APD/GBA (Belgium) - 49/2023
APD/GBA - 49/2023 | |
---|---|
Authority: | APD/GBA (Belgium) |
Jurisdiction: | Belgium |
Relevant Law: | Article 6(1)(e) GDPR Article 9(1) GDPR |
Type: | Complaint |
Outcome: | Upheld |
Started: | |
Decided: | 28.04.2023 |
Published: | |
Fine: | n/a |
Parties: | n/a |
National Case Number/Name: | 49/2023 |
European Case Law Identifier: | n/a |
Appeal: | Unknown |
Original Language(s): | French |
Original Source: | APD/GBA (in FR) |
Initial Contributor: | n/a |
The DPA considered that a school informing the pupils' parents that some professor were on strike did not reveal trade union membership. However, this processing was not necessary to carry out a public task (i.e. the school's education mission) and therefore lacked legal basis.
English Summary
Facts
In March 2022, a school (controller) organised a parents' meeting and informed the parents that some teachers would not be able to attend because they were on strike. In practice, the school sent out a list of teachers and marked them as 'on strike'. Other teachers were absent for other reasons and the school simply added the word "absent" without additional information.
A few days after the strike, the union delegation contacted the school management to say that this was inappropriate. The school did not respond to this. Five striking teachers therefore lodged a complaint with the DPA, claiming that the controller had violated Article 9(1) GDPR by disclosing their trade union membership without a legal basis. Alternatively, they considered that the controller had violated Articles 5(1) and 6(1) GDPR.
In its defence, the controller explained that the meeting of parents is part of its public interest mission (education) which is a legal basis under Article 6(1)(e) GDPR. It added that calling a teacher a striker did not reveal a trade union membership and that the situation therefore did not fall within the scope of Article 9 GDPR. However, the controller acknowledged that the use of the term striker should have been avoided. It added that this was a human error and that it was taking steps to avoid similar errors in the future.
Holding
The DPA joined the complaints and began by examining whether or not the term "striker" fell within the scope of Article 9(1) GDPR. To be covered by this article, the reference must reveal trade union membership. The DPA referred to the English and Dutch versions of the GDPR and considered that being a striker does not reveal trade union membership within the meaning of Article 9(1) GDPR.
On the other hand, the DPA considered that the qualification of "striker" could constitute "highly personal" data within the meaning of the EDPB guidelines on DPIA. This implies that they are sensitive in the common sense of the term which may increase the possible risk to rights and freedoms. The DPA also added that sensitive data must be interpreted broadly, but that even a broad interpretation does not allow the striker to be considered as falling within the scope of Article 9(1) GDPR.
Since Article 9 GDPR was not applicable, the DPA examined the lawfulness of the processing under Article 6(1)(e) GDPR which was put forward by the controller. It considered that the education mission of the controller includes an aspect of communication with the parents of the pupils. However, the communication of the status of striker was not necessary for this task. The DPA explained that simple information that absent teachers could be contacted at another time would have been sufficient.
In conclusion, the DPA considered that the controller had no legal basis for his processing. In view of the measures already taken by the controller, the DPA issued a reprimand.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/19 Litigation Chamber Decision on the merits 49/2023 of 28 April 2023 File numbers: DOS-2022-02905 – DOS-2022-02908 – DOS-2022-02910 – DOS-2022-02912– DOS-2022-02915 Subject: Complaint relating to the communication of the status of striking teacher by a school when organizing a parent-teacher meeting – procedure on the merits guaranteeing the confidentiality of the identity of the complainants against the defendant The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke Hijmans, chairman, and Messrs. Romain Robert and Christophe Boeraeve, members; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the data protection), hereinafter "GDPR"; Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter ACL); Having regard to the internal regulations as approved by the House of Representatives on 20 December 2018 and published in the Belgian Official Gazette on January 15, 2019; Considering the documents in the file; Made the following decision regarding: The Complainants: 1. Mr. X1, hereinafter “Complainant No. 1” (DOS-2022-02905); 2. Mr. X2, hereinafter “Complainant No. 2” (DOS-2022-02908); 3. Mr. X3, hereinafter “Complainant No. 3” (DOS-2022-02910); Decision on the merits 49/2023 – 2/19 4. Ms. X4, hereinafter "Complainant No. 4" (DOS-2022-02912); 5. Mr. X5, hereinafter "Complainant No. 5" (DOS-2022-02915); All 5 represented by their counsel, Maître Laurence RASE, lawyer, whose firm is established at 4000 Liège, Quai de Rome, 2. Hereinafter referred to together as “the (striking) teachers” or “the plaintiffs”. The defendant: Secondary school Y, hereinafter “the defendant”. I. Facts and procedure 1. During the months of May and June 2022, the complainants each lodged a complaint with of the Data Protection Authority (APD) against the defendant. 1 2. The subject of their complaint concerns the communication by the defendant of their status striking teacher when sending by e-mail to all the parents of pupils of the list of teachers who can be met during the meeting of parents of pupils of the establishment of March 29, 2022. The facts are more fully detailed in the points which follow. 3. On July 7, 2022, the 5 complaints were declared admissible by the Front Line Service (SPL) DPA ON THE BASIS OF ARTICLES 58 AND 60 OF THE ACL AND COMPLAINTS ARE FORWARDED TO THE Chamber Litigation under Article 62, § 1 of the LCA. 4. Under the terms of his complaint, each complainant requests, ticking the box provided for this purpose in the complaint form, whether its data is masked, or whether it is not communicated to the defendant. 