APD/GBA (Belgium) - 63/2023
From GDPRhub
| APD/GBA - 63/2023 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 5(1)(c) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 24.01.2023 |
| Decided: | 01.06.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 63/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | French |
| Original Source: | APD/GBA (in FR) |
| Initial Contributor: | n/a |
An employer informing the staff of the dismissal of some employees breached Article 5(1)(c) by specifying the reasons of the dismissal.
English Summary
Facts
On 15 January 2023, an employer (controller) sent an email to his staff concerning the dismissal of two employees (data subjects). The email stated that the data subjects were being dismissed for serious misconduct.
Believing that it was not necessary to specify why they were being dismissed, especially as their job was to look after children and this could give the impression that they had committed a fault in relation to the children, the data subjects each lodged a complaint with the Belgian DPA.
Holding
As the two complaints concerned the same controller and the same facts, the DPA joined the complaints together.
The DPA recalled that, according to the principle of minimisation, personal data must be adequate, relevant and limited to what is necessary for the purposes for which it is processed.
In this case, the DPA considered that the controller did not have to specify the reason for the dismissal in order to inform the staff that the data subjects were no longer part of the team. The controller thus breached Article 5(1)(c) GDPR. The DPA therefore issued a warning.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/5
Litigation Chamber
Decision 63/2023 of June 1, 2023
File number: DOS-2023-00504 attached to DOS 2023-00468
Subject: Complaint relating to the sending of an email by the ex-employer of the complainants to the ex-colleagues
of these, specifying the nature of their dismissal
The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke
Hijmans, chairman;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and
to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the
data protection), hereinafter “GDPR”;
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, hereinafter
“ACL”;
Having regard to the internal regulations as approved by the House of Representatives on 20
December 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Made the following decision regarding:
The complainants: Ms. X1, and Ms. X2 hereinafter “the complainants”; .
.
.
The defendant: Y, hereinafter: “the defendant” Decision 63/2023 – 2/5
I. Facts and procedure
1. On January 24 and 27, 2023, the complainants filed a complaint with the Authority of
Data Protection (hereinafter “the DPA”), against their former employer, the defendant.
The subject of the complaint concerns the sending on January 15, 2023 to third parties (between twenty and thirty
members of staff) of an email concerning the dismissal of the complainants by their ex-
employer. The disputed email specifies that the complainants were dismissed for serious misconduct.
However, the plaintiffs point out that specifying to third parties (their ex-colleagues) the nature of the
dismissal, i.e. serious misconduct, was not necessary. They indicate that this can give
the impression that they have committed a serious fault in relation to the children cared for by
the institution of their ex-employer, while the reasons underlying the serious misconduct would be
others.
2. On February 15, 2023, the complaint was declared admissible by the Front Line Service on the
basis of Articles 58 and 60 of the LCA and the complaint is forwarded to the Litigation Chamber
under Article 62, § 1 of the LCA for file 2023-00504. On February 3, 2023, the
complaintisdeclaredadmissiblebythePremiumLineServiceonthebasisofarticles58 and
60 of the LCA and the complaint is transmitted to the Litigation Chamber under article 62,
st 4
§ 1 of the ACL for file 2023-00468.
3. On February 27, 2023, the Litigation Chamber sent a letter to the complainant in the
file 2023-00504 to inform him that a complaint for the same facts against the same
controller of another person was received in case 2023-00468.
In this respect, for reasons of procedural economy and efficiency, the Chamber
Litigation sent an e-mail to the two complainants, to indicate to them that unless the
their part within 10 days, the two complaints will be joined. Following this, the two files have
been joined.
4. Pursuant to article 95 § 2, 3° of the LCA as well as article 47 of the rules of order
inside the DPA, a copy of the file may be requested by the parties. If one of
parties wishes to make use of the possibility of consulting the file, the latter is required to
contact the secretariat of the Litigation Chamber, preferably via the address
litigationchamber@apd-gba.be.
1
Pursuant to article 61 LCA, the Litigation Chamber informs the parties by this decision, of the fact that the complaint has been
declared admissible.
2 Pursuant to Article 95, § 2 LCA, by this decision, the Litigation Division informs the parties of the fact that following
of this complaint, the file was forwarded to him.
3 Pursuant to article 61 LCA, the Litigation Chamber informs the parties by this decision, of the fact that the complaint has been
declared admissible.
