APD/GBA (Belgium) - 21/2025
| APD/GBA - 21/2025 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 6(1)(a) GDPR Article 5(1)(c) GDPR LCA Article 95 #1 3° |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | 12.09.2024 |
| Decided: | 06.02.2025 |
| Published: | 06.02.2025 |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 21/2025 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | French |
| Original Source: | APD/GBA (in FR) |
| Initial Contributor: | claratab |
In the context of a dismissed complaint about satisfaction surveys, the DPA referred to the recent CJEU case C-394/23 Mousse to confirm that unnecessary processing of the gender of the data subject threatens compliance with the principle of data minimisation.
English Summary
Facts
The processor conducted satisfaction surveys on behalf of the controller. The data subject responded to a survey.
The data subject exercised their right of access under Article 15 GDPR to the processor. The processor responded to the complainant's access request and shared the data provided by the controller, the purpose of the processing, the categories of data subjects, the retention period and specified the rights of the data subjects. The data subject transmitted the answer to the DPA and claimed that the data processing could not be based on a legitimate interest of the controller.
On 8 March 2024, the processor communicated to the data subject that their previous reply to the access request was incorrect.
On 11 March 2024, the data subject requested access to their data from the controller to verify the information given by the processor. The controller responded to the data subject that only the necessary data was transmitted to the processor.
On 12 September 2024, the DPA started investigating the complaint.
Holding
The DPA decided to dismiss the complaint due to the following reasons.
Generally, the DPA may dismiss a complaint either due to insufficiency of elements to likely to lead to a sanction; or due to the need for expediency.
In this case, the DPA closed the complaint as it is manifestly unfounded. The DPA observed that information about the data sharing from controller to processor was was provided for in the controller’s privacy policy, to which the data subject consented. So, the legal basis for such processing would be Article 6(1)(a) GDPR.
However, the DPA noticed that, among the data transmitted, there was also the gender of the data subject. The DPA considered that there was no need to process that information in the context of a satisfaction survey. As found by the CJEU in C-394/23 Mousse, processing of information about the data subject's gender may raise doubts as per the requirements of the GDPR. In the case at hand, the DPA found no violation of the principle of data minimisation as per Article 5(1)(c) GDPR.
Nevertheless, the DPA found that the complaint is manifestly unfounded and thus dismissed it.
Comment
Share your comment here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/6 Litigation Chamber Decision 21/2025 of 6 February 2025 File number: DOS-2024-05409 Subject: Complaint regarding the legitimacy of a data transfer and the management of requests for the exercise of rights. The Litigation Chamber of the Data Protection Authority, consisting of Mr. Hielke H IJMANS, President, sitting alone; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter "GDPR"; Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, hereinafter “LCA”; Having regard to the Law of 30 July 2018 on the protection of individuals with regard to the processing of personal data, hereinafter “LTD”; Having regard to the Rules of Procedure as approved by the Chamber of Representatives on 20 December 2018 and published in the Belgian Official Journal on 15 January 2019; Having regard to the documents in the file; Has taken the following decision concerning: The complainant: X, hereinafter “the complainant”; The defendant: Y1, hereinafter “defendant 1”; Y2, hereinafter “defendant 2”. Decision 21/2025 — 2/6 I. Facts and procedure 1. The complaint concerns the lack of legitimate interest in transferring personal data to conduct a satisfaction survey. 2. On 12 September 2024, the complainant filed a complaint with the Data Protection Authority. 3. This complaint follows a previous DPA case concerning requests for the exercise of the complainant's rights of rectification and opposition, which were positively handled in mediation. 4. It appears from the documents in the case that Defendant 2 conducts satisfaction surveys on behalf of Defendant 1 based on the information that the latter provides to it. 5. On 4 March 2024, the DPO of Defendant 2 responds to the Complainant’s request for access by detailing the data received by Defendant 1, the purpose of the processing, the categories of data subjects, the retention period and the rights of the data subjects. 6. On 6 March 2024, the Complainant forwards this communication to the DPA and confirms his complaint regarding Defendant 1’s lack of legitimate interest. 7. On 8 March 2024, the DPO of Defendant 2 returns to the Complainant’s request for access by specifying that a manual error had occurred in the table listing the categories of data in the previous communication. In addition, Defendant 2 appears to respond to the questions that the Complainant asked in response to the previous communication. 8. On 9 March 2024, the complainant forwarded this communication to the APD and confirmed his complaint regarding the lack of legitimate interest of defendant 1. 9. On 11 March 2024, the complainant exercised his right of access to defendant 1 by asking questions aimed at clarifying the information transmitted by defendant 2. 10. On 20 March 2024, defendant 1 responded to the complainant’s request to exercise his right of access and specified that only the data necessary for carrying out a study were transmitted, in accordance with point 5.2.3. of its general declaration on respect for privacy. 