APD/GBA (Belgium) - 62/2023
From GDPRhub
| APD/GBA - 62/2023 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 6(1)(a) GDPR Article 95 §1 3° Loi portant création de l'Autorité de protection des données |
| Type: | Complaint |
| Outcome: | Other Outcome |
| Started: | 11.03.2023 |
| Decided: | 01.06.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 62/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | French |
| Original Source: | Autorité de Protection des données (in FR) |
| Initial Contributor: | Enzo Marquet |
The Belgian DPA dismissed a complaint based on article 95, §1, 3 LCA because the data subject did not adequately prove a breach of the GDPR. The Belgian DPA stated that it would require a disproportionate amount of resources, compared to the limited impact, to resolve the issue.
English Summary
Facts
There were four parties in this case: the data subject who applied for a new job, his ex-employer who fired him, the new employer where the data subject applied for a job and a recruitment agency tasked with the recruitment for the new employer.
When the data subject applied for a new job, the recruitment agency contacted the ex-employer to ask for references. The ex-employer provided negative references. This resulted in the new employer not wanting to hire the data subject and the recruitment agency ceasing all contact with him.
The data subject was informed about this negative reference and also reached out to the new employer and recruitment agency to resolve the matter amicably. He did not receive a response and thus went to the DPA to complain about his personal data being processed without the required legal basis, his consent.
Holding
The Belgian DPA clarified that it possesses the competence to dismiss a complaint under article 95, §1, 3° Law creating the Data Protection Authority. For this case, the DPA motivated its dismissal based on two reasons:
First, the DPA found that the data subject did sufficiently prove a breach of the GDPR or any data protection legislation. There was no concrete proof of the allegations such as supporting documents. A presented screenshot of a text message did not suffice to prove the authenticity of the allegations, nor did it provide compelling evidence.
Second, the DPA dismissed the case based on opportunity reasons. The complaint did not meet the threshold of general or elevated personal impact. The DPA clarified that the resources required to conduct additional research for evidence purposes would be disproportionately large and not an efficient usage of the limited resources available.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/6
Litigation Chamber
Decision 62/2023 of June 1, 2023
File number: DOS-2023-01173
Subject: Complaint relating to the collection of personal data belonging to a
candidate by the potential employer with his former employer as part of a
recruitment procedure and conversely to the communication of said data by
the ex-employer to the potential employer
The Litigation Chamber of the Data Protection Authority, made up of Mr Hielke
Hijmans, President, sitting alone;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and
to the free movement of such data, and repealing Directive 95/46/EC (general regulation on the
data protection), hereinafter “GDPR”;
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter
“ACL”);
Having regard to the Law of 30 July 2018 relating to the protection of natural persons with regard to
processing of personal data (hereinafter “LTD”);
Having regard to the Rules of Procedure as approved by the House of Representatives on 20
December 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Made the following decision regarding:
The plaintiff: X, hereinafter “the plaintiff”;
Defendant: Y1, hereinafter “Defendant 1”;
Y2, hereinafter “Defendant 2”;
Y3, hereinafter “Defendant 3”. Decision 62/2023 - 2/6
I. Facts and procedure
1. On March 11, 2023, the complainant lodged a complaint with the Data Protection Authority
data (hereafter "DPA") against the defendants.
2. The subject of the complaint concerns the collection of personal data belonging to a
candidate by the potential future employer with his former employer as part of a
recruitment procedure and conversely to the communication of said data by the former
employer to potential future employer
3. On March 11, 2023, the Complainant requested the SPL from the DPA through the application form
of information. The complainant, a job seeker, discovered that a potential employer,
Mr. Y1 (hereinafter “Defendant 1”), took references without his consent
from a former director of company Z, Mr. Y2 (hereinafter “defendant 2”). THE
complainant asks the SPL to confirm the data breach and indicate the procedure
which must be followed in order to obtain compensation.
4. On March 14, 2023, the SPL reminded the complainant of the concept of processing personal data
staff and urges the complainant to verify certain information. On the same day, the complainant
files a complaint: he claims in the body of his email that defendant 1 informed by
e-mail Mrs. V in charge of recruitment at W (hereinafter "the
defendant 3") that he did not want to work with him because of comments that were not
commendation from its former director, defendant 2. In support of his remarks, the
complainant attached to his complaint a screenshot of a message (SMS) he received from the
defendant 3: “Monday Mr. Y1 gave an email response. He decided not to
work with you. He received not very complimentary comments about you from
the former director of Z.”. The plaintiff adds that defendant 3 ceased, since this
incident, any form of collaboration in the management of his file and that defendant 2 has
already damaged his reputation by spreading false rumours. He thinks the
documents which could, we quote, “emerge from this complaint [him] would allow
to be able to sue [respondent 2] for slander and defamation”.
