APD/GBA (Belgium) - 141-2023
From GDPRhub
| APD/GBA - 141-2023 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 77 GDPR Article 95 Loi du 3 décembre 2017 portant création de l'Autorité de protection des données (LCA). |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 141-2023 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | French |
| Original Source: | APD (in FR) |
| Initial Contributor: | n/a |
The Belgian DPA (ADP) dismissed a complaint regarding the disclosure of personal data by the communications officer of a political party to unauthorized persons, because the data subject had not provided sufficient evidence that their rights were violated.
English Summary
Facts
The data subject was a member of a political party. On 10 March 2023, the data subject contacted the political party's data protection officer (DPO), claiming that their personal data was illegally disclosed to other members, by the party's communication officer. The data subject objected to the disclosure and requested information on the measures which would be taken to address the disclosure.
On 03 April 2023, the political party's DPO replied, claiming that the data was processed in accordance with legal requirements and that there was no disclosure.
On 11 April 2023, the data subject announced their dissatisfaction with the decision. After further communications with the party, on 6 June 2023, the data subject first filled a request for mediation to the ADP, which was unsuccessful.
On 18 August 2023, the data subject converted their request for mediation into a complaint as permitted by Article 62, §2 of the Loi du 3 Décembre 2017 portant création de l'Autorité de protection des données (LCA).
Holding
ADP rejected the complaint under Article 95, § 1, 3° of the LCA.
Firstly, the Belgian DPA found that the data subject's claim was not sufficiently proven. During the mediation and proceedings, the data subject claimed that the disclosure was supported by testimonies of several persons and police complaint but no such proof was presented. The data subject also claimed that the person who allegedly disclosed data communicated it to them, but did not present any communication which would prove this fact.
The data subject also presented a disciplinary action against the communications officer, who was supposed to have disclosed the data, carried out by the data controller, but ADP noted that it was not enough to prove that there was disclosure of personal data in the party.
Finally, the ADP decided that it was not necessary to launch an investigation into the activities of the data controller, in order to collaborate the claims of the data subject. Regardless of being proven or not, the DPA concluded that the grievance raised by the data subject did not correspond to the criteria of high general or personal impact. Therefore it was up to the ADP to weigh up the personal impact of the circumstances of the complaint and to decide whether it was appropriate to take the complaint further. Given the the lack of substantial evidence and time considerations, the ADP decided not to investigate the matter further.
Comment
The Belgian DPA's criteria for "high personal impact" is stated as follows:
"3.2.1 General criteria for high social and/or personal impact
In principle, the [Belgian DPA] will deem it appropriate to deal with your complaint in depth if it involves grievances with a major social and/or personal impact, in other words if it involves one of the following situations:
- Profiling and predictive activities relating to aspects of the individual's work performance, economic status, health, personal preferences or interests, reliability or behaviour, or location and travel.
- Automated decision-making with legal effect (or similar significant effects) on the data subject (e.g. granting credit based on automated criteria).
- Processing operations used to observe, monitor or control data subjects, including the collection of data over networks or by "systematic surveillance of a publicly accessible area" (e.g. camera surveillance in public places).
- Processing of sensitive data of a highly personal nature, namely personal data as referred to in Article 9 of the GDPR (data concerning health, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and processing of genetic data, biometric data for the purpose of uniquely identifying a person, or data relating to a person's sexual behaviour or sexual orientation), as well as personal data relating to criminal convictions or offences (Article 10 of the GDPR).
- Widely processed data, taking into account the following factors:
- the number of people affected, either in absolute terms or in relation to the population under consideration;
- the volume of data and/or range of different data elements processed;
- the geographical scope of the processing activity (e.g. cross-border or not).
- Cross-referencing or combining data sets from different processing activities in a way that goes beyond the data subject's reasonable expectations (e.g. other than the purposes for which the data were collected).
- Data concerning vulnerable persons who cannot freely consent (e.g. children,workers, mentally ill people, asylum seekers, patients).
- Use of new technological or organisational solutions whose impact on data subjects is not easily foreseeable (e.g. facial recognition systems).
- Processing that prevents data subjects from exercising a right or receiving a service or contract
These criteria are inspired by those used by the European Data Protection Authorities to identify "high-risk" processing operations that should be subject to a prior impact assessment under Article 35 GDPR. These criteria take into account both societal (impact on multiple individuals) and personal factors (impact on a single person). Please consult the professional section of [our] website if you would like further explanation on the criteria of Article 35 GDPR."
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/7
ChamberLitigation
Decision 141/2023 of October 16, 2023
File number: DOS-2023-02498
Subject: Complaint relating to the disclosure of personal data by the party
Belgian politics “..”
