APD/GBA (Belgium) - 67/2024
APD/GBA - 67/2024 | |
---|---|
Authority: | APD/GBA (Belgium) |
Jurisdiction: | Belgium |
Relevant Law: | Article 5(1)(c) GDPR |
Type: | Complaint |
Outcome: | Upheld |
Started: | |
Decided: | 30.04.2024 |
Published: | 30.04.2024 |
Fine: | n/a |
Parties: | n/a |
National Case Number/Name: | 67/2024 |
European Case Law Identifier: | n/a |
Appeal: | n/a |
Original Language(s): | Dutch |
Original Source: | GBA (in NL) |
Initial Contributor: | nzm |
The DPA held that a municipality processing a third party’s criminal data to adequately justify a marriage refusal decision was disproportionate and could have been attained by less intrusive measures, for example anonymisation of the data.
English Summary
Facts
Two of the data subject's friends wanted to get married. However, this marriage was refused by the municipality as it was considered a marriage of convenience. In the refusal decision, the municipality mentioned the data subject and their criminal records. Indeed, the municipality based its decision on the opinion of the public prosecutor’s office which showed that the refusal was justified, and mentioned the data subject’s criminal records.
The data subject considered that the facts dated back more than 25 years and it were completely irrelevant to the marriage refusal decision. Therefore, they made an access request and an erasure request with the municipality. The municipality’s DPO responded that they were not the controller, and that they were merely carrying out a mandate imposed by the federal government. Indeed, the data came from the national database of the judicial authorities, as the public prosecutor’s report is available for inspection by those concerned at the court and the town hall. This document served as the justification for the municipality’s ruling.
The data subject’s lawyer responded to this answer and stressed that the municipality is indeed a controller. He indicated that the person who is responsible for investigating the legality of a marriage and who determines what data is collected for this purpose is the controller. In addition, they argued that although the public prosecutor’s opinion included criminal data, the municipality does not have to copy this opinion identically, especially since the data subject’s history was irrelevant and the couple was not even aware of his history at the time.
The DPO of the municipality responded that the prosecutor decided to include the data subject’s judicial past in their opinion, and that they could not answer the question regarding the prosecutor’s motives and legal basis for explicitly mentioning the data subject. The DPO also indicated that after a meeting that took place on the matter of marriages of convenience, they decided to communicate all considerations on the basis of which they take their refusal decisions in order to avoid “too limited” or “too vague” decisions. It also referred to a Ghent Court of Appeal judgement which held that it is common for authorities to include the opinion of the public prosecutor in their decision (Arrest van 14 January 2016, T. Vreemd. 2016, afl. 2, 2019).
After a mediation with the municipality, the data subject lodged a complaint with the Belgian DPA (‘GBA’).
Holding
Firstly, regarding the controllership, the GBA indicated the public prosecutor has the power to decide if an opinion is needed, without the municipality having a say in this. Therefore, the public prosecutor is responsible for the processing operations carried out in the context of this investigation. However, the municipality is responsible for investigating the legality of a marriage and determines what data should be collected for that purpose. Therefore, the municipality assesses whether to take into account the public prosecutor’s opinion. The GBA ruled that the municipality has the decision making power in this case, and must therefore be considered the controller.
Secondly, regarding the necessity and proportionality of the processing of the data subject’s criminal records, the GBA considered that it appeared to be, prima facie, disproportionate and in violation of the data minimisation principle. Indeed, the objective to adequately justify the refusal decision could have been achieved in a less intrusive manner, for example by anonymising the data. The GBA took into account the nature of the personal data. The DPA also noted that the municipality changed its practice and allows the anonymisation of personal data belonging to third parties, in marriage refusal decisions.
Lastly, regarding the data subject’s rectification request, the GBA considered that it could not assess the accuracy of the personal data as it did not have access to the data subject’s court file.