5. At the end of August 2022, the Litigation Chamber asked each plaintiff whether he whether or not he agreed to his identity being communicated to the other complainants, the confidentiality remains preserved with regard to the defendant. 6. Each complainant, in response, indicated his agreement to the communication of his identity to the other complainants. 1 Complaints 1, 2 and 5 are dated May 10, 2022 (complaint 2 was received on July 4, 2022). Complaint 3 is dated May 30, 2022 and 4 is dated June 6, 2022. Decision on the merits 49/2023 – 3/19 7. The plaintiffs are all members of the teaching staff of the defendant and employees of it within the Y secondary school. 8. On March 29, 2022, a strike was organized at the initiative of the trade unions representatives of staff in the education sector. 9. On the same March 29, 2022, a parents' meeting was organized within the defendant in order to to allow the parents of the pupils of the school to meet the teachers individually. 10. The parties report that by an email dated March 25, 2022, the management of the defendant appealed to all of its teachers in these terms: "As you know, the parents' meeting will take place on March 28, 2022 (read March 29 2022). However, the strike will take place this Tuesday as well. I ask those who intend to do strike to report it to me for this Monday at 9am at the latest so that I report your absence to the educators and parents. On the other hand, if you are absent, you will have to ensure the parents' permanence this Thursday at from 3:30 p.m. instead of this Tuesday, unless you still participate in parent's meeting. 11. The complainants point out that several members of the teaching staff – including union representatives – in response, informed the school management that they would participate in strike action. 12. On March 29, 2022, the management of the defendant informed the parents of the students of the terms organizing the parent meeting on the same day. A letter is sent to the parents of students by email. The complainants specify that they are several hundred parents. THE complainants report that this mail was also distributed, by hand, on the spot at school on the day of the parents' meeting by the management present at the entrance of the establishment. 13. This letter states this: “As announced in the media, some teachers have decided to follow the strike action organized today. On the back you will find the list of striking teachers as well as sick teachers who will not be present at the parent meeting. However, the striking teachers were asked to take contact with the parents concerned in order to fix an appointment this Thursday afternoon for meet you ". 14. The list of school teachers is attached to the letter. It lists the premises where the teachers will be present. Considering the names of the teachers who announced to the management their participation in the strike (point 10 above), the mention "striker" is affixed. This was Decision on the merits 49/2023 – 4/19 in particular the case with regard to the name of the complainants. For other teachers absent during of the parents' meeting, it is indicated "abs", without specifying the reason for their absence. 15. The complainants add that a few days after March 29, 2022, a trade union delegation challenged Y's management team orally about this way of proceeding. She has him reports the inappropriate nature of such a communication which mentions data to be "sensitive" personal character according to her to third parties, communication querien justified. THE complainants further add that the management of Y did not intend to follow up on this questioning and that the trade union representatives concerned were dismissed. 16. Following these events, five members of the striking teaching staff were, as he has been set out in point 1, lodges a complaint with the DPA, in order to denounce a violation of the GDPR. They insist on the deleterious climate within the establishment and the contempt opposed to the right to strike more generally. 17. On October 6, 2022, the Litigation Chamber informs the parties by registered mail of the provisions as set out in article 95, § 2 as well as in article 98 of the LCA. In this mail, the Litigation Chamber, taking into account the request for confidentiality of the plaintiffs against the defendant: To. Decides to join the complaints which it considers to be so closely related that there is interest in instructing them and making a decision about them at the same time in order to guarantee the consistency of its decisions; b. Takes note that the Complainants request confidential treatment of their identity with respect to the defendant. The Litigation Chamber considers in this respect that it is able to pursue the examination of complaints without disclosing the identity of the plaintiffs to the defendant; vs. Takes note that the complainants have each given their agreement that their identity is shared with other complainants; d. Summarizes the facts reported by the complainants under each of their complaints and specifies that at the request of the defendant, the anonymized file relating to each complaint will be communicated to him; e. Invites the parties to submit their respective arguments to it in the form of conclusions. The Litigation Chamber more particularly invites the defendant to specify the methods of the communication of the letter of March 29 2022 as well as to put forward its arguments with regard to potential breaches revealed by the facts, in particular with regard to the basis of lawfulness on which it believes that he can justify the processing (internal registration, communication to the parents) of the “striking” data attached to each of the complainants. The Chamber Decision on the merits 49/2023 – 5/19 Litigation cannot exclude at this stage of the procedure the application of the article 9 of the GDPR, it invites the defendant to defend itself both with regard to articles 5.1.a) and 6 of the GDPR only with regard to Article 9 combined with Article 6 of the GDPR; f. Defines that the defendant must file its submissions in response no later than on November 17, 2022 and its submissions in reply no later than January 2, 2023. The plaintiffs are invited to file their joint conclusions on if applicable – 9 December 2022 at the latest (article 99 LCA); g. Indicates that in view of the complainants' request for confidentiality, it will itself communicate the conclusions to the other party for guarantee the adversarial nature of the