APD/GBA (Belgium) - 77/2023
From GDPRhub
| APD/GBA - 77/2023 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 5(1)(c) GDPR Article 5(1)(d) GDPR Article 5(1)(e) GDPR Article 17 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | 30,000 EUR |
| Parties: | n/a |
| National Case Number/Name: | 77/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | French |
| Original Source: | APD/GBA (in FR) |
| Initial Contributor: | n/a |
A pharmacists association, indefinitely storing data related to disciplinary sanction issued under a former regulation violates, among others, principles of lawfulness, purpose limitation, data minimisation, accuracy and storage limitation. The DPA issued a €30,000 fine.
English Summary
Facts
A pharmacist (data subject) was disciplinary sanctioned by the pharmacists' association for having used certain commercial practices prohibited in this profession. The data subject contested this decision with several courts. This led the controller to amend the rules of professional conduct.
Following this change, the data subject considered that the sanction was now illegal and requested the controller to erase the mention of its sanction from all registers and to stop processing this data. The controller considered that the sanction had not been made illegal and refused to delete the sanction from the registers. This led the data subject to lodge a complaint with the Belgian DPA.
The data subject considered that the unlimited retention of sanctions was inappropriate, that the controller had breached Article 17 GDPR by refusing to delete her data and that the principles set out in Article 5 GDPR had been violated. It added that the disciplinary sanction was included in the notion of conviction within the meaning of Article 10 GDPR.
In its defence, the controller explained in particular that unlimited retention was prescribed by national regulation and that Article 17 included exceptions that applied to the case in point. It added that it had taken steps to improve data processing.
Holding
The DPA analysed the respect of each principle for each purpose of the processing.
As to the lawfulness of the processing, the DPA considered that each purpose had to have a legal basis. The processing in question had several purposes and the DPA considered that for some of them there was no adequate legal basis, in breach of Article 5(1)(a) GDPR, in particular when the controller wrongly relied on national regulations.
As for the storage limitation, it must not exceed what is necessary for each purpose. Here, the DPA considered that unlimited storage was not necessary for all purposes, for example to manage disciplinary cases, it was not necessary to retain data for an unlimited period and that the controller was in breach of Article 5(1)(e) GDPR by not having a reasonable personal data retention policy.
As regards purpose limitation, the DPA considered that the controller had not sufficiently specified the purposes, in breach of Article 5(1)(b) GDPR.
As for minimisation, the DPA concluded that there had been a breach of Article 5(1)(c), in particular because all the data relating to a sanction could be consulted to check the eligibility of a candidate for election to the pharmacists' association, which was not necessary.
As for the principle of accuracy, the DPA considered that the controller should review the sanctions after the amendment of the professional conduct regulations to assess whether the sanction was maintained. By failing to do so, the controller was in breach of Article 5(1)(d) GDPR.
As for Article 10, the DPA did not follow the data subject's argument. It held that a minor disciplinary sanction such as that in the case in point was not a criminal conviction within the meaning of Article 10 GDPR.
As for Article 17 GDPR, the DPA held that the processing operations were unlawful, which meant that the data subject was entitled to request the erasure of her data under Article 17(1)(d) GDPR without the exceptions applying.
In conclusion, the DPA found a breach of Articles 5(1)(a), (b), (c), (d) and (e). It ordered the controller to comply with the erasure request and fined €30,000.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/49
Litigation Chamber
Decision on the merits77/2023 of 16 June 2023
File number: DOS-2022-01379
Subject: Complaint for refusal to follow up on the exercise of the right to erasure and for the
unlawful processing of personal data relating to a sanction
disciplinary
The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke
Hijmans, Chairman, and Messrs. Yves Poullet and Christophe Boeraeve, members;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and
to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the
data protection), hereinafter “GDPR”;
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter
“ACL”);
Having regard to the Law of 30 July 2018 relating to the protection of natural persons with regard to
processing of personal data (hereinafter “LTD”);
Having regard to the internal regulations as approved by the House of Representatives on 20
December 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Made the following decision regarding:
The complainant: Ms. X, represented by Me Etienne Wéry, hereinafter “the complainant”
The defendant: Order of Pharmacists, whose registered office is located at Avenue Henri Jaspar
94, 1060 Saint-Gilles, registered under company number 0218.024.029,
represented by Me Jérémie Doornaert, hereinafter “the defendant”. Decision on the merits 77/2023 – 2/49
I. Facts and procedure
1. On March 24, 2022, the complainant filed a complaint with the Authority for the Protection of
data (hereinafter “ODA”). The complaint relates to the unlawful processing carried out by the defendant,
in particular personal data relating to a disciplinary sanction
pronounced by the defendant (hereinafter "the disputed data") and the defendant's refusal to
follow up on a request to erase this disputed data.
I.1. Relevant facts
I.1.1. The parties involved in the case
2. The plaintiff is a pharmacist-holder of the pharmacy Z. On 22 December 2016,
she is subject to a disciplinary sanction by the defendant.
3. The defendant, the Order of Pharmacists, is a professional order created by the law of May 19
1949 and is governed by Royal Decree No. 80 relating to the Order of Pharmacists (hereinafter “the RD
n°80”) and by the Royal Decree of 29 May 1970 regulating the organization and operation of
councils of the Order of Pharmacists (hereinafter “the RD of May 29, 1970”). He enjoys a
2
civil personality under public law.
4. The Order of Pharmacists:
To. is invested with a mission of general interest in the field of public health; 3
b. is composed of three bodies which are the Provincial Councils (a Council
provincial in each province), Appeals Councils (an Appeals Council
French-speaking and a Dutch-speaking Appeal Board) and 5
6
the National Council;
vs. has regulatory, disciplinary and administrative jurisdictional powers: these
powers are distributed among the aforementioned organs of the Order through the
various missions reserved for them by Royal Decree no. 80;
d. includes "all holders of the legal diploma or the foreign diploma legally
recognized as a pharmacist, domiciled in Belgium, and registered on the roll of the Order of
7
the province in which their domicile is located. [...]”;
1
2Royal Decree No. 80 of November 10, 1967 relating to the Order of Pharmacists, M.B. on November 14, 1967.
3AR no. 80, art. err.
Royal Decree no. 80, art. 1 .
4AR no. 80, art. 5, paragraph 1.
5AR no. 80, art. 12, §1.
6AR no. 80, art. 1 art. 12, §1.
7AR n°80, art.2. ;"To be able to practice pharmaceutical art in Belgium, all pharmacists must be registered on the
the Order.[...]No one may be registered on more than one of the provincial rolls, which together constitute the roll of the Order.
[...]” (RD n°80, art. 2, §2). Decision on the merits 77/2023 – 3/49
e. acts by its National Council in justice "and is represented by the president of the
ci or, in his absence, by his deputy chairman, jointly with the assessor”. 8
5. The organization and missions of the National Council are mainly defined in Articles
14 and 15 of Royal Decree no. 80.
6. In addition to establishing its internal rules and elaborating “the general principles and
rules relating to morality, honor, discretion, probity, dignity and devotion
essential to the exercise of the profession, which constitute the code of ethics
10 11
pharmaceutical industry", the National Council is also responsible for:
“1° to keep an up-to-date list of disciplinary decisions that are no longer
subject to appeal and which have been taken by the provincial councils and by the
appeal advice; to adapt, if necessary, the code of ethics in order to
supplement or clarify the provisions on the basis of this case law;
[…]
3° to take all necessary measures to achieve the object of the Order;
4° to set and collect the contributions necessary for the operation of the various
organs of the Order; […]”.
(emphasis added by the Litigation Chamber)
7. The organization and missions of the Provincial Councils are mainly defined in
Articles 5 to 11 of Royal Decree no. 80. In each province, there is established "a provincial council of
the College of Pharmacists which has authority and jurisdiction over registered pharmacists,
in accordance with article 2, on the roll of the Order of this province [...]” 12 (this is the Chamber
Litigation that emphasizes). The provincial tables together constitute the table of
13
the Order. Each Provincial Council establishes its rules of procedure submitted to the
National Council which definitively adopts the text.
8. The Provincial Councils are also responsible for:
“1° draw up the picture of the Order
[…]
2° to ensure compliance with the rules of pharmaceutical ethics and the maintenance of
honor, discretion, probity and dignity of the members of the Order. They
8
Royal Decree no. 80, art. 3.
9AR n°80, art. 14, §2.
10AR no. 80, art. 15, §1.
11AR no. 80, art. 15, §2.
12AR no. 80, art. 5, paragraph 1.
13AR n°80, art. 2, paragraph 4.; “no one can be registered in more than one of the provincial rolls” (RD n°80, art. 2, paragraph 4).
14
Royal Decree no. 80, art. 6. Decision on the merits 77/2023 – 4/49
are responsible for this purpose to punish disciplinary 15 the faults of the members
entered on their roll, committed in the exercise or on the occasion of the exercise of
profession as well as serious misconduct committed outside the activity
professional, when these faults are likely to tarnish the honor or dignity
of the profession;
3° to give members of the Order, on their own initiative or at their request, opinions on
pharmaceutical ethical issues that are not addressed in the code
provided for in Article 15, § 1 or by the case law established pursuant to § 2, 1 of the
same item; the opinions are sent to the National Council for approval and then
communicated to the provincial council which forwards them to interested pharmacists;
4° report to the competent authorities the acts of illegal exercise of art
pharmaceutical of which they are aware;
5° to arbitrate as a last resort, at the joint request of the interested parties,
disputes relating to the fees claimed by the pharmacist from his client, except
jurisdiction clauses included in agreements or
commitments made in terms of health and disability insurance;
6° to respond to any request for an opinion from the courts and tribunals relating to
16
fee disputes. » .
