APD/GBA (Belgium) - 124/2021
From GDPRhub
| APD/GBA (Belgium) - 124/2021 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 6(3) GDPR Article 13(1)(c) GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 10.11.2021 |
| Published: | |
| Fine: | None |
| Parties: | n/a |
| National Case Number/Name: | 124/2021 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | Beslissing ten gronde 124/2021 (in NL) |
| Initial Contributor: | Matthias Smet |
The Litigation Chamber of the Belgian DPA can only be competent for data processing that, although started before May 25 2018, still continues after that date, but not for one-off processing operations before May 25 2018 or multiple processing that stopped before May 25 2018.
English Summary
Facts
complainants X1 and X2 filed a complaint against the defendant regarding the disclosure to third parties of personal data concerning tenants of social housing in the context of an asset investigation and the absence of a legal basis to disclose this personal data. On top of that complainants were not informed about the processing activity in accordance with article 13 GDPR.
After these complaints have been declared admissible, the Litigation Chamber requested the Inspection Service to conduct an investigation at the premises of the defendant. During this investigation, five additional breaches against data protection principles were discovered.
The defendant stated that the processing it carries out forms part of the legal framework for social housing and that the basis of the processing, namely the consent of the complainants, is expressly included in Flemish regulations governing the social housing system.
Holding
Dismissal of the complaints:
The processing operations in casu all took place before the GDPR became applicable, except for the period that was granted to the complainants to leave the house. This period expired on October 31 2021.
In previous decisions of the Litigation Chamber it already stated that it can only be competent for data processing that, although started before May 25 2018, still continues after that date, but not for one-off processing operations before May 25 2018 or multiple processing that stopped before May 25 2018.
The Ligitation Chamber considers itself ratione temporis to be incompetent to deal with these complaints on the merits, given the fact that the contested processing operations were carried out on a date before the GDPR became applicable. Therefore, the Litigation Chamber decides to dismiss the present complaint in accordance with the terms of the its dismissal policy.
legal basis 'legal obligation' and 'fulfillment of a task in the public interest or the exercise of public authority: Balancing test necessary
If processing is carried out because the controller is legally obliged to do so or if the processing is necessary for the performance of a task carried out in the public interest or the exercise of public authority, the processing must be based on Union or Member State law.
Article 6.3 GDPR adds that the purpose of the processing must be found in that legal basis. In other words, a legislative standard must be sufficiently clear and precise so that the essential characteristics (including the precise purposes) of a processing operation are known when the above legal bases are used. In most cases, processing takes place on a more general regulatory power to act without concretely defined provisions. Therefore, the Litigation Chamber states that when using these legal grounds, a balancing test is necessary between the necessity of the processing and the interests of the data subject.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/12
Dispute room
Decision on the merits 124/2021 of 10 November 2021
File number : DOS-2018-05039en DOS-2018-05524
Subject : Sharing of personal data concerning tenants of social housing in the
framework of an asset investigation
The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke Hijmans,
chairman and Messrs Frank De Smet and Romain Robert;
Having regard to Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 on
the protection of natural persons with regard to the processing of personal data and
on the free movement of such data and repealing Directive 95/46/EC (General
Data Protection Regulation), hereinafter GDPR;
Having regard to the law of 3 December 2017 establishing the Data Protection Authority, hereinafter WOG;
Having regard to the internal rules of procedure, as approved by the Chamber of Representatives
on December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;
Having regard to the documents in the file;
has taken the following decision regarding:
The complainants: Mrs and Mr X1, represented by Mr. Özgür Balci (hereinafter: 'complainant 1'), and
Mrs. X2, represented by Mr. Özgür Balci (hereinafter "complainant 2"),
hereinafter collectively referred to as 'the complainants'.
The defendant: Y, represented by mr. Kris De Sager, hereinafter “the defendant”. Decision on the merits 124/2021 - 2/12
I. Facts procedure
1. On September 17, 2018 and September 26, 2018, respectively, Complainant 1 and Complainant 2 filed a
lodge a complaint with the Data Protection Authority against the defendant.
