APD/GBA (Belgium) - 141/2023
| APD/GBA - 141/2023 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 5(2) GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | 18.08.2023 |
| Decided: | 16.10.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 141/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | French |
| Original Source: | APD (in FR) |
| Initial Contributor: | n/a |
The Belgian DPA dismissed a complaint regarding disclosure of data by the communications officer of a political party to unauthorized persons, because the data subject had not provided sufficient evidence that their rights were violated.
English Summary
Facts
Data subject was a member of a political party. On 10 March 2023 the data subject contacted Political Party Data Protection Officer claiming that their personal data was illegally disclosed to other members by the party communication officer, objecting to such a disclosure and requesting information on the measures which would be taken to stop such treatment. On 03 April 2023 the Political party data protection officer replied, claiming that the data was processed in accordance with legal requirements and that there was no disclosure. On 11 April 2023, Data subject announced their dissatisfaction with the decision and listed a number of claims supporting their claims. After further communication, data subject first filled on 6 june 2023 a request for mediation in front of the ADP. Political Party maintained its position during the mediation and added in subsequent communication that person who was supposed to have disclosed the data did not have access to it at all. On 18 August 2023, the Data Subject converted their request for mediation into a complaint as permitted by Article 62, §2 of the Loi du 3 décembre 2017 portant création de l'Autorité de protection des données (LCA).
Holding
ADP rejected the complaint under Article 95, § 1, 3° of the LCA.
Firstly, the ADP found that the data subject claim of data disclosure was not sufficiently proven. During the mediation and proceedings, data subject claimed that the disclosure was supported by testimonies of several persons and police complaint but no such proof was presented. Data subject also claimed that the person who allegedly disclosed data communicated such fact to them, but did not present any communication which would prove this fact. Data subject brought up also disciplinary action against the communications officer, who was supposed to have disclosed the data, carried out by the data controller, but ADP noted that it was not enough to prove that there was disclosure of personal data in the party. Finally ADP decided that there was no necessity to launch an investigation into the activities of the data controller join order to collaborate the claims of the data subject. Regardless of being proven or not, the grievance raised by the complainant does not correspond to the criteria of high general or personal impact. Therefore it is up to the ADP to weigh up the personal impact of the circumstances of the complaint and to decide whether it is appropriate to deal with the complaint further. Given the the lack of substantial evidence and for the reasons of expediency, ADP decided not to investigate the matter further.
Comment
ADP’s criteria for "high personal impact" is stated as follows: "3.2.1 General criteria for high social and/or personal impact In principle, the [Belgian DPA] will deem it appropriate to deal with your complaint in depth if it involves grievances with a major social and/or personal impact, in other words if it involves one of the following situations: 1. Profiling and predictive activities relating to aspects of the individual's work performance, economic status, health, personal preferences or interests, reliability or behaviour, or location and travel. 2. Automated decision-making with legal effect (or similar significant effects) on the data subject (e.g. granting credit based on automated criteria). 3. Processing operations used to observe, monitor or control data subjects, including the collection of data over networks or by "systematic surveillance of a publicly accessible area" (e.g. camera surveillance in public places). 4. Processing of sensitive data of a highly personal nature, namely personal data as referred to in Article 9 of the GDPR (data concerning health, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and processing of genetic data, biometric data for the purpose of uniquely identifying a person, or data relating to a person's sexual behaviour or sexual orientation), as well as personal data relating to criminal convictions or offences (Article 10 of the GDPR). 5. Widely processed data, taking into account the following factors: o the number of people affected, either in absolute terms or in relation to the population under consideration; o the volume of data and/or range of different data elements processed;- The geographical scope of the processing activity (e.g. cross-border or not). 6. Cross-referencing or combining data sets from different processing activities in a way that goes beyond the data subject's reasonable expectations (e.g. other than the purposes for which the data were collected). 7. Data concerning vulnerable persons who cannot freely consent (e.g. children,workers, mentally ill people, asylum seekers, patients). 8. Use of new technological or organisational solutions whose impact on data subjects is not easily foreseeable (e.g. facial recognition systems). 9. Processing that prevents data subjects from exercising a right or receiving a service or contract.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