5. In addition to the abovementioned information, the complainant affirms, in the complaint form,
having been dismissed after 13 years of service for reorganization by the defendant 2 , and considers
that his personal data has been unlawfully processed by his former employer and the
potential employer. The complainant indicates that he tried to contact the people involved,
both by phone and by e-mail, to solve this problem amicably,
but without success.
6. The complainant sends an email to the SPL providing information
supplementary information on the law on labor relations and the collection of candidate data
with their former employers and clients. The complainant also provided a link, link Decision 62/2023 - 3/6
which refers to the site of the Data Protection Authority (hereinafter "DPA")
https://www.autoriteprotectiondonnees.be/professionnel/themes/vie-privee-sur-le-lieu-
of-work/recruitment-of-candidates.
7. On March 21, 2023, the SPL informed the complainant that his complaint was inadmissible for defects of
forms. The same day, the complainant returns the complaint form duly completed.
8. On May 2, 2023, the SPL declared the complaint admissible on the basis of Articles 58 and 60 of the ACL,
and sends it to the Litigation Division in accordance with Article 62, § 1 of the LCA.
II. Motivation
9. Pursuant to Article 4, § 1 of the LCA, the DPA is responsible for monitoring the principles
of data protection contained in the GDPR and other laws containing
provisions relating to the protection of the processing of personal data.
10. Pursuant to Article 33, §1 of the LCA, the Litigation Chamber is the body for
ODA administrative litigation. It receives complaints that the SPL forwards to it in
application of Article 62, § 1 of the LCA, i.e. admissible complaints. In accordance with
Article 60 paragraph 2 of the LCA, complaints are admissible if they are written in one of the
national languages, contain a statement of the facts and the information necessary to
identify the processing of personal data to which they relate and which
fall within the competence of the ODA.
11. On the basis of the facts described in the complaint file as summarized above, and on the
powers attributed to it by the legislator under Article 95, § 1 of the
the LCA, the Litigation Chamber decides on the follow-up to be given to the file; in this case, the
Litigation Chamber decides to proceed with the dismissal of the complaint,
in accordance with Article 95, § 1, 3° of the LCA, for the reasons set out below.
12. In matters of dismissal, the Litigation Chamber is required to justify its
1
step-by-step decision and:
- to pronounce a classification without technical continuation if the file does not contain or not
sufficient element likely to lead to a sanction or if it includes a
technical obstacle preventing him from rendering a decision;
- or pronounce a classification without further opportunity, if despite the presence
elements likely to lead to a sanction, the continuation of the examination of the
file does not seem to him to be appropriate given the priorities of the Autorité de
1Cour des marchés (Brussels Court of Appeal), September 2, 2020, judgment 2020/AR/329, p. 18. Decision 62/2023 - 4/6
data protection as specified and illustrated in the Privacy Policy
2
dismissal of the Litigation Chamber.
13. In the event of dismissal based on several reasons for dismissal, these
last (respectively, classification without technical continuation and classification without continuation
opportunity) should be addressed in order of importance . 3
14. In this case, the Litigation Chamber decides to proceed with a classification without further
the complaint on these two grounds. The decision of the Litigation Chamber is based more
specifically on two reasons why it considers it inappropriate to
continue to monitor the case, and therefore decides not to proceed, among other things, with
a review of the case on the merits.
15. First, the Litigation Division finds that the complaint is not sufficiently
supported by evidence of a breach of GDPR or privacy laws
personal data, and decides to dismiss the complaint for technical reasons.
16. Although the complainant alleges the collection and communication of personal data
personal by the defendants, he did not provide any hard evidence to support these
allegations. The complaint does not contain supporting documents, correspondence or
other specific pieces of evidence that would allow the Litigation Chamber
to clearly identify the alleged violation. The Litigation Chamber adds that the capture
screenshot of the SMS message provided by the complainant, although presented as evidence,
does not allow the authenticity of the information to be verified and does not constitute proof
conclusive. In the absence of sufficient evidence, the Litigation Chamber cannot conclude
whether there is a breach of GDPR and/or data protection laws. By
Consequently, the grievance raised by the complainant is dismissed.