The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke
Hijmans, president, sitting alone;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the
protection of natural persons with regard to the processing of personal data and
to the free movement of these data, and repealing Directive 95/46/EC (general regulation on the
data protection), (hereinafter “GDPR”);
Having regard to the Law of December 3, 2017 establishing the Data Protection Authority (hereinafter
“LCA”);
Having regard to the Law of July 30, 2018 relating to the protection of individuals with regard to
processing of personal data (hereinafter “LTD”);
Considering the Internal Regulations as approved by the House of Representatives on 20
December 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Has taken the following decision regarding:
The complainant: X, hereinafter “the complainant”;
The defendant: Y, hereinafter “the defendant”. Decision 141/2023 - 2/7
I. Facts and procedure
1. On August 18, 2023, the complainant filed a complaint with the Data Protection Authority.
data (hereinafter “the APD”) against the defendant, the local section of the political party “Y”
of Braine-l’Alleud (hereinafter “the political party”).
2. The subject of the complaint concerns the unlawful processing of personal data,
these would have been used illicitly and disclosed to other members of the party
policy by Mrs. Z1, the communications manager of the defendant, in order to
damage its reputation.
3. On March 10, 2023, the complainant contacted Z2, the party's data protection officer
policy (hereinafter the “DPO”). She alleges that her personal data, appearing
in a “listing” of members of the local section of Braine-l’Alleud, would have been
disclosed. The complainant identifies Madame Z1, the communications manager of the
defendant, as the alleged perpetrator of the offense. It is based on several
evidence, in particular an anonymous testimony certificate dated March 4
2022, which claims that Madame Z1 would have made negative comments about her in private in front of
the witness and several of her colleagues, while asking them to remove her from their list
friends on Facebook; and a police complaint filed on October 7, 2022. Other evidence
would be available, but they must be requested by the DPO.
4. On March 14, 2023, the DPO acknowledges receipt of the complainant’s email and undertakes to
undertake the necessary checks.
5. On April 3, 2023, the complainant sent a reminder to the DPO concerning her email of March 10
2023, and she expresses her opposition to the illicit use of her data. She asks for
information on the measures that will be taken to prevent the unlawful processing of its
data. The same day, the DPO shared the results of his checks and indicated that the
internal rules were well respected in that the President of the local section of the party
policy, namely Mr. Z3 in this case, responsible and guarantor of the confidentiality of
personal data of members of the section within the meaning of article 21, §3 of the
statutes of the local sections of the political party, would have confirmed to him that, on the one hand, he
would keep the “listing” of the members of the section in a secure manner and that, on the other hand,
On the other hand, he would not have entrusted the file in question to another member of the said section.
6. On April 11, 2023, the complainant expressed her dissatisfaction with the response received and
expresses concerns about the misuse of his personal data by
The political party. The complainant bases her assertions on several elements and facts that she
listed in his email. Decision 141/2023 - 3/7
7. On June 8, 2023, the complainant filed a request for mediation with the APD against the
defendant within the meaning of article 22, §1, 2° of the LCA.
8. On July 3, 2023, the Front Line Service (hereinafter “SPL”) declares the request in
admissible mediation. On the same date, the SPL contacts the DPO to initiate the
mediation procedure with the complainant and ask her to respond to the email of April 11
2023, in which she expressed her concerns about the need to take
measures to avoid abusive processing of personal data. Furthermore, she
requested that the recipients of his personal data be informed of
the misuse of personal data of members of the political party of Braine-
L’Alleud.
9. On July 19, 2023, the DPO reiterated that Madame Z1 did not have access to the “listing” of members of the
political party. In addition, the DPO mentions having reiterated his request to the President of
the local section of the political party, Mr. Z3, who formally confirmed that he was the only
responsible for the use of the file of members of its Braine-l’Alleud section. The DPO
understands the complainant's suspicions, but specifies that they are unfounded. According to
DPO, the personal data would have been communicated or used outside the
strict functioning of the party.
10. On August 1, 2023, the complainant responded to the DPO indicating that she had an interview with the
president of the Braine-l’Alleud section of the political party on July 28, 2023. She specifies
that the latter will provide him with answers to questions relating to the use of his
personal data by mid-August. On this same date, the SPL informed the
complainant that he received a response from the defendant dated July 19, 2023; and estimates
that the mediation led to a positive result.
11. On August 18, 2023, the complainant transformed her request for mediation into a complaint as
This is permitted by article 62, §2, paragraph 4, 1° of the LCA.