Litigation Chamber Decision 141/2023 of October 16, 2023 File number: DOS-2023-02498 Subject: Complaint relating to the disclosure of personal data by the party Belgian politics “..” The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke Hijmans, president, sitting alone; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the protection of natural persons with regard to the processing of personal data and to the free movement of these data, and repealing Directive 95/46/EC (general regulation on the data protection), (hereinafter “GDPR”); Having regard to the Law of December 3, 2017 establishing the Data Protection Authority (hereinafter “LCA”); Having regard to the Law of July 30, 2018 relating to the protection of individuals with regard to processing of personal data (hereinafter “LTD”); Considering the Internal Regulations as approved by the House of Representatives on 20 December 2018 and published in the Belgian Official Gazette on January 15, 2019; Considering the documents in the file; Has taken the following decision regarding: The complainant: X, hereinafter “the complainant”; The defendant: Y, hereinafter “the defendant”. Decision 141/2023 - 2/7 I. Facts and procedure 1. On August 18, 2023, the complainant filed a complaint with the Data Protection Authority. data (hereinafter “the APD”) against the defendant, the local section of the political party “Y” of Braine-l’Alleud (hereinafter “the political party”). 2. The subject of the complaint concerns the unlawful processing of personal data, these would have been used illicitly and disclosed to other members of the party policy by Mrs. Z1, the communications manager of the defendant, in order to damage its reputation. 3. On March 10, 2023, the complainant contacted Z2, the party's data protection officer policy (hereinafter the “DPO”). She alleges that her personal data, appearing in a “listing” of members of the local section of Braine-l’Alleud, would have been disclosed. The complainant identifies Madame Z1, the communications manager of the defendant, as the alleged perpetrator of the offense. It is based on several evidence, in particular a certificate of anonymous testimony dated March 4 2022, which claims that Madame Z1 would have made negative comments about her in private in front of the witness and several of her colleagues, while asking them to remove her from their list friends on Facebook; and a police complaint filed on October 7, 2022. Other evidence would be available, but they must be requested by the DPO. 4. On March 14, 2023, the DPO acknowledges receipt of the complainant’s email and undertakes to undertake the necessary checks. 5. On April 3, 2023, the complainant sent a reminder to the DPO regarding her email of March 10 2023, and she expresses her opposition to the illicit use of her data. She asks for information on the measures that will be taken to prevent the unlawful processing of its data. The same day, the DPO shared the results of his checks and indicated that the internal rules were well respected in that the President of the local section of the party policy, namely Mr. Z3 in this case, responsible and guarantor of the confidentiality of personal data of members of the section within the meaning of article 21, §3 of the statutes of the local sections of the political party, would have confirmed to him that, on the one hand, he would keep the “listing” of the members of the section in a secure manner and that, on the other hand, On the other hand, he would not have entrusted the file in question to another member of the said section. 6. On April 11, 2023, the complainant expressed her dissatisfaction with the response received and expresses concerns about the misuse of his personal data by The political party. The complainant bases her assertions on several elements and facts that she listed in his email. Decision 141/2023 - 3/7 7. On June 8, 2023, the complainant filed a request for mediation with the APD against the defendant within the meaning of article 22, §1, 2° of the LCA. 8. On July 3, 2023, the Front Line Service (hereinafter “SPL”) declares the request in admissible mediation. On the same date, the SPL contacts the DPO to initiate the mediation procedure with the complainant and ask her to respond to the email of April 11 2023, in which she expressed her concerns regarding the need to take measures to avoid abusive processing of personal data. Furthermore, she requested that the recipients of his personal data be informed of the misuse of personal data of members of the BraineL’Alleud political party. 9. On July 19, 2023, the DPO reiterated that Madame Z1 does not have access to the “listing” of members of the political party. In addition, the DPO mentions having reiterated his request to the President of the local section of the political party, Mr. Z3, who formally confirmed that he was the only responsible for the use of the file of members of its Braine-l’Alleud section. The DPO understands the complainant's suspicions, but specifies that they are unfounded. According to DPO, the personal data would have been communicated or used outside the strict functioning of the party. 