procedure while preserving this request for confidentiality. The Litigation Chamber adds that these conclusions will be communicated as is to the other party and that it is therefore the responsibility of the complainants to draft them in such a way as to preserve the confidentiality of their identity with respect to the defendant. h. Indicates that if the parties wish to file exhibits in support of their conclusions, they are invited to do so at the same time as submitting these latest. The procedures for preserving the confidentiality of the identity of the plaintiffs with regard to the defendant will be identical to those provided for in point g). i. Finally, specifies that taking into account the complainants' request for confidentiality, a hearing cannot be granted to them. Indeed, as soon as a party requests hearing, all parties are invited to attend. The anonymity of the parties e can therefore be guaranteed during the hearing, the parties being heard together and not separately (Article 53 of the RoI). 18. On November 16, 2022, the Litigation Chamber receives the submissions in response from the defendant. The summary of the defendant's position is set out in point 20 above including his reply. 19. On December 8, 2022, the Litigation Chamber receives from the complainants their conclusions in common replicas. To. The plaintiffs mainly denounce a violation of Article 9 of the GDPR. They indeed consider that by communicating their status as striker, the defendant treated sensitive data concerning them – more particularly their membership trade union – without having any basis of lawfulness to do so. b. Union membership, according to the complainants, includes any expression of an activity union, which must be understood in a broad sense. It is not synonymous Decision on the merits 49/2023 – 6/19 of union affiliation. Participation in a strike organized at the initiative of trade union organizations representing workers constitutes an activity union, regardless of whether or not the participants are affiliated with a union. This is the exercise of the fundamental rights of freedom of expression (Article 10 of the European Convention on Human Rights - ECHR) and freedom of assembly and association (article 11 of the same ECHR). vs. Reveal to third parties - in this case to parents of pupils - the status of "striker" of a group of teachers therefore constitutes data processing referred to in Article 9 of the GDPR. The term "striker" reveals the participation of teachers in an activity union and, consequently, their union membership. It is undisputed that the complainants have not consented (article 9.2.a) of the GDPR) and the complainants believe that no other basis of lawfulness provided for in Article 9.2 of the GDPR applies. d. In the alternative, failing the Litigation Chamber to find a violation of Article 9 of the GDPR, the plaintiffs believe that the defendants have at least found guilty of a breach of Articles 5.1 and 6.1 of the GDPR. i. The plaintiffs exclude the bases of lawfulness listed in Article 6.1 of the GDPR, that it is their consent, the legal obligation to which the defendant would be held, or even the mission of public interest with which the latter would be invested. ii. The plaintiffs point out that the defendant does not dispute the character inadequate communication but Islam minimizes it. An alternative should have complainants be put in place which would simply indicate that some members of the teaching staff unavailable on March 29, 2022 would ensure a permanence on March 31, 2022 or later. iii. The plaintiffs also believe that the defendant cannot be followed when it claims that the communication would have been made in a fair and transparent to the staff members concerned. They point out that in its letter of March 25, 2022 (point 10), the management of Y told them that this information was requested from them in order to be able to warn the parents of their absence, and not the reasons for this absence. The data communicated have therefore not been treated fairly or adequately, relevant and limited to what was necessary for that purpose. THE sections 5.1. a) and c) of the GDPR have thus been violated as well as article 6.1. of GDPR. e. The plaintiffs asking the Litigation Chamber to pronounce a sanction exemplary (an administrative fine or at the very least a reprimand) with regard to the defendant who takes into account a) the sensitive nature of the data communicated which is indicative of the complainants' union conviction and is the subject of a Decision on the merits 49/2023 – 7/19 special protection under Article 9 of the GDPR in the form of a prohibition of principle with exceptions as well as b) the distribution by e-mail of this information to several hundred parents of students. f. On the basis of article 100.1, 9° of the LCA, the plaintiffs also postulate that it is ordered the defendant to formally remind its management of its obligations in regarding the protection of personal data and to prohibit any subsequent disclosure of data without first obtaining consent expressly from the staff members concerned as to this disclosure and the purposes for which it is authorized. 20. On December 29, 2022, the Litigation Chamber receives the conclusions in reply of the defendant. The defendant's argument – as developed both in its conclusions in reply than in those in reply – can be summarized as follows: To. The date of March 29 scheduled for the parents' meeting had been set in consultation with staff representatives at the end of the school year former. b. This parent meeting is an important deadline for parents of students – especially for those who encounter difficulties – which allows them to receive information and educational advice aimed at the success of their child at the end of the school year. vs. This meeting fits in a very essential way within the framework of the execution of its mission as provided for by the Decree defining the missions priorities for basic education and secondary education in the 24 2 July 1997. It contributes to the necessary cooperation between parents and teachers, who are also part of all the schools' educational projects. She results from the exercise of its public interest mission within the meaning of Article 6.1.e) of the GDPR. d. The information that some teachers are on strike has been collected in a fair and transparent manner following