12. On August 25, 2023, the SPL informed the defendant that the request for mediation had been
transformed into a complaint by the complainant.
13. On August 28, 2023, the SPL of the APD declared the complaint admissible on the basis of articles 58 and
60 of the LCA, and transmits it to the Litigation Chamber in accordance with article 62,
§ 1 of the LCA.
II. Motivation
14. Pursuant to article 4, §1 of the LCA, the APD is responsible for monitoring the principles of
data protection contained in the GDPR and other laws containing provisions
relating to the protection of the processing of personal data. Decision 141/2023 - 4/7
15. Pursuant to article 33, §1 of the LCA, the Litigation Chamber is the organ of the
administrative litigation of the APD. It receives complaints that the SPL sends to it in
application of article 62, §1 of the LCA, or admissible complaints. In accordance with article
60 paragraph 2 of the LCA, complaints are admissible if they are drawn up in one of the
national languages, contain a statement of the facts and the necessary information
to identify the processing of personal data to which they relate and which
fall under the jurisdiction of the ODA.
16. Based on the facts described in the complaint file as summarized above, and on
basis of the powers assigned to it by the legislator under article 95,
§ 1 of the LCA, the Litigation Chamber decides on the follow-up to be given to the file; in
occurrence, the Litigation Chamber decides to proceed with the classification without further action.
the complaint, in accordance with article 95, § 1, 3° of the LCA, for the reasons set out below
After.
17. In matters of dismissal, the Litigation Chamber is required to provide reasons for its decision.
1
decision by step and to:
- pronounce a classification without technical follow-up if the file does not contain or not
sufficient evidence likely to lead to a sanction or if it includes a
technical obstacle preventing it from rendering a decision;
- or pronounce a classification without further opportunity, if despite the presence
of elements likely to lead to a sanction, the continuation of the examination of the
file does not seem appropriate given the priorities of the Authority of
data protection as specified and illustrated in the Privacy Policy
classification without further action by the Litigation Chamber. 2
18. In the event of dismissal based on several grounds for dismissal, these
last (respectively, classification without technical follow-up and classification without follow-up
3
opportunity) must be treated in order of importance.
19. In this case, the Litigation Chamber decides to proceed with a classification without further action
the complaint for these two reasons. The decision of the Litigation Chamber rests more
precisely on two reasons why it considers it inappropriate to
continue monitoring the file, and therefore decides not to proceed, among other things, to
an examination of the merits of the case.
1Market Court (Brussels Court of Appeal), September 2, 2020, judgment 2020/AR/329, p. 18.
2In this regard, the Litigation Chamber refers to its classification policy as developed and published on the Authority’s website
data protection: https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
litigation.pdf.
3Data protection authority, “Disclosure policy of the Litigation Chamber: 3. – In what cases is my complaint
Is it likely to be closed without further action by the Litigation Chamber? », June 18, 2021, available on
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-contentieuse.pdf. Decision 141/2023 - 5/7
20. The Litigation Chamber notes that the complainant denounces the unlawful processing of her
personal data.
21. Firstly, the Litigation Chamber finds that the complaint is not sufficiently
supported by evidence of the existence of a violation of the GDPR or protective laws
personal data (criteria A. 1 of said policy). Consequently, the Chamber
Litigation decides to dismiss the complaint for technical reasons.
22. Despite the allegations that the plaintiff makes against the defendant concerning
the alleged disclosure of his personal data to other party members
political, the Litigation Chamber notes that no proof of this meaning appears in the
file. The complainant, in fact, claims to have received testimonies from people
who would have obtained illicit access to their personal data, but does not provide any
nevertheless no trace.
23. In addition, the complainant relies on the existence of a precedent under which the
communications manager of the defendant was sanctioned by a former
employer. However, this sanction cannot lead the Litigation Chamber to
determination of the existence of a violation of the GDPR or data protection laws
personal for the facts in this case.
24. Furthermore, the complainant states that the president of the Braine-l’Alleud local section of
political party would have confirmed the position of the communications manager of the
defendant, presumed author of the offense, and as such refers us to an exchange
informal non-time-stamped between her and him. However, nothing of the sort appears when reading this
part of the file.
25. Finally, the complainant expresses her dissatisfaction with the answers given by the DPO of the
defendant, however, it turns out that he always responded within the time limit given to him
imposed by Articles 12.3 and 12.4 of the GDPR (see points 5, 8 and 9).
26. Secondly, and without prejudice to the above, the Litigation Chamber proceeds to
classification without follow-up for reasons of expediency (criteria B.2 and B.5 of the said policy). 4
27. On the one hand, the Litigation Chamber notes that the grievance raised by the complainant does not
does not meet the high general or personal impact criteria, as defined by ODA
in its note on the no action classification policy of June 18, 2021.