(emphasis added by the Litigation Chamber)
9. Article 16 of Royal Decree no. 80 indicates that the Provincial Council has the power to pronounce
following sanctions: warning, censure, reprimand, suspension of the right
to exercise the profession for a maximum period of two years and removal from the roll
of the order.
10. The organization and missions of the Appeals Boards are mainly defined in Articles
12 and 13 of Royal Decree no. 80. In addition to establishing its internal rules submitted to the Board
which finalizes the text, each Appeals Council 17 is responsible for
hear “appeals of decisions taken respectively by the provincial councils
using the French language or by those using the Dutch language and who apply
of article 6, 1° or 2°”.
15AR no. 80, art. 16: “The sanctions available to the provincial council are: warning, censure, reprimand,
suspension of the right to practice the profession for a term that may exceed two years and removal from the table
the Order. Pharmacists affected by a decision which is no longer subject to appeal, the suspension of the right to practice
the profession, are permanently deprived of the right of eligibility and during the suspension period, of the right to take part
in provincial council elections. » ; Royal Decree no. 80, art. 25, §5: “The Appeals Council cannot apply a sanction while the
provincial council shall not pronounce any, or aggravate the sanction pronounced by this council, except by a two-thirds majority. ".
16
17AR n°80, art. 6.st
Royal Decree no. 80, art. 12, §1. ; There is the appeal board using the French language and the appeal board using the language
18 Dutch.
Royal Decree no. 80, art. 13. Decision on the merits 77/2023 – 5/49
I.1.2. The context of the case
11. A disciplinary sanction - namely a reprimand - was pronounced against the
complainant in second instance by the French-speaking Appeal Board on December 22, 2016.
This sanction was adopted following the violation of the essential principles of the
profession of pharmacist due to the following commercial practices: advertisements
advertisements, the installation of advertising banners on a website and the use of
Google AdWords services. The plaintiff lodged an appeal in cassation against this
decision but the Court of Cassation rejected the appeal on January 5, 2018.
er
12. On September 1, 2017, the complainant, alongside other pharmacists, filed a complaint
with the Belgian Competition Authority (hereinafter “ABC”) to denounce the practices
restrictive of the defendant, both because of its normative policy and the exercise of its
disciplinary mission. In response to these complaints, the CBA issued two rulings
closure, subject to the adoption of undertakings by the defendant in the first
19
decision and a transaction in the second decision. One of the commitments offered by
the defendant sought to reform the Code of Pharmaceutical Ethics (hereinafter “the Code”)
in order to remedy restrictive interpretations of competition by the authorities
disciplinary matters in matters of advertising and commercial practices, or to review all five
years the Code taking into account the decision-making practice of the disciplinary councils in a
to avoid restrictive interpretations of competition by them. 20
21
13. As a result of these decisions, the Respondent adopted a new Code in January 2020.
14. On January 27, 2020, the plaintiff friends ordered the defendant to proceed with the erasure
in “all registers, files and other ‘criminal records’ of the Order, any
information in connection with the reprimand pronounced on December 22, 2016, and to cease all
processing involving this personal data”. 22According to the complainant, the decision of 22
December 2016 pronounced by the Respondent’s Francophone Appeal Board would be the
result of an anti-competitive practice sanctioned as such by the ABC. This
decision would be unlawful and the processing of the data contained in such a decision
would therefore violate the GDPR.
15. In this formal notice, the complainant cites two damages suffered: her sanction
prevent him from being eligible for election to the Provincial Council, the Appeals Council and the
19 Belgian Competition Authority, decision of October 15, 2019, ABC-2019-P/K-34 and decision of October 15, 2019, ABC-
2019-P/K-35. ; Complainant exhibits 8 and 9. ; Exhibits 4 and 5 of the defendant.
20
Belgian Competition Authority, decision of October 15, 2019, ABC-2019-P/K-34 and decision of October 15, 2019, ABC-
2119-P/K-35, paragraph 177 to 182.; Complainant exhibits 8 and 9. ; Exhibits 4 and 5 of the defendant.
Paragraphs 84 and 85 of Respondent's Reply Submissions; New code of ethics, art. 125, available on
https://www.ordredespharmaciens.be/assets/files/PHARMA-Code-double-A4-v.%C3%A9lectronique-avec-liens-r15.pdf
22Exhibits 1 of the plaintiff and 9 of the defendant. Decision on the merits 77/2023 – 6/49
National Council and this sanction could be taken into account as an aggravating factor
in any future disciplinary decisions. 23
16. Finally, the complainant alleges several breaches of the provisions of the GDPR: the
defendant would have violated both the principles of data minimization, accuracy and
limitationofpreservation,becausethepreservationofanillegaldisciplinary decision would
not relevant or necessary, that the principle of transparency enshrined in Articles 12, 13
24
and 14. Regarding the absence of a retention period, it indicates that the Order would not have
not set a retention period for disciplinary data, as required by article 5.1.e of the
GDPR. Disciplinary sanctions would therefore never be erased. The Complainant
therefore requested the erasure of the disputed data in accordance with Article 17.1.d of the
GDPR.
25
17. On April 22, 2020, the Respondent responded to the Complainant's request. In summary, according to
the defendant, there is no reason to consider that the disciplinary sanction taken against
the complainant is invalidated by the decisions of the CBA and the adoption of the new Code. THE
data would remain adequate, relevant and necessary since they allow
the assessment of recidivism in the context of new disciplinary cases and
applications to become an internship supervisor and are also used to assess the conditions
eligibility for the different councils. The retention of disciplinary sanctions is
always relevant in view of the annual requests from universities that verify the past
ethics of internship supervisor candidates. In addition, the table of pharmacists,
containing the disciplinary sanctions, is only accessible to a limited number of
people. The defendant indicates that he can avail himself of two exceptions provided for in
Article 17, paragraph 3 of the GDPR, namely, on the one hand, a legal obligation of the Order to
process this data (art. 17.3.b GDPR) and, on the other hand, the defense of its rights in court (art.
17.3.e GDPR).
18. In the same letter, the Respondent also stated that he was beginning to reflect on
the principle of limitation of data retention.
23For the influence of an existing disciplinary decision on the part of a pharmacist on a future decision, the council of
the complainant recalls that “a decision of December 12, 2017 of the Provincial Council of Liège imposed on Mrs. X a
suspension of the right to practice the profession for a period of three days, justifying this serious sanction by the existence of a
sanction for previous similar behavior (publicity). Admittedly, this suspension never came into force because
Mrs. X appealed against this decision and the procedure before the Appeal Board was suspended following the complaint before
the competition authority, but it is a good illustration of the risk. (point 4 of the appendix to the complaint filed on March 24, 2022). There
Litigation Chamber notes the absence of proof of this damage.
24The complainant points out in her email of January 27, 2020 that the Order never provided the mandatory information
CONCERNING THE TREATMENTS FOLLOWED BY THE ORDER OR THE disciplinary bodies depending on it, THEIR
implementation and the rights related thereto or that no information relating to the GDPR is made available to
25pharmaciens on the Order's website in order to inform them of the processing of data concerning them.
Exhibits 2 of the plaintiff and 10 of the defendant; Paragraphs 34 of the submissions in response and 35 of the submissions in
respondent's reply. Decision on the merits 77/2023 – 7/49
I.2. Procedure
I.2.1. Admissibility of the complaint
19. As indicated in point 1, on March 24, 2022, the complainant lodged a complaint with
ODA.
20. On April 7, 2022, the complaint was declared admissible by the Service de Première Ligne on the
of articles 58 and 60 of the LCA and the complaint is transmitted to the Litigation Chamber in
pursuant to Article 62, § 1 of the LCA.
I.2.2. Object of the complaint
21. In her complaint, 26 the complainant regrets that, following her request of January 27, 2020, the
defendant did not erase the disputed data. She regrets that the principle of registration
ad vitam aeternam of any sanction in a disciplinary file is still in force
despite the promises of reflection announced by the defendant in April 2020 and complains that
the personal disciplinary file of a pharmacist is accessible without restriction of access.
It opposes the reasoning of the Order which justifies the unlimited preservation of the sanctions
because of their relevance for assessing recidivism in new cases and
evaluate applications for internship supervisors.
22. The complainant points to other breaches of the provisions of the GDPR. The defendant would
violated the fundamental principles enshrined in Article 5, paragraph 1 of the GDPR as well
than Article 10 of the GDPR since, according to the complainant, data relating to the sanction
disciplinary data must be assimilated to judicial data and require measures of
adequate guarantees. Finally, the defendant would also have violated Article 17 of the GDPR by
refusing to erase the disputed data despite his formal notice (points 14 to 16).
23. The Complainant's claims regarding the disputed data are as follows:
- The deletion from his personal file of the sanction of reprimand pronounced on
December 22, 2016 against him;
- Prohibition on the defendant from disclosing this information on the occasion of
any new disciplinary proceedings;
- The injunction to the defendant to modify his data protection declaration
for pharmacists of 28 May 2020 in order to remove any reference to the interest
legitimate as the basis of lawfulness for the processing carried out in the context of
its disciplinary mission;
26Points 3 to 5 of the appendix to the complaint filed on March 24, 2022. Decision on the merits 77/2023 – 8/49
- The injunction to the defendant to modify his data protection declaration
for pharmacists in order to make it compliant with the principles of the GDPR,
in particular the principle of the retention period and the minimization of
data.