communication by the management of the email of March 25, 2022 cited in point 10 above. e. Contrary to what the plaintiffs state, the term "striker" does not reveal not union membership. The reasoning of the defendant is in this regard to the following: 2M.B., September 23, 1997. Decision on the merits 49/2023 – 8/19 i. The right to strike is recognized for all workers whether they belong or no to a union and any worker, unionized or not, can choose to participate in such and such a strike; ii. A strike can occur without union intervention. She is not conditioned by a union initiative; iii. As a result, assimilating the fact of participating in a strike (and therefore of being “striker”) to that of belonging to a union organization is based on erroneous premises; iv. Trade union membership consists of affiliation to a trade union. There English GDPR terminology “trade -union membership” is in this regard enlightening. It is also this status that is likely to lead to discrimination at the very least differential treatment, which Article 9 of the RGP D seeks to avoid. Participation in a strike may, on the other hand, be a one-off act like any exercise of other rights related to the right of the work. v. The notion of union membership is strictly interpreted. Account given that Article 9 of the GDPR consists of an exception to Article 6 of the GDPR, the interpretation of the ban on data processing “revealing trade union membership” must be interpreted restrictively. A excerpt from recital 51 of the GDPR is invoked by analogy in this respect. 3 vi. Finally, the defendant wonders whether the fact of infer that a person, by virtue of his participation in a strike, belongs necessarily to a union would not constitute an inference to the contrary the principle of data accuracy set out in Article 5.1.c) of the GDPR. f. The qualifier "striker" should have been avoided and the defendant expresses its sorry about the use of this terminology. The terms “absent (for sick teachers) and “contactable” (for strikers absent on March 29 but that the parents could contact) would have been preferable according to her. g. The defendant adds that it has endeavored to implement all of the obligations arising from the GDPR and that it has, for this purpose, engaged a delegate for the external data protection (DPO) in 2021 which has done a substantial job and helped to train and sensitize staff members on issues of Data protection. In terms of achievements, the defendant cites: 3Recital 51: (…) The processing of photographs should not systematically be considered as constituting processing of special categories of personal data, given that these do not fall under the definition of biometric data only when they are processed according to a specific technical method allowing unique identification or authentication of a natural person. (…) Decision on the merits 49/2023 – 9/19 the establishment of the various registers (of processing activities, breaches data, access), mandatory training for staff members, the publication of a document containing the essential points of the GDPR to be respected or the implementation of information security measures. h. This is a one-time incident resulting from human clumsiness on the part of a school collaborator when sending a single communication in a emergency context. This is not a decision of the defendant in the sense of a decision that would have been taken by the organizing authority. The defendant indicates that it would like to point out in this respect that it does not have a database in which this quality would be listed and which it in no way intends categorize its staff members on this basis in its processes administrative. i. The defendant further observes that if the plaintiffs were to be union representatives, it cannot be excluded that Article 9.2. e) GDPR applies. Under this article, the prohibition of data processing sensitive (including those revealing trade union membership) is lifted when “the processing relates to personal data which are manifestly made public by the data subject”. Confirmation of applicability of this article could result in the lifting of the “anonymity” of the complainants. d. To prevent this error from recurring in the future, the defendant indicates that she will take the following additional actions suggested to her are DPO: i. Implementation of an obligation to monitor the training provided in 2021 within 3 months of taking office, with particular attention to school administrative staff; ii. Organization of a question-and-answer session with the DPO during pedagogical daysforexampleificeladewouldrespondtoarequest Staff ; iii. Putting on the agenda of a meeting with the local authorities of competent consultation (Works Council and Committee for the prevention and protection at work - CPPT) with a view to determining together the procedures and terms to be used when communicating different types of school absences. k. Finally, the defendant regrets not having been questioned directly by the complainants following the distribution of the list, which would have allowed a dialogue. She furthermore denies any denial of the right to strike within it underlining by Decision on the merits 49/2023 – 10/19 elsewhere the lack of competence of the Litigation Chamber to hear this type of grievance. 21. The filing of these submissions in reply closes the exchange of arguments between the parties. None of them not having requested a hearing and the Litigation Chamber not having convened a hearing on its own initiative, the Litigation Chamber decides as set out below. II. Motivation II.1. As to the jurisdiction of the Litigation Chamber 22. Pursuant to Article 4 § 1 of the LCA, the DPA is responsible for monitoring the principles of data protection contained in the GDPR and other laws containing provisions relating to the protection of the processing of personal data. In application of Article 33 § 1 of the LCA, the Litigation Chamber is the administrative litigation body of ODA. It receives complaints that the SPL transmits to it pursuant to Article 62 § 1. LCA, or admissible complaints. 