4
Pursuant to Article 95, § 2 LCA, by this decision, the Litigation Chamber informs the parties of the fact that following
of this complaint, the file was forwarded to him. Decision 63/2023 – 3/5
II. Motivation
5. The data minimization principle states that personal data
must be adequate, relevant and limited to what is necessary for the purposes
for which they are processed (article 5.1.c) of the GDPR).
6. The Litigation Chamber considers that it is not necessary to specify the nature of the
dismissal in order to inform employees of the dismissal of the complainants, the only
mention of the departure being sufficient in this regard. Insofar as the purpose pursued
could reasonably be achieved without disclosing this information, the Chamber
Litigation finds that the defendant violated article 5.1.c) of the GDPR by specifying in
the disputed email that the dismissal takes place for serious misconduct, instead of being limited to the
notification of dismissal only.
7. This decision is a prima facie decision taken by the Litigation Chamber
in accordance with article 95 of the LCA on the basis of the complaint lodged by the complainants,
within the framework of the “procedure prior to the substantive decision” and not a decision on the
merits of the Litigation Chamber within the meaning of Article 100 of the LCA.
8. The purpose of this decision is to inform the defendant, allegedly responsible for the
processing, because it may have violated the provisions of the GDPR,
in order to enable it to still comply with the aforementioned provisions.
9. If, however, the defendant does not agree with the content of this decision
prima facie and believes that it can make factual and/or legal arguments that
could lead to another decision, it may send the Litigation Chamber a
request for treatment on the merits of the case via the e-mail address litigationchamber@apd-
gba.be, within 30 days of notification of this decision. The case
applicable, the execution of this decision is suspended for the period
aforementioned.
10. In the event of further processing of the case on the merits, pursuant to Articles 98, 2° and 3°
juncto article 99 of the LCA, the Litigation Chamber will invite the parties to introduce their
conclusions and attach to the file all the documents they deem useful. If applicable, the
this decision is permanently suspended.
11. In the interests of transparency, the Litigation Division finally emphasizes that a
dealing with the case on the merits may lead to the imposition of the measures mentioned in
section 100 of the ACL.
5
Section 3, Subsection 2 of the ACL (articles 94 to 97 inclusive).
6Art. 100. § 1. The litigation chamber has the power to
1° dismiss the complaint without follow-up;
2° order the dismissal; Decision 63/2023 – 4/5
III. Publication of the decision
12. Considering the importance of transparency regarding the decision-making process of the Chamber
Litigation, this decision is published on the website of the Protection Authority
Datas. However, it is not necessary for this purpose that the identification data
of the parties are communicated directly.
FOR THESE REASONS,
The Litigation Chamber of the Data Protection Authority decides, after
deliberation:
- Pursuant to Article 95, § 1, 4° of the LCA, to issue a warning with regard to
the defendant to comply in the future with the requirements of Article 5.1.c) of the GDPR.
In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged,
within thirty days of its notification, to the Court of Markets (court
d'appel de Bruxelles), with the Data Protection Authority as defendant.
Such an appeal may be introduced by means of an interlocutory request which must contain the
7
information listed in article 1034ter of the Judicial Code. The interlocutory motion must be
3° pronouncing the suspension of the pronouncement;
4° to propose a transaction;
5° issue warnings and reprimands;
6° order to comply with requests from the data subject to exercise his or her rights;
7° order that the person concerned be informed of the security problem;
8° order the freezing, limitation or temporary or permanent prohibition of processing;
9° order compliance of the processing;
10° order the rectification, restriction or erasure of the data and the notification thereof to the recipients of the
data ;
11° order the withdrawal of accreditation from certification bodies;
12° to issue periodic penalty payments;
13° to issue administrative fines;
14° order the suspension of cross-border data flows to another State or an international body;
15° forward the file to the public prosecutor's office in Brussels, who informs it of the follow-up given to the file;
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority.
7
The request contains on pain of nullity:
(1) indication of the day, month and year;
2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
Business Number;
3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
(4) the object and summary statement of the means of the request;
(5) the indication of the judge who is seized of the application;
6° the signature of the applicant or his lawyer. Decision 63/2023 – 5/5
8
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , Or
via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).
(se). Hielke H IJMANS
President of the Litigation Chamber
8The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.
