Court of Appeal of Brussels - 2019/AR/1234
| Hof van Beroep - 2019/AR/1234 | |
|---|---|
 | |
| Court: | Court of Appeal of Brussels (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 12 GDPR Article 15 GDPR |
| Decided: | 23.10.2019 |
| Published: | |
| Parties: | The Federal Public Service (FPS) Health, Food Chain Safety and Environment |
| National Case Number/Name: | 2019/AR/1234 |
| European Case Law Identifier: | |
| Appeal from: | APD/GBA 05/2019 |
| Appeal to: | Not appealed |
| Original Language(s): | Dutch |
| Original Source: | APD/GBE (in Dutch) |
| Initial Contributor: | Jette |
The Court of Appeal of Brussels held the Belgian DPA exceeded the limits of its competence by including a value judgement and furthermore, based its decision against the FPS on insufficent grounds. The Court therefore overturned the decision.
English Summary
Facts
The appealed decision concerns a healthcare professional (data subject) whose appointment as a deputy member of PGC Limburg (Provinciale Geneeskundige Commissie van Limburg) was withdrawn by a decision correcting his previous appointment. The data subject submitted an access request at the FPS Public Health (controller) to figure out why his appointment was withdrawn. With no response from the FPS Public Health, he filed a first complaint with the Belgian DPA.
In October 2018, the DPA ordered the FPS Public Health to respond to the data subject's request, but the FPS did not comply. The data subject then filed a second complaint in 2019.
The DPA found that the FPS had not established internal procedures in compliance with the GDPR's standards. In doing so, the FPS Public Health also failed to comply with the principle of accountability (Article 5(2) GDPR). The DPA noted that the FPS acknowledged these facts and stated that there were problems with its internal procedures. The DPA decided to reprimand the FPS for its violations. Additionally, the DPA held that the FPS must implement internal procedures in line with the GPDR.
In the appeal procedure, the FPS argues that: 1. the complaint has become devoid of all purpose 2. the DPA interprets the right to access to broad, violating Article 15 GDPR; 3. there was no violation of Article 12(3) and 12(4) GDPR, as it has a procedure in place to handle these requests; and 4. the DPA exceeded the limits of its competence, as the decision was based on violations that were not stated by the data subject.
Holding
The Court of Appeal of Brussels held that, while the purpose of the complaint deviates from that of the appealed decision, the DPA can, on its own initiative, investigate the controller after a complaint.
The Court found no trace of the FPS's alleged statement that it commited any kind of error in the record of the proceedings. However this was indicated by the DPA and, moreover, used to substantiate its decision. The Court therefore held that the decision was based on insufficient grounds, as the evidence did not correspond with facts and arguments given by the DPA. Consequently, the decision can be overturned.
The Court noted that the DPA can only judge whether a controller complies with the GDPR. However, the DPA based its decision on a value judgement regarding the internal decision of the FPS to exclude the data subject. The Court therefore held that the DPA exceeded the limits of its competence. This is another reason to overturn the decision.
As the decision is being overturned, the Court stated that there was no need to get into the DPA's interpretation of the right of access (Article 15 GDPR). In addition, the Court also noted that exceeding the deadline laid down in Article 12(3) and article 12(4) was not sanctioned as a legal rule. It therefore cannot result in any lawful sanction.
Lastly, by publicising the decision without anonymising it, altough with consent of both parties, the Court held that the decision was meant to unnecessarily harm the FPS.
The Court overturned the appealed decision and ordered the DPA to publicise the current judgement on its website, including identification details of the parties.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
,,,,,,,,,,,,,,,,,,,,,,,,,,,,