I.2.3. Substantive examination by the Litigation Chamber
er er
24. On September 1, 2022, the Litigation Chamber decides, pursuant to Article 95, § 1, 1° and
of article 98 of the LCA, that the case can be dealt with on the merits.
25. The same day, the parties concerned are informed by registered mail of the
provisions as set out in Article 95, § 2 and Article 98 of the LCA. They are
also informed, pursuant to Article 99 of the LCA, of the deadlines for transmitting their
conclusions. For findings relating to the subject of the complaint, the deadline for
receipt of the defendant's submissions in response was set for September 30, 2022, that
for the submissions in reply of the complainant on October 21, 2022 and finally that for the
Respondent's submissions of November 4, 2022.
26. In this same letter, the Litigation Division invites the parties to present their
arguments on the following allegations:
- Violation of the principles of purpose limitation, minimization of data,
accuracy and limitation of storage (Article 5.1.b, 5.1.c, 5.1.d and 5.1.e of the
GDPR);
- Violation of the principle of legality (article 5.1.a of the GDPR);
- Violation of Article 10 of the GDPR on the processing of judicial data;
- Violation of Article 17 of the GDPR relating to the request for erasure.
27. On September 1, 2022, the complainant acknowledged receipt of the letter sent on September 1
2022 informing the parties that the Litigation Chamber has decided to proceed with an examination
of the substantive complaint.
28. On September 2, 2022, the Respondent acknowledges receipt of the aforementioned letter, agrees to
receive all case-related communications electronically and manifestly
his intention to make use of the possibility of being heard, in accordance with Article 98 of the
LCA. On the same day, the defendant requests a copy of the file (art.95,§2,3°LCA), which
is sent to them on September 8, 2022.
I.2.4. Arguments of the parties Decision on the merits 77/2023 – 9/49
29. On September 30, 2022, the Litigation Chamber receives the submissions in response from the
respondent. A summary of his full argument will be detailed in paragraphs 45 and
following.
I.2.4.1. The complainant's position
30. On October 20, 2022, the Litigation Chamber receives the conclusions in reply of the
complainant. His argument can be summarized as follows.
1. Regarding compliance with the principle of the storage limitation (article 5.1.e of the GDPR)
31. The complainant considers that the unlimited retention of personal data
relating to the disciplinary sanctions adopted by the defendant, that is to say throughout the
career of a pharmacist, is excessive. This excessive nature would also be reinforced
by the fact that the defendant does not distinguish between the degrees of seriousness of the
sanctions adopted: a minor sanction, in this case the sanction of reprimand
pronounced in December 2016, should not be kept for the entire duration of the
career of a pharmacist.
32. The Complainant accuses the Respondent of hiding behind the lack of precision in the
retention period law for not adopting a retention period
adequate and emphasizes that it would be up to the data controller to fill the
deficiency of the law under Article 5.2 and recital 39 of the GDPR).
2. Regarding compliance with the principle of purpose limitation (Articles 5.1.b of the GDPR)
33. The complainant considers that the ad vitama eternam conservation of data, in this case the
sanction of reprimand, would violate the principle of minimization: a piece of data is only relevant
and adequate for the pursuit of a purpose only during the retention period justified by
this same purpose. The complainant admits that the Order may sanction at a given time
unethical behavior, due to its legal mission. However, she
do not realize that this appreciation given at a given moment is permanent and affects
the professional life of the pharmacist "until [his] death" without the possibility of deletion or
reappraisal.
3. Regarding compliance with the principle of data minimization (article 5.1.c of the GDPR)
34. As to the principle of purpose limitation, the complainant links compliance with this principle to the
principle of retention limitation: data stored for too long could not
be processed again for its original purpose. Decision on the merits 77/2023 – 10/49
4. Regarding compliance with the principle of accuracy (Article 5.1.e of the GDPR)
35. The Complainant argues that the principle of accuracy of personal data should
be examined with regard to the purpose for which the data is processed and insists on the
distinction to be made between the “veracity” of the data (which, according to her, refers to reliability) and
“the accuracy of the data” (which refers to the link between the data and the purpose of the processing).
So that true data can become inaccurate within the meaning of the GDPR when it is no longer
relevant to the purpose initially pursued. Therefore, keeping a
disciplinary sanction is acceptable to assess the recidivism, but only for a
time.
5. Regarding compliance with the principle of lawfulness (Art. 5.1.a of the GDPR)
36. According to the Complainant, the principle of lawfulness must be applied in combination with the other
principles of Article 5. Therefore, the shortcomings attributed by the plaintiff in the
defendant would lead to the violation of the principle of legality. To support his point, the
complainant relies on the Google Spain judgment of the Court of Justice of the European Union (hereinafter
“the CJEU”) which would deduce the unlawful nature of data processing “not only from the
fact that these data are inaccurate but, in particular, also because they are
inadequate, irrelevant or excessive in relation to the purposes of the processing, whether
are not updated or that they are kept for a period exceeding that
necessary, unless their conservation is necessary for historical, statistical or
scientists”.7
37. Next, referring to the Respondent's privacy statement, the
complainant contests the basis of certain processing operations on the basis of the lawfulness of the interest
legitimate within the meaning of Article 6.1.f of the GDPR. The Respondent could not rely on such a basis
of lawfulness because of its mission of public interest. In addition, the criteria for the duration of
retention of data would be too vague. This imprecision would lead to the violation of the
principles of loyalty and transparency.
38. According to the Complainant, the processing carried out by the Respondent should be based on a
legal obligation (article 6.1.c) or on a mission of public interest (article 6.1.e of the GDPR).
6. Regarding compliance with Article 10 of the GDPR
39. For the complainant, the ethical sanctions, because of their characteristics and
their consequences, in particular on the ability to exercise the profession, must be
included in the concept of criminal convictions and offenses within the meaning of Article 10
of the GDPR. Therefore, for the plaintiff, the defendant should have provided guarantees
appropriate for the rights and freedoms of data subjects.
27CJEU, judgment of May 13, 2014, Google Spain SL and Google Inc, C-131/12, §92. Decision on the merits 77/2023 – 11/49
7. Regarding compliance with Article 17 of the GDPR
40. According to the complainant, the retention of personal data would no longer be
necessary with regard to the purposes for which they were collected and the data
would be treated without rules as to their retention period. Therefore, the defendant would have
had to follow up on his request to delete the disputed data. Rejecting his request
to exercise his right to erasure, the defendant would have violated the provisions of Article
17.1 a), d) and e) GDPR.
41. The Complainant contests the justifications put forward by the Respondent for not following up
his right to delete personal data. First, the defendant
invokes a legal obligation, making it necessary to process the disputed data (art.
17.3.b). The defendant considers itself legally bound to process this data on the basis of
several duties:
- The maintenance of the list of pharmacists as well as the exercise of the functions
of the College of Pharmacists (articles 8, 12, 14 and 15 of AR no. 80);
- The transmission of data relating to a disciplinary sanction to the FPS Health
public as part of the permanent federal database of
health professionals (based on articles 97 and following of the law
coordinate of 10 May 2015 relating to health care professions).
data request rosters and opt-out information
temporary or permanent right to practice health professionals;
- The transmission of disciplinary sanctions to the other Member States via the
IMI system (based on article 114/1 of the law of 10 May 2015). This basis of
data requires information on the restriction of the exercise of professionals
health.
42. Secondly, the defendant justifies its refusal to delete the personal data
plaintiff's staff by the need to continue to process the disputed data in the
defense of his rights in court (art. 17.3.e GDPR). The plaintiff who lodged an appeal
in annulment against certain provisions of the Code of Ethics before the Council of State,
the defendant would need to process the disputed data in the context of this
procedure.
43. As to the first justification put forward by the Respondent, the Complainant denied the need
to transmit the data in question to comply with these legal obligations: the
minor sanctions would not be data collected by these databases.
114/1 of the law of May 10, 2015 would not require the communication of character data
personnel relating to a minor disciplinary sanction because such data would not enter
not in the information covered by the obligation of this article. Article refers to restrictions Decision on substance 77/2023 – 12/49
or prohibitions from practicing, which a reprimand would not be. About the bank
permanent federal health care professional ethical sanctions
would not be part of the information to be communicated. Only temporary withdrawals or
should be mentioned, which does not justify the transmission of data
contentious.
44. Finally, with regard to the second justification relating to the exercise of the defendant's rights to
defend in court the proceedings still pending between the parties before the Council of State
refers to the Code of Ethics, a code adopted by the National Council, the normative body of the
respondent. According to the complainant, the management of disciplinary sanctions would be the responsibility of the
disciplinary bodies of the defendant and not of its normative body. The complainant submits
that the defendant would not respect the distinction established by law between its organs
of its normative body by invoking this exception to erasure for
retain disciplinary action.
I.2.4.2. The defendant's position
45. On November 4, 2022, the Litigation Chamber receives the summary conclusions of the
respondent.
To. Regarding compliance with the principle of storage limitation (article 5.1.e of the GDPR)
46. The defendant established the criteria in order to determine the duration of the retention of the data
of a personal nature that he is required to process in a general manner: “The Person in charge of the
Processing retains Personal Data (i) for as long as it is
necessary or relevant for the purposes indicated above, (ii) for the period during
required by law, or (iii) for as long as legal litigation or investigations may
28
take place. » . These criteria would meet the requirement of Article 13.2.a of the GDPR.
