APD/GBA (Belgium) - 16/2023
From GDPRhub
| APD/GBA - 16/2023 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 5(2) GDPR Article 6(1) GDPR Article 24(1) GDPR Article 29 GDPR Article 32 GDPR Act of 8 August 1983 regulating a National Register of Natural Persons |
| Type: | Complaint |
| Outcome: | Partly Upheld |
| Started: | 27.02.2023 |
| Decided: | |
| Published: | 28.02.2023 |
| Fine: | n/a |
| Parties: | Centre public d'action sociale |
| National Case Number/Name: | 16/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | French |
| Original Source: | Décision 16/2023 (in FR) |
| Initial Contributor: | Matthias Smet |
An employee of the public social service acts as controller when consulting the national register of a data subject for personal purposes. This processing does not rely on a legal basis and therefore breaches Article 5(1)(a) and 6 GDPR.
English Summary
Facts
A data subject noticed that her personal data was consulted on 4 September 2019 by an intermediate of the Crossroads Bank for Social Security (BCSS). Consequently, she exercised her right of access towards the BCSS, which resulted in discovering that an employee (defendant 1) of the public social service center (CPAS) (defendant 2) had consulted her data. Based on this information the data subject filed a complaint stating that both defendants had breached Article 5(1) and articles 5 and 13 of the Act of 8 August 1983 regulating a National Register of Natural Persons which exhaustively list the purposes for which the register may be consulted.
Holding
Since the complaint was directed against two defendants, the litigation chamber determined who was the data controller within the framework of this processing activity. The DPA stated that CPAS remained the data controller for the consultations carried out by its employees. However, this qualification as 'data controller' is limited to the consultations that are carried out within the framework of the of CPAS's mission, i.e. pursuing the purposes set out in Article 5 of the Act of 8 August 1983 regulating a National Register of Natural Persons. In case of consultations and searches outside the framework of its duties as a social agent and searches for private purpose, the CPAS's employee (in this case Defendant 1), was acting as controller.
Towards the employee of CPAS (defendant 1):
The DPA stated that the employee consulted that national register without any legal basis. In doing so, the she was guilty of a breach of Article 6 GDPR combined with a breach of Article 5(1)(a) under which the processing of personal data must in particular be lawful. The DPA warned for the future that the consultation of personal data from the National Register via the BCSS for private purposes constitutes an unlawful processing of personal data.
Towards CPAS:
The DPA considered that CPAS had taken appropriate and sufficient measures in order to prevent and detect abusive use of the national registers. It therefore dismissed the complaint against CPAS.
Comment
- The wording of the complaint and the documents that were handed over imply that the complainant is the ex-wife of defendant 1's father.
- Besides the administrative procedure before the litigation chamber, article 13 of the Act of 8 August 1983 regulating a National Register of Natural Persons foresees legal sanctions as fines and imprisonment under Belgian criminal law.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/9
Litigation Chamber
Decision 16/2023 of February 27, 2023
File number: DOS-2021-06717
Subject: Consultation for private purposes of the National Register by an agent of the Center
provincial social action
The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke
Hijmans, chairman;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and
to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the
data protection), hereinafter “GDPR”;
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, hereinafter
“ACL”;
Having regard to the internal regulations as approved by the House of Representatives on 20
December 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Made the following decision regarding:
The plaintiff: Ms. X, hereinafter “the plaintiff”; .
.
.
The defendant: Mrs. Y1, hereinafter: “the defendant 1”;
Center public d’action sociale de […] Y2, hereinafter: “the defendant 2”. Decision 16//2023 – 2/9
I. Facts and procedure
1. The subject of the complaint concerns the consultation on September 4, 2019 of personal data
staff of the National Register by the defendant 1.
2. The wording of the complaint and the documents in the file indicate that the complainant is the ex-partner
Defendant 1's father. Defendant 1 works as a social worker with
of Defendant 2. Plaintiff submits that Defendant 1 is guilty of
breaches of Article 5.1.a of the GDPR, in combination with Articles 5 and 13 of the law of
August 8, 1983 organizing a National Register of natural persons to have consulted the
National Registry for improper purposes, through his functions with the defendant 2. In
consulting the history of consultations of her data in the National Register, the complainant
discovered that a consultation of his data had been carried out on September 4, 2019 by
through the Crossroads Bank for Social Security (BCSS). The complainant exercised
his right of access to the BCSS, which revealed to him that the consultation had been carried out by
2. After having exercised its right of access to the latter, the
Defendant 2 then told him that this consultation was done by Defendant 1 to
private purposes.
3. On 11 October 2021, the complainant lodged a complaint with the Authority for the Protection of
given against the defendant 1.
