APD/GBA (Belgium) - 141/2022
| APD/GBA - 141/2022 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 17 GDPR Article 17(3) GDPR Article 17(3)(a) GDPR Article 89 GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | 19.02.2021 |
| Decided: | 04.10.2022 |
| Published: | 04.10.2022 |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 141/2022 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | French |
| Original Source: | Gegevensbeschermingsautoriteit (in FR) |
| Initial Contributor: | Enzo Marquet |
The Belgian DPA closed a complaint on the basis of expediency because of a lack of evidence. There was insufficient evidence to balance conduct a balancing exercise pursuant of Article 17(3)(a) GDPR between the freedom of expression/journalism against the right of data protection.
English Summary
Facts
A picture of a house, owned by the data subject, was used in a news article about a 'lock down' party. This article was posted on an online page of a newspaper (Controller). The data subject first contacted the newspaper and requested the removal or correction of the news article because according to him, it contained several mistakes, such as that the lock down party had not taken place in this house. He also stated that the publication of the photo was in essence the same as the publication of his address. The data subject also stated that he was discredited by the local community because of the article and that he received hateful messages on social media.
Before submitting the complaint at the Belgian DPA (DPA) on 19 February 2021, the data subject contacted the DPO of the controller with the request to either delete the published information or to correct it. The data subject especially requested to delete the photo, because he felt that the publication of the photo was disproportionate and not necessary for the article. The controller replied that the information was, in fact, accurate.
Holding
Closure of the proceedings
The DPA determined that it would dismiss the complaint pursuant of Article 95(1)(3) LCA.
The DPA explained that when it decided to end a procedure, it had to pronounce a technical dismissal if there were insufficient elements that could lead to a sanction or when there was a technical hurdle that would prevent the DPA to make its decision. The other option was to end a procedure on the basis of expediency. This can be the case when despite the presence of elements that could lead to a sanction, further investigation of the case does not appear appropriate in the light of the priorities of the DPA. In this decision, the DPA closed the case on the basis of expediency. According to the DPA, the grievances raised by the data subject did not meet the criteria of high general or personal impact.
The DPA also stated for that disputes, it would balance the personal impact for the fundamental rights and freedoms of the data subject against the effectiveness of action taken by the DPA, in order to decide if it was expedient to continue the proceedings.
Erasure request
The DPA stated that Article 17(1)(c) GDPR gives the data subject the right to request erasure of his personal data when one of the requirements of Article 17 GDPR is applicable, especially when personal data is no longer necessary for the purposes for which they were originally collected or otherwise processed (Article 17(1)(a) GDPR). The DPA determined that it was authorized to determine if the controller had applied Article 17 GDPR correctly in its reaction to the data subject, including the use of Article 17(3) GDPR by the controller.
The DPA stated that the request of the data subject was a request for erasure from an online archive, belonging to a press organisation. The DPA reiterated that Article 89 GDPR acknowledged the importance of processing personal data for archiving purposes in the public interest. The DPA also stated that, according to the case law of the CJEU, internet archives were protected under Article 10 ECHR and Article 11 of the Charter. The DPA also added that Article 17(3)(a) GDPR prescribes that Article 17(1) GDPR is not applicable when processing is necessary for the freedom of expression and information. For this exception, a balancing exercise has to be conducted between the freedom of expression and the right to data protection.
The DPA also referred to the Google Spain case and stated that the rights of privacy and data protection (Article 7 and 8 of the Charter) usually prevail in this balancing test. However, this balancing exercise can in special cases depend on the nature of the specific information and the sensitivity of this information for the privacy of the data subject, as well as the public’s interest in having access to this information, which can vary depending on the role of the data subject in public life. (C -131/12, Google Spain en Google, par 81).
The DPA determined that the sole wish from data subject to be removed from the online archive was not sufficient. Digital archives contain valuable information for which accessibility must be preserved. Archives also contribute to democratic opinion-forming. Any measure preventing access to these archives must be justified with particularly compelling reasons. The DPA also added that the ECHR had stated that there is more room for balancing conflicting interests when the archived information relates to past events than when it relates to current or recent events.
The DPA stated that the photo of the house constituted personal data, because the data subject was the owner of the house, which made him indirectly identifiable. Therefore, the data subject was entitled to use Article 17 GDPR to request removal, if any of the requirements in Article 17 GDPR were applicable. However, the DPA determined that the processing in this case fell under the journalistic exception. The DPA also held that the controller could have a legitimate interest for the processing of this information. In general, erasure request were also thoroughly reviewed by the controller using the journalistic ethical code, especially regarding the truthfulness of the information and confidentiality of used sources.
