a contractual retroactivity clause agreed solely by the
defendants in disregard of the rights of the persons concerned - who are not parties to the
contract – enshrined in a standard, of European rank in addition.
30. In light of the above, the Litigation Chamber concludes that both the first and the second
The second defendants were guilty of a breach of Article 28.3. of
GDPR. For all useful purposes, the Litigation Chamber specifies that it is empowered to retain a
breach of this provision by the second respondent notwithstanding the absence of
breach pointed out in the head of the latter by the IS and this, in execution of its
own skills. The second defendant implicated under the terms of the complaint
filed (point 1) was also invited to defend itself with regard to this breach in
respect for the contradictory debate (point 15) and does not deny the absence of a contract at the time
facts.
31. The defendants also claim that in any event, they respected the
obligations arising from the Law of December 8, 1992 relating to the protection of private life
with regard to data processing (LVP) previously applicable (article 16 devoted to
9
obligations of the subcontractor) and that taking into account other emergencies particularly linked to the
covid-19 virus pandemic, compliance with the GDPR has not been seen
as a priority from 2018 given the few risks incurred by the taxpayer in the
context concerned. The defendants also argue that the rights of the plaintiff have
always been respected, even before the conclusion of the contract on July 27, 2020 and that the
data concerning him have not been used for purposes other than those related to the royalty
parking.
8The LCA does not require the Litigation Chamber to use the Inspection Service. Indeed, the Litigation Chamber
decides sovereignly whether, following the filing of a complaint, an investigation is necessary or not (article 63.2° of the LCA and
art. 94, 1° of the LCA). In this sense, article 94, 3° LCA explicitly provides that once seized, the Litigation Chamber may
process the complaint without resorting to the Inspection Service. It thus has a power of appreciation of the complaint which is
independent of the inspection (Cour des Marches (19th ch. A), December 7, 2022, 2022/AR/560 and 2022/AR/564; Court of
markets (19th ch. A), December 7, 2022, 2022/AR/556).
9It should be noted that the obligations of the subcontractor were very limited compared to the requirements required by article
28 of the GDPR. Article 16 of the LVP was in fact limited to providing that the subcontractor could only act on instructions from the
data controller and must present sufficient guarantees to ensure the security of the processing which it
were subcontracted. Decision on merits 137/2023 – 10/16
32. For the Litigation Chamber, the circumstances invoked by the defendants -
even if they prove to be true, they are not likely to eliminate the existence of a failure in
their boss. They could, however, at most be taken into account by the Chamber
Contentious in the assessment of the appropriate sanction with regard to all of the
circumstances of the case.
II.2. As for the breach of article 12.1. and 14 of the GDPR by the first defendant
33. The Litigation Chamber takes note of what the first defendant has now
provided for information reflecting the elements required in execution of article 14 of the GDPR to
destination of the persons concerned on its website on the one hand and has also
committed to providing information to the persons concerned when sending requests
payment of royalties on the other hand.
34. The Litigation Chamber nevertheless concludes that for the past, the first
defendant was guilty of a breach of articles 12.1 and 14 of the GDPR in
not providing adequate information for the attention of the persons concerned. There
In this regard, the Litigation Chamber shares the analysis of the SI which rules out the applicability of
Article 14.5.c) of the GDPR.
35. Under the terms of this article 14.5.c), the data controller is exempt from his obligation
information when and to the extent that “obtaining or communicating information
information is expressly provided for by Union or Member State law
to which the controller is subject and which provides for appropriate measures
aimed at protecting the legitimate interests of the data subject.
36. The Litigation Chamber notes a difference in language between the French version and, by
example, the Dutch and English versions of this provision. Indeed, while the
French version of article 14.5.c) of the GDPR mentions “when and to the extent that
obtaining or communicating information is expressly provided for by law
of the Union or the Member State", the Dutch and English versions of the text retain
respectively the following terms: “wanneer en voor zover het verkrijgen de verstrekken
van de gegevens uitdrukkelijk is voorgeschreven bij Unierecht of lidstaatelijk recht” and “
where and insofar obtaining or disclosure is expressly laid down by Union or Member State
law”. (read: obtaining or disclosure of data in accordance with the terms of recital 62).