4. On October 19, 2021, the complaint was declared admissible by the Front Line Service on the
1
basis of Articles 58 and 60 of the LCA and the complaint is forwarded to the Litigation Chamber
st 2
pursuant to Article 62, § 1 of the LCA.
5. Pursuant to article 95 § 2, 3° of the LCA as well as article 47 of the rules of order
inside the DPA, a copy of the file may be requested by the parties. If one of
parties wishes to make use of the possibility of consulting the file, the latter is required to
contact the secretariat of the Litigation Chamber, preferably via the address
litigationchamber@apd-gba.be.
II. Motivation
II.1. Identification of data controllers and their processing
6. As already recalled by the Litigation Chamber in its decision 129/2021, 3
in accordance with Article 4 §1 LCA, the DPA is responsible for monitoring the principles of
1 Pursuant to article 61 LCA, the Litigation Chamber informs the parties by this decision, of the fact that the complaint has been
declared admissible.
2 Pursuant to Article 95, § 2 LCA, by this decision, the Litigation Division informs the parties of the fact that following
of this complaint, the file was forwarded to him.
3
Litigation Chamber, decision 129/2021 of November 26, 2021 (available on
https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-129-2021.pdf) Decision 16//2023 – 3/9
data protection contained in the GDPR and other laws containing provisions
relating to the protection of personal data including the Law of 8 August 1983
organizing a National Register of natural persons and the Law of January 15, 1990
organization of the Crossroads Bank for Social Security (BCSS) . 4
7. In accordance with article 4 §7 LCA, it is necessary to consider as responsible for the
processing: “the natural or legal person, public authority, service or other
body which, alone or jointly with others, determines the aims and means of
treatment ".
8. In this case, the Litigation Division finds that Defendant 2 determines the
purposes and means of processing. Indeed, for the CPAS, consultations of the Register
national via the BCSS are carried out only within the framework of its application missions
of social security. It is also defendant 2 who makes available to its
agents the means to carry out such processing (via its computer systems). THE
CPAS must therefore be considered as a data controller for consultations
BCSS personal data.
9. It should also be noted that, as stated by the Court of Justice of the European Union
(CJEU) in its Wirtschaftakademie judgment of June 5, 2018, “the notion of
“controller” refers to the organization which, “alone or jointly with others”
determines the purposes and means of the processing of personal data, this
concept does not necessarily refer to a single organization and may relate to several
actors […]”. Although defendant 2 is the controller of the
consultation of the BCSS by its employees, this does not therefore mean, in this case,
that she alone corresponds to this quality. It is necessary to distinguish between consultations
of the BCSS within the framework of the purposes of the missions of the defendant 2 of the consultations
abuses carried out for private purposes by the defendant 1. Although having used the means
made available by Defendant 2, and to the extent that Defendant 1 dealt with the
personal data of the BCSS for its own purposes, that is to say outside
within the scope of its duties as agent for Respondent 2, Respondent 1 must be
considered as a data controller for BCSS consultations,
specifically for those made for private purposes .7
10. The Litigation Division therefore distinguishes the processing carried out within the framework of
consultations of the National Register as provided for by the purposes of the defendant 2,
4
Draft law creating the Data Protection Authority, explanatory memorandum, Doc., Ch., 2016-2017, n°2648/001,
5. 13.
6Art. 4 §4 1° of the organic law of 15 January 1990 on the Crossroads Bank for Social Security, hereinafter BCSS law.
CJEU (gde ch.), judgment of June 5, 2018, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v.
Wirtschaftsakademie Schleswig-Holstein GmbH, C-210/16, § 29.
7 European Data Protection Board (EDPB), Guidelines 07/2020 concerning the concepts of responsible
of processing and processing in the GDPR, version 2.0, p. 33, § 88. Decision 16//2023 – 4/9
consultations for private purposes carried out by the defendant 1. Although the latter
either responsible for processing for abusive consultations, defendant 2 remains
data controller for consultations of the National Register in the context of
8 9
purposes determined by him (application of social security). In this context, the
defendant 2 remains subject to the principle of responsibility (art. 5.2 and 24 of the GDPR) and, in
as data controller and employer, in Articles 29 and 32 of the GDPR. For these
reasons, although not directly covered by the complaint filed with the DPA, the
Litigation Chamber will state additional findings in this regard.
II.2. As to the breaches of the GDPR alleged by the defendant 1
11. Access to the data contained in the National Register constitutes processing of
personal data within the meaning of Article 4.2 of the GDPR. Under this
qualification, this processing is subject to the various prescriptions and obligations of the GDPR and
in particular to the principles of legality, fairness and transparency provided for in Article 5.1.a of the
GDPR.
12. The principle of lawfulness indicates that any processing of personal data must
have one of the bases of lawfulness in article 6.1 of the GDPR.