23. As the Litigation Chamber has already had occasion to state, data processing data are operated in multiple sectors of activity, in particular within the framework professional as in the present case. The fact remains that the competence of the APD in general, and of the Litigation Chamber in particular, is limited to the control of the compliance with the regulations applicable to data processing, regardless of the sector of activity in which this data processing takes place. Its role is not to substitute for the courts of the judiciary in the exercise of the powers which are the their labor rights and the right to strike, for example II.2. Regarding the alleged violations of the GDPR II.2.1. Regarding the principles of lawfulness and minimization (Article 5.1.a) and 5.1.c) of the GDPR as well as Articles 6 and 9 of the GDPR) 24. Any processing of personal data must, in application of the principle of lawfulness devoted to Article 5.1. a) of the GDPR, rely on one of the bases of lawfulness of Article 6.1. of GDPR. When the data controller processes data that comes out of the "categories specific data”, he must also comply with the conditions of article 9 of the GDPR read in combination with Article 6 GDPR. 25. Article 6 of the GDPR thus provides that personal data may be processed if their processing can validly be based on one of the 6 bases that it lists, namely: the consent of the data subject (Article 6.1.a)), the performance of the contract or measures Decision on the substance 49/2023 – 11/19 pre-contractual obligations taken at the request of the data subject (Article 6.1.b)), the execution a legal obligation (Article 6.1.c)), the vital interest of the data subject (Article 6.1.d)), the execution of the public authority or the public interest mission with which the controller (article 6.1. e)) or legitimate interest (article 6.1.f)). In all cases, the data processing must be necessary. 26. Article 9 of the GDPR (special categories of data) provides for its part n its § 1 , a ban on the processing of so-called “sensitive” data in these terms: “the processing of personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as the processing of genetic data, biometric data for the purpose of identifying a natural person in a unique way, data concerning health or data concerning the sex life or sexual orientation of a natural person are prohibited”. 27. Recital 51, which explains Article 9 of the GDPR, specifies in particular that "in addition to the requirements applicable to this processing [read the processing of these special categories of data], the general principles and other rules of this Regulation should apply, in particular with regard to the conditions of lawfulness of the processing”. In in other words the application of article 9.2. of the GDPR which authorizes the processing of said data in some cases should be read in conjunction with Section 6.1. of the GDPR which requires that any processing is based on one of the 6 bases of lawfulness that it sets out. 28. Consequently, it is essential before being able to consider whether or not a basis of lawfulness failure, as denounced by the complainants, to qualify the data processed to determine whether the compliance with Article 6 GDPR alone must be verified or whether, in the presence of data falling within the article 9.1. of the GDPR (i.e. data qualified as “sensitive”), this is compliance with article 9.2 read in conjunction with Article 6 of the GDPR which should be checked. 29. In the present case, it is not disputed that the mention “striker” attached to the identity of the complainants and other staff consists of personal data relating to the latter within the meaning of Article 4.1. of the GDPR. In fact, this is information relating to directly identified natural persons since the statement is affixed opposite of their first and last name. 30. Nor is it contested that the communication made by the defendant via her e-mail of March 29, 2022 sent to parents of students is processing within the meaning of Article 4.2. of RGD. It is indeed a communication made in this case using methods automated. 31. The views of the parties differ on the other hand on the question of whether the qualifier “striker” falls under Article 9.1 or not. of the GDPR, more particularly if it reveals, within the meaning of Decision on the merits 49/2023 – 12/19 this provision, the trade union membership of the complainants. The summaries of the conclusions of the parties set out in points 19 and 20 state their respective arguments in this regard. 32. The Litigation Chamber notes that in order to be covered by Article 9 of the GDPR, the information status as a striker must reveal union membership. The Litigation Chamber is of the opinion that the fact of being a striker does not reveal this membership. Union membership indeed consists of trade union membership, which the English version of the GDPR translates better as well as the French term "affiliation". The English version retains the terms of "trade-union membership" which translates the idea that the person concerned is a member “member”) of a trade union. The Dutch version also clearly mentions being affiliated to a trade union using the term "lidmaatschap" either which is "lid" or which is “member”. However, the right to strike is open to all workers whether or not they are affiliated to a syndicate. A strike does not necessarily have to be organized at the initiative of a union. In other words, a participant in a strike is not necessarily a member of a union. He may be, but if necessary, his participation in the strike will not be revealed. In other In other words, being a striker does not reveal union membership. The Litigation Chamber considers, moreover, that the fact of deducing that a person, because of his participation in a strike, would necessarily belong to a trade union would constitute an inference contrary to the principle of data accuracy enshrined in Article 5.1.c) of the GDPR. 33. The Litigation Chamber concludes that the mention of the quality of striker of the complainants does not consist of processing data revealing trade union membership within the meaning of Article 9.1 GDPR. The Litigation Chamber, on the other hand, is of the opinion that the qualification of "striker" can be considered as "highly personal" data in the meaning that the European Data Protection Board (EDPB) has given to this concept in its Data Protection Impact Assessment (DPIA) Guidelines . 4 The EDPS stresses that, beyond the provisions of the GDPR, certain categories of data may be considered to increase the possible risk to the rights and freedoms of people. They are “sensitive” in the common sense of the term and require attention particular when they are processed, the philosophy of the GDPR being characterized by a approach on the risk and on the taking of measures intended to take them into account and minimize. 