The object of the complaints concerns the communication to third parties of personal data
concerning tenants of social housing in the context of an asset survey.
2. On October 5, 2018 and October 15, 2018 respectively, the complaints will be
First-line service has been declared admissible on the basis of Articles 58 and 60 WOG and the
complaints pursuant to art. 62, §1 WOG transferred to the Disputes Chamber. The Dispute Room
deals with both cases in a single decision as the subject matter of the complaint is fully
is parallel.
3. On October 18, 2018, in accordance with art. 96, §1 WOG the request of the Dispute Chamber
sent to the Inspectorate to carry out an investigation, together with the complaints
and the inventory of the pieces.
4. The inspection will be completed by the Inspectorate on 21 October 2019, the report will be
the file is added and the file is transferred by the Inspector General to the
Chairman of the Disputes Chamber (art. 91, §1 and §2 WOG).
The report contains findings with regard to the subject matter of the complaint and concludes that
defendant:
• has not complied with the obligations imposed by Articles 5 and 6 of the GDPR;
(Principles on processing of personal data and lawfulness of the
processing)
• the obligations imposed by Article 12(1) of the GDPR and by Articles 13 and
14 of the GDPR;
(provision of transparent information, communication and further rules for the
exercise of the rights of data subjects, and regarding to provide
information)
• the obligations imposed by Article 44 of the GDPR and Article 49 of the GDPR
has not complied with.
(General principle on transfers and on derogations for specific
situations)
5. The report also contains findings outside the subject matter of the complaint and concludes that
defendant: Judgment on the merits 124/2021 - 3/12
• has not complied with the obligations imposed by Article 30(1) of the GDPR;
(register of processing activities)
• has not complied with the obligations imposed by Article 31 of the GDPR;
(cooperation with the supervisory authority)
• the obligations imposed by Article 37(5) and (7) of the GDPR and Article 38,
paragraph 1 of the GDPR has not been complied with.
(designation of the data protection officer and his position)
6. In its report, the Inspectorate formulates an additional consideration of the temporal
application of the GDPR to the aforementioned facts. In this regard, she refers to the fact that the
Defendant has requested the complainants by letter dated April 11, 2018 for “no later than 31”
October 2018 […] to leave the house and garage and make it available to Y”. The
Inspectorate indicates that the GDPR applies to the aforementioned facts, in view of the fact that
the period to vacate the house and garage expires on October 31, 2018, and thus after the
become applicable of the GDPR on 25 May 2018 . 1
7. In addition, the Inspectorate states that the GDPR has already entered into force on 24 May 2016
pursuant to Article 99(1) of the GDPR, whereby the defendant had already taken the necessary steps
must take to ensure that the processing of personal data is in accordance with the GDPR
bring.
8. On January 14, 2020, the Disputes Chamber will decide on the basis of art. 95, §1, 1° and art. 98 WOG that it
file is ready for processing on the merits.
9. The Disputes Chamber decides on the basis of the report of the Inspectorate to divide the file
in two separate parts.
10. On January 14, 2020, the concerned parties will be notified by registered letter of
the provisions as stated in article 95, §2, as well as those in art. 98 WOG. They will also be
pursuant to art. 99 WOG of the time limits for submitting their defences.
With regard to the findings with regard to the subject-matter of the complaint, the
date for receipt of the statement of reply from the complainants on 28 January 2020 and this before
the statement of the defendant's reply on February 11, 2020. With regard to the findings
going beyond the subject of the complaint, the deadline for receipt of the
statement of defense of the defendant recorded on January 28, 2020.
1
Article 99(2) of the GDPR Decision on the merits 124/2021 - 4/12
11. At the request of the defendant, the Disputes Chamber decided to exceptionally grant an extension
of the claim periods. With regard to the findings with regard to the
subject of the complaint (art. 98, 1° WOG), the time limit for the complainants' conclusion was determined
on January 31, 2020 and this for the statement of reply of the defendant on February 14, 2020 .
