APD/GBA (Belgium) - 69/2024
From GDPRhub
| APD/GBA - 69/2024 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 32 GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 02.05.2024 |
| Published: | |
| Fine: | n/a |
| Parties: | X Y |
| National Case Number/Name: | 69/2024 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | APD/GBA (Belgium) (in NL) |
| Initial Contributor: | n/a |
The DPA dismissed a complaint filed by a data subject after a data breach. The DPA found the controller’s technical and organisational measures under Article 32 GDPR were appropriate.
English Summary
Facts
A bank’s employee, an ex-girlfriend of data subject, allegedly consulted data subject's personal data for one and a half of a year.
The data subject contacted the bank (controller) twice, claiming that the controller’s employee (his ex-girlfriend) breached the confidentiality of the data, as she consulted the data outside controller's instructions, namely to stalk the data subject. Also, the data subject asked about the measures taken by the controller against the employee.
Later on, the data subject decided to file a complaint with the police against his ex-girlfriend on charge of stalking.
In response, the controller explained that the employee processed the data subject's data outside of her professional capacity and without controller's instruction. Additionally, the controller, implemented necessary and proportionate measures, as well as reported the breach with the Dutch DPA (APD/GBA).
The data subject did not share the views of the controller and, consequently, filed a complaint with the DPA and the National Ombudsman (Nationale ombudsman), claiming a breach of confidentiality by the controller.
Holding
The DPA dismissed the data subject's complaint.
Firstly, the actions taken by the controller after data subject’s notification were sufficient in the situation at hand. The controller implemented measures which adequately dealt with the breach of confidentiality. As a result, the DPA found no evidence that the measures were ineffective, especially they did not stop the employee from further unlawful conduct. At the same time, the controller acted proactively, preventing similar breaches to occur in the future. Therefore, the subject matter of the case was obsolete.
Secondly, the DPA stated the complaint brought by the data subject also covered the criminal offence of stalking. However, the DPA had no jurisdiction over criminal cases of that kind, which made this part of compliant inadmissible.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/6
Dispute Chamber
Decision 69/2024 of May 2, 2024
File number: DOS-2024-01292
Subject: Your complaint regarding a breach of your confidentiality
personal data
The Disputes Chamber of the Data Protection Authority, composed of Mr
Hielke HIJMANS, sole chairman;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of
personal data and regarding the free movement of such data and to the revocation of
Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”;
Having regard to the law of 3 December 2017 establishing the Data Protection Authority,
hereinafter “WOG”;
In view of the internal rules of order, as approved by the House of Representatives
Representatives on December 20, 2018 and published in the Belgian Official Gazette on
January 15, 2019;
Considering the documents in the file;
Has made the following decision regarding:
Complainant: X, hereinafter “the complainant”;
The defendant: La banque Y, hereinafter “the defendant”. Decision 69/2024 — 2/6
I. Facts and procedure
1. The subject of the complaint concerns an alleged breach of confidentiality
personal data of the complainant that are processed by the defendant.
2. On March 7, 2024, the complainant filed a complaint with the GBA. The complaint concerns an infringement
the confidentiality of the complainant's personal data by an employee of the
defendant.
On February 8, 2024, the complainant sent an email to the defendant to complain
about an employee who would use the complainant's personal data several times
have been consulted in the last 1.5 years. The employee was due to do so in December
2023 have been addressed by the defendant and the consultations of the
admitted personal data. The complainant inquired about the
measures taken against this employee, who has also been the ex-girlfriend of 1.5 years
complainant were struck by the defendant.
On February 16, 2024, the complainant contacted the defendant again
inquire about the measures taken against the employee, because
he had been told that these measures were far from sufficient.
On February 17, 2024, the complainant filed a complaint with the police, of which the PV is responsible
attached in the documents. The complainant stated that he felt morally damaged and
to be concerned that the defendant could no longer be stalked
would have taken sufficient measures to prevent this.
On February 28, 2024, the defendant responded to the complaint. She confirmed that the
employee consulted the complainant's data “without a professional context
and without a mandate”. “Necessary and proportionate measures” were taken
taken against the employee. The defendant also reported that the infringement
was reported to the Data Protection Authority.
On March 4, 2024, the complainant responded to the communication by email
defendant with the message that he did not consider the measures proportionate and that
in the meantime he had filed a complaint with the police against the employee. He asked
also that he would file a complaint with the ombudsman and with the
Data Protection Authority.
3. On March 28, 2024, the complaint was declared admissible by the First Line Service on the grounds
of Articles 58 and 60 WOG and the complaint is filed on the basis of Article 62, § 1 WOG
transferred to the Disputes Chamber. Decision 69/2024 — 3/6
II. Justification
4. On the basis of the elements in the file that are known to the Disputes Chamber, and on the basis
of the powers granted to it by the legislature on the basis of Article 95, § 1 WOG
assigned, the Disputes Chamber will decide on the further follow-up of the file; in this case
the Disputes Chamber will dismiss the complaint in accordance with Article 95,
§ 1, 3° WOG, based on the following justification.