34. The Litigation Chamber adds abundantly that it does not, however, share the point Defendant's view that Article 9.1. of the GDPR should, in principle, be er interpreted restrictively, In a judgment of August 1, 2022, the Court of Justice of the European Union (CJEU) has clearly specified that “(…) a broad interpretation of the notions 4Article 29 Group, Guidelines on Data Protection Impact Assessment (DPIA) and Data Protection how to determine whether the processing is “likely to create a high risk” for the purposes of Regulation (EU) 2016/679, WP 248 of October 4, 2017: https://www.cnil.fr/sites/default/files/atoms/files/wp248_rev.01_fr.pdf. These guidelines were endorsed by the European Data Protection Board at its inaugural meeting on 25 May 2018: https://edpb.europa.eu/sites/default/files/files/news/endorsement_of_wp29_documents_en_0.pdf Decision on substance 49/2023 – 13/19 of “special categories of personal data” and of “sensitive data” is supported by the objective of Directive 95/46 and the GDPR, recalled in paragraph 61 of this judgment, which is to guarantee a high level of protection of the fundamental rights and freedoms of natural persons, in particular their privacy, with regard to the processing of personal data. personal character concerning them (see, to this effect, judgment of 6 November 2003, Lindqvist, 5 C-101/01, EU:C:2003:596, point 50)’. The Court adds that "the contrary interpretation would, moreover, run counter to the purpose of Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR, consisting in ensuring increased protection against processing which, because of the particular sensitivity of the data which is the subject of it, are likely to constitute, as well as that it appears from recital 33 of Directive 95/46 and recital 51 of the GDPR, a particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data, guaranteed by Articles 7 and 8 of the Charter [see, incense, judgment of September 24, 2019, GCe.a. (Dereferencing of sensitive data), C-136/17, EU:C:2019:773, point 44] » .6 35. In this case, the Litigation Division considers that this interpretation, even broad (and not not restrictive as the defendant postulates) does not allow to consider that the quality striker reveals, even indirectly, trade union membership and should therefore be considered as sensitive data within the meaning of article 9.1. of the GDPR. as well as the room Litigation she explained, this qualification would be based on the erroneous premise that any striker is unionized and would otherwise violate the principle of data accuracy as also already mentioned. 36. Since the defendant was not processing sensitive data, Article 9 of the GDPR is not applicable. application. The Litigation Chamber's assessment of the legality of the processing of the "striker" data will therefore be made from article 6.1 alone. of the GDPR and the principles general terms set out in Article 5 of the GDPR and not at the start of Article 9.2. read in combination with GDPR Article 6. 37. As a basis of lawfulness, the defendant indicates that the disputed communication was part of within the framework of the execution of its mission of public interest of teaching and that it was from therefore founded on the basis of Article 6.1.e) of the GDPR which authorizes the processing of data when "the processing is necessary for the performance of a task in the public interest or falling the exercise of official authority vested in the controller”. She returns 5CJEU, judgment of August 1, 2022, OTagainst Vyriausioji tarnybinės etikos komisija, C-184/20, ECLI:EU:C:2022:601, point 125). It is the Litigation Chamber which underlines. 6Point 126 of the aforementioned judgment. It is the Litigation Chamber which underlines. Decision on the merits 49/2023 – 14/19 to the "Missions" decree already cited without further clarification as well as to the educational regulations of the schools (item 20). 38. The mobilization of article 6.1.e) of the GDPR presupposes the meeting of the conditions below that the Litigation Chamber will endeavor to verify: - The data controller must, in accordance with Article 6.3.b) of the GDPR read in the light of recitals 41 and 45, be entrusted with the performance of a task in the public interest or relating to the exercise of official authority by virtue of a legal basis, whether in law of the European Union or under the law of the Member State; - The purposes of the processing must be necessary for the performance of the mission of interest public or the exercise of public authority. 39. Recital 41 clarifies the quality of this legal basis. : :" When this Regulation refers to a legal basis or a legislative measure, this does not does not necessarily mean that the adoption of a legislative act by a parliament is required, without prejudice to the obligations provided for under the constitutional order of the Member State concerned. However, this legal basis or legislative measure should be clear and precise and its application should be foreseeable for litigants, in accordance with the case law of the Court of Justice of the European Union (CJEU) and of the European Court of human rights (Eur. Court D.H.)”. 40. In other words, according to recital 41, this legal basis or measure legislation should be clear and precise and its application should be predictable for litigants, in accordance with the case law of the CJEU and the Eur. D.H. 41. This requirement of foreseeability implies that certain constituent elements of the processing be registered in the legal basis, including in particular the purpose of the processing. 42. As to the requirement of necessity (the processing is lawful only if and insofar as it is necessary for the execution of the mission of public interest to take only one of the hypotheses covered by Article 6.1 of the GDPR), the Litigation Chamber has already pointed out that the legislation does not often contains no specific provision for the necessary data processing. THE data controllers who wish to invoke Article 6.1.e) of the GDPR under such legal basis must then themselves carry out a weighting between the need for the processing for the task of public interest and the interests of data subjects. 