11. On 10 December 2024, the Front Line Service of the Data Protection Authority declares the complaint admissible on the basis of Articles 58 and 60 of the LCA, and forwards it to the Litigation Chamber in accordance with Article 62, § 1 of the LCA. Decision 21/2025 — 3/6 II. Grounds 12. On the basis of the facts described in the complaint file as summarised above, and on the er basis of the powers conferred on it by the legislator under Article 95, § 1 of the LCA, the Litigation Chamber decides on the further action to be taken on the file; in this case, the Litigation Chamber decides to proceed with the filing of the complaint without further action, in accordance with Article 95, § 1, 3° of the LCA, for the reasons set out below. 13. In matters of filing of the complaint without further action, the Litigation Chamber is required to justify its decision in stages and to: - pronounce a technical filing of the complaint without further action if the file does not contain or does not contain sufficient evidence likely to result in a sanction or if it contains a technical obstacle preventing it from rendering a decision; - or pronounce a filing of the complaint without further action as a matter of expediency, if despite the presence of evidence likely to result in a sanction, the continuation of the examination of the file does not seem appropriate to it taking into account the priorities of the Data Protection Authority as specified and illustrated in the Litigation Chamber's Filing of the complaint without further action policy. 2 14. In the event of a dismissal based on several grounds for dismissal, the latter (respectively, dismissal on technical grounds and dismissal on expediency) must be treated in order of importance. 3 15. In this case, the Litigation Chamber decides to dismiss the complaint on the grounds that the complaint is manifestly unfounded (criterion A.2). The decision of the Litigation Chamber is based more specifically on a reason why it considers that it is inappropriate to continue monitoring the case, and consequently decides not to proceed, among other things, with an examination of the case on the merits. 16. The Litigation Chamber notes that the complaint is manifestly unfounded within the meaning of Article 57.4 of the GDPR; and decides to dismiss the complaint on technical grounds (criterion 4 A.2.) . 1 Market Court (Brussels Court of Appeal), 2 September 2020, judgment 2020/AR/329, p. 18. 2 In this regard, the Litigation Chamber refers to its dismissal policy as developed and published on the Data Protection Authority website: https://www.autoriteprotectiondonnees.be/publications/politique-de- classement-sans-suite-de-la-chambre-contentieuse.pdf. 3 See Title 3 – In which cases is my complaint likely to be dismissed by the Litigation Chamber? of the dismissal policy of the Litigation Chamber. 4APD, “Policy for dismissal of cases by the Litigation Chamber: 3.1 Technical criteria for dismissal of cases – A.2 – The complaint is manifestly unfounded”, 18 June 2021, available at https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre- contentieuse.pdf. ; Litigation Chamber, decision 56/2020 of 2 September 2020. ; APD, Litigation Chamber, decisions 31/2024, 09/2024, 04/2024, 49/2024. Decision 21/2025 — 4/6 17. In the present case, the transfer of data to Defendant 2 is provided for in point 5.2.3 of the Defendant’s general privacy statement to which the complainant consents at the start of a contractual relationship with it. Therefore, the facts indicate that the Defendant would justify this transfer by the consent obtained under Article 6.1.a) of the GDPR. 18. Therefore, this transfer can be considered legitimate, subject to compliance with the obligations arising from Article 28 of the GDPR concerning subcontracting. 19. However, the Litigation Chamber notes that the data transferred to the defendant’s alleged subcontractor include the gender of the data subject. However, the Litigation Chamber notes that no element in the documents in the case file justifies the need to process this information as part of a satisfaction survey. Although the lack of justification does not allow a definitive conclusion to be drawn regarding a potential violation of the principle of data minimization, it could, at first glance, raise a potential risk with regard to the requirements of the GDPR. 5 20. Although this lack of justification does not allow a definitive conclusion to be drawn regarding a potential violation of the principle of data minimization, it could, at first glance, raise a potential risk with regard to the requirements of the GDPR, as recalled by the CJEU in its Mousse judgment. Nevertheless, and in view of the analysis of the preceding paragraphs, the complaint is clearly unfounded and is dismissed for technical reasons. 21. In addition, the complainant exercises his right of objection, which was implemented in mediation in his previous complaint. The complainant’s request for a right of access was also satisfactorily answered within the time limits set by the GDPR. 22. In light of these elements, the Litigation Chamber notes that the complaint presents neither tangible evidence nor clear indications demonstrating a breach of the GDPR or the laws on the protection of personal data by the defendant. In the absence of such evidence, it is clear that the Litigation Chamber cannot conclude that there has been a breach, which leads to considering the complaint as manifestly unfounded and to dismissing it on technical grounds. III. Publication and communication of the decision 23. Given the importance of transparency regarding the decision-making process and the decisions of the Litigation Chamber, this decision will be published on the website of the Data Protection Authority. However, it is not necessary for this purpose for the parties’ identification data to be directly communicated. 5 Cf. Mousse judgment of the CJEU of 9 January 2025 (C-394/23) on the need to process the civility of a data subject. Decision 21/2025 — 6/6 To enable it to consider any other possible course of action, the Litigation Chamber refers the complainant to the explanations provided in its policy on dismissal without further action. 10 (sé). Hielke HIJMANS President of the Litigation Chamber 10Cf. Title 4 – What can I do if my complaint is dismissed? of the Disputes Division’s dismissal policy.