Therefore, the GBA issued a warning against the controller. This was a prima facie decision.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/12 Dispute Chamber Decision 67/2024 of April 30, 2024 File number: DOS-2023-03824 Subject: stating personal data (of a criminal nature) in a marriage refusal decision by a municipality The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke HIJMANS, sole chairman; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and regarding the free movement of such data and to the revocation of Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”; Having regard to the law of 3 December 2017 establishing the Data Protection Authority, hereinafter “WOG”; In view of the internal rules of order, as approved by the House of Representatives Representatives on December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019; Considering the documents in the file; Has made the following decision regarding: Defendant: Mr. X, represented by master VAN AERSCHOT, hereinafter “the complainant” The Defendants: Y1, hereinafter “the Defendant 1” Y2, hereinafter “the Defendant 2” Decision 67/2024 — 2/12 I. Facts and procedure 1. The object of the complaint concerns the recording of the complainant's personal data (and in particular his criminal history) in a marriage refusal decision and a request for correction thereof. The complaint is also against a municipality (Defendant 1) as against a public prosecutor's office (Defendant 2). 2. On February 13, 2021, a couple of friends of the complainant wanted to get married. However, this marriage was refused by Respondent 1, because he was of the opinion that it was a marriage of convenience. In the decision of Defendant 1 who refused the marriage in question the complainant was also mentioned in the following paragraph: “They state that they met each other for the first time at the son's communion party from the (..) niece of Mrs. Z1, and this on (...). Mr. Z2 turned out to be friends with the husband of Z1, Mr National Database (ANG) quite known for […].” 3. On the basis of the previous paragraph, Defendant 2, and later Defendant 1, attempts to: show that the environment of the spouse of the couple in question is not suitable, and therefore, in combination with the other elements in the file, a decision to refuse of marriage is justified. In other words, the personal data of the complainant are used in this way in a decision to refuse marriage of two thirds. The refusal of marriage decision of Respondent 1 has the above paragraph identically taken from the report of Defendant 2 dated. February 8, 2021. By doing this do, the parties to the intended marriage are now aware of the criminal law past history of the complainant. According to him, this is unjustified, as it is not relevant to it marriage of the parties, the facts date from more than 25 years ago, and the municipality cannot simply include this entire paragraph in the decision, especially when this criminal data. 4. In March 2021, the complainant submits a request for access to his personal data and a request for data erasure and rectification to Respondent 1. He considers the addition of criminal data are completely irrelevant to the marriage refusal decision. Moreover, he would only have been in custody for the facts cited. The complainant was not sentenced to prison. From the statement by the Defendant 2 However, this appears to be the case in the paragraph drawn up and restated by Respondent 1. He wants these statements should therefore be amended. 5. The DPO of Respondent 1 responded on March 30, 2021. She stated that Respondent 1 did not controller, but the Civil Affairs Service only carries out an assignment imposed by the federal government. The criminal law data comes from Decision 67/2024 - 3/12 from the report with negative advice from the Crown prosecutor. This data comes from the national databases of the judicial authorities. This report from the prosecutor Konings is available for inspection by those involved at the court and the town hall and serves as a motivation for the decision of the mayor who rules on the refusal to solemnization of the marriage. Defendant 1 refers the complainant to the authorities that have submitted the report to them transferred. She hereby provides the contact details of the DPO of the FPS Justice. She adds that questions regarding the legal basis of his judicial past specifically mentioned in the report of the Crown prosecutor at Y2. Finally, the DPO informs who has access to the information in question report. 