47. With regard to the disputed data, the defendant considers that their retention period is
reasonable since the processing of personal data relating to the sanction
disciplinary action against the complainant would have started when the sanction decision became
effective, after the appeal in cassation, i.e. on February 5, 2018. The disputed data
would thus have been kept for a period of less than five years.
48. Furthermore, more generally, the Respondent indicates that the disciplinary sanctions
are kept until the end of the pharmacists' career, because Royal Decree no. 80 obliges them to do so.
49. The Respondent argues that it has undertaken a reflection on the retention period of the
disciplinary sanctions since 2020.
28Pages 34 to 35 of the Respondent's summary submissions Decision on the merits 77/2023 – 13/49
b. Regarding compliance with the principle of purpose limitation (Articles 5.1.b of the GDPR)
50. The Respondent considers that the disputed data was collected and processed for
a specific, explicit and legitimate purpose, namely compliance with the legal obligations of the
disciplinary defendant. The disputed data would have been processed
subsequently in a manner compatible with the aforementioned purpose.
vs. Regarding compliance with the principle of data minimization (article 5.1.c of the GDPR)
51. The disputed data processed would be relevant for the purposes of processing
for which they are intended (i.e. the management of the disciplinary file, the evaluation of
eligibility conditions for counsel for the defendant). In addition, access to data
contentious is restricted. This principle is therefore not infringed.
d. Regarding compliance with the principle of accuracy (Article 5.1.e of the GDPR)
52. The Respondent emphasizes that the disputed data, including the sanction, were
recorded, following the appeal in cassation and that the decisions adopted by the ABC and
the adoption of the new Code of Ethics would not have rendered these data inaccurate. THE
respondent points out that, at the time the sanction of reprimand was adopted, the acts of
complainant were deemed objectionable by the Appeals Board. Even assuming that the
Complainant's question is relevant, according to the Respondent, it is not certain that the
Appeals Board would have judged the facts differently in light of the new provisions of the
Code of ethics. It is therefore not excessive to keep track of the sanction
disciplinary action, in particular to take it into account in the event of recidivism or to assess the
Conditions of eligibility.
53. Finally, the Respondent recalls that the Complainant had demanded in 2020, on the basis of this principle,
that “the data be erased or, at the very least, corrected by indicating that the sanction
31
allegedly unlawful was pronounced in contravention of competition law”.
Insofar as the complainant does not demonstrate that the disputed data has become
inaccurate, excessive or irrelevant, the defendant believes that it does not violate the principle
GDPR accuracy.
e. Regarding compliance with the principle of lawfulness (Art. 5.1.a of the GDPR)
54. The Respondent considers that the Complainant's reasoning relating to the Google Spain judgment
could not apply in this case because the defendant would not have violated any principle of the GDPR
in the context of the processing of the disputed data.
29Point 7.2.3 of the complainant's submissions in response; paragraphs 80 to 86; 98 to 101 of the conclusions in reply of the
respondent.
30Idem.
31Paragraph 86 of Respondent's Reply Submissions. Decision on the merits 77/2023 – 14/49
55. The Respondent also clarifies that the legitimate interest, as a basis of lawfulness within the meaning of
Article 6.1.f of the GDPR is not invoked in the context of the processing of disputed data.
For these treatments, the defendant invokes a legal obligation.
f. Regarding compliance with Article 10 of the GDPR
56. For its part, the Respondent argues that the purpose of Article 10 of the GDPR is to create a
obligation on the part of the legislator: the appropriate safeguards for the processing of
judicial sanctions must be provided for by the law of the European Union or of the State
member, and not controllers. The defendant announces that in the absence of
clear guarantees imposed by the legislator, it nevertheless took the initiative to define
reasonable retention periods, to ensure that the data relating to the sanctions
disciplinary procedures are accessible only to a limited number of people and to take
technicalandorganizationalmeasurestoensureconfidentialityandintegrity
of said data. This is why the defendant points out that there can be no question of a
violation of Article 10 of the GDPR.
g. Regarding compliance with Article 17 of the GDPR
57. The Respondent recalls that the Complainant had initially requested, in her letter of 27
January 2020, the deletion of his disputed data based on the illegality
of the sanction (art. 17.1.d GDPR). To the extent that the defendant contested the illegality of the
sanction, he did not comply with his request. He also disputes the new arguments
provided by the complainant on the grounds that the data processed would always be adequate and
relevant, and their reasonable retention period (less than five years after the adoption
final sanction).
58. Furthermore, the Respondent raises two exceptions to the right to delete data at
personal nature applicable to his situation (see points 41 and 42): the legal obligation to
transmit data to databases containing information on the
health professionals (article 17.3.b of the GDPR) and the legal defense of their rights
(Article 17.3.e of the GDPR).
59. Finally, the defendant assures that the disputed data will be erased anyway,
following the adoption of the new Internal Rules (hereinafter “ROI”) in March 2023,
subject to compliance with the conditions of a new automatic erasure mechanism
minor sanctions handed down more than five years ago .32
I.2.5. The hearing of the parties
32 This is what the defendant asserted during the hearing of January 24, 2023. Decision on the merits 77/2023 – 15/49
60. On October 20, 2022, the complainant expressed her intention to use the possibility of being
understood, in accordance with Article 98 of the LCA.
61. On November 28, 2022, the parties are informed that the hearing will take place on January 17
2023. On January 16, 2023, the defendant requested the postponement of the hearing, which the Chamber
Litigation accepted with the plaintiff's approval. The parties were then admitted
postponement of the hearing to January 24, 2023.
62. On January 24, 2023, the parties are heard by the Litigation Chamber.
63. On February 20, 2023, the minutes of the hearing are submitted to the parties.
64. On February 24, 2023, the Litigation Chamber received comments relating to the trial
from the part of the defendant which it decides to take up in its deliberation. On the other hand,
the Litigation Chamber receives no comments from the complainant.
I.2.6. The imposition of an administrative fine
65. On May 17, 2023, the Litigation Division informed the defendant of its intention to
proceed with the imposition of an administrative fine as well as the amount thereof, in order to
give the defendant the opportunity to defend himself before the penalty is effectively
inflicted. She also asks him to provide her with a balance sheet.
66. On June 2, 2023, the Litigation Division received the defendant's reaction concerning
the intention to impose an administrative fine and the amount thereof, as well as the balance sheet
defendant's accountant. The defendant argues that the Litigation Chamber bases itself on
elements contrary to those appearing in the file and does not understand the context
legislation relating to the College of Pharmacists. It also disputes certain criteria applied
by the Litigation Chamber to impose an administrative fine.
67. The Respondent raises in particular the absence of mitigating circumstances on its part.
According to him, the defendant has taken many initiatives and steps since 2020 in order to
bring the processing carried out with the disputed data into compliance.
be considered as a mitigating circumstance for the imposition of a fine
administration.
68. The Respondent also indicated that the disciplinary sanction pronounced against the
complainant has been deleted. The Litigation Chamber notes, however, that it does not provide the
evidence. These arguments are discussed in paragraphs 199 to 208 of this decision. Decision on the merits 77/2023 – 16/49
II. Motivation
II.1. As for the identification of the disputed data and the controller
69. The Litigation Chamber recalls that Article 4.1) of the GDPR defines data of a nature
personal as “any information relating to an identified natural person or
identifiable (hereinafter referred to as the “data subject”); is deemed to be a "person
identifiable natural" means a natural person who can be identified, directly or
indirectly, in particular by reference to an identifier, such as a name, a number
identification, location data, an online identifier, or to one or more
specific elements specific to his physical, physiological, genetic, psychic identity,
economic, cultural or social; […]”.
70. Processingofpersonaldatameans“anyoperationanytogether
operations carried out or not using automated processes and applied to
data or sets of personal data, such as the collection,
the recording, organization, structuring, preservation, adaptation or
modification, extraction, consultation, use, communication by transmission,
dissemination or any other form of making available, reconciliation or interconnection,
limitation, erasure or destruction”.
71. The Litigation Division finds that the sanction imposed on the complainant
and all information related to this sanction contains personal data
34
personal within the meaning of the GDPR. Like the parties, the Litigation Chamber emphasizes that
the creation of a disciplinary file for a pharmacist, the registration in this file of a
disciplinary sanction, or the consultation, communication or even storage of
the sanction are, pursuant to Article 4, 2) of the GDPR, as much data processing to
personal character.
72. The Litigation Chamber recalls that Article 4.7) of the GDPR defines the person responsible for the
treatment as "the natural or legal person, public authority, agency or
other body which, alone or jointly with others, determines the purposes and
means of treatment; when the purposes and means of this processing are determined
by Union law or the law of a Member State, the controller may be
designated or the specific criteria applicable to its designation may be provided for by the
33 GDPR, Art. 4.2.
34See in particular CJEU, judgment of 2017, Nowak c. Data Protection Commissioner, §34: ““any information” in the
framework of the definition of “personal data”, set out in Article 2(a) of Directive 95/46, reflects
the objective of the Union to attribute a broad meaning to this concept, which is not restricted to sensitive information or
private, but potentially encompasses all kinds of information, both objective and subjective in the form of opinions or
assessments, provided that they “concern” the person in question. » Decision on the merits 77/2023 – 17/49
35
Union law or by the law of a Member State. The concept of responsible
processing is an autonomous concept of European law, the assessment of which must be made at the
with regard to the following criteria: the determination of the purposes of the data processing
concerned as well as the determination of the essential means thereof. According to the Committee
European Data Protection Authority, there is, in principle, no limitation as to the
type of entity likely to assume the role of data controller. 38
73. Based on the aforementioned elements, the Litigation Division understands that the Order
pharmacists, as a professional order in the field of health, has been charged
by the Belgian legislator to regulate the pharmaceutical profession. Reason for this mission,
the defendant is expected to pursue a mission to regulate access to the profession
pharmaceutical, opinion, advice and prevention, but also disciplinary mission. These
missions, of public interest, were therefore assigned to the defendant, the Order of Pharmacists,
by the legislator. And, even if the activities of the Order and its organs are regulated
by legislative and regulatory measures, the defendant has a certain margin
freedom to determine the means necessary for the pursuit of these purposes. There
Chambre Litigation deduces from this that the Order of Pharmacists is responsible for
processing carried out with the disputed data and other data relating to
disciplinary sanctions.