10. On August 1, 2023, the complainant responded to the DPO indicating that she had an interview with the president of the Braine-l’Alleud section of the political party on July 28, 2023. She specifies that the latter will provide him with answers to questions relating to the use of his personal data by mid-August. On this same date, the SPL informed the complainant that he received a response from the defendant dated July 19, 2023; and estimates that the mediation led to a positive result. 11. On August 18, 2023, the complainant transformed her request for mediation into a complaint as This is permitted by article 62, §2, paragraph 4, 1° of the LCA. 12. On August 25, 2023, the SPL informed the defendant that the request for mediation had been transformed into a complaint by the complainant. 13. On August 28, 2023, the SPL of the APD declared the complaint admissible on the basis of articles 58 and 60 of the LCA, and transmits it to the Litigation Chamber in accordance with article 62, § 1 of the LCA. II. Motivation 14. Pursuant to Article 4, § 1 of the LCA, the APD is responsible for monitoring the principles of data protection contained in the GDPR and other laws containing provisions relating to the protection of the processing of personal data. Decision 141/2023 - 4/7 15. Pursuant to article 33, §1 of the LCA, the Litigation Chamber is the organ of the administrative litigation of the APD. It receives complaints that the SPL sends to it in application of article 62, §1 of the LCA, or admissible complaints. In compliance with article 60 paragraph 2 of the LCA, complaints are admissible if they are drawn up in one of the national languages, contain a statement of the facts and the necessary information to identify the processing of personal data to which they relate and which fall under the jurisdiction of the ODA. 16. Based on the facts described in the complaint file as summarized above, and on basis of the powers assigned to it by the legislator under article 95, § 1 of the LCA, the Litigation Chamber decides on the follow-up to be given to the file; in occurrence, the Litigation Chamber decides to proceed with the classification without further action. the complaint, in accordance with article 95, § 1, 3° of the LCA, for the reasons set out below. 17. In matters of dismissal, the Litigation Chamber is required to provide reasons for its decision. step-by-step decision1 and: - pronounce a classification without technical follow-up if the file does not contain or not sufficient evidence likely to lead to a sanction or if it includes a technical obstacle preventing it from rendering a decision; - or pronounce a classification without further opportunity, if despite the presence of elements likely to lead to a sanction, the continuation of the examination of the file does not seem appropriate given the priorities of the Authority of data protection as specified and illustrated in the Privacy Policy classification without further action by the Litigation Chamber2 . 18. In the event of dismissal based on several grounds for dismissal, these last (respectively, classification without technical follow-up and classification without follow-up opportunity) must be treated in order of importance3 . 19. In this case, the Litigation Chamber decides to proceed with a classification without further action. the complaint for these two reasons. The decision of the Litigation Chamber rests more precisely on two reasons why it considers it inappropriate to continue monitoring the file, and therefore decides not to proceed, among other things, to an examination of the merits of the case. 1 Market Court (Brussels Court of Appeal), September 2, 2020, judgment 2020/AR/329, p. 18. 2 In this regard, the Litigation Chamber refers to its policy of dismissal as developed and published on the Authority’s website. data protection: https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambrecontentieuse.pdf. 3 Data Protection Authority, “Disclosure policy of the Litigation Chamber: 3. – In what cases is my complaint likely to be closed without action by the Litigation Chamber? », June 18, 2021, available on https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-contentieuse.pdf. Decision 141/2023 - 5/7 20. The Litigation Chamber notes that the complainant denounces the unlawful processing of her personal data. 21. Firstly, the Litigation Chamber notes that the complaint is not sufficiently supported by evidence of the existence of a violation of the GDPR or protective laws personal data (criteria A. 1 of said policy). Consequently, the Chamber Litigation decides to dismiss the complaint for technical reasons. 22. Despite the allegations that the plaintiff makes against the defendant concerning the alleged disclosure of his personal data to other party members political, the Litigation Chamber notes that no evidence to this effect appears in the case. The complainant, in fact, claims to have received testimonies from people who may have obtained illicit access to their personal data, but does not provide any nevertheless no trace. 