The Litigation Chamber is of the opinion that it is indeed the obtaining and communication of
data which must be provided for by national law (or, where applicable, by Union law
European) and notwithstanding the terms of the French version of article 14.5.c) of the GDPR.
37. What is provided for in article 14.5. c) of the GDPR constitutes an exception to the right to information.
Failing to be informed that data processing concerning it is being carried out, the Decision on the merits 137/2023 – 11/16
data subject is deprived of information which is in principle spontaneously available to him
provided by the data controller and which facilitates the exercise of his other rights including
it is also informed of the existence and methods of exercise through this means (article
13.2 b), c) and d) and 14.2 c), d) and e) of the GDPR).
38. This exemption must be interpreted restrictively since it constitutes a
exception to the information obligation provided for by the fundamental right to the protection of
data and the corollary information obligation imposed on the data controller.
It also deprives, as already mentioned, the person concerned of information on
the existence and methods of exercising their other rights which are, for their part, not
subject to the same exception “in the event of obtaining or communication expressly provided for
by the law”. As an example, the right of access (article 15 of the GDPR) - which in turn opens the way
to exercise other rights such as the right to rectification, opposition or even erasure
– does not know this exception (article 15.4. of the GDPR).
39. The ratio legis of this exception in Article 14.5.c) of the GDPR is based on the fact that the
national legislation would require the obtaining or communication of said data. He imports
provided that this legislation is particularly clear and complies with the qualities that must
adopt any data protection legislation and that this
obtaining/communication is binding on the data controller which he must
be able to demonstrate. Said legislation must also provide for appropriate measures to
guarantee the legitimate interests of the data subject.
40. The Litigation Chamber adds that finally, the obligation to obtain or communicate
of said data must, in order to trigger the exception of article 14.5.c) of the GDPR,
logically cover all the data which would have been processed by the person responsible for
processing which would invoke exemption from information.
41. The SI report notes that the first defendant relies on the following texts:
has. Article 6 of the royal decree of July 20, 2001 relating to vehicle registration
which provides that the search and criminal prosecution of crimes, misdemeanors and
contraventions are the purposes for which personal data
from the DIV directory (Directorate of Vehicle Registration) can make
the subject of treatment.
The Litigation Chamber notes that this provision specifies the purposes of the DIV
consultation of which is authorized for the benefit of the first defendant for
these purposes, including that of establishing the fee.
b. The law of February 22, 1965 allowing municipalities to establish royalties
parking applicable to motor vehicles. Decision on merits 137/2023 – 12/16
Here too the Litigation Chamber notes that this is a text which allows the
first respondent to establish the parking fee. When examining the
text, the Litigation Chamber notes that article 2 of the legislation provides that “
for the collection of remunerations, taxes or royalties from
parking referred to in Article 1, the towns and municipalities and their
concessionaires and autonomous municipal authorities are authorized to request
identity of the holder of the number of the registration mark to the responsible authority
of vehicle registration, in accordance with the law on the protection of
private life ". The text thus provides the right for municipalities such as the first
defendant to consult the DIV for the purposes of establishing the fee.
vs. The fee regulation relating to the municipal parking policy voted by
the municipal council dated […] which makes it possible to establish the royalties of
parking when a vehicle does not comply with the relevant legislation.
Upon analysis of this text communicated by the first defendant SI, the Chamber
Litigation notes (i) that it organizes the modalities according to which the
parking is regulated, subdivided (paid zone, blue zone etc.) and according to what rate,
(ii) that it details the terms of amicable recovery and amicable complaint
as well as (iii) the terms of forced recovery and recourse against the procedure
forced recovery. The text further details the exemption cards
existing.