5. If a complaint is dismissed, the Disputes Chamber will make its decision
1
to motivate gradually and:
- to issue a technical dismissal if the file does not exist or is insufficient
contains elements that could lead to a conviction, or if there is insufficient
there is a prospect of a conviction due to a technical obstacle,
which prevents her from reaching a decision;
- or declare a policy rejection, if despite the presence of elements
that could lead to a sanction, the continuation of the investigation
dossier does not seem appropriate in the light of the priorities of the
Data Protection Authority, as specified and explained in the
dismissal policy of the Disputes Chamber. 2
6. In the event of dismissal on more than one ground, the grounds for dismissal (resp.
3
technical dismissal and policy dismissal) should be treated in order of importance.
7. In the present file, the Disputes Chamber will dismiss the complaint,
on the basis of an expediency dismissal. There are two motives underlying the decision
decision of the Disputes Chamber as to why it considers it undesirable to take further action
to the file and therefore decides not to proceed with, inter alia, a hearing at
ground
8. Firstly, the subject of the complaint appears to have disappeared as a result of the measures taken
were taken by the controller. 4
The complaint of February 8, 2024, addressed to the defendant, seems to have been brought to her attention
have on the possible violation of the confidentiality of the personal data of
1Court of Appeal Brussels, Market Court Section, 19 Chamber A, Chamber for Market Affairs, judgment 2020/AR/329, September 2, 2020,
p. 18.
2In this context, the Disputes Chamber refers to its dismissal policy as explained in detail on the GBA website:
https://www.gegevensbeschermingsautoriteit.be/publications/sepotbeleid-van-de-geschikkamer.pdf
3 Cf. Title 3 – In which cases is my complaint likely to be dismissed by the Disputes Chamber? from the
dismissal policy of the Disputes Chamber.
4Cf. criterion B.6 in the dismissal policy of the Disputes Chamber. Decision 69/2024 — 4/6
the complainant by an employee. This means that the defendant is the employee
who allegedly admitted the violation.
On February 28, 2024, the defendant informed the complainant of this
violation of the confidentiality of personal data and of the necessary and
proportionate measures that would have been taken to avoid this violation in the
future. The defendant has also submitted a data breach notification
to the Data Protection Authority.
9. The Disputes Chamber has no elements that could indicate that the violation
of the confidentiality of the complainant's personal data would not have stopped and
that the defendant's measures would not have been sufficient to prevent a
to prevent similar violations in the future. Without the importance of it forward
want to minimize the incident, the Disputes Chamber rules that a
treatment on the merits does not seem appropriate.
10. Secondly, the complaint is a secondary dispute in a broader dispute that must be settled
for courts and tribunals. 5
Following the alleged facts, the complainant filed a complaint on February 17, 2024
submitted to the police, the report of which was added to the documents. In this complaint
the complainant declares that he no longer wants to be stalked and that he feels morally damaged.
Stalking, which is the legal term under attack, is made punishable in Article 442bis of
6
the Criminal Code, which does not fall within the powers of the Disputes Chamber. The
Disputes Chamber is also not authorized to assess any moral damage suffered by a party
assess data protection breach.
Given the interpersonal context of the complaint, given the complaint filed with
the police before a complaint was filed with the Data Protection Authority and seen
the Disputes Chamber does not appear to have jurisdiction over various elements of the main dispute
a treatment on the merits of this breach of confidentiality
personal data by the Disputes Chamber is also not appropriate.
III. Publication and communication of the decision
11. Considering the importance of transparency with regard to decision-making
Dispute Chamber, this decision will be published on the website of the
5Cf. criterion B.3 in the dismissal policy of the Disputes Chamber.
6Article 442bis SW: “He who has harassed a person while he knew or should have known that his behavior caused him to rest in peace
would seriously disturb that person, shall be punished with imprisonment of fifteen days to two years and with
fine of fifty [euros] to three hundred [euros] or one of those penalties alone. […]” Decision 69/2024 — 6/6
in accordance with Article 1034quinquies of the Dutch Civil Code. , or via the e-Deposit information system
of the Ministry of Justice (Article 32ter of the Dutch Civil Code).
To enable the complainant to consider other possible remedies, the
11
Disputes Chamber will refer the complainant to the explanation in its dismissal policy.
[The Dispute Chamber emphasizes that the closure of cases by the
Data Protection Authority may be taken into account for its future
determine priorities and/or may give rise to future investigations on its own initiative
by the Inspection Service of the Data Protection Authority].
(get). Hielke IJMANS
Chairman of the Disputes Chamber
1The petition with its attachment will be sent by registered letter in as many copies as there are parties involved
deposited with the clerk of the court or at the registry.
1Cf. Title 4 – What can I do if my complaint is closed? of the dismissal policy of the Disputes Chamber.