13. It appears from the documents in the file, including the assertions of Respondent 2, that in
consulting on September 4, 2019 the data "legal address" of the complainant, the
defendant 1 did not proceed to a consultation in the context of the performance of a
task which falls within his competence as a CPAS agent.
14. By virtue of their function, and for the sole performance of the tasks relating to it, the agents
CPAS have access to certain data from the National Register via the BCSS . He 10
it is their responsibility to scrupulously respect the purposes of this access which they prefer.
15. By failing to respect the purpose of the access granted to it, Respondent 1
consulted the National Register without an adequate legal basis. Therefore, she proceeded to a
data processing in respect of which it will not be able to validly invoke
one of the bases of lawfulness required by Article 6 of the GDPR. In doing so, the defendant
found guilty of a breach of Article 6 of the GDPR. This failure is combined with a
breach of Article 5.1.a of the GDPR according to which the processing of data to
personal character must in particular be lawful. This requirement, while not limited to
compliance with Article 6, undoubtedly encompasses it.
8
9Art. 2.2.f) of the BCSS Law.
European Data Protection Board (EDPB), Guidelines 07/2020 concerning the concepts of responsible
of processing and processing in the GDPR, version 2.0, p. 33, § 88, footnote 34.
10Art. 3 in combination with art. 2.2.f of the BCSS Law. Decision 16//2023 – 5/9
16. The Litigation Chamber considers that, on the basis of the facts mentioned above, it would appear that
Defendant 1 may have committed a violation of Articles 5.1.a and 6.1 of the GDPR, which
justifies, in this case, taking a decision in accordance with Article 95, §
1, 4° of the LCA, more specifically to warn defendant 1 for the future that the
consultation of personal data from the National Register via the BCSS for the purposes
personal data constitutes an unlawful processing of personal data, and therefore a
violation of articles 5.1.a and 6.1 of the GDPR.
17. This decision is a prima facie decision taken by the Litigation Chamber
pursuant to Article 95 of the LCA on the basis of the complaint lodged by the complainant/the
complainant, in the context of the "procedure prior to the substantive decision" and not a
decision on the merits of the Litigation Chamber within the meaning of Article 100 of the LCA.
18. The purpose of this decision is to inform defendant 1, allegedly responsible for the
processing, because it may have violated the provisions of the GDPR,
in order to enable it to still comply with the aforementioned provisions.
19. If, however, Respondent 1 disagrees with the content of this decision
prima facie and believes that it can make factual and/or legal arguments that
could lead to another decision, it may send the Litigation Chamber a
request for treatment on the merits of the case via the e-mail address litigationchamber@apd-
gba.be, within 30 days of notification of this decision. The case
applicable, the execution of this decision is suspended for the period
aforementioned.
20. In the event of further processing of the case on the merits, pursuant to Articles 98, 2° and 3°
juncto article 99 of the LCA, the Litigation Chamber will invite the parties to introduce their
conclusions and attach to the file all the documents they deem useful. If applicable, the
this decision is permanently suspended.
21. With a view to transparency, the Litigation Division finally emphasizes that a
dealing with the case on the merits may lead to the imposition of the measures mentioned in
section 100 of the ACL .2
1Section 3, Subsection 2 of the ACL (articles 94 to 97 inclusive).
12Art. 100. § 1. The litigation chamber has the power to
1° dismiss the complaint without follow-up;
2° order the dismissal;
3° pronouncing the suspension of the pronouncement;
4° to propose a transaction;
5° issue warnings and reprimands;
6° order to comply with requests from the data subject to exercise his or her rights;
7° order that the person concerned be informed of the security problem;
8° order the freezing, limitation or temporary or permanent prohibition of processing;
9° order compliance of the processing;
10° order the rectification, restriction or erasure of the data and the notification thereof to the recipients of the
data ; Decision 16//2023 – 6/9
II.3. As to the alleged breach of the GDPR by the defendant 2
22. As data controller, defendant 2 is required to implement
the data protection principles and must be able to demonstrate that these
13
are respected, in accordance with the principle of accountability. Moreover, it must always
in its capacity as data controller, implement all measures
14
necessary for this purpose.
23. On the basis of Article 5.1.f of the GDPR, personal data must be processed
so as to ensure appropriate security, "including protection against the processing
unauthorized or unlawful and against accidental loss, destruction or damage,
using appropriate technical or organizational measures”.
24. In the absence of appropriate measures to secure the personal data of the
data subjects, the effectiveness of the fundamental rights to privacy and protection
personal data cannot be guaranteed, especially given the crucial role played
by information and communication technologies in our society.
25. It should be noted that the security principle set out in Article 5.1.f is now established
in the GDPR at the same level as the fundamental principles of lawfulness, transparency,
loyalty.
26. The obligations of data controllers with regard to the security of processing are based
on articles 32 et seq. of the GDPR.
