APD/GBA (Belgium) - 42/2020

APD/GBA - DOS-2019-01240
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 2(1) GDPR Article 4(7) GDPR Article 6(1)(f) GDPR
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	30.06.2020
Published:
Fine:	None
Parties:	n/a
National Case Number/Name:	DOS-2019-01240
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Dutch
Original Source:	Gegevensbeschermingsautoritei (in NL)
Initial Contributor:	n/a

Belgium DPA looked into the complaint of a person whose Facebook profile picture was shared by the defendant by email without his consent. The organization that shared the picture was looking to comply with the prior judgement of the Sports Court prohibiting the complainant from attending training sessions, championships or other competitions organized by one defendant. Belgium DPA decided that this kind of processing was allowed under the legal basis of legitimate interest of the controller.

English Summary

Facts

On 25 of February 2019 the complainant has submitted a complaint against Organization 2. The essence of the complaint was: screenshot of his Facebook profile picture was shared by Organization 2 without his consent. The complainant asserted that his profile picture was not publicly available. On 8 July 2019 DPA declared the complaint admissible. On 23 July 2019 the Disputes Chamber decided that the file was ready to be considered on the merits. On 4 September 2019 the Disputes Chamber received the response of both organizations involved in this processing (defendants). On 8 October 2019 the Disputes Chamber received the conclusion response of the complainant, limiting the subject of the complaint to the sharing of the picture via email. On 30 October 2019 Disputes Chamber accepted another comment from the defendants, stating that the complainant violated article 124 of the electronic communications law by deliberately accessing the email that was not addressed to him. On 27 May 2020 the parties were heard by the Disputes Chamber.

Dispute

The defendants were able to demonstrate that the Facebook profile picture of the complainant was publicly available and in no way protected. The organizations are also of the opinion that no personal data processing took place in this case because the complainant failed to demonstrate that his picture was structured according to the specific criteria. In case if the DPA finds that personal data processing took the place, the defendants invokes legitimate interest as a legal basis of processing and refers DPA to the judgement of the Sports Court prohibiting the complainant from attending training sessions, championships or other competition organized by Organization 1 for the period of one year.

On 8 October the complainant agreed that his profile pictures were publicly accessible. However, in his opinion legitimate interest was not applicable in this case because it was possible to find his picture by searching on Facebook directly. So the sharing of his picture via email was not necessary.

Holding

DPA held that: 1) Organization 2 was acting as a processor on behalf of Organization 1 when it shared complainant's pictures via email with third parties; 2) Personal data processing via automated means took place. The argument of the defendants that the complainant failed to demonstrate that his picture was structured according to the specific criteria was not relevant because the filing system criterion applies to manual processing only; 3) The fact that profile picture was publicly available doesn't mean that it can be used without legal basis; and 4) Legitimate interest was a valid legal basis in this case:

   Purpose test satisfied, purpose: enforcing the judgement of the Sports Court;
   Necessity test satisfied: picture of the complainant was necessary to identify him. In addition, the controller edited the picture of the complainant is such a way, that another person on that photo was no longer visible, complying with the principle of data minimization;
   Balancing test satisfied: DPA took into account the reasonable expectations of the complainant and found that because the complainant made his picture publicly available, it was within his reasonable expectations that third parties might access that picture and use it. Moreover, according to the Sports Court judgement, organization 1 (controller) was required to communicate the prohibition to all organizers of completions in Belgium. Although the judgement did not specifically instruct organization 1 to share pictures of the complaint, DPA considered this necessary for the purpose of identifying the complainant. 

Comment

It was not clear whether the legitimated interest assessment was provided by the defendant or executed by the DPA.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.