6. On April 29, 2021, the complainant's lawyer will respond to the DPO's response. He emphasized that Respondent 1 is indeed the controller, because they are the has the opportunity to obtain non-binding advice from the public prosecutor's office. According to the law the registrar responsible for investigating the legality of a marriage and which determines which data will be used for this purpose collected. Defendant 1 then processes the personal data received in it within the framework of its independent and legally granted authority to assess whether there is an impediment to marriage. In addition, it is mentioned that criminal data may be included the advice of Respondent 2. However, this does not mean that Respondent 1 when writing a decision must copy this advice identically and must not take into account the principles of the GDPR. This is especially true given the criminal history of the complainant is irrelevant to comply with the obligation to state reasons for the decision, and the couple was not even aware of the complainant's past at the time. 7. An answer will follow from the DPO of Defendant 1 on May 19, 2021. With regard to the legal basis it says the following: “Legal basis for stating the criminal details and name of the client & request to remove it from the refusal decision As clarified in our first letter, it is the King's Attorney who does it felt it was proportionate to look up and complete your client's judicial history describe in its advice. We cannot answer your question about the reasons and legal basis for the attorney to expressly mention your client. We have you will also be provided with the Y's contact details. The report of the King's Attorney was subsequently available for inspection in court and it city Hall. In the past, the Public Prosecution Service has always informed us of Decision 67/2024 - 4/12 to include the full advice of the Attorney in the refusal decision, whatever happened here. 8. The DPO then refers to a report of the meeting on marriages of convenience of December 20, 2004, which states that “from now on, the unfavorable advice regarding intended marriages [will be] much more extensive in the sense that all elements that form the basis for this advice, will be shown and explained. Such as the ABS takes the advice of the Public Prosecutor as his own, my office considers it accurate to formulate motivation in an at least equally extensive manner. Such change in course of action is dictated by the judgment of the President of the first court predicate, such as in summary proceedings, who believes in some sham marriage files that the justification of the refusal decision under the ABS 'too limited', 'too vague' and 'not was sufficient. There are such violations of the rules of open government This has led to some marriages of convenience having to be concluded after all due to judicial decisions accomplished. At the time of the refusal decision and its notification to the partners, it is important that the ABS considers all considerations, according to which he is made a decision. In addition, it is desirable that the ABS also communicates that it The entire file, as it was transferred by the Public Prosecutor's Office, is available for inspection municipal government. Moreover, even the attachment of a copy of the file attached to the refusal decision, my office seems appropriate.” 9. The DPO also refers to a judgment of the Court of Appeal of Ghent in which: stated that it is very common for authorities to take the preliminary advice of the public prosecutor's office include in their decision. “The court is of the opinion that the contested refusal decision meets the special requirements obligation to state reasons within the meaning of art. 167, fourth paragraph of the Dutch Civil Code. The official does not have any referred to the negative advice obtained from the Public Prosecution Service, but it adopted and as such made it his motivation. The method to... based on the preliminary advice of the Public Prosecution Service after a thorough police investigation research is very common, especially in smaller cities or municipalities with less foreign population compared to the larger cities (such as Antwerp, Brussels and Ghent), where special 'marriage of convenience' cells also function. In the smaller towns and cities municipalities, the registrar is responsible for fulfilling his task above all dependent on the public prosecutor and the police.” 10. According to Defendant 1, the request for data deletion or anonymization can only be made performed in the authentic source; in the Central Criminal Register. This request serves as such should be addressed to the FPS Justice. She will come back to this later in a 1Judgment of January 14, 2016, T. Strange. 2016, episode 2, 2019 Decision 67/2024 — 5/12 mediation procedure, in which she acknowledges that she can anonymize the data in the decision. 11. The complainant sends a letter to the couple against whom the marriage refusal decision was made taken. He asks them to destroy the documents and to discretion. 12. A mediation request is submitted by the complainant on June 11, 2021 (DOS-2021- 04477). This mediation failed after the complainant felt it was not sufficiently far-reaching that Respondent 1 would anonymize the personal data in the decision itself. The complainer After all, he also wanted a correction of the facts. The mediation shows that Defendant 1 has since adjusted his practice. In the future would anonymize this personal data, where possible and relevant. The mediation is converted into a complaint. On November 8, 2021, the complaint will be filed by the First-line service is declared admissible on the basis of Articles 58 and 60 WOG and is the complaint has been transferred to the Disputes Chamber on the basis of Article 62, §1, WOG. This will result in a dismissal on May 11, 2023. 13. On October 24, 2023, the complainant submits another complaint to the Data Protection Authority against the defendant(s). 