With regard to the findings that go beyond the object of the complaint, the extreme
date for receipt of the defendant's claims set at January 31, 2020
12. On January 14, 2020, the defendant requests a copy of the file (art. 95, §2, 3° WOG), which
it was transferred on January 22, 2020.
13. On 29 January 2020, the complainants lodged their statement of defense in which three pleas were raised:
quoted:
• In the first ground of appeal, the complainants allege an infringement of Articles 5 and 6
of the GDPR. Defendant does not justify on what legal basis it
communicated the complainants' details to Z. There is no evidence that
complainants have consented to the communication of the
personal data to Z.
• In the second ground of appeal, the complainants allege an infringement of Articles 12, 13 and
14 of the GDPR. The information provided on the Defendant's website is not
transparent, incoherent and incomprehensible to those involved.
• In the third plea, the complainants allege an infringement of Articles 44 and 49
of the GDPR. Referring to the Inspection Report, the conditions of
Article 49 not complied with.
14. On January 31, 2020, the Disputes Chamber will receive the statement of defense from the defendant
with regard to findings outside the subject matter of the complaint. In this she wishes her
to assert defenses in the file with regard to the findings made by the
Inspection service was performed outside the scope of the complaint (art. 92.3° WOG) and the infringements that
it believes it must conclude from these findings.
• With regard to the findings regarding the register of processing activities,
defendant that she has in any case always been transparent in all her communication to
the Inspectorate and that it has complied with all its obligations. Defendant argues that
the foregoing shows that it is impossible to conclude that it committed an infringement
against Article 30(1) of the GDPR.
• Concerning the determination of cooperation with the supervisory authority
Defendant believes that it never fulfills its obligations under Article of the GDPR
would have intentionally failed to comply and thus did not infringe Article 31 of the GDPR. Decision on the merits 124/2021 - 5/12
• What the findings regarding the appointment of the data protection officer
and its position, the defendant is of the opinion that all requirements are always met, and that
the professional qualities and expertise in data protection beyond question
to stand.
According to the defendant, no infringement was committed with regard to Articles 37 and 38 of the GDPR.
15. On 14 February 2020, the Disputes Chamber received the statement of reply from the
defendant with regard to the findings within the subject matter of the complaint. In her first
In its plea, the defendant argues that only acts performed from the date on which the
AVG regulation applies can withstand the test of the AVG. There would be no actions
have been made from 25 May 2018 that would be the subject of discussion.
In its second plea, the defendant states that the obligations imposed by Articles 5 and
6 were complied with. In this regard, the defendant argues that this is a document issued by the Flemish Government and
the Flemish Housing Company is a recognized social housing company with as
specific aim to improve living conditions (of the most deprived and single people)
by ensuring an adequate supply of social rental or owner-occupied housing. She acts and is
bound by the legal framework on social rent. Defendant further argues that the
processing of the personal data must be in accordance with the AVG, but that this processing is
is based on the consent of the complainants, which is also provided for in the decision of
the Flemish Government of 12 October 2007 to regulate the social rental system in
implementation of Title VII of the Flemish Housing Code to regulate the social housing system
for the implementation of Title VII of the Flemish Housing Code (hereinafter referred to as the "Social Rent Framework Decree")
. In addition, the defendant refers to Legal Consideration 47 of the GDPR, which states that the
processing of personal data that are strictly necessary for fraud prevention is also a
legitimate interest for the controller. Furthermore, the defendant argues that the
lack of a detailed procedure concerning the control of the
property condition abroad and the exchanges of this information by no means
means that information cannot be sought and obtained in any other way.
With regard to Articles 13 and 14 of the GDPR, the defendant maintains that the GDPR has not yet
was applicable.
With regard to the privacy statement, the respondent, referring to its reply letter of 1
October 2019, that this was established on the advice of its official for
data protection and that it is still subject to revision and reworking.