II.2. Regarding compliance with the principle of lawfulness (Article 5.1.a of the GDPR)
74. The principle of lawfulness is one of the key principles of the GDPR and alone conditions the application
other GDPR principles governing the processing of personal data.
application of article 5.1.a of the GDPR, any processing of personal data must
including being fair, transparent and lawful. To be lawful, any processing of data to
personal character must in particular invoke a basis of lawfulness in Article 6 of the GDPR. He
it is up to the data controller to determine what is the adequate basis of lawfulness
with regard to the purpose of the processing.
75. For these reasons, the Litigation Division will therefore first examine compliance with this
principle before addressing the other grievances of the complaint.
76. Article 6(1) of the GDPR lists six bases for lawfulness of processing: in addition to
consent (art.6.1.a of the GDPR), the processing of personal data may be
necessary for the performance of a contract (art. 6.1.b of the GDPR), for compliance with a legal obligation
35
36 GDPR, Art. 4.7.
See for example the decision 63/2022 of the Litigation Chamber of May 2, 2022, available on
https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-63-2022.pdf
37European Data Protection Board (EDPB), Guidelines 07/2020 concerning the concepts of
controller and processor in the GDPR, version 2.0 of July 7, 2021, points 39 et seq.
38EDPS, op. cit., p. 11. Decision on the merits 77/2023 – 18/49
(art. 6.1.c of the GDPR), the performance of a mission of public interest or relating to the exercise of
the public authority (Art. 6.1.e of the GDPR), to the legitimate interests pursued by the controller
of the processing or by a third party (Art. 6.1.f of the GDPR), or is necessary to safeguard the
vital interests of the data subject (Art. 6.1.d GDPR).
77. Each processing should be justified by a basis of lawfulness mentioned above.
When the same processing pursues several purposes, each purpose must be based on
a basis of lawfulness.
78. In this case, the defendant mentions that the processing of personal data
subject of the complaint is the keeping of a register of disciplinary sanctions. 39
However, the Litigation Division considers this presentation of the facts by the
respondent. Indeed, it appears from the documents in the file, including the conclusions of the defendant
and the complainant, that the complaint actually targets several processing operations carried out with the
disputed data (conservation, consultation, transmission of disputed data).
79. It also appears from the documents in the file that this processing pursues the purposes
different, which are as follows:
40
1. Management of a disciplinary file;
41
2. Updating the roll of the Order;
3. Assessing the conditions of eligibility of candidates for election to organs of the
42
defendant;
4. The evaluation of applications to become a training supervisor and the transmission of
43
this assessment to universities;
5. The transmission of the disputed data to a federal database maintained by
44
the FPS Public Health;
6. The transmission of data to a European database on the system
45
IMI;
7. Maintaining a directory of Council case law in order to develop the
46
principles of pharmaceutical ethics;
47
8. Legal defense of the defendant.
39
Respondent's Summary Submissions, p. 9, §21.
40 Defendant's summary conclusions, p.29, §71, where it is indicated that a disciplinary sanction is entered in the file
of the pharmacist.
41 Defendant's summary conclusions, page 14, §35, where it is indicated that the table of pharmacists contains in particular
disciplinary sanctions.
42
43 Respondent's Summary Submissions, p. 14, §35.
Respondent's Summary Submissions, p. 14, §35.
44 Respondent's Summary Submissions, p. 49, §119.
45 Respondent's Summary Submissions, p. 50, §119.
46 Respondent's Summary Submissions, p. 9, §21.
47 Respondent's Summary Submissions, p. 50, §120. Decision on the merits 77/2023 – 19/49
80. Processing for these purposes requiring the storage, consultation or
transmission of the disputed data, the Litigation Chamber will examine the
bases of lawfulness for each purpose.
II.2.1. Management of disciplinary cases
81. On several occasions, the Respondent invokes the management of “disciplinary cases” as
purpose of processing the disputed data.
82. First and foremost, for the sake of clarity, the Litigation Division wishes to clarify what it intends
in this decision by:
- Management of disciplinary cases: all actions taken by the Councils
Provincial Councils and Appeals Councils necessary to regulate the behavior of
48
pharmacists with a view to imposing respect for pharmaceutical ethics
(ranging from the opening of an investigation, to the investigation of the case, the prosecution, the judgment,
the transmission of a file to an appeal body and the assessment of the risk of recidivism
49
in the event of a subsequent procedure). The management of disciplinary cases requires keeping
a disciplinary file reflecting the current disciplinary status of a pharmacist and
containing the decisions pronounced against the pharmacist;
- Disciplinary file: the individual file, specific to each pharmacist, in which
finds the disciplinary sanctions or other decisions pronounced against a
pharmacist. This file reflects the disciplinary status of a pharmacist.
83. In the present case, the defendant invokes a legal obligation within the meaning of Article 6.1.c of the
50
GDPR for the management of disciplinary cases. To do this, the defendant invokes the article
15 of Royal Decree no. 80, requiring the National Council to keep a directory of case law, the
articles of Royal Decree no. 80 instituting disciplinary jurisdiction on the part of the Councils
51
provincial and Appeals Councils, as well as the articles of Royal Decree no. 80 defining the
52
conditions of eligibility for positions in the organs of the respondent.
84. Pursuant to Article 6, paragraph 1, c) of the GDPR, the processing can be considered as
lawful when it is necessary "for compliance with a legal obligation to which the person responsible for the
treatment is submitted”. As clarified by the Article 29 Working Party, for a
controller can rely on article 6.1.c of the GDPR to process data
personal data, the controller must be obliged to do so by or
under a legislative standard.
48 See not.J.ALARDIN,J.CASTIAUX, Disciplinary law in the case law, Brussels, Larcier, 2014, p. 50: “The action
disciplinary has, in fact, for the purpose of research if the holder of a profession has violated the rules of ethics or
discipline or has damaged the honor or dignity of his office or profession”.
50 This list is not exhaustive.
51 Respondent's summary submissions, page 43, §103.
Royal Decree no. 80, art. 6, 2°, article 12, §1, 1°.
52AR no. 80, art. 8 §1, article 12, §1, 1°, art. 14, §1, 1°, par. 2. Decision on the merits 77/2023 – 20/49
85. In accordance with Article 6.3 of the GDPR, read in conjunction with Article 22
of the Constitution and with Articles 7 and 8 of the Charter of Fundamental Rights of the Union
European Union, this legislative standard must define the essential characteristics of a
data processing, necessary for the performance of a task in the public interest or falling
the exercise of official authority vested in the controller. In the
aforementioned provisions, it is emphasized in this respect that the processing in question must be
framed by a sufficiently clear and precise standard whose application must be predictable
for the people concerned. 53In accordance with Article 6(3) of the GDPR, this
standard must define the purpose(s) of the processing.
86. However, the Litigation Division finds that the provisions of Royal Decree no. 80 put forward by the
defendant to demonstrate a legal obligation on his part (point 82) do not mention
explicitly the management of disciplinary cases. They allow at most
Provincial Councils and Appeals Councils to adopt disciplinary sanctions and assess
the eligibility of candidates for election. Evaluation of the conditions of eligibility for elections
of the defendant's organs does not pursue the same purpose as the management of the cases
disciplinary proceedings. The Litigation Chamber finds that Article 15 of AR No. 80 mentioned in
effect the keeping of a register of disciplinary decisions at the expense of the National Council but
the purpose of which is well defined and does not target the management of disciplinary cases: this
register must be used to “adapt, if necessary, the code of ethics with a view to supplementing or
to specify its provisions on the basis of this case law”.
87. In the legal provisions invoked by the Respondent, there is therefore no question of the
keeping of a disciplinary file or the assessment of the offense.
rely on Article 6.1.c of the GDPR to justify the management of disciplinary cases. A
hypothetical legal obligation based on Royal Decree no. 80 could only justify part of the
processing carried out by the defendant (RD no. 80 only mentions the adoption of
sanction and consultation of sanctions in order to determine the eligibility of a candidate for
elections). This legal basis, erroneously invoked by the defendant, could not
allow data subjects to understand the extent of the processing carried out
with personal data relating to disciplinary sanctions. This
ignorance on the part of the defendant is therefore not compatible with the obligation to
transparency. The defendant will therefore violate Article 5.1.a of the GDPR by invoking a basis of
erroneous legality.
88. However, the Litigation Chamber does not conclude that there is no legal basis
adequate regarding the processing(s) of data in the context of business management
disciplinary.
53 DPA, decision on the merits 47/2022 of 4 April 2022, p. 22, item 106, available at
https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-47-2022.pdf . Decision on the merits 77/2023 – 21/49
89. Indeed, with regard to its missions, it is normal that a professional order such as the Order
of pharmacists can keep a disciplinary file of its members up to date in order to
continue its disciplinary mission.