14. On October 24, 2023, the complaint will be declared admissible by the First Line Service on on the basis of Articles 58 and 60 WOG and the complaint is filed on the basis of Article 62, § 1 WOG transferred to the Disputes Chamber. 15. In accordance with Article 95, § 2, 3° of the WOG as well as Article 47 of the internal regulations order of the GBA, the parties can request a copy of the file. If one both parties wish to make use of the opportunity to consult and copying the file, he or she must contact the secretariat of the Disputes Chamber, preferably via litigationchamber@apd-gba.be. II. Justification II.1.1. Processing responsibility 16. Defendant 1 initially indicated in communications with the complainant that she was not herself considered a controller when they follow the advice of the public prosecutor Konings in her decision to refuse marriage. The Dispute Chamber reminds us in this context, indicate that the concept of “controller” should be expanded Decision 67/2024 — 6/12 defined to ensure effective and complete protection of data subjects 2 to ensure. 17. Article 4.7 GDPR, read in the light of that purpose, provides that a person or a entity should be classified as a 'controller' if it alone or jointly with others determines the purposes and means of the processing, then whether these objectives and means are determined in national law. If the latter is the case, it must be determined whether that law determines who is the controller or according to what specific criteria he or she becomes controller 3 designated. 18. In accordance with the division drawn up by the European Data Protection Board (hereinafter: 4 EDPB) creates, in this case, an implied legal authority. The official of the civil registry of the competent municipality must be obtained in accordance with Article 164/1, §4, OBW 5 check whether there are any impediments to marriage and whether they exist. This is further regulated in Article 167OBW, which stipulates that the registrar refuses to solemnize the marriage when it appears that the qualities and conditions required for a be allowed to enter into a marriage, or if he is of the opinion that the solemnization is contrary to the principles of public order. The registrar hereby decides 6 about the possibility of obtaining non-binding advice from the public prosecutor's office. 19. The registrar is legally charged with investigating the legality of a marriage and determines which data must be collected for this purpose become. It is at the request of the registrar that it is made public 2 See, to that effect, judgments CJEU, 5 December 2023, C-683/21, Nacionalinis visuomenės sveikatos centras, (EU:C:2023:949), para. 29, and CJEU, 5 December 2023, C-807/21, Deutsche Wohnen, (EU:C:2023:950), para. 40 and those cited there jurisdiction. 3 CJEU,11January2024,C-231-22,,Belgian State.Data Protection Authority,(ECLI:EU:C:2024:7),para.29.;European Data Protection Board, Guidelines 07/2020 on the concepts of “controller” and “processor” in the GDPR, July 7, 2021, para. 15 et seq. 4 The case in which a (legal) person is assigned a specific assignment by law, or is imposed a duty to to collect and further process certain personal data, without this (legal) person expressly consenting is designated as controller. This is the case when a public body is assigned a task which cannot be fulfilled without processing at least certain personal data for this purpose. The law in that case determines the purpose of the processing and also determines, albeit indirectly, who is responsible for the processing is responsible. 5Article 167 OBW: “The registrar refuses to solemnize the marriage if it appears that the requirements have not been met the qualities and conditions required to enter into a marriage, or if he is of the opinion that the performance is contrary to the principles of public order. If there is a serious suspicion that the conditions set in the previous paragraph have not been met, the official may: of the registry office, postpone the solemnization of the marriage, after, if necessary, the advice of the public prosecutor the judicial district in which the applicants intend to marry, during 10.00 a maximum of two months from the wedding date proposed by the interested parties, in order to to conduct research. […] In the event of a refusal as referred to in the first paragraph, the registrar will provide reasons the decision without delay to the knowledge of the interested parties. At the same time, a copy of this will be sent together with a copy of all useful documents, sent to the prosecutor of the King of the judicial district in which the refusal took place […].” 6Gent January 14, 2016, no. 5, https://www.ipr.be/sites/default/files/rechtspraak/20161_20160114D.pdf. Decision 67/2024 — 7/12 ministry can initiate an investigation. It is thus up to the civil registrar stand to assess whether such processing is relevant. It clearly follows that the civil servant, or the municipality in sensu lato, has the decision-making power in this case, and therefore, it must be regarded as a controller. The public prosecutor has the authority to decide for himself which one personal data are needed to prepare advice, without the municipality here has a say in it. The prosecutor is therefore personally responsible with regard to the processing that takes place in the context of this research. 