As far as the wording is concerned, the defendant argues that the text is clear and that the abbreviations also
clear when read in context. Decision on the merits 124/2021 - 6/12
II. Justification
II.1. Jurisdiction of the Dispute Chamber
16. On the basis of the information currently available to the Disputes Chamber, and in particular
on the fact that the contested processing operations were carried out on a date before the applicable
of the GDPR, the Disputes Chamber considers itself ratione temporis to be incompetent to process this complaint
to treat and therefore decide to dismiss this on the basis of Article 95, §1, 3° WOG.
17. In order for the Disputes Chamber to be competent, it is necessary that the GDPR applies to the
processing of personal data that are the subject of the complaint. According to art. 4, paragraph 2
GDPR is the processing of personal data: “any operation or set of operations with
relating to personal data or a set of personal data, whether or not carried out via
automated procedures, such as collecting, recording, organizing, structuring, storing,
update or modify, request, consult, use, provide by transmission,
distribute or otherwise make available, align or combine, shield,
erasure or destruction of data”.
The processing operations in this case and their timing can be summarized as follows: the order to
verification investigation at the Dutch company Z dates from March 7, 2018. The investigation by the
firm Z was completed and a report was submitted on March 28, 2018. Subsequently, with
a letter dated 11 April 2018 an end to the lease and the defendants are
requested to vacate the house and the garage by 31 October 2018 at the latest.
In the defendant's letter, the complainants are given a period of time to
to leave the garage. This period ends on October 31, 2018, so after the application of the
GDPR on 25 May 2018. 2 In its conclusion, the defendant argues that the
data processing in question took place before May 25, 2018, as a result of which the GDPR
does not apply in this case. The Inspectorate argues in its report that the GDPR does apply
is applicable because the aforementioned term expires on October 31, 2018, i.e. after the applicable
become of the GDPR. Moreover, according to the Inspectorate, the GDPR has already entered into force on 24
May 2016, pursuant to Article 99(1) of the GDPR, whereby the defendant already has the necessary
should have taken steps to ensure that the processing operations are in accordance with
would be with the GDPR.
18. The Disputes Chamber establishes that the aforementioned processing of personal data has
occurred before the GDPR came into effect on May 25, 2018. Although the deadline
which was granted to the complainants to vacate the home and garage does indeed expire on 31
October 2021, the processing operations that are the subject of this case have not
occurred during this period. The Disputes Chamber is therefore not authorized to take cognizance of
2
Article 99(2) GDPR Decision on the merits 124/2021 - 7/12
to take. The Disputes Chamber finds the legal basis of its competence in the law of 3
December 2017 establishing the Data Protection Authority (WOG) whose
entry into force was established, subject to exceptions, on 25 May 2018 (Article 110 of the
WOG). Although the Disputes Chamber is competent for data processing that, although before 25
May 2018 but still continuing after that, she is not authorized for one-off
processing operations that would have taken place before 25 May 2018 or multiple processing operations
4
the before May 25, 2018. The Disputes Chamber cannot determine that after 25 May 2018
processing operations to which this case relates have taken place.
5
19. In view of the foregoing, the Dispute Chamber proceeds to a technical dismissal through which this
complaint is not followed up further as there is no infringement of the GDPR.
II.2. Legislative framework : Relationship between the processing of personal data and the
admission requirements in the context of social rent
20. For the sake of completeness, the Disputes Chamber wishes to draw attention to the broader issue
related to the complaint, namely the processing of personal data in function of the
control of the registration and admission conditions in the context of social rent.
21. In this context, the Disputes Chamber first of all points out that pursuant to Article 13.1c) of the GDPR, the
controller already when collecting personal data concerning a
data subject, this data subject must inform about, among other things, the processing purposes
6
for which the personal data is intended, as well as the legal basis of the processing. The
The controller must therefore establish the legal basis for the processing prior to the processing
transparent manner. No cascade system is possible in determining the
applicable legal basis for the processing, where the controller
designates alternative legal bases, as each legal base has different obligations
associated with the controller.