90. In accordance with Article 6.1.e of the GDPR, processing of personal data
may be necessary for the performance of a mission of public interest or relating to the exercise of
the official authority vested in the controller by virtue of a provision
legislative. Unlike the legal obligation provided for in Article 6.1.c of the GDPR, the
processing necessary for the pursuit of the mission of public interest must not be
explicitly described in a legislative provision. Salaries, according to the Chamber
Litigation, are based rather on the public interest mission conferred on the head of the
treatment. 55 The legal basis must, at least, define the missions of public interest or falling
of the exercise of official authority which justify the need for the processing of data to
personal character. The purpose of the processing must also be determined in this
legal basis .6
91. The notion of “processing necessary for the performance of a task in the public interest” has a
broad in scope since it covers not only the processing necessary for the execution of the
mission of public interest in the strict sense, but also the processing necessary to
the performance of tasks directly related to this mission of public interest, including the
processing necessary for the management and operation of the bodies responsible for
this mission of public interest.
92. The Article 29 Working Party rightly noted that this legal basis is relevant
for: “a professional association, such as a bar association or a professional association
doctors, vested with the required public authority, may initiate disciplinary proceedings
against some of its members. 57
93. In this case, the management of disciplinary cases involves the processing necessary to
the exercise of the quasi-jurisdictional functions of the Provincial Councils and the Councils
appeal of the Order. These disciplinary functions are, in accordance with Article 6.3 of the GDPR,
exclusively attributed by Royal Decree no. 80 to the Provincial and Appeals Councils of the Order.
The assessment of the risks of recidivism in the assessment of the sanction to be adopted is
also necessary to pursue this mission.
94. In view of the foregoing, the Litigation Chamber concludes that the treatments of the
disputed data consisting of the management of disciplinary cases by the Councils
Provincial Councils and Appeals Councils are justified on the basis of Article 6, paragraph 1, e) of the
54
GDPR, art. 6.3.
55C. DE TERWANGNE, The General Data Protection Regulation, p. 136; W. KOTSCHY, The EU General Data
ProtectionRegulation (GDPR), p. 336.
56 GDPR, recital 45.
57 Article 29 Working Party, op. cit. p. 23. Decision on the merits 77/2023 – 22/49
GDPR, insofar as said processing is carried out by the competent bodies
who is responsible for the performance of disciplinary jurisdictional functions.
II.2.2. The establishment and management of the roll of the Order
95. Respondent submits that the disciplinary status must appear on the Order's roll.
To do this, the defendant must read the pharmacists' disciplinary file.
However, Royal Decree 80 assigns the mission of establishing a list of pharmacists to the Councils
58 and the Royal Decree of 4 July 1970 imposes on the Provincial Councils the procedure to be followed
for registration on the roll.9 The set of provincial rolls constitutes the roll of
the Order.
96. The Respondent did not explain all the purposes pursued by keeping the scoreboard
the Order. It emerges from the aforementioned provisions that registration on the provincial rolls allows
the Provincial Councils to control access to the profession by requiring proof of
competence on the part of pharmacists and also conditions access to the profession. Of
more, the table of the Order, which is the sum of the provincial tables, has a function
administrative, by listing all the pharmacists practicing or having the right to practice
in Belgium. This list should contain the identification data of the pharmacists as well as
than their disciplinary status.
97. The Litigation Chamber judges that the provisions mentioned in point 96
60
contain the essential elements of the treatment. The Litigation Chamber notes
however, the personal data accessible on the list does not appear
in these provisions. However, the provisions mentioned are satisfactory for
allow the defendant to rely on Article 6.1.c of the GDPR in order to proceed with
the establishment and management of the roll of the Order.
II.2.3. Assessing the eligibility of candidates for election to the organs of the
respondent
98. As mentioned previously, AR No. 80 requires the organs of the defendant to take
into consideration the sanctions pronounced against the candidates in their elections
respective. Thus, for the defendant's bodies, the pharmacist who has
61
incurred a sanction other than that of a warning.
58
59AR no. 80, art. 6, 2°.
60AR of July 4, 1970, articles 21 to 26.
Although not explicit, the purpose of such processing is understood, the data controller, as well as the bodies
competent, the recipients of the personal data, the categories of personal character necessary for
proceed with registration.
61AR n°80, art.8§1, art. 12, §1, 1°, art. 14, §1, 1°, par. 2. Decision on the merits 77/2023 – 23/49
99. This purpose therefore involves consulting the disciplinary status of the candidate pharmacist.
100. Given that the purposes and means of this processing are sufficiently delimited,
the Litigation Chamber finds that this processing is justified by a legal obligation
meaning of article 6.1.c of the GDPR.
II.2.4. The evaluation of applications to become an internship supervisor and the transmission
of this assessment to universities
101. The Respondent also mentioned consulting the disciplinary status of the
pharmacists in order to provide advice to the universities that have received their application for a
position of internship supervisor. Even if this opinion only takes the form of a yes or a no, 62the
consultation and drafting of this notice are processing of personal data
personnel requiring a basis of lawfulness of Article 6 of the GDPR. The purpose pursued -
indicate to universities whether potential future internship supervisors have a suitable profile
to train pharmacy students - is different from that of business management
disciplinary.
102. However, the Respondent does not advance any basis of legality relating to this purpose.
more how this treatment would be compatible with the initial treatment, the management of the cases
(point 142). The Litigation Chamber therefore finds that the defendant violated
Article 5.1.a of the GDPR by not indicating an adequate basis of lawfulness for these
data processing.
II.2.5. The transmission of data to the federal database CoBRAH and to the database
European data
103. The defendant indicated that he had to transmit to the FPS Public Health certain data
relating to registration on the roll and the temporary or permanent withdrawal of the right to exercise
pharmacy profession via the federal CoBRAH database. 63
104. The defendant must transmit information relating to the restrictions or prohibitions
to practice the profession of pharmacist to the competent authorities who in turn inform
the authorities of other Member States via the Internal Market Information System
64
(IMI).
62 Minutes of hearing, p. 13.
63 Coordinated law of 10 May 2015, art. 99.7°.
64 Coordinated law of 10 May 2015, art. 114/1. Decision on the merits 77/2023 – 24/49
105. Given that these processing operations are sufficiently delimited by law, the Chamber
Litigation accepts the basis of legality put forward by the defendant, i.e. an obligation
legal under article 6.1.c of the GDPR.
II.2.6. Maintaining a directory of case law
106. The Respondent wrongly relied on Article 15 of Royal Decree no. 80 to justify, due to a
legal obligation within the meaning of Article 6.1.c of the GDPR, the management of disciplinary cases
Provincial Councils and Appeals Councils (points 81 to 95).
107. The Litigation Chamber notes, however, that the defendant can rely on this
provision of Royal Decree no. 80, but only for the processing of disputed data
pursuing the purpose imposed by Article 15, and at the expense of the National Council. Indeed, this
article requires the National Council to keep an up-to-date directory of disciplinary decisions
pronounced by the National Councils and the Appeals Councils. The only purpose indicated by
the legislator for such a repertoire is to develop the principles of ethics
pharmaceutical industry and to adapt the Code of Ethics.
108. Therefore, the keeping of such a repertoire of case law by the National Council in order to develop
the code of ethics is based on a legal obligation within the meaning of article 6.1.c of the GDPR, namely
article 15 of RD n°80.
II.2.7. Recognition, exercise or defense of legal rights
The defendant further invokes the legitimate interest as a basis of lawfulness within the meaning of Article
6.1.f GDPR to process the complainant's disputed data. 65
II.2.7.3. Position of parties
109. The defendant explains that the complainant has a broader dispute with the Order,
in particular the complaint filed with the ABC (point 12) 66and that an action for annulment
before the Council of State was introduced by the complainant on March 2, 2020. In this
executive, he had to refer to the decision rendered on December 22, 2016 by the Appeals Board
and the procedure before the Council of State is still pending. For this last reason, the
respondent emphasizes that it will continue to process the disputed data in the proceedings
still in progress, in particular before the Council of State, but only within this framework. 67
65
Point 10.2.2 of the complainant's reply submissions; paragraphs 35, 120 and 121 to the rebuttal submissions of the
respondent.
66Paragraphs 120 of the Respondent's Reply submissions as well as paragraphs 25 and following with respect to
the complaint to the CBA.
67Paragraph 120 of Respondent's Reply Submissions. Decision on the merits 77/2023 – 25/49
110. The complainant explained that the dispute between her and the defendant before the Council of State
on the new Code of Ethics: this is a dispute relating to the normative function of the
defendant and not to his disciplinary jurisdictional functions. Moreover, "the law organizes
carefully the independence of the provincial council and the appeals council in relation to
68
order as drafter of the Code of Ethics”. The complainant adds that the
defendant would invoke the need for indefinite storage “(until the death of the
pharmacist concerned) ethical sanctions in order to ensure the defense of his rights
69
in justice " .
II.2.7.4. Position of the Litigation Chamber
111. The Litigation Chamber notes that, according to Article 6.1.f of the GDPR, the processing of
personal data must be “necessary for the fulfillment of the legitimate interest”
pursued by the data controller (for completeness: or by a third party).