20. It is then up to the registrar, partly based on the advice of the public prosecutor, to assess whether there is any impediments to marriage, in the context of its independent and legal rights authority. 21. This decision must be properly substantiated. Once again this is an obligation that rests on the registrar, who must personally assess which processing operations are relevant in the context of this obligation to state reasons. It is therefore up to Respondent 1 to assess whether an identical adoption of (part of) the advice should take place. Defendant 1 indicates that he has made agreements to enhance the collaboration facilitate this, but these must be seen in the light of the GDPR. 22. Based on the foregoing, the Disputes Chamber determines that Respondent 1 is should be properly regarded as a controller, both for the identically adopting the advice of Defendant 2 in her marriage refusal decision, and the way in which the parties involved can provide advice at the town hall 8 look into . Therefore, Defendant 1 must be deemed liable under Article 5(2) GDPR to be responsible for compliance with the provisions referred to in paragraph 1 of this article principles regarding the processing operations required under national law perform, and therefore for all obligations imposed by the GDPR on the controller imposes.9 II.1.2. Necessity and proportionality 23. It follows from Article 5.1.c) GDPR that any processing is relevant and limited to what necessary for the purposes for which they are to be processed. So is the foreseen processing activity is not permitted if it is less intrusive 7Act of 29 July 1991 regarding the explicit motivation of administrative acts. 8 The municipality is also responsible for informing the parties involved. After all, it is informing one of the tasks assigned to it in accordance with applicable national law. See CJEU, January 11, 2024, C-231-22, , Belgian state t. Data Protection Authority, (ECLI:EU:C:2024:7), para. 38. 9By analogy from CJEU, January 11, 2024, C-231-22, , Belgian State v. Data Protection Authority, (ECLI:EU:C:2024:7), para. 43. Decision 67/2024 — 8/12 measures are possible to achieve the purpose of the processing and may only be carried out personal data are processed that are necessary, sufficient and relevant for the goal or goals.0 24. The complainant emphasizes that the registrar in the exercise of his duties legal powers can refuse to solemnize a marriage. One such refusal decision must be sufficiently substantiated. Such motivation can be a contain (integral) adoption of an advice from the public prosecutor, if this is the case advice is relevant to the substantiation of the official's decision. However, this does not mean that the registrar can comply with the principles of the GDPR ignore when personal data is included in the advice of the public prosecutor, especially if the decision does not concern the data subject whose personal data are processed. The complainant adds that he believes that there is sufficient factual and legal considerations in the file to make such a decision even without explicitly mentioning the identity of the complainant and its full information to include criminal history in the refusal decision. 25. The Disputes Chamber is also of the opinion that such processing, i.e. it is identical adopt the advice of the public prosecutor in the marriage refusal decision, prima facie disproportionate and in violation of the minimization principle seems to be. The purpose (i.e. to adequately motivate the decision taken within the framework of its legal authority) would be less can be achieved in a drastic manner. For example, the Disputes Chamber encourages anonymization of personal data. 26. The nature of the personal data must also be taken into account. 11 Since this case concerns data of a criminal nature, the Dispute Chamber recommends a more cautious approach. 27. In the context of the mediation procedure that preceded this complaint, the Defendant 1 the following: “After our last contact in July 2021, the civil affairs department itself contacted the W public prosecutor's office and presented this specific case. The public prosecutor's office has confirmed to us that the The municipality worked in accordance with the agreements, but that they had nothing against us can now anonymize the names of third parties in a refusal decision. Consequently we can respond to the other party's request for the name of the other party 10 Article 29 Data Protection Working Party, Opinion 03/2013 on purpose limitation, April 2, 2013, p. 15. 11Article 10 GDPR: “Personal data concerning criminal convictions and criminal offenses or in connection therewith containing security measures may only be processed under public supervision pursuant to Article 6(1). or if the processing is permitted by Union or Member State law providing appropriate safeguards for the rights and freedoms of those involved. Comprehensive records of criminal convictions are only allowed are kept under government supervision.” Decision 67/2024 — 9/12 anonymize in the refusal decision (the civil affairs department will record the necessary information in this file steps).We will also apply this guideline to the future files of the parquet." 