22. At the time of the facts in question, the registration and admission requirements in the
framework of social rent determined by the Social Rent Framework Decree. Article 3, 1 of the Framework Decision
states that a natural person can be registered in the register referred to in Article 7, if he
meets several conditions, including the following:
”3° [the (prospect) tenant], together with his family members, has no house or plot that
3
See point 3.1.A.4 of the Disputes Chamber's Dismissal Policy, published on its website on June 16, 2021,
(https://www.dataprotectionauthority.be/publications/sepotbeleid-van-de-geschillenkamer.pdf).
4Decision on the merits 19/2020 of 29 April 2020 (https://www.dataprotectionauthority.be/publications/besluit-ten-
ground no.-19-2020.pdf)
5 See point 3.1.A4 of the Disputes Chamber's Dismissal Policy, published on its website on June 16, 2021,
(https://www.dataprotectionauthority.be/publications/sepotbeleid-van-de-geschillenkamer.pdf).
6See art. 13, 1 c of the GDPR.
7
“Each landlord keeps a register in which, according to the order in which the application for registration is submitted, the candidate
tenants are registered, stating any priority rules […]” (Art. 7 of the Social Rent Framework Decree) Decision on the merits 124/2021 - 8/12
is intended for residential construction wholly in full ownership or wholly in usufruct in domestic or
abroad, unless it concerns a camping stay located in the Flemish Region”
23. Pursuant to Article 52, §1 of the Framework Decree, the tenant gives the landlord, by means of his application
to registration in the register, his registration as a prospective tenant or his tenantship, the
permission to submit to the competent authorities and institutions and to the local authorities the
necessary documents or information regarding the conditions laid down in this decree and
to obtain obligations. These competent authorities and institutions are in§2 of the same
article listed in a non-exhaustive manner as follows 9:
1° the National Register of Natural Persons, mentioned in the law of 8 August 1983
arranging a national register of natural persons;
2° the social security institutions, mentioned in Articles 1 and 2, first paragraph, 2°, of the law
of 15 January 1990 establishing and organizing a Crossroads Bank for the
Social Security and the persons to whom the social security network with
application of Article 18 of the same law was extended;
3° the Federal Public Service Finance;
4° the Civic Integration Crossroads Bank;
5° the Houses of Dutch;
6° the reception offices;
7° the Flemish E-government coordination cell;
8° the organizations and institutions referred to in Article 4, first paragraph, including the
policy area Education and Training of the Flemish Community.
24. These sources can be easily consulted for real estate properties in Belgium.
However, investigations into real estate in EU countries or non-EU countries are less
8
art. 52.§1.: The reference person gives the landlord, by means of his application for registration in the register, his registration as
prospective tenant or his tenantship, the permission to apply to the competent authorities and institutions and to the local authorities
administer the necessary documents or data regarding the conditions and obligations set out in this Decree
obtain, while preserving the application of the provisions of the law of December 8, 1992 on the protection of the
privacy in relation to the processing of personal data, its implementing decrees and any other provision
for the protection of privacy, established by or pursuant to a law, decree or decision.
9Art. 52.§2: For the implementation of the provisions of this Decree, the lessor relies on information provided by the competent authorities
governments or institutions or other landlords can deliver it electronically. If in this way no or insufficient
data are obtained, the candidate-tenant or tenant is requested to provide the necessary data.