27. It appears from the documents in the file that defendant 2 is able to identify the agent
having consulted the personal data of the National Register of the complainant, thus
than the date of consultation. The defendant was not, however, capable of knowing the
purpose of the consultation as well as the data consulted without further consultation
of said data. According to defendant 2, access to the software allowing the
consultation of the National Register would be limited to the use of social workers and the
executive management. Following the event giving rise to the complaint, respondent 2 indicated
make arrangements vis-à-vis the agent concerned and put in place a control
quarterly of consultations of personal data carried out under its responsibility.
28. On the basis of the facts described in the complaint file as summarized above, and on the
powers attributed to it by the legislator under Article 95, § 1 of the
LCA, the Litigation Chamber decides on the follow-up to be given to the file; in this case, the
11° order the withdrawal of accreditation from certification bodies;
12° to issue periodic penalty payments;
13° to issue administrative fines;
14° order the suspension of cross-border data flows to another State or an international body;
15° forward the file to the public prosecutor's office in Brussels, who informs it of the follow-up given to the file;
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority.
13Article 5.2 GDPR.
14Article 24 GDPR. Decision 16//2023 – 7/9
Litigation Chamber decides to proceed with the dismissal of the complaint,
in accordance with Article 95, § 1, 3° of the LCA, for the reasons set out below.
29. In terms of dismissal, the Litigation Chamber is required to justify its
15
step-by-step decision and:
- to pronounce a classification without technical continuation if the file does not contain or not
sufficient element likely to lead to a sanction or if it includes a
technical obstacle preventing him from rendering a decision;
- or pronounce a classification without further opportunity, if, despite the presence
elements likely to lead to a sanction, the continuation of the examination of the
file does not seem to him to be appropriate given the priorities of the Autorité de
data protection as specified and illustrated in the Privacy Policy
16
dismissal of the Litigation Chamber.
30. In the event of dismissal based on several reasons for dismissal, these
last (respectively, classification without technical continuation and classification without continuation
timeliness) should be addressed in order of importance .7
31. In this case, the Litigation Chamber decides to proceed with a classification without follow-up
the complaint for technical reasons for the breaches alleged to the defendant 2. The
decision of the Litigation Division is based more specifically on the fact that the complaint is not
not sufficiently supported by evidence of the existence of a violation of the GDPR or the laws
protection of personal data. Indeed, it appears from the documents in the file that few
information relating to the security measures put in place by the defendant 2
been communicated to the Litigation Chamber. On the basis of this information, the Chamber
Litigation is not in a position to determine whether defendant 2 breached its
obligations of data controller.
III. Publication of the decision
32. Given the importance of transparency regarding the decision-making process of the Chamber
Litigation, this decision is published on the website of the Protection Authority
15Cour des marchés (Brussels Court of Appeal), September 2, 2020, judgment 2020/AR/329, p. 18.
16
In this respect, the Litigation Chamber refers to its policy of classification without follow-up as developed and published on
the website of the Data Protection Authority: https://www.autoriteprotectiondonnees.be/publications/politique-de-
classification-without-continuation-of-the-litigation-chamber.pdf.
17Cf. Title 3 – In which cases is my complaint likely to be dismissed by the Litigation Chamber? of the
dismissal policy of the Litigation Chamber.
18Cf. Reason A.1 of the dismissal policy of the Litigation Chamber. Decision 16//2023 – 8/9
Datas. However, it is not necessary for this purpose that the identification data
of the parties are communicated directly.
FOR THESE REASONS,
The Litigation Chamber of the Data Protection Authority decides, subject to
the introduction of a request by one of the defendants for treatment on the merits
in accordance with articles 98 e.s. of the ACL:
- With regard to defendant 1: pursuant to Article 58.2.a) of the GDPR and
article 95, § 1, 4° of the LCA, to warn the defendant 1 for the future that the
consultation of personal data in the National Register for the purposes
private constitutes a violation of Article 5, paragraph 1, a) and Article 6,
paragraph 1 of the GDPR;
- With regard to defendant 2: to dismiss, pursuant to article 95,
§1, 3° of the LCA.
In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged,
within thirty days of its notification, to the Court of Markets (court
d'appel de Bruxelles), with the Data Protection Authority as defendant. Decision 16//2023 – 9/9
Such an appeal may be introduced by means of an interlocutory request which must contain the
information listed in article 1034ter of the Judicial Code. The interlocutory motion must be
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 20
via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).
(Sr.) Hielke H IJMANS
President of the Litigation Chamber
19The application contains on pain of nullity:
(1) indication of the day, month and year;
2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
Business Number;
3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
(4) the object and summary statement of the means of the request;
(5) the indication of the judge who is seized of the application;
6° the signature of the applicant or his lawyer.
20
The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.