The data subject's position was that the lockdown party did not take place in his building, but he did not provide any evidence. The controller stated that this was incorrect, after checking this fact with the responsible journalist internally. The DPA determined that the positions of both parties were opposites. Without decisive evidence, a balancing act pursuant of Article 17(3)(a) GDPR was deemed impossible.
The DPA continued by stating that at first glance, the complaint was not precise enough and provided too little evidence to enable the DPA to make a decision without starting an investigation. The DPA determined that it was not expedient to enlist the help of its investigation service. An investigation would not be proportionate, looking at the resources necessary to make the investigation a success. Also, at first glance, the DPA determined that it would not be able to gather evidence in this case, unless it would interview the journalist and ask him to reveal his sources. This kind of investigation is normally not a priority for the DPA.
The DPA recommended the data subject that he would select a more appropriate legal remedy.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/7
Litigation Chamber
Decision 141/2022 of October 4, 2022
File number: DOS-2021-00827
Subject: Complaint relating to the publication of personal data in the press
The Litigation Chamber of the Data Protection Authority, made up of Mr Hielke
Hijmans, President, sitting alone;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and
to the free movement of such data, and repealing Directive 95/46/EC (general regulation on the
data protection), hereinafter GDPR;
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter
ACL);
Having regard to the Law of 30 July 2018 relating to the protection of natural persons with regard to
processing of personal data (hereinafter LTD);
Having regard to the Rules of Procedure as approved by the House of Representatives on 20
December 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Made the following decision regarding:
The complainant: Mr. X, hereinafter “the complainant”;
The defendant: Y, hereinafter “the defendant”. Decision 141/-2/7
I. Facts and procedure
1. The complainant filed a complaint with the Data Protection Authority (DPA) on 19
February 2021 regarding the publication of the photo of the house he owns in
the online pages of the defendant's newspaper. This photo illustrated an article relating
a “lock-down” party in an Ardennes village that took place in said house, according to
the press article “lockdown party at [locality] – (…)”.
2. The complainant contacted the newspaper to request the deletion or rectification of
the article which according to him gives erroneous information:
- The lockdown party would not have taken place in that accommodation;
- The people responsible for a lockdown party in the village would never have
wanted to organize a seminar.
3. The Complainant believes that publication of the photo is equivalent to publication of his address
and deplores having suffered damage following this publication: “we have suffered
degradation of the local population to one of our lodgings, messages of hatred rang out on
social networks ; we are very badly regarded in the commune”.
4. Prior to filing his complaint, the complainant contacted the delegate for
protection of the defendant's data to claim the deletion and/or the
rectification of the data published, in particular the deletion of the photo estimating this
disproportionate and unnecessary data for press information on the holding of a
lockdown party in a Belgian border village, with the corollary, according to the complainant, the
suspicion of having imported the virus there. In his email of February 16, 2021 to the defendant,
the plaintiff considered it "unacceptable for the press to throw out erroneous data, without verifying
their accuracy and without measuring the impact on the lives of its targets, while the information
brings nothing to the public, neither safety nor useful information”. The defendant has
replied that after investigation with the journalist concerned, the information
mentioned in the article are exact and have been treated on the basis of article 24 § 2 of the LTD.
II. Motivation
5. Based on the facts described in the complaint file as summarized above, and on
basis of the powers attributed to it by the legislator under Article 95.1.
LCA, the Litigation Chamber decides to proceed with the classification without follow-up of the
complaint, in accordance with article 95.1, 3° LCA, for the reasons set out below. Decision 141/-3/7
6. In terms of classification without follow-up, the Litigation Chamber must justify its decision by
step and:
- to pronounce a classification without technical continuation if the file does not contain or not
sufficient elements likely to lead to a sanction or if it includes a
technical obstacle preventing him from rendering a decision;
- or pronounce a classification without further opportunity, if despite the presence
elements likely to lead to a sanction, the continuation of the examination of the
file does not seem to him to be appropriate given the priorities of ODA such as
specified and illustrated in the Chamber's Discontinued Classification Policy
Litigation. 2
7. In the event of dismissal on the basis of several reasons (respectively, dismissal
without technical and/or opportunity follow-up), the reasons for the classification without follow-up must be
treated in order of importance.