information from the competent authorities or institutions or other landlords shows that the prospective tenant or tenant does not or does not
more meets the conditions and obligations of this Decree, this determination will be communicated to the prospective tenant or
tenant who can respond within one week after the notification. Among the competent authorities and institutions, mentioned in §1 and §2,
first paragraph, includes :1° the National Register of Natural Persons, mentioned in the law of 8 August 1983
arranging a national register of natural persons; 2° the social security institutions referred to in Articles 1 and 2,
first paragraph, 2°, of the law of 15 January 1990 establishing and organizing a Crossroads Bank for Social Security
and the persons to whom the social security network was extended under Article 18 of the same law; 3° the
Federal Public Service Finance;4°the Crossroads Bank for Civic Integration;5°the Houses of Dutch;6°the reception offices;7°de
Flemish E-government coordination cell;8° the organizations and the institutions referred to in Article 4, first paragraph, including the
policy area Education and Training of the Flemish Community. Decision on the merits 124/2021 - 9/12
naturally. The defendant notes that no procedure with regard to investigations in
non-EU countries was available at the time of the facts, but that this does not exclude the possibility that there
can be called upon to private investigative agencies to comply with the obligation to check with
with regard to the aforementioned condition of ownership.
25. The Social Rent Framework Decree was repealed by the Decree of the Flemish Government of 11
September 2020 to implement the Flemish Housing Codex. The aforementioned article 52, §§1 and 2
of the Social Rent Framework Decree has been incorporated in full in Article 5.246, §1 of the
the aforementioned decision of the Flemish Government of 11 September 2020. Social landlords can
therefore still conducting research via the same non-exhaustive sources listed above
to real estate. To address the lack of an effective
procedure for investigations into foreign real estate, the Flemish
The Social Housing Company (hereinafter: “VMSW”) has concluded a framework agreement with
private investigative agencies specializing in real estate investigations in
Abroad. Social landlords can call on these research bureaus when
there is a risk of the presence of foreign immovable property at their (candidate)
tenants.
26. In its claims, the defendant refers to the fact that it has received a letter from the Flemish Government and
Flemish Housing Company is a recognized housing company whose aim is to
rental or sale of social housing the housing conditions of the person in need of housing
improve families and singles, especially the most deprived families and
single persons, by ensuring an adequate supply of social housing or social housing
owner-occupied houses. It does this, among other things, by checking the registration conditions (such as:
set out above).
27. If the processing is carried out because the controller is legally required to do so
mandatory10 or if the processing is necessary for the fulfillment of a task of general
interest or for a task in the exercise of public authority, the 1
processing has a basis in Union or Member State law. 12
28. However, in accordance with Article 6.3 of the GDPR, “the purpose of the processing must be that legal basis”
[to be] determined whether in relation to the processing referred to in point (e) of paragraph 1 is necessary
[to be] for the performance of a task in the public interest or for the exercise of
public authority conferred on the controller”. Furthermore, according to article
6.3 GDPR, the legal basis also includes “specific provisions to regulate the application of the rules”
of this Regulation, including the general conditions on the
10Art. 6, 1, (c) of the GDPR.
11
art. 6, 1, (e) of the GDPR
12Art. 6.3 of the AVG. Decision on the merits 124/2021 - 10/12
lawfulness of processing by the controller; the types processed
data; The involved; the entities to which and the purposes for which the
personal data may be provided; the target limitation; the storage periods; and the
processing activities and procedures (…)”.
29. The Disputes Chamber points out in this regard that, in accordance with the aforementioned Article 6.3 of the GDPR,
read in conjunction with Article 22 of the Constitution and in the light of Articles 7 and 8 of
the European Charter of Fundamental Rights, a legislative standard defines the essential features of a
must record data processing that is necessary for the performance of a task of
public interest or for the exercise of official authority vested in the
13
controller is entrusted. The Disputes Chamber emphasizes that the parties involved
processing should be framed by a standard that is sufficiently clear and precise
the application of which is foreseeable to the persons concerned. In accordance with article 6.3
GDPR, the precise purpose(s) of the processing should be specified in the legal standard itself
included. Furthermore, the following elements must be foreseeable: the identity of the
controller(s), the categories of data processed, on the understanding that
they must be in accordance with Article 5.1 of the GDPR, "adequate, relevant and
limited to what is necessary for the purposes for which they are processed", the
categories of data subjects whose data will be processed, the retention period of
the data, the recipients or categories of recipients to whom their data is sent
communicated, the circumstances in which and the reasons for which they will be communicated
and any limitation of the obligations and/or rights referred to in Articles 5, 12 to
with 22 and 34 GDPR.
