APD/GBA (Belgium) - 41/2022
From GDPRhub
| APD/GBA (Belgium) - 41/2022 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 5(1)(c) GDPR Article 5(1)(e) GDPR Article 6(1)(e) GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 18.03.2022 |
| Published: | |
| Fine: | None |
| Parties: | n/a |
| National Case Number/Name: | 41/2022 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Dutch |
| Original Source: | APD/GBA (in NL) |
| Initial Contributor: | kc |
The Belgian DPA held that a municipality was entitled to send emails to data subjects who had previously registered their email addresses for a campaign as volunteers.
English Summary
Facts
Three data subjects registered as volunteers for the distribution of mouth masks with their email addresses. They claimed that the controller, the municipality that organised the campaign, had used their email addresses for other purposes.
Holding
The DPA found no violation by the controller. There was no indication that the controller had used the emails for other purposes than the campaign. In particular, it had used the BCC function when sending out emails to the mailing list so that the recipients could not see each others contact data. According to the DPA, the controller was justified by Article 6(1)(e) GDPR which allows processing of personal data for the purposes of public interest, especially since the data had been provided by the data subjects themselves. Furthermore, the controller had complied with the principles of data minimisation (Article 5(1)(c) GDPR) and of storage limitation (Article 5(1)(e) GDPR).
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/6
Dispute room
Decision on the merits41/2022 of 18 March 2022
File number: DOS-2020-03145 / DOS-2020-3155 / DOS-2020-03156
Subject : Improper use of email addresses
The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke Hijmans,
chairman and Messrs Dirk Van Der Kelen and Christophe Boeraeve, members;
Having regard to Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 on
the protection of natural persons with regard to the processing of personal data and
on the free movement of such data and repealing Directive 95/46/EC (General
Data Protection Regulation), hereinafter GDPR;
Having regard to the law of 3 December 2017 establishing the Data Protection Authority, hereinafter WOG;
Having regard to the internal rules of procedure, as approved by the Chamber of Representatives
on December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;
Having regard to the documents in the file;
has taken the following decision regarding:
†
The complainants: Mrs. X1, hereinafter “complainant 1”; †
Mr X2, hereinafter referred to as “complainant 2”; †
Mr X3, hereinafter “complainant 3”;
The Defendant: Mrs. Y, hereinafter referred to as “the Defendant”, Decision on the merits 41/2022 - 2/6
I. Facts procedure
1. On 29 June 2020, the complainants each filed a separate complaint with the
Data protection authority against the defendant.
The subject of the complaint concerns the use by the defendant, aldermen of the municipality (…),
from e-mail addresses obtained via the general e-mail address of the municipality (…) in the context of
a call for volunteers for the distribution of mouth masks, to personally meet the volunteers
via her own professional email address (…).
2. On 6 July 2020, the complaint will be declared admissible by the Frontline Service on the basis of the
Articles 58 and 60 of the WOG and the complaint pursuant to Article 62, §1 of the WOG is forwarded to the
Dispute room.
3. On September 23, 2020, the Disputes Chamber decides to join the three complaints, since it
subject of the complaint is the same. Pursuant to Article 95, §1, 1° and Article 98 WOG,
also decides that the file is ready for treatment on the merits and the parties concerned are
parties have been notified of the provisions as stated in article 95, §2, as well as of this article
98 WOG. They are also informed, pursuant to Article 99 of the WOG, of the time limits to
to submit their defences.
The deadline for receipt of the defendant's statement of defense was thereby set
laid down on November 3, 2020, this for the conclusion of the complainants' reply on 24
November 2020 and those for the defendant's statement of reply on December 15, 2020.
4. On September 23, 2020, complainant 3 requests a copy of the file (art. 95, §2, 3° WOG), which
it was transferred on October 21, 2020.
5. On October 29, 2020, the defendant states that defenses will be filed and states
know that they wish to make use of the opportunity to be heard, in accordance with
article 98 WOG.