28. Defendant 1 has therefore now adjusted its working method with regard to the possible anonymizing personal data (particularly when they belong to third parties). marriage refusal decisions. 29. Finally, the Disputes Chamber also wishes to draw attention to the manner in which the advice from the public prosecutor can be viewed at the town hall. It is to Defendant 1 to also do this in a manner that takes into account the principles of the GDPR. 30. Due to the changes already implemented in the practice of Respondent 1, the Dispute Chamber decides to warn Respondent 1, as provided in Article 95, §1, 4°, of the WOG. At this point, the Dispute Chamber does not think it is necessary to ask for more to impose drastic corrective measures. II.1.3. Request for rectification 31. The complainant also requested a rectification of his personal data in the refusal of marriage decision, because he believes that it is incorrect. 32. Defendant 1 states that the municipality is not authorized to follow the advice of the public prosecutor King to change. Moreover, the municipality has no access to the judicial system file of the complainant, which prevented her from verifying whether the information provided was correct goods. A request for rectification or deletion of data from data in the original advice should be addressed to the competent government authorities. 33. The Disputes Chamber notes that it cannot verify the accuracy of the personal data because it does not have access to the complainant's judicial file. She prima facie acknowledges that Respondent 1 cannot change the advice of Defendant 2. II.1.4. Competence of the Disputes Chamber with regard to the King's Attorney and courts 34. First of all, the Disputes Chamber recalls its jurisdiction. Article 4, §2, WOG stipulates after all, the GBA is not competent for the supervision of processing by courts and tribunals courts, as well as by the public prosecutor in the exercise of their judicial functions tasks. This follows from Article 55.3 GDPR, which stipulates that supervisory authorities are not competent to supervise processing by courts exercise of their judicial functions. Decision 67/2024 — 10/12 35. The Disputes Chamber therefore decides prima facie not to rule on this matter Defendant 2. 36. In addition, the Disputes Chamber also emphasizes the power of a court to: to communicate information (such as having an opinion viewed), which is covered by the responsibility of these bodies themselves and which the Disputes Chamber does not discuss has control. 12 II.1.5. Correcting measures 37. This decision is a prima facie decision taken by the Disputes Chamber in accordance with Article 95 of the WOG on the basis of the complaint submitted by the complainant, in the context of the “procedure prior to the decision on the merits” and none decision on the merits of the Disputes Chamber within the meaning of Article 100 of the WOG. 38. The Disputes Chamber has thus decided, on the basis of Article 58.2.a) GDPR and Article 95, § 1, 4° of the WOG, to give Defendant 1 a warning for violating the minimization principle. 39. The purpose of this decision is to inform the defendant of the fact that this has committed an infringement of the provisions of the GDPR and has the opportunity to do so still agree to comply with the aforementioned provisions. The previously discussed compensation in the mediation procedure is hereby encouraged. 40. If the defendant does not agree with the content of this prima facie case decision and is of the opinion that it can put forward factual and/or legal arguments that could lead to a new decision, it can request a reconsideration submit to the Disputes Chamber in accordance with the procedure established in Articles 98 in conjunction 99 of the WOG, known as a “treatment on the merits”. This request must be sent to the email address litigationchamber@apd-gba.be within a period of 30 days after notification of this primafacie decision. If applicable, implementation will take place of this decision is suspended for the above-mentioned period. 41. In the event of a continuation of the merits of the case, the Disputes Chamber the parties on the basis of Articles 98, 2° and 3° in conjunction with Article 99 of the invite WOG to submit their defenses and any documents they consider useful to be added to the file. If necessary, the present decision will become final suspended. 1By analogy with CJEU, 24 March 2022, C-245/20, Dutch Data Protection Authority, (ECLI:EU:C:2022:216), para. 38. Decision 67/2024 — 12/12 an application for intervention must be submitted to the registry of the Market Court in accordance with Article 1034quinquies of the Dutch Civil Code. , or via the e-Deposit information system of the Ministry of Justice (Article 32ter of the Ger.W.). (ge). Hielke H IJMANS Chairman of the Disputes Chamber 1° the day, month and year; 2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or company number; 3° the surname, first name, place of residence and, where applicable, the capacity of the person to be summoned; 4° the subject matter and brief summary of the grounds of the claim; 5° the judge before whom the claim is brought; 6° the signature of the applicant or his lawyer. 14The application with its attachment will be sent by registered letter in as many copies as there are parties involved deposited with the clerk of the court or at the registry.