43. As mentioned in point 39, the Litigation Division will endeavor to verify whether the conditions for recourse to Article 6.1. e) of the GDPR were met in this case. Decision on the merits 49/2023 – 15/19 As for the mission of public interest and the quality of the legal basis which consecrates it 44. The defendant invokes in this respect its teaching mission as it is in particular 7 regulated by the “Missions” decree of the French community in Belgium. Bedroom Litigation considers that a school such as that of the defendant is certainly vested with a mission of public interest within the meaning of Article 6.1. e) GDPR. 45. The “Missions” decree already cited provides for several provisions under which parents secondary school students are informed and/or involved in decision-making about their child. Thus, for example, the class council is designated as being responsible for student guidance. “To this end, it associates the psycho- medico-social and parents. To this end, he guides each student in the construction of a project school and professional life according to the methods described in article 67” (article 22). 46. Article 67.1 of the "Missions" decree provides for the mandatory adoption by the establishment of a school project which must be drawn up taking into account "(…): 2° the aspirations of students and their parents in terms of career plans and continuation of studies » .8 47. Article 67.2 of the decree provides that “the management plan, whose model and termsaredecidedbytheGovernment,includesinparticularthefollowingpoints:(…)g) the partnership and collaboration strategy with the parents of the school's students, in consultation with the participation council”. 48. Finally, numerous provisions of the “Missions” decree mention contact with the parents in the provisions relating to a change of establishment, the evaluation of specific needs, in cases of absenteeism and exclusion decisions in particular. 9 49. The decree of February 2, 2007 establishing the status of principals and directors in education, provides for its part that the profile of a director necessarily includes a responsibility in terms of internal and external communication, particularly with regard to parents. 50. In conclusion, it emerges from the aforementioned texts that the public mission of teaching a school such as the defendant includes communication with parents about their child's experience in the school. 51. In line with point 47, the defendant's business plan provides for contacts regularly with parents. . 7 Decree defining the priority missions of basic education and secondary education and organizing structures to achieve them, French Community, July 24, 1997, M.B., September 23, 1997. 8It is the Litigation Chamber that underlines. 9 Decree of the French Community of February 2, 2007 establishing the status of directors in education, M.B., 15 May 2007. Decision on the merits 49/2023 – 16/19 52. The Litigation Chamber considers that the organization of parents' meetings in a school secondary requires that parents be informed of where they can meet the present teachers of their children, these teachers being different according to the subjects dispensed. 53. In conclusion on this point, the Litigation Division is of the opinion that the organization of the meeting of parents of March 29 and the communication of the presence or absence of one or the other teacher that the parents would like to meet participates in the execution of the defendant's public teaching mission. This communication pursues a legitimate and necessary purpose for the performance of this mission which is based on various legal texts governing the exercise by a school of its mission teaching, including communication with the parents of students regarding schooling of their child. As for the need to process “striking” data 54. On the other hand, with regard to the communication of the complainants' status as strikers, the Litigation Chamber considers that it was not necessary for the achievement of the purpose of the treatment which consisted in indicating to the parents which teachers would be present that they could meet during the parents' meeting of March 29, 2022. In this respect, only the mention of the absence of certain teachers, for any reason whatsoever, having been sufficient. The distinction that the defendant actually intended to make between teachers strikers who would have been “contactable” two days later and the others who would not have been not been due to their absence, for example for illness, does not convince the Chamber Litigation. Indeed, a teacher who is ill or absent for any other reason on the day of the parents' meeting could, a priori, if necessary, be contacted at short notice also by the parents too. The Litigation Chamber is in this respect of the opinion that it was sufficient for the defendant to put in place general information according to which, as far as concerned absent teachers, another time to be agreed could be fixed. Conclusion 55. In conclusion, it appears from the foregoing that the defendant communicated to the parents of students a personal data relating to the complainants which was not necessary for the purpose she was chasing. On this basis, the Litigation Chamber concludes that the defendant has found guilty of a breach of Article 6.1.e) of the GDPR and more generally of Article 6 of the GDPR – no other basis of lawfulness can be invoked by the defendant by elsewhere – combined with Article 5.1.c) of the GDPR. 56. As to the defendant's allusion to the possible application of Article 9.2.e) of the GDPR, the Chambre Litigation emphasizes that even if the status of trade union representative of the complainants or one of them was proven, the mention of their or their status as a “striker” does not in Decision on the merits 49/2023 – 17/19 would not reveal this "trade union membership". In this particular case, it could be relevant to the purpose for which such data was processed. The data "striker" was not processed for the sensitive information it would contain, either to reveal the trade union membership of the complainants. Article 9 would therefore not apply. AT even assuming that it is, the status of union representative is certainly made public by the person concerned but this circumstance does not authorize that any processing of this data can take place. Indeed, Article 9.2. cannot be applied alone but must be done in combination with Article 6 of the GDPR. In this case, the condition that the processing is necessary for the exercise of the public mission remains. Section 9.2. is limited to lift the ban on the processing of sensitive data. However, the Litigation Chamber has demonstrated above that this condition of necessity was not fulfilled. II.2.2. As for the principle of loyalty (article 5.1.a) of the GDPR) 57. The Litigation Division considers that it does not have sufficient evidence to conclude that a proven lack of loyalty on the part of the defendant. 