APD/GBA (Belgium) - 69/2024

APD/GBA - 69/2024
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 95 of the Act of 3 December 2017 establishing the Data Protection Authority
Type:	Complaint
Outcome:	Upheld
Started:	28.03.2024
Decided:	02.05.2024
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	69/2024
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Dutch
Original Source:	APD/GBA (in NL)
Initial Contributor:	nzm

The DPA dismissed a complaint considering that the measures taken by the controller, namely informing the DPA and the data subject of the breach of personal data and taking action to prevent a similar breach in the future, rendered any further corrective measures unnecessary.

English Summary

Facts

The data subject sent an email to the controller complaining about the fact that one of their employees, which was his ex-girlfriend, had consulted his personal data several times in the past year and a half. The employee admitted this to the controller.

The data subject inquired about the measures taken against the employee. The controller responded that the employee consulted the data subject's data without professional context nor mandate, and that 'necessary and proportionate' measures were taken against her. The controller also indicated that the breach was reported to the Belgian DPA ('GBA').

He replied that he lodged a complaint with the police as he felt morally harmed and was distressed that he could be stalked any longer given that the controller allegedly failed to take sufficient measures to prevent it. He also stated that he would complain with the GBA.

Holding

The GBA explained that when it dismisses a complaint, it must give reasons for doing so. The dismissal can be of two sorts: (i) a ‘technical dismissal’ if the case file contains no or insufficient elements that could lead to a conviction or (ii) a ‘policy dismissal’ if, despite the presence of elements that could lead to a sanction, the continuation of the examination of the complaint does not seem appropriate in the light of the priorities of the DPA.

In the present case, the GBA adopted a ‘policy dismissal’ , and justified this position with two reasons. First, the DPA considered that the subject of the complaint disappeared as a result of the measures taken by the controller. The GBA stated that the controller alerted the DPA on the possible breach of personal data of the data subject by an employee. The controller also informed the data subject of this breach and stated that the necessary and proportionate measures would be taken to avoid this breach in the future. Therefore, the DPA considered that there were no elements to indicate that the breach had not stopped and that the measures taken would not have been sufficient to prevent a similar breach in the future.

Second, the GBA held that the complaint seems to be a supplement to a broader dispute that should be resolved before the courts of appeal. Indeed, the data subject filed a complaint with the police stating that he no longer wanted to be stalked. The DPA noted that stalking is criminalized under the Belgian Criminal Code. Therefore, the DPA found that this does not fall under its jurisdiction, nor is it competent to assess any moral damage from a breach. The GBA also took into account the fact that the complaint was lodged with the police before it was lodged with the DPA.

Hence, the GBA dismissed the complaint.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

1/6



                                                                          Dispute Chamber


                                                      Decision 69/2024 of May 2, 2024


File number: DOS-2024-01292


Subject: Your complaint regarding a breach of your confidentiality

personal data



The Disputes Chamber of the Data Protection Authority, composed of Mr

Hielke HIJMANS, sole chairman;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

on the protection of natural persons with regard to the processing of

personal data and regarding the free movement of such data and to the revocation of

Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”;


Having regard to the law of 3 December 2017 establishing the Data Protection Authority,
hereinafter “WOG”;


In view of the internal rules of order, as approved by the House of Representatives

Representatives on December 20, 2018 and published in the Belgian Official Gazette on

January 15, 2019;


Considering the documents in the file;


Has made the following decision regarding:



Complainant: X, hereinafter “the complainant”;


The defendant: La banque Y, hereinafter “the defendant”. Decision 69/2024 — 2/6


I. Facts and procedure


 1. The subject of the complaint concerns an alleged breach of confidentiality

      personal data of the complainant that are processed by the defendant.

 2. On March 7, 2024, the complainant filed a complaint with the GBA. The complaint concerns an infringement

      the confidentiality of the complainant's personal data by an employee of the

      defendant.

               On February 8, 2024, the complainant sent an email to the defendant to complain

               about an employee who would use the complainant's personal data several times

               have been consulted in the last 1.5 years. The employee was due to do so in December

               2023 have been addressed by the defendant and the consultations of the
               admitted personal data. The complainant inquired about the

               measures taken against this employee, who has also been the ex-girlfriend of 1.5 years

               complainant were struck by the defendant.


               On February 16, 2024, the complainant contacted the defendant again
               inquire about the measures taken against the employee, because

               he had been told that these measures were far from sufficient.


               On February 17, 2024, the complainant filed a complaint with the police, of which the PV is responsible
               attached in the documents. The complainant stated that he felt morally damaged and

               to be concerned that the defendant could no longer be stalked

               would have taken sufficient measures to prevent this.

               On February 28, 2024, the defendant responded to the complaint. She confirmed that the

               employee consulted the complainant's data “without a professional context

               and without a mandate”. “Necessary and proportionate measures” were taken

               taken against the employee. The defendant also reported that the infringement

               was reported to the Data Protection Authority.

               On March 4, 2024, the complainant responded to the communication by email

               defendant with the message that he did not consider the measures proportionate and that

               in the meantime he had filed a complaint with the police against the employee. He asked

               also that he would file a complaint with the ombudsman and with the
               Data Protection Authority.