112. Moreover, recourse to legitimate interest is expressly subject to a criterion
additional balancing act, which aims to protect the interest and the rights and freedoms
fundamentals of the people concerned. In other words, the legitimate interest pursued
by the controller must be weighed against the interests or rights and freedoms
fundamental rights of the data subject, the objective of the balancing being to prevent
a disproportionate impact on their rights and freedoms.
113. The interest pursued by the data controller, even if it is legitimate and necessary, cannot
therefore validly be invoked only if the fundamental rights and freedoms of persons
concerned do not prevail over this interest. The Court of Justice of the European Union 70 has
clarified that these three conditions – either the pursuit of a legitimate interest by the controller
of processing (out of purpose)(a), the need for the processing to achieve the interest
lawsuit pursued (necessity test) (b) and the condition that the rights and freedoms
of the persons concerned do not prevail over the interest pursued (test of
weighting) (c), are cumulative.
114. In this regard, legal defense is a fundamental right enshrined in article 48 of the
Charter of Fundamental Rights of the Union. In general, the legal defense can
actually be considered a lawful legitimate interest in the context of
the application of article 6.1.f. of the GDPR. In accordance with Opinion 06/2014 of the Group of
Article 29 on the notion of legitimate interest, this interest must be real and present, or not
68
Point 10.2.2 of the complainant's reply submissions; paragraphs 35, 120 and 121 to the rebuttal submissions of the
respondent.
69 In paragraph 120 of its Reply Submissions, the Respondent adds that it has never claimed that the preservation
of the data was necessary until the death of the pharmacist concerned in order to ensure the defense of his rights in court.
70CJUE, judgment of December 11, 2019, TK c. Asociaţia de Proprietaribloc M5A-ScaraA, C-708/18, § 44. Decision on the merits 77/2023 – 26/49
71
hypothetical. The Litigation Chamber finds that the interest of the defendant is real and
present, because of the proceedings pending before the Council of State. The first requirement
is therefore fulfilled.
115. With regard to the second condition, the defendant must show that the treatment is
necessary for the exercise of this defense in court. This need to deal with
disputed data implies that the legal defense of the defendant before the Council of State
be obstructed without the processing of the disputed data. Moreover, one of the corollaries of
this criterion of necessity is compliance with the principle of data minimization (article 5.1.c
GDPR).
116. In the present case, the Litigation Division notes that the procedure initiated by the
plaintiff before the Council of State seeks to annul certain provisions of the new Code
of ethics. The defendant indicates that the processing of the data was necessary because
it had to mention the decision of the Appeals Council of December 22, 2016 in its conclusions.
Legitimate interest, as a basis for lawfulness, would only allow the National Council, as
legal representative of the defendant, to process the disputed data in the context of
this procedure only.
117. With regard to the third condition, the fact remains that this data processing must
also fit in a relevant and proportionate way with the purpose precisely
identified with this legitimate interest, namely the legal defense with regard to the dispute before the Board
of state. It is therefore still necessary to ensure that the requirements of the weighting test are
encountered. The balancing test requires balancing the interests of the
controller on the one hand and the fundamental rights and freedoms of the person
concerned on the other hand.
118. The Litigation Division is of the opinion that legal defense is a compelling interest
that may justify an infringement of the right to the protection of the privacy of individuals
73
concerned. Such an infringement of the plaintiff's right would be justified. Furthermore, the
defendant is not a public authority and can therefore invoke a legitimate interest in the
framework of the defense of his rights in court.
119. The defendant may therefore invoke the defense of his rights in court as an interest
legitimate within the meaning of Article 6.1.f of the GDPR to justify the processing of the data
disputed by the National Council.
71
“Article 29” Working Group, Opinion 06/2014 on the notion of legitimate interest to be monitored by the data controller
data within the meaning of article 7 of directive 95/46/EC, p. 27.
72 Motion to quash, Exhibit 8 of the Respondent's Inventory.
73 Group 29, “Opinion 06/2014 on the notion of legitimate interest pursued by the data controller
data within the meaning of Article 7 of Directive 95/46/EC”, p. 27. Decision on the merits 77/2023 – 27/49
II.2.8. Conclusions on compliance with the principle of lawfulness
120. As noted above, the Respondent relied on a basis of legality
inadequate to justify processing relating to the management of disciplinary cases
(points 81 to 95). Nor did the defendant invoke a basis of lawfulness to justify the
processing relating to opinions given to universities (points 101 and 102). Based on these
findings, the Litigation Chamber judges that the defendant violated the principle of legality
and transparency of Article 5.1.a of the GDPR.
II.3. With regard to Article 5, paragraph 1, e) of the GDPR (principle of limitation of the storage
Datas)
121. The principle of limitation of data retention implies that the duration of
retention of personal data must be defined and limited. She must not
exceed what is strictly necessary with regard to the purposes for which the
74
data is processed. Applying this principle also reduces the risk of
the use of such data to the detriment of the data subject.
122. The GDPR does not dictate the retention period of personal data but
requires the data controller to adopt, at the very least, retention criteria
75
with regard to the purposes established for each treatment. In principle, the duration of
conservation determined by the data controller must be communicated to the
76
data subject at the time the personal data is obtained.
123. The College has established the following criteria to determine the retention period of
personal data that it is required to process in general: “The
Controller retains Personal Data (i) for as long as
that it is necessary or relevant for the purposes indicated above, (ii) for the period
during which the law requires it, or (iii) as long as a legal dispute or investigations
77
can take place. » .
124. Given its preponderant role in achieving the other purposes pursued by the
defendant, the Litigation Chamber will first consider the retention limit
data related to a disciplinary file.
74
75GDPR, recital 39
76 GDPR, art. 5.2.
77 GDPR, art. 13.2, a).
Pages 34 to 35 of the Respondent's summary submissions Decision on the merits 77/2023 – 28/49
A. Duration of retention of disciplinary sanctions within the framework of management
disciplinary cases
125. Concretely, the Respondent decided to keep the data related to sanctions
disciplinary until the death of pharmacists registered on the Order's roll or, at the
78
less,until the end of their career. In order to justify this retention period, the Order
to RD n°80 which does not indicate when a sanction becomes obsolete to determine the
Conditions of eligibility. Insofar as Royal Decree no. 80 does not explicitly provide for
provisions concerning the retention period of data in disciplinary matters, the
defendant therefore concluded that the provisions of the Royal Decree required de facto a
processing for an indefinite period, thus justifying data retention
disciplinary measures until the death or the end of the pharmacists' career.
126. However, as examined previously, these provisions are not relevant to establish
treatment involved in the management of disciplinary cases.
not relevant to justify this retention period.
127. The management of disciplinary matters, including the keeping of a disciplinary record, is
reality based on a mission of public interest (paragraphs 89 to 94). But it would be wrong
to interpret the silence of a legislative text as allowing data processing to be
unlimited in time. A royal decree imposing a mission of public interest on the
meaning of Article 6.1.e of the GDPR must be interpreted in accordance with the GDPR. So the
controller cannot shirk its obligations, including that of
determine the period necessary for the retention of personal data. He
it was therefore up to the defendant to adopt a retention period adequate for the management of the
disciplinary cases.
128. The Litigation Division draws a distinction between two types of sanctions:
minor sanctions (the warning and the reprimand) and major sanctions (the
penalties greater than a reprimand). Such a distinction is also adopted by the
respondent. 79
129. In the present case, according to the Litigation Division, the retention of a disciplinary sanction
in a file until retirement, regardless of its severity, is excessive and not
GDPR compliant. Moreover, the defendant fails to explain the relevance of the
conservation of minor sanction until the death or the end of the career of a pharmacist in order,
for example, to take recidivism into account in a disciplinary case.
130. With regard to the retention period applied to the complainant's sanction, the
defendant also argues that the retention period of the data in question must be
78Page 48 of the Respondent's summary submissions
79See the 2021 Annual Report of the National Council of the Order of Pharmacists, p. 27. Decision on the merits 77/2023 – 29/49
determined from February 5, 2018, when the decision relating to the sanction with regard to the
complainant has become effective, i.e. thirty days from the notification of the judgment of the
Court of Cassation (point 15). A cassation appeal in disciplinary matters has
effectively a suspensive effect on the contested decision. The treatments mentioned
previously and involving the complainant's disciplinary status (taking into consideration
of the sanction to assess the conditions of eligibility for elections as well as for a post of
supervisor, to assess the risk of recurrence, etc.) would not have taken place until after the 5
February 2018. The Complainant did not contest this point. The Litigation Chamber is therefore
of the opinion that the start of the retention period of the disciplinary sanction imposed on
against the plaintiff is scheduled to begin on February 5, 2018.
131. However, this last point does not change the finding that the Respondent was applying a
policy of retention of data related to excessive disciplinary sanctions and
intended to apply it to the complainant's disputed data.
132. In conclusion, the Respondent failed to adopt a reasonable retention period for the
retention of personal data relating to disciplinary sanctions, and
this without taking into consideration the severity of the sanctions adopted. Bedroom
Litigation concludes that such a data retention policy
personnel violates the principles of retention limitation (Articles 5.1.e of the GDPR).
133. Furthermore, when this decision was adopted, the disciplinary sanction imposed on
against the plaintiff will have been adopted more than five years after the judgment of the Court of
cassation has become res judicata. The Litigation Chamber considers that a
retention period exceeding five years for a minor disciplinary sanction is
excessive.
134. The defendant must then adopt a retention limitation policy specific to the
needs encountered in handling disciplinary cases. The defendant must adopt
fixed retention periods depending on the types of decisions contained in a
disciplinary record.