58. Section 5.1. a) of the GDPR does not only enshrine the principle of lawfulness discussed above above but also the principle of loyalty that the data controller must respect. This principle of loyalty is also enshrined in Article 8.2. of the Bill of Rights fundamentals of the European Union (EU) according to which the data “must be 10 processed fairly, for specific purposes and on the basis of the consent of the person concerned or under another legitimate basis provided for by law. ". This duty of loyalty excludes that the data is obtained or processed using unlawful or unfair means. 59. The Litigation Chamber notes that it is indeed apparent from the writings of the parties that the defendant did not explicitly indicate to the teachers that the information they would provide according to which they intended to go on strike would be communicated to the parents of students (Item 10). Human error or clumsiness invoked by the defendant cannot exclude the liability of the controller. The same is true of efforts organizational arrangements implemented by the defendant. If the Litigation Chamber welcomes such efforts, it recalls that they are only the logical consequence of the legal obligations of the defendant and invites it to pay particular attention to the processing of this information should such situations arise again. As the complainants indicate, they have in confidence communicated this information at the invitation of the defendant for the purpose of make it possible to organize the parents' meeting as well as possible, which did not require, as he 10 It is the Litigation Chamber which underlines. Decision on the merits 49/2023 – 18/19 demonstrated above, that their status as strikers is known to all parents of students from school. II.3. Regarding corrective measures and sanctions 60. Under Article 100 of the LCA, the Litigation Chamber has the power to: 1° dismiss the complaint without follow-up; 2° order the dismissal; 3° order a suspension of the pronouncement; 4° propose a transaction; (5) issue warnings or reprimands; 6° order to comply with the data subject's requests to exercise his or her rights; (7) order that the person concerned be informed of the security problem; 8° order the freezing, limitation or temporary or permanent prohibition of processing; 9° order the processing to be brought into conformity; 10° order the rectification, restriction or erasure of the data and the notification of these to the recipients of the data; 11° order the withdrawal of accreditation from certification bodies; 12° to issue periodic penalty payments; 13° to impose administrative fines; 14° order the suspension of cross-border data flows to another State or a international body; 15° forward the file to the public prosecutor's office in Brussels, which informs it of the follow-up given to the file; 16° decide on a case-by-case basis to publish its decisions on the website of the Authority of Data protection. 61. The Litigation Division notes that the defendant admitted from the outset that it had committed an error in mentioning the status of striker of the plaintiffs during its communication by email dated March 29, 2022. 62. The Litigation Division notes above all that the defendant indicated that it had put in place, prior to the incident denounced in the terms of the complaints, a series of measures intended to implements the obligations arising from the GDPR. It also notes the commitments made to terms of its conclusions after the reported incident to prevent such errors from occurring. reproduce. 63. It also follows from the finding of the Litigation Chamber that the notion of “striker” does not may be further processed by the defendant for other purposes. Decision on the merits 49/2023 – 19/19 64. In light of the foregoing, the Litigation Chamber considers that the reprimand constitutes the appropriate sanction in the circumstances. III. Publication of the decision 65. Given the importance of transparency regarding the decision-making process of the Chamber Litigation, this decision is published on the DPA website. Is about the identity of the complainants, the Litigation Chamber having considered that it was able to process their complaint without disclosing their identity to the defendant, it will not disclose in all logical not their identity at the end of its publication. Regarding the identity of the defendant, the Litigation Chamber considers that its identification is not necessary for the publication. FOR THESE REASONS, the Litigation Chamber of the Data Protection Authority decides, after deliberation: - Under Article 100.5. of the ACL, to issue a reprimand with regard to the defendant with regard to the violation of Articles 5.1.a) (lawfulness) and 6 of the GDPR. In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged, within thirty days of its notification, to the Court of Markets (court d'appel de Bruxelles), with the Data Protection Authority as defendant. Such an appeal may be introduced by means of an interlocutory request which must contain the information listed in article 1034ter of the Judicial Code. The interlocutory motion must be filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 12 via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.). (se). Hielke HIJMANS President of the Litigation Chamber 1The request contains on penalty of nullity: (1) indication of the day, month and year; 2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or Business Number; 3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned; (4) the object and summary statement of the means of the request; (5) the indication of the judge who is seized of the application; 6° the signature of the applicant or his lawyer. 12 The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter recommended to the court clerk or filed with the court office.