 3. On March 28, 2024, the complaint was declared admissible by the First Line Service on the grounds

      of Articles 58 and 60 WOG and the complaint is filed on the basis of Article 62, § 1 WOG
      transferred to the Disputes Chamber. Decision 69/2024 — 3/6



II. Justification


 4. On the basis of the elements in the file that are known to the Disputes Chamber, and on the basis

       of the powers granted to it by the legislature on the basis of Article 95, § 1 WOG

       assigned, the Disputes Chamber will decide on the further follow-up of the file; in this case

       the Disputes Chamber will dismiss the complaint in accordance with Article 95,

       § 1, 3° WOG, based on the following justification.


 5. If a complaint is dismissed, the Disputes Chamber will make its decision
                                 1
       to motivate gradually and:

            - to issue a technical dismissal if the file does not exist or is insufficient

                contains elements that could lead to a conviction, or if there is insufficient

                there is a prospect of a conviction due to a technical obstacle,

                which prevents her from reaching a decision;


            - or declare a policy rejection, if despite the presence of elements

                that could lead to a sanction, the continuation of the investigation

                dossier does not seem appropriate in the light of the priorities of the

                Data Protection Authority, as specified and explained in the

                dismissal policy of the Disputes Chamber. 2


 6. In the event of dismissal on more than one ground, the grounds for dismissal (resp.
                                                                                               3
       technical dismissal and policy dismissal) should be treated in order of importance.

 7. In the present file, the Disputes Chamber will dismiss the complaint,

       on the basis of an expediency dismissal. There are two motives underlying the decision

       decision of the Disputes Chamber as to why it considers it undesirable to take further action

       to the file and therefore decides not to proceed with, inter alia, a hearing at

       ground


 8. Firstly, the subject of the complaint appears to have disappeared as a result of the measures taken

       were taken by the controller. 4


       The complaint of February 8, 2024, addressed to the defendant, seems to have been brought to her attention

       have on the possible violation of the confidentiality of the personal data of






1Court of Appeal Brussels, Market Court Section, 19 Chamber A, Chamber for Market Affairs, judgment 2020/AR/329, September 2, 2020,
p. 18.

2In this context, the Disputes Chamber refers to its dismissal policy as explained in detail on the GBA website:
https://www.gegevensbeschermingsautoriteit.be/publications/sepotbeleid-van-de-geschikkamer.pdf
3 Cf. Title 3 – In which cases is my complaint likely to be dismissed by the Disputes Chamber? from the

dismissal policy of the Disputes Chamber.
4Cf. criterion B.6 in the dismissal policy of the Disputes Chamber. Decision 69/2024 — 4/6


      the complainant by an employee. This means that the defendant is the employee

      who allegedly admitted the violation.


      On February 28, 2024, the defendant informed the complainant of this

      violation of the confidentiality of personal data and of the necessary and

      proportionate measures that would have been taken to avoid this violation in the

      future. The defendant has also submitted a data breach notification
      to the Data Protection Authority.


 9. The Disputes Chamber has no elements that could indicate that the violation

      of the confidentiality of the complainant's personal data would not have stopped and

      that the defendant's measures would not have been sufficient to prevent a

      to prevent similar violations in the future. Without the importance of it forward

      want to minimize the incident, the Disputes Chamber rules that a
      treatment on the merits does not seem appropriate.


 10. Secondly, the complaint is a secondary dispute in a broader dispute that must be settled

      for courts and tribunals. 5

      Following the alleged facts, the complainant filed a complaint on February 17, 2024

      submitted to the police, the report of which was added to the documents. In this complaint

      the complainant declares that he no longer wants to be stalked and that he feels morally damaged.


      Stalking, which is the legal term under attack, is made punishable in Article 442bis of
                        6
      the Criminal Code, which does not fall within the powers of the Disputes Chamber. The

      Disputes Chamber is also not authorized to assess any moral damage suffered by a party
      assess data protection breach.


      Given the interpersonal context of the complaint, given the complaint filed with

      the police before a complaint was filed with the Data Protection Authority and seen

      the Disputes Chamber does not appear to have jurisdiction over various elements of the main dispute

      a treatment on the merits of this breach of confidentiality

      personal data by the Disputes Chamber is also not appropriate.


III. Publication and communication of the decision


 11. Considering the importance of transparency with regard to decision-making

      Dispute Chamber, this decision will be published on the website of the






5Cf. criterion B.3 in the dismissal policy of the Disputes Chamber.
6Article 442bis SW: “He who has harassed a person while he knew or should have known that his behavior caused him to rest in peace
would seriously disturb that person, shall be punished with imprisonment of fifteen days to two years and with
fine of fifty [euros] to three hundred [euros] or one of those penalties alone. […]” Decision 69/2024 — 6/6


 in accordance with Article 1034quinquies of the Dutch Civil Code. , or via the e-Deposit information system

 of the Ministry of Justice (Article 32ter of the Ger.W.).


To enable the complainant to consider other possible remedies, the
                                                                 11
Disputes Chamber will refer the complainant to the explanation in its dismissal policy.

[The Dispute Chamber emphasizes that the closure of cases by the

Data Protection Authority may be taken into account for its future

determine priorities and/or may give rise to future investigations on its own initiative


by the Inspection Service of the Data Protection Authority].






 (get). Hielke IJMANS


 Chairman of the Disputes Chamber















































1The petition with its attachment will be sent by registered letter, in as many copies as there are parties involved
deposited with the clerk of the court or at the registry.

1Cf. Title 4 – What can I do if my complaint is closed? of the dismissal policy of the Disputes Chamber.