8. In the present case, the Litigation Chamber proceeds to a dismissal for
motive of opportunity. Indeed, the Litigation Division notes that the grievances raised by the
complainant do not meet the high general or personal impact criteria, such as
defined by the DPA in its note on the classification policy without follow-up of June 18, 2021.
9. Furthermore, the Litigation Chamber weighs the personal impact of the circumstances
of the complaint for the fundamental rights and freedoms of the complainant and the efficiency of his
intervention, to decide whether it considers it appropriate to deal with the complaint in a
thorough.
10. According to Article 17.1.c) of the GDPR, a data subject has the right to obtain from the controller
the processing the erasure, as soon as possible, of personal data the
concerning when one of the conditions of application of this article applies,
thus in particular, when the personal data are no longer necessary for the
with regard to the purposes for which they were collected or otherwise processed
(Art. 17.1.a) GDPR).
1
2Cour des marchés (Brussels Court of Appeal), September 2, 2020, 2020/AR/329, p. 18.
See Discontinued classification policy of the Litigation Chamber, 06/18/2021, available at
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
litigation.pdf. Decision 141/-4/7
11. In this case, the Litigation Chamber is entitled to check whether a person responsible for
processing has, in its response to the exercise of his right of erasure by a person
concerned, correctly applied Article 17 of the GDPR. This control also covers
whether or not it is appropriate to use Article 17.3 of the GDPR, which requires the controller to
treatment (i.e. the defendant) to operate a balance of interests to conclude or not to
the need for treatment in the name of freedom of expression.
12. The Litigation Chamber understands that in this case, the request for erasure concerns
on the online archives of a press organ. The Litigation Chamber reminds this
respect that the GDPR recognizes the importance of the processing of personal data for
archival purposes in the public interest in Article 89. Such processing is subject to
appropriate safeguards for the rights and freedoms of data subjects.
In accordance with the case law of the European Court of Human Rights, the 3
Internet archives are indeed content protected by the right to freedom of expression
and information (Article 10 of the European Convention on Human Rights (ECHR) and
Article 11 of the EU Charter of Fundamental Rights).
13. Article 17.3.a) of the GDPR adds that Article 17.1 will not apply insofar as this
processing is necessary for the exercise of the right to freedom of expression and information,
thus providing, under the very terms of Article 17 of the GDPR, an exceptional regime which
implies a balance of interests between two fundamental rights (the right to freedom
of expression and the protection of personal data). 4
In its “Google Spain” judgment of 13 May 2014, the Court of Justice of the European Union
sets out that, as a general rule, the rights of the data subject enshrined in Articles
7 and 8 of the Charter of Fundamental Rights of the European Union (EU) (i.e. the right to life
privacy and the protection of personal data) prevail. Nevertheless, "this
balance may however depend, in particular cases, on the nature of the information in
issue and its sensitivity to the privacy of the data subject as well as
the interest of the public in having this information, which may vary, in particular,
depending on the role played by that person in public life”.5
14. As the European Court of Human Rights has repeatedly pointed out,
the wish of a (concerned) person to erase his past is not sufficient to justify a
measure of modification of the archives precisely because these archives participate, at the
3
eur. D.H., HURBAIN v. Belgium, 22 June 2021, req. No. 57292/16. ; see also Litigation Chamber, Decision
439/21, available at https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-139-2021.pdf.
Litigation Chamber, Decision 139/21, available at https://www.autoriteprotectiondonnees.be/publications/decision-
quant-au-fonds-n-139-2021.pdf.
5C.J.U.E., May 13, 2014, C-131/12, Google Spain and Google judgment, paragraph 81. Decision 141/-5/7
same title as the initial publication, to the effectiveness of the freedom of expression and
information as mentioned above. Digital archives are a
valuable source of information whose accessibility must be preserved. They participate in
the formation of democratic opinion and any measure limiting access by the public – which
has the right to receive them – must be justified by particularly compelling reasons .6
15. The European Court of Human Rights adds that a wider latitude exists for
balancing competing interests when information is archived
and relate to past events only when they relate to events
current, recent..7
16. In the present case, the image which the complainant requests to be deleted, namely the
photograph of a house he owns, allows, according to the complainant, to identify him
indirectly, in connection with the facts reported in the newspaper. This image therefore constitutes a
personal data within the meaning of the GDPR and the complainant is entitled to request the deletion
of this data if he demonstrates the conditions of application of Article 17 of the GDPR.
17. The processing of this data seems to fall within the scope of the journalistic exception
referred to above and the press organization may have a legitimate interest in processing this
information. The request for erasure of a journalistic article by the press organ
itself is subject to the rules of journalistic ethics, in particular with regard to
concerns the veracity of the data and the secrecy of the sources.