17. Secondly, and without prejudice to the foregoing, the Litigation Division proceeds to a
dismissal for reasons of opportunity. The Litigation Chamber notes that the grievance
raised by the complainant does not meet the general or personal impact criteria
high, as defined by the APD in its note on the policy of classification without follow-up of the
June 18, 2021. The Litigation Chamber therefore weighs the personal impact
the circumstances of the complaint for the fundamental rights and freedoms of the complainant, and
the efficiency of its intervention, to decide whether it considers it appropriate to deal with the complaint of
thorough manner.
2In this respect, the Litigation Chamber refers to its policy of dismissal as developed and published on
the website of the Data Protection Authority: https://www.autoriteprotectiondonnees.be/publications/politique-de-
classification-without-continuation-of-the-litigation-chamber.pdf.
3Data Protection Authority, “Policy of classification without follow-up of the Litigation Chamber: 3.–In which cases
Is my complaint likely to be dismissed by the Litigation Chamber? », June 18, 2021, available on
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
litigation.pdf. Decision 62/2023 - 5/6
18. In this case, although the Complainant mentioned alleged consequences on his
reputation and his relationship with the defendant 3, the Litigation Chamber finds that the
screenshot of an SMS message provided by the complainant does not constitute a source
sufficiently reliable and verifiable to support claims of a breach of the GDPR and/or
data protection laws. In addition, the Litigation Chamber recalls that it
evaluates the efficiency of its intervention and the means necessary to deal with the complaint
thorough manner. In this case, a thorough investigation would require means
considerable resources to gather additional evidence, question the parties involved
and assess the circumstances surrounding the allegations. Given the lack of evidence
strong and the significant resources that this would entail, the Litigation Chamber
considers that it is not appropriate to pursue the examination of the complaint. Therefore, the
Complaint is also dismissed for reasons of expediency. 4
19. In conclusion, the Litigation Chamber decides to proceed with the dismissal of the
plaintiff's complaint, both for technical and expediency reasons.
III. Publication and communication of the decision
20. Given the importance of transparency with regard to the process
decision-making and the decisions of the Litigation Chamber, this decision will be published on the
website of the Data Protection Authority. However, it is not necessary for this
so that the identification data of the parties are directly communicated.
21. In accordance with its policy of dismissal, the Litigation Chamber
5
communicate the decision to the defendants. Indeed, the Litigation Chamber decided to
communicate dismissal decisions to default defendants. There
However, the Litigation Chamber refrains from such communication when the complainant
has requested anonymity vis-à-vis the defendant(s) and when the communication of the
decision to the defendant(s), even pseudonymized, nevertheless risks allowing its re-
identification . This is not the case in the present case, the plaintiff having not requested
anonymity.
4
A dismissal for reasons of expediency does not mean, however, that the Litigation Chamber legally finds that no
violation has taken place, but the resources needed to substantiate the claim are potentially excessive. ; Authority for the protection of
data, “Dismissal policy of the Litigation Chamber”, June 18, 2021, available on
5ttps://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-contentieuse.pdf
Data Protection Authority, “Policy of classification without follow-up of the Litigation Chamber: 5. -Classification
without follow-up will it be published? Will the opposing party be informed? », June 18, 2021, available on
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
litigation.pdf.
6Ibidem. Decision 62/2023 - 6/6
FOR THESE REASONS,
The Litigation Chamber of the Data Protection Authority decides, after deliberation,
to close this complaint without further action pursuant to Article 95, § 1, 3° of the LCA.
In accordance with article 108, § 1 of the LCA, an appeal against this decision may be lodged,
within thirty days of its notification, to the Court of Markets (court
d'appel de Bruxelles), with the Data Protection Authority as defendant.
Such an appeal may be introduced by means of an interlocutory request which must contain the
information listed in article 1034ter of the Judicial Code. The interlocutory motion must be
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 8
via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).
To allow him to consider any other possible course of action, the Litigation Chamber sends
the complainant to the explanations provided in its dismissal policy. 9
The Litigation Chamber underlines that the classifications without action taken are likely
to be taken into account by the Data Protection Authority in order to set its future priorities
and/or could inspire future investigations of the Inspection Authority's own initiative.
Data protection.
(se). Hielke HIJMANS
President of the Litigation Chamber
7The request contains on penalty of nullity:
(1) indication of the day, month and year;
2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
Business Number;
3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
(4) the object and summary of the grounds of the application;
(5) the indication of the judge who is seized of the application;
6° the signature of the applicant or his lawyer.
8
The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.
9Data Protection Authority, “Discontinued filing policy of the Litigation Chamber: 4. – What can I
should I do if my complaint is dismissed? », June 18, 2021, available on
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
litigation.pdf.