23. In addition, the complainant relies on the existence of a precedent under which the communications manager of the defendant was sanctioned by a former employer. However, this sanction cannot lead the Litigation Chamber to determination of the existence of a violation of the GDPR or data protection laws personal for the facts in this case. 24. Furthermore, the complainant states that the president of the Braine-l’Alleud local section of political party would have confirmed the position of the communications manager of the defendant, presumed author of the offense, and as such refers us to an exchange informal non-time-stamped between her and him. However, nothing of the sort appears when reading this part of the file. 25. Finally, the complainant expresses her dissatisfaction with the answers given by the DPO of the defendant, however, it turns out that he always responded within the time limit given to him imposed by Articles 12.3 and 12.4 of the GDPR (see points 5, 8 and 9). 26. Secondly, and without prejudice to the above, the Litigation Chamber proceeds to classification without further action for reasons of expediency (criteria B. 2 and B. 5 of said policy)4 . 27. On the one hand, the Litigation Chamber notes that the grievance raised by the complainant does not does not meet the criteria of high general or personal impact, as defined by the ODA in its note on the no action classification policy of June 18, 2021. 28. On the other hand, if the criteria of high general or personal impact do not apply, the Litigation Chamber weighs the personal impact of the circumstances of the complaint 4 A dismissal for reasons of expediency does not mean that the Litigation Chamber legally finds that no violation has occurred, but the resources required to substantiate the complaint are potentially excessive. ; Protection Authority data, “Policy of classification without further action of the Litigation Chamber”, June 18, 2021, available on https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-contentieuse.pdf Decision 141/2023 - 6/7 for the rights and fundamental freedoms of the complainant, and the efficiency of her intervention, to decide whether it considers it appropriate to deal with the complaint in depth. In this case, the Litigation Chamber notes that there is a legal proceeding in progress which includes the grievances made in the complaint filed by the complainant with the police on October 7, 2022. However, the Litigation Chamber recalls that it assesses the efficiency of its intervention as well as the means necessary to handle the complaint in a manner in-depth. In this context, given the absence of substantial evidence (see points 21 to 25) and the significant resources that this would imply, the Litigation Chamber concludes that it would not be appropriate to launch an investigation through the Inspection Service to corroborate the complainant's allegations, nor to make decisions parallel to a ongoing legal proceedings. Consequently, the Litigation Chamber decides not to carry out an examination of the merits of the case. 29. In conclusion, the Litigation Chamber decides to proceed with the classification without further action. the complainant's complaint, both for technical reasons and for reasons of expediency. 30. For information purposes, and without this constituting any corrective measure or sanction within the meaning of article 95, §1 of the LCA, the Litigation Chamber recalls nevertheless, any data controller must be able to demonstrate the compliance of its processing with the GDPR, and throughout, by virtue of Article 5.2 of the GDPR. III. Publication and communication of the decision 31. Given the importance of transparency regarding the process decision-making and the decisions of the Litigation Chamber, this decision will be published on the website of the Data Protection Authority. However, it is not necessary for this so that the identification data of the parties are directly communicated. 32. In accordance with its policy of dismissal, the Litigation Chamber will communicate the decision to the defendant(s) 5 . Indeed, the Litigation Chamber decided to communicate the decisions of dismissal to the defendants by default. There Chambre Litigation, however, refrains from such communication when the complainant requested anonymity with regard to the defendant(s) and when the communication of the decision to the defendant(s), even pseudonymised, nevertheless risks allowing their reidentification6 . This is not the case in the present case. 5 Data Protection Authority, “Clearance policy of the Litigation Chamber: 5. – Will the classification without action be published? Will the opposing party be informed? », June 18, 2021, available on https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-contentieuse.pdf. 6 Ibid. Decision 141/2023 - 7/7 In accordance with article 108, § 1 of the LCA, an appeal against this decision may be lodged, within thirty days from its notification, to the Court of Markets (court of Appeal of Brussels), with the Data Protection Authority as defendant. Such an appeal may be introduced by means of an interlocutory request which must contain the information listed in article 1034ter of the Judicial Code7 . The interlocutory request must be filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud.8 , Or via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. judic.). To enable it to consider any other possible course of action, the Litigation Chamber refers the complainant to the explanations provided in its classification policy without further action9 . The Litigation Chamber emphasizes that the classifications without further action are likely to be taken into account by the Data Protection Authority in order to set its future priorities and/or could inspire future initiative investigations by the Inspection Service of the Authority of Data protection. (sé). Hielke HIJMANS President of the Litigation Chamber