28. On the other hand, if the criteria of high general or personal impact do not apply, the
Litigation Chamber weighs the personal impact of the circumstances of the complaint
4A dismissal for reasons of expediency does not mean that the Litigation Chamber legally notes that no
violation has occurred, but the resources required to substantiate the complaint are potentially excessive. ; Protection Authority
data, “Political classification without further action of the Litigation Chamber”, June 18, 2021, available on
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-contentieuse.pdf Decision 141/2023 - 6/7
for the rights and fundamental freedoms of the complainant, and the efficiency of her intervention,
to decide whether it considers it appropriate to deal with the complaint in depth.
In this case, the Litigation Chamber notes that there are legal proceedings underway
which includes the grievances made in the complaint filed by the complainant with the police on
October 7, 2022. However, the Litigation Chamber recalls that it assesses the efficiency
of its intervention as well as the means necessary to handle the complaint in a manner
in-depth. In this context, given the absence of substantial evidence (see points
21 to 25) and the significant resources that this would imply, the Litigation Chamber
concludes that it would not be appropriate to launch an investigation through the Inspection Service
to corroborate the complainant's allegations, nor to make decisions parallel to a
ongoing legal proceedings. Consequently, the Litigation Chamber decides not to
carry out an examination of the merits of the case.
29. In conclusion, the Litigation Chamber decides to proceed with the classification without further action.
the complainant's complaint, both for technical reasons and for reasons of expediency.
30. For information purposes, and without this constituting any corrective measure
or sanction within the meaning of article 95, §1 of the LCA, the Litigation Chamber recalls
nevertheless, any data controller must be able to demonstrate the
compliance of its processing with the GDPR, and throughout, by virtue of
Article 5.2 of the GDPR.
III. Publication and communication of the decision
31. Given the importance of transparency regarding the process
decision-making and the decisions of the Litigation Chamber, this decision will be published on the
website of the Data Protection Authority. However, it is not necessary for this
so that the identification data of the parties are directly communicated.
32. In accordance with its policy of dismissal, the Litigation Chamber
5
will communicate the decision to the defendant(s). Indeed, the Litigation Chamber decided
to communicate the decisions of dismissal to the defendants by default. There
Chambre Litigation, however, refrains from such communication when the complainant
requested anonymity with regard to the defendant(s) and when the communication of the
decision to the defendant(s), even pseudonymised, nevertheless risks allowing its re-
identification . This is not the case in the present case.
5
Data Protection Authority, “Disclosure policy of the Litigation Chamber: 5. – Filing without action will be-
Did he publish? Will the opposing party be informed? », June 18, 2021, available on
6ttps://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-contentieuse.pdf.
Ibid. Decision 141/2023 - 7/7
FOR THESE REASONS,
the Litigation Chamber of the Data Protection Authority decides, after deliberation,
to dismiss this complaint in accordance with article 95, § 1, 3° of the LCA.
In accordance with article 108, § 1 of the LCA, an appeal against this decision may be lodged,
within thirty days from its notification, to the Court of Markets (court
of Appeal of Brussels), with the Data Protection Authority as defendant.
Such an appeal may be introduced by means of an interlocutory request which must contain the
information listed in article 1034ter of the Judicial Code. The interlocutory request must be
8
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , Or
via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. judic.).
To enable it to consider any other possible course of action, the Litigation Chamber refers
the complainant to the explanations provided in its policy of dismissal. 9
The Litigation Chamber emphasizes that the classifications without further action are likely
to be taken into account by the Data Protection Authority in order to set its future priorities
and/or could inspire future initiative investigations by the Inspection Service of the Authority of
Data protection.
(sé). Hielke HIJMANS
President of the Litigation Chamber
7The request contains barely any nullity:
1° indication of the day, month and year;
2° the name, first name, domicile of the applicant, as well as, where applicable, his qualifications and his national register number or number
business;
3° the surname, first name, address and, where applicable, the status of the person to be summoned;
4° the object and summary of the grounds of the request;
5° indication of the judge who is seized of the request;
6° the signature of the applicant or his lawyer.
8The request, accompanied by its annex, is sent, in as many copies as there are parties involved, by registered letter to
clerk of the court or filed with the registry.
9Data protection authority, “Disclosure policy of the Litigation Chamber: 4. – What can I do if my complaint
estclasséesanssuite?”, June 18, 2021, available at https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-
suite-of-the-contentious-chamber.pdf.