The Litigation Chamber, however, does not identify any provision which specifies
what data the first defendant would be required to obtain in the context
of the establishment and collection of a parking fee.
d. The order of January 22, 2009 10 – chapter VII – royalties
parking and monitoring compliance with parking rules. The text
organizes the parking policy in the Brussels-Capital region, creates
the Parking Agency, sets the amount of fees and addresses the issue
of the control and collection of these royalties as well as their cost for the
municipalities etc.
Here too, the Litigation Chamber does not identify any provision relating to
the compulsory obtaining/communication of data including the first defendant
could rely on it to found the exemption from information that it invoked.
10Read the Order of January 22, 2009 on the organization of parking policy and creation of the Parking Agency
parking lot of the Brussels-Capital Region, M.B., January 30, 2009. Decision on the merits 137/2023 – 13/16
42. In support of the above, the Litigation Chamber concludes that if we understand that the
first respondent certainly needs certain data to establish a fee
parking and collect it (and be authorized to consult a source such as theDIV at
this effect), the texts that it invokes in support of its competence do not provide for obtaining
or mandatory communication of the data it has processed in this case (including
photographs). As the SI also points out, none of these texts provides for
additional appropriate measures intended to protect the interests of individuals
concerned in this context where no information would therefore be provided to them in the sense
proactive that the GDPR gives to this obligation. Consequently, the Litigation Chamber
notes that the conditions for application of article 14.5.c) of the GDPR are not met and
that the first defendant was, therefore, not authorized to invoke this exception.
43. In this sense, the deliberation of the CSAF to which the first respondent refers enjoined
to inform the people concerned, which the first defendant failed to do
TO DO.
44. Finally, for cases where the data controller would be entitled to rely on article
14.5.c of the GDPR, the Litigation Chamber recalls as highlighted by the EDPS in its
Transparency guidelines already cited, this exemption does not require them
less than “the controller should clearly notify individuals
concerned that it obtains or communicates personal data in accordance with
the right in question, unless there is a legal prohibition preventing it from doing so. This
This provision complies with recital 41 of the GDPR, which provides that a legal basis or
a legislative measure should be clear and precise and its application should be
foreseeable for litigants, in accordance with the case law of the Court of Justice of
the European Union and the European Court of Human Rights”. This obligation
is in line with that which the data controller has to identify - in execution
of articles 13.1.c) and 14.1.c) of the GDPR - the legal bases of its processing and this,
prior to their operationalization. In this regard, it is not enough to indicate that
data processing will take place in execution of a legal obligation or to refer
purely and simply to the application of article 6.1. c) of the DPR. It is the responsibility of the person responsible
of processing to identify the relevant legislation which underlies the processing it carries out.
45. In conclusion, the Litigation Chamber notes a breach of Article 14 of the GDPR
on the part of the first defendant combined with a breach of article 12.1 of the
GDPR. Indeed, failing to provide the information listed in Article 14 of the GDPR
to the persons concerned, the first respondent also fails to comply with this provision
which requires the data controller to take appropriate measures to provide
any information referred to in Articles 13 and 14 in a concise, transparent,
understandable and easily accessible, in clear and simple terms. Decision on merits 137/2023 – 14/16
II.3. As for corrective measures and sanctions
46. Under the terms of article 100 of the LCA, the Litigation Chamber has the power to:
1° close the complaint without further action;
2° order the dismissal of the case;
3° pronounce a suspension of the sentence;
4° propose a transaction;
5° issue warnings or reprimands;
6° order to comply with the requests of the person concerned to exercise their rights;
7° order that the person concerned be informed of the security problem;
8° order the freezing, limitation or temporary or definitive ban on processing;
9° order compliance of the processing;
10° order the rectification, restriction or erasure of data and notification of
these to the recipients of the data;
11° order the withdrawal of the accreditation of certification bodies;
12° give fines;
13° issue administrative fines;
14° order the suspension of cross-border data flows to another State or a
international body;
15° transmit the file to the public prosecutor of the King of Brussels, who informs him of the
follow-up given to the file;
16° decide on a case-by-case basis to publish its decisions on the website of the Authority of
Data protection.