30. The Disputes Chamber points out in this regard, however, that tasks of general interest or public
authority with which controllers are entrusted are often not based on
precisely defined obligations or legislative standards that meet the requirements stated
under marginal 28, in particular the recording of the essential characteristics of the
data processing. Rather, processing takes place on the basis of a more general
authorization to act as is necessary for the performance of the task. This leads to
the relevant legal basis in practice often no concretely defined provisions
contains about the necessary data processing. Data controllers who on
If you wish to invoke Article 6.1 e) GDPR on such a legal basis, you must then
make a trade-off between the necessity of the processing for the task of general
interests and the interests of those involved.
13See also the advice of the Knowledge Center of the GBA 36/2020, 42/2020, 44/2020, 46/2020, 52/2020 and 64/2020
(https://www.dataprotectionauthority.be/burger/zoeken?q=&search_category%5B%5D=taxonomy%3Apublications&sear
ch_type%5B%5D=advice&s=recent&l=25) Decision on the merits 124/2021 - 11/12
31. The defendant also refers to Legal Consideration 47 of the GDPR which states that the
processing of personal data that are strictly necessary for fraud prevention also a
legitimate interest for the controller. The Disputes Chamber points out that
the legal basis 'legitimate interest' as provided for in Article 6.1, f) of the GDPR does not apply
applies to processing by bodies with a public law function in the context of
the performance of their duties.14
32. Finally, the defendant argues that the processing in question is based on the
consent of the complainants and that the processing is therefore lawful under Article 6, 1, a)
of the GDPR. This consent would result from the signing of a declaration of honor
in which the tenant confirms that he does not own immovable property. More specifically, it mentions
statement, which was prepared by the VMSW, the following:
This declaration on honor serves to verify whether the imposed property value has been met
met. The declaration made will be checked with the competent government department.
33. The Disputes Chamber states that although consent may constitute a lawful ground for processing,
as stipulated in Article 6, 1, a) of the GDPR, but adds that at the time
processing is based on the consent of the data subject, there are several conditions
this permission applies. Consent must be freely given, specific and
informed and finally unambiguous.15In this context, Recital 43 of the
GDPR states that there is no free consent in the case of a clear
disproportion between the parties or if the failure to give consent to the data subjects
obvious disadvantage. In this case there is a clear mismatch between the person concerned
and the social housing company with a specific status under public law as
controller. Moreover, the (candidate) social tenant does not have the
actual choice to refuse without negative consequences to the refusal
be connected. After all, in the event of refusal, he is no longer eligible for social security benefits
home. The Disputes Chamber emphasizes that a legally required consent is not a lawful
processing ground in accordance with Article 6(1)(a) of the GDPR as it is not free
may have been given by the person concerned.
34. In view of the above, the Disputes Chamber determines that the consent does not
may constitute a legal ground for the present processing operations
35. In this decision, the Disputes Chamber limits itself to these general considerations about the
legal basis. The Disputes Chamber has observed these social problems and
will investigate further when further proceedings in this regard are brought before it
turn into.
14Recital 47 of the GDPR.
15EDPB Guidelines 05/2020 on consent underRegulation 2016/679, p. 7-8. Decision on the merits 124/2021 - 12/12
III. Publication of the decision
36. Given the importance of transparency in the decision-making of the
Litigation Chamber, this decision will be published on the website of the
Data Protection Authority. It is not necessary, however, that the identification data
of the parties be made public directly.
FOR THESE REASONS,
the Disputes Chamber of the Data Protection Authority decided, after deliberation, to
of Article 100, §1, 1° WOG to dismiss the present complaint.
Against this decision, pursuant to art. 108, §1 WOG, appeals must be lodged within a
period of thirty days, from the notification, to the Marktenhof, with the
Data Protection Authority as Defendant.
(get). Hielke Hijmans
Chairman of the Disputes Chamber