18. The Litigation Chamber emphasizes - that in support of all the elements which have been
presented - the complainant's request was the subject of a response from the newspaper. The complainant
claims without further evidence that the incriminated "lockdown party" would not have taken place
held in its building. The defendant's organ asserts the opposite after having checked
this point internally with the journalist in charge
19. The Litigation Chamber submits that the position adopted by the Complainant and the Respondent
are diametrically opposed and that the absence of conclusive evidence prevents a
balancing the interests to operate between the right to data protection on the one hand and the
right to freedom of expression on the other hand pursuant to Article 17.3. a) GDPR.
6
See. for example eur court. D.H., Timpul Info-Magazin and Anghel v. Moldova, 27 November 2007; judgment M.L. and W.W.
vs. Germany, June 28, 2008 and Times Newspapers Limited v. United Kingdom judgment, March 10, 2009.
7 European Court. D.H., Times Newspapers Limited v. United Kingdom, 10 March 2009, req. 3002/03 and 2676/03, point 45.
8 GDPR, Art. 6.1.f). Decision 141/-6/7
20. Indeed, it seems prima facie that the complaint is not sufficiently precise and does not provide
insufficient evidence to allow the Litigation Chamber to take a
decision without recourse to an investigation by the Inspection Service. The Litigation Chamber
considers that it is not appropriate to call on the Inspection Service to substantiate the complaint
since an examination of the complaint would not be proportionate taking into account the means
9
necessary to put the complaint in a state of being examined and of the chances of success . Of
In fact, it appears prima facie that the DPA would not have the possibility of collecting evidence on this
subject except to question the journalist and ask him to reveal his sources. This guy
examination, in principle, does not fall within the priorities of a supervisory authority such as
ODA.
21. Accordingly, the Litigation Chamber considers that it does not have the opportunity to rule on
the existence of a breach of the GDPR based on the elements provided in the complaint.
22. Furthermore, the Litigation Chamber recalls that the complainant has the possibility of choosing a
more appropriate legal remedy (e.g. seize the Belgian courts and tribunals, demand a right of
response and/or seize the ad hoc ethical bodies) in the context of a
news publication.
III. Publication and communication of the decision
23. Given the importance of transparency with regard to the decision-making process and the
decisions of the Litigation Chamber, this decision will be published on the website of
the Data Protection Authority. However, for this purpose it is not necessary that the
identification data of the parties are directly communicated.
24. In accordance with its policy of dismissal, the Litigation Chamber
communicate the decision to the defendant(s).
to communicate the decisions of classification without follow-up to the defendants by default. The
However, the Litigation Chamber refrains from such communication when the complainant
requested anonymity and when the communication of the decision to the defendant, even
pseudonymized, risk of allowing the identification of the latter by the person in charge of the
treatment. This is not the case in this case, the complainant having not requested anonymity.
9 See Discontinuance policy of the Litigation Chamber, “Title 3 – In which cases is my complaint
likely to be dismissed by the Litigation Chamber? », 06/18/2021.
10Cf Discontinued classification policy of the Litigation Chamber, “Title 5 - Will the discontinued classification be published?
will the opposing party be informed? », 06/18/2021. Decision 141/20-7/7
FOR THESE REASONS,
The Litigation Chamber of the Data Protection Authority decides, after
deliberation to close the present complaint without follow-up pursuant to article 95.1,
3° the Law of 3 December 2017 establishing the Authority for the Protection of
data.
er
Under Article 108, § 1 of the LCA, this decision may be appealed to the
Court of Markets within thirty days of its notification, with the Authority of
data protection as defendant.
Such an appeal may be introduced by means of an interlocutory request which must contain the
information listed in article 1034ter of the Judicial Code. The interlocutory motion must be
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 12
via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).
To allow him to consider any other possible course of action, the Litigation Chamber sends
13
the complainant to the explanations provided in its dismissal policy.
(Sé). Hielke Hijmans
President of the Litigation Chamber
11The request contains on pain of nullity:
(1) indication of the day, month and year;
2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
Business Number;
3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
(4) the object and summary of the grounds of the application;
(5) the indication of the judge who is seized of the application;
6° the signature of the applicant or his lawyer.
12The request, accompanied by its annex, shall be sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.
13Cf. Title 4 – What can I do if my complaint is dismissed? of the Chamber's policy of classification without follow-up
Litigation.