6. On November 2, 2020, the Disputes Chamber will receive the statement of defense from the
defendant. She states that as ships of communication she received permission on May 19, 2020
of the College of Mayor and Aldermen to coordinate and communicate
the distribution of the mouth masks in consultation with an official. The data that the
volunteers, were, according to the defendant, only used for the purpose
for which they were intended, namely the organization of the distribution of mouth masks. She has
addressed the volunteers as aldermen of communication through her municipal e-mail address and
solely for the intended purpose. The recipients of the email were placed in “bcc” and
the e-mail addresses were deleted after the invitation was sent., Decision on the merits 41/2022 - 3/6
7. On November 23, 2020, the Disputes Chamber will receive the statement of reply from complainants 1 and 2
stating that there is as yet no evidence that the defendant had the consent
obtained from the College of Mayor and Aldermen and the general director. Complainants 1
and 2 add that a decision of the College of Mayor and Aldermen is not in conflict
may be in accordance with applicable law. On the same day, the Disputes Chamber also receives the
conclusion of the complainant's reply 3. This contains, in outline, the statement that the
mouth mask distribution was officially assigned and not to a mandatary. The defendant is
not a processor or controller. According to complainant 3, there would be an incompatible
further processing has taken place and he refers for this to Article 75, 2° of the law
of 30 July 2018 . Complainant 3 also relies on the law of 30 July with regard to the legal basis
2018, in particular Article 74, 4°.
8. The defendant has not made use of the opportunity to add another statement of reply
to submit.
9. On January 13, 2022, the parties will be notified that the hearing will take place
on March 10, 2022.
10. On March 10, 2022, complainant 3 and the defendant will be heard by the Disputes Chamber. Complainants 1
and 2 have not appeared.
11. The minutes of the hearing will be submitted to the parties on 11 March 2022.
12. On March 11, 2022, the Disputes Chamber receives the response from the defendant that it does not
has any comments with regard to the summary of what is at the hearing forward
brought.
13. On March 17, 2022, the Disputes Chamber receives a notification from the complainant that he does not
has comments with regard to the official report. He does, however, specify
which the Disputes Chamber decides to include in its deliberations.
II. Justification
14. The complainants argue that their e-mail addresses from which they had addressed the
general e-mail address of the municipality (…) in order to register as a candidate volunteer for
the distribution of mouth masks, were used by the defendant to personally protect them
contact us. The complainants allege that the defendant does not have access to the relevant e-mail
receive e-mail addresses and thus not process this personal data, since the
the defendant did not need this information for the performance of its function. Support the complainants
1
Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, Decision on the merits 41/2022 - 4/6
their argument on the absence of any decision by the college of aldermen in which the
the defendant would have been assigned a task in the context of the organization of the volunteer work
in the distribution of face masks.
15. The Disputes Chamber establishes that the e-mail addresses of the complainants have been provided by themselves on their own initiative
movement were provided as volunteers within the framework of the municipality
organized distribution of mouth masks. The municipality must be regarded as the
controller within the meaning of Article 4. 7) GDPR , as she is the body that
purpose and means for the processing of the personal data, in this case the relevant e-mail
3
email addresses. The legal basis for the municipality to collect the personal data of the
volunteers – including their e-mail addresses – is the need to perform a task of
public interest (Article 6.1 e) GDPR), in particular the need to take measures
take with a view to preventing the further spread among the citizens of
infection with the coronavirus. The factual elements of the file do not show that the
defendant uses the email addresses of the volunteers for any purpose other than that for which
the data was collected, has used. There is no indication whatsoever that the defendant
has appropriated the personal data of the volunteers who registered by email
for any purpose other than that for which they were collected, in particular the organization of the
mouth mask distribution. The defendant brought in the volunteers, including the complainants
this framework and thus with respect for the purpose limitation principle (Article 5.1 b) GDPR) contacted in
connection with the practical organization of the mouth mask distribution. She also did this from
2Article 4.