47. It is important to contextualize the failings of which each of the defendants committed
made responsible in order to identify the most corrective measures and/or sanctions
adapted.
48. The Litigation Chamber wishes to point out that it is sovereignly its responsibility
independent administrative authority - in compliance with the relevant articles of the GDPR and
of the LCA - to determine the corrective measure(s) and/or sanction(s)
appropriate(s) with regard to all the circumstances of the file. Thus, it does not belong
for the complainant to ask the Litigation Chamber to order this or that measure
corrective or sanction (exemplary) and even less that it takes measures which do not
would not appear among those that the Litigation Chamber is authorized to impose. If,
notwithstanding the above, the complainant had to make such a request, it is not the responsibility
not for the Contentious Chamber to justify why it would not retain one or the other
request thus formulated by the complainant. These considerations leave the obligation intact
for the Litigation Chamber to provide reasons for the choice of measure and/or sanction for which Decision on the merits 137/2023 – 15/16
judge, (among the list of measures and sanctions made available to him by articles 58 of the
RGPD and 95.1 and 100.1 of the LCA) appropriate to condemn the party(ies) involved.
49. Still in this regard, the Litigation Chamber specifies that it does not have jurisdiction to
grant damages or compensation for possible harm suffered or to
invalidate a parking fee. These skills are not provided for by the article
58 of the aforementioned GDPR nor by article 100.1. of the LCA cited above. The imposition of such
Measures are reserved, if necessary, to the competent courts and tribunals.
50. In view of the failings noted on the part of the first respondent in the
Articles 28.3. (point 30), 14 and 12.1. of the GDPR (point 45) in its capacity as a public authority, the
Litigation Chamber decides that the reprimand constitutes the appropriate sanction.
51. The Contentious Chamber also notes that it emerges from the recognition of the facts by the
first defendant, the signing of a subcontracting contract in July 2020 and
commitments made in terms of information to the people concerned, that the first
The defendant took stock of the breaches denounced in articles 28.3., 14 and 12.1. of
GDPR already mentioned.
52. Concerning the second defendant, the Litigation Chamber also decides to
send a reprimand with regard to the breach noted in article 28.3 of the GDPR (point
30) in his head as well. Considering all the circumstances of the case, this
In the eyes of the Litigation Chamber, this measure constitutes the appropriate sanction for the
past breach noted.
III. Publication of the decision
53. Given the importance of transparency regarding the decision-making process of the Chamber
Contentious, this decision is published on the APD website. However, it is not
not necessary for this purpose that the identification data of the parties be directly
mentioned. Decision on merits 137/2023 – 16/16
FOR THESE REASONS,
the Litigation Chamber of the Data Protection Authority decides, after deliberation:
- Under article 100.5° of the LCA, to send a reprimand to the first
defendant for breaches of articles 28.3, 14 and 12.1. of the GDPR.
- Under article 100.5° of the LCA, to send a reprimand to the second
defendant for the breach of article 28.3. GDPR
In accordance with article 108, § 1 of the LCA, an appeal against this decision may be lodged,
within thirty days from its notification, to the Court of Markets (court
of Appeal of Brussels), with the Data Protection Authority (DPA) as a party
defendant.
Such an appeal may be introduced by means of an interlocutory request which must contain the
information listed in article 1034ter of the Judicial Code. The interlocutory request must be
12
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , Or
via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. judic.).
(sé). Hielke H IJMANS
President of the Litigation Chamber
11The request contains barely any nullity:
1° indication of the day, month and year;
2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualifications and his national register number or
Business Number;
3° the surname, first name, address and, where applicable, the status of the person to be summoned;
4° the object and summary of the grounds of the request;
5° indication of the judge who is seized of the request;
6° the signature of the applicant or his lawyer.
12
The request, accompanied by its annex, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court registry.