For the purposes of this Regulation:
†
7) 'controller' means a natural or legal person, a public authority, a service or other body
which, alone or jointly with others, determines the purposes and means of the processing of personal data; when the
the purposes and means of such processing may be established in Union or Member State law
determine who the controller is or according to which criteria it is designated;
33
In this regard, complainant 3 relies for the legal basis on Article 74 of the Law of 30 July 2018 on the protection of
natural persons with regard to the processing of personal data. The Disputes Chamber points out that this provision only
applies to the protection of natural persons with regard to the processing of personal data by the
intelligence and security services (see Subtitle I of Title 3 of the law of 30 July 2018). However, the present file has no
relating to data processing by intelligence and security services. This applies equally to articles 75, 2° and 84 of
the law of 30 July 2018 on which complainant 3 relies, so that the provisions cited by complainant 3 do not apply.
4Article 6.
1. Processing is only lawful if and insofar as at least one of the following conditions is met:
†
e) the processing is necessary for the performance of a task carried out in the public interest or of a task carried out in the exercise
from the public authority entrusted to the controller;
†
5Article 5
1. Personal data must:
†
b) collected for specified, explicit and legitimate purposes and may not be further
are processed in a manner incompatible with those purposes; further processing with a view to archiving in general
interest, scientific or historical research or statistical purposes shall not be regarded as
considered incompatible with the original purposes ("purpose limitation");, Decision on the merits 41/2022 - 5/6
her professional email address in her capacity as ships, so by no means from her
personal private email address.
16. The defendant acted fully within the original purpose for which the
data were obtained and involved by the municipality as controller
volunteers contacted from her position as aldermen on behalf of the municipality, as also
according to the session report of the Board of Mayor and Aldermen dated 19 May 2020
which explicitly states that the coordination of the mouth mask distribution will be
entrusted to one official “in association with ships Y” (being the defendant).
17. In addition, when sending the e-mail which is the subject of the
complaint made use of the “bcc” function which allows the intended recipients of the email
can be reached in a single movement without the e-mail addresses of everyone being visible. The
data processing was therefore by no means excessive and was done in full accordance with
6
the principle of data minimum processing (Article 5.1 c) GDPR).
18. The principle of storage limitation (Article 5.1 e) GDPR) was also complied with. After all, as soon as it
purpose - the distribution of mouth masks - was reached, the e-mail addresses were destroyed. The
the defendant has stated that this destruction took place, which the complainant does not regard as
is thus disputed. In addition, there is no document showing that the defendant
would have used e-mail addresses after the mouth mask distribution, so that there is no doubt about it
the fact that the data was indeed destroyed after the purpose was achieved.
19. The Disputes Chamber thus concludes that the defendant has not committed any infringement of
the AVG.
6Article 5
1. Personal data must:
†
c) adequate, relevant and limited to what is necessary for the purposes for which they are processed ("minimum"
data processing”);
7
Article 5
1. Personal data must:
e) be kept in a form that makes it possible to identify the data subjects for no longer than for the purposes for which
the personal data are processed is necessary; personal data may be stored for longer periods for
insofar as the personal data is solely for the purpose of archiving in the public interest, scientific or historical research or
statistical purposes shall be processed in accordance with Article 89(1) provided that the appropriate technical requirements required by this Regulation
and organizational measures are taken to protect the rights and freedoms of the data subject
("storage limitation");, Decision on the merits 41/2022 - 6/6
III. Publication of the decision
20. Given the importance of transparency in the decision-making of the
Litigation Chamber, this decision will be published on the website of the
Data Protection Authority. It is not necessary, however, that the identification data
of the parties shall be published directly.
FOR THESE REASONS,
the Disputes Chamber of the Data Protection Authority decides, after deliberation, to
of Article 100, §1, 1° WOG, to dismiss the complaint in view of the fact that there is no infringement in this regard
can be determined on the basis of the GDPR.
Against this decision, pursuant to art. 108, §1 WOG, appeals must be lodged within a
period of thirty days, from the notification, to the Marktenhof, with the
Data Protection Authority as Defendant.
(Sé). Hielke Hijmans
Chairman of the Disputes Chamber