B. Duration of retention of disputed data in the context of processing
involving disciplinary status other than the management of disciplinary cases
135. Given that the roll of the Order must reflect the disciplinary status of a pharmacist on
basis of his disciplinary file, the mention of a disciplinary sanction on the table of
the Order must remain published on the list of the Order as long as the
disciplinary sanction in the individual disciplinary file.
80 Judicial Code, art. 1121/5, 3°. Decision on the merits 77/2023 – 30/49
C. Duration of retention of a disciplinary sanction in the directory of
jurisprudence
136. The Litigation Chamber understands from article 15 of Royal Decree no. 80 that the National Council
mission is to establish a directory of disciplinary decisions in order to develop its
jurisprudence and not to manage disciplinary files (points 106 and 108).
137. To comply with this legal obligation, the Litigation Division considers that a
longer preservation of the disciplinary sanction in this directory will be necessary, but
solely for the purpose of fulfilling this specific purpose.
II.4. As to Article 5, paragraph 1, b) (purpose limitation principles)
138. The purpose of the processing is based on the fact that each processing of personal data
personnel must have a specific, explicit and legitimate purpose. This purpose of
processing must be respected, make it possible to determine the relevance of the data
collected and must set the retention period for the data. In other words, once
the data is collected and processed for a purpose, it is, in principle, no longer possible
to use them for processing for a different purpose, subject to
the application of article 6.4 of the GDPR.
139. The Litigation Chamber recalls that the purpose limitation principle implies that the
controller must, before the start of any processing, determine the purpose of the
processing, i.e. the purpose it intends to achieve through the use of the data
personal. The purpose must be determined, explicit AND legitimate, so that a person
concerned must be able to understand what data will be processed and for what purposes.
140. Further processing of personal data for purposes other than the one(s)
for which this data was initially collected is only authorized if
subsequent processing is compatible with the purposes for which the character data
personal were initially collected, taking into account the link between the purposes for
which they were collected and the purposes of the further processing envisaged, the framework
in which the personal data was collected, of the consequences
possibilities of the further processing envisaged for the data subject and the existence of
appropriate safeguards. A compatible purpose is, for example, a purpose that the person
concerned may provide or which may be considered compatible by virtue of a
legal provision (see article 6.4. of the GDPR). Further processing is however excluded.
when the initial processing is based in particular on national law or European law.
141. The Litigation Chamber judges that the purposes presented by the defendant are not
sufficiently determined, i.e. specific, or explicit. Indeed, the respondent Decision on the merits 77/2023 – 31/49
justifies the processing of the disputed data under an obligation to manage the "business
disciplinary matters", or to keep a directory of case law. This concept is very vague.
and would not make it possible to understand the purposes listed in point 79. In addition, the use
of a vague notion to define the purposes of such processing also means that these
purposes are not sufficiently explicit.
142. The defendant also mentions subsequent processing (in particular the evaluation of
conditions of eligibility for a position of internship supervisor) compatible with the initial purpose
81
collection of disputed data (management of disciplinary cases). The defendant
does not, however, prove compliance with the conditions for applying further processing
compatible with the original purpose. Furthermore, the Litigation Chamber notes that the
initial processing of disputed data is based on a mission imposed by law
Belgian (see section II.2.1), which excludes further processing with the same data.
143. Consequently, the Litigation Division finds a violation of the principle of limitation of
purposes (Article 5.1.b of the GDPR) because the defendant did not sufficiently specify the purposes
pursued with the disputed data, rendering the said purposes insufficiently
determined and explicit.
II.5. As to Article 5(1)(c) (data minimization principle)
144. According to the minimization principle, the data undergoing processing must be
“adequate, relevant and limited to what is necessary in relation to the purposes for
which they are processed. The relevance requirement is met if the data
present a necessary and sufficient link with the purposes pursued. Furthermore, the
principle of data minimization leads to personal data
are processed only where that purpose can reasonably be achieved by
82
to the treatment in question.
145. In order to honor the principle of minimization, data controllers may have
use of measures such as anonymization, pseudonymization of data
83
(making the person concerned unidentifiable) or the designation of the persons
authorized to access the data.
81
82 Respondent's Summary Submissions, p. 30, § 73.
83 GDPR, recital 39.
GDPR, art. 4.5°; This is the “processing of personal data in such a way that they can no longer be
be attributed to a specific data subject without recourse to additional information, provided that
such additional information is kept separately and subject to technical and
organizational to ensure that personal data is not assigned to a natural person
identified or identifiable” Decision on the merits 77/2023 – 32/49
146. The Litigation Chamber will examine compliance with the principle of minimization with
each purpose pursued.
A. Management of the Complainant's Disciplinary Cases
147. As mentioned above in Section II.2.1, the keeping of a disciplinary file is necessary for
the exercise of the quasi-judicial functions of the controllers who are the
Provincial Councils and Appeals of the Order. When they exercise their function
disciplinary authority assigned by AR No. 80, they must process personal data in
disciplinary matter, in particular transmitting information allowing the assessment of the
recidivism or to pursue disciplinary proceedings at second instance. In this case, the
Litigation Chamber was unable to identify and trace the transfer of the
disciplinary data between the organs of the Order and regrets that the communication and/or
the transmission of disciplinary data to assess the recidivism or the conditions
of eligibility within the organs of the Order have not been explained by the defendant.
148. The Litigation Chamber recalls that the principle of minimization also implies a
restricted access to personal data. Transfers within the Order must
therefore be necessary with regard to the powers of each body.
B. Management of the roll of the Order
149. The Respondent also indicated that the Order’s roll “repeated” or “contained” the
disciplinary sanctions. The defendant also ensured that such treatment respected the
principle of minimization due to its restricted access, which in the future will be even more
restricted because only accessible to the instructor and the rapporteur of an instance
disciplinary. The Litigation Chamber questions this assertion: the defendant
seems to confuse the keeping of a disciplinary file and the keeping of the roll of the Order.
150. With regard to the purpose pursued by the management of the table of the Order with the related data
to disciplinary sanctions, it is not necessary that the full sanction be accessible via
the consultation of the table of the Order. Only an up-to-date statement of disciplinary status is
sufficient to pursue this purpose.
C. Development of ethical principles based on case law
151. The defendant had also raised its obligation to maintain a directory of
case law. The Litigation Chamber recalls the precise purpose of such a directory that
must pursue the National Council: the development of the principles of ethics.
152. In order to comply with the principle of data minimization, the respondent must implement
adequate measures to manage this repertoire of case law. The defendant should
therefore proceed to the pseudonymization of the personal data included in
a decision. Decision on the merits 77/2023 – 33/49
D. Assessment of Eligibility Conditions for Elections to Organs of the Respondent
153. As indicated above, the organs of the defendant will have the obligation to take into account
the disciplinary status of a candidate in their elections. The Litigation Chamber notes
however, this processing does not require consultation of the file and the sanction
entire discipline. A sanction contains a lot of personal data
relating to the behavior of the accused. In order to comply with the principle of minimizing
data, consultation of the table of the Order, where there is a mention of any
sanction, would be sufficient.
E. Communication of disputed data to the CoBRAH database and the
IMI system database
154. With regard to processing aimed at satisfying the legal obligation of the defendant to
transfer data to the mentioned databases, the Litigation Chamber
notes that the reprimand is not a measure restricting or prohibiting the right
to practice the profession of pharmacist. As such, the communication of the disputed data
is not necessary to satisfy the legal obligation of the defendant to transfer to the
other Member States via the IMI system of disciplinary sanctions other than
restriction or prohibition to practice the profession of pharmacist. Bedroom
Litigation adds that Article 114/1 of the coordinated law of 10 May 2015 does not provide for the
communication of all the disciplinary data of a pharmacist nor the sanctions
disciplinary measures other than the restriction or prohibition to exercise the profession of
pharmacist.
155. Moreover, contrary to the defendant, the Litigation Chamber finds that Article 99, 7°
84
of the law of 15 May 2015 provides that the data to be transmitted by the defendant to the database
of CoBRAH data are the data relating to the registration on the roll and the withdrawal
temporary or permanent right to practice. Based on this provision, it appears that the
communication of data relating to disciplinary sanctions not resulting in the
removal from the roll or temporary or permanent withdrawal from practice is not necessary for
fulfill the obligation established by article 99, 7° of the law of 15 May 2015.
156. The Litigation Chamber notes, however, that the defendant invokes, for the transmission of
data to the FPS Public Health, a protocol concluded between the defendant and the FPS Health
public.85 This protocol would establish the communication of all sanctions
84 Coordinated law of 10 May 2015, art. 99: “The following services, organizations and persons provide the bank with
permanent federal data of health care professionals the following data:
[…]
7° the Order, with regard to professional addresses as well as data relating to registration on the roll and
temporary or permanent withdrawal of the right to practice but without mentioning the reasons justifying this withdrawal;
[…]”
85 Respondent's submissions, p. 50, §119. Decision on the merits 77/2023 – 34/49
to the FPS Public Health but was not provided by the defendant to the Chamber
Litigation and is not freely accessible.
157. The Litigation Division finds that this protocol does not meet the requirements of
Article 6.1.c of the GDPR to constitute a legislative provision imposing an obligation
legal because this protocol is not foreseeable for the persons concerned (point 84).
158. The Litigation Chamber then concludes that the Defendant violated Article 5.1.c of the GDPR
proceeding to the communication of the data relating to the minor sanctions which were
not necessary for the purpose pursued
II.6. As to Article 5(1)(d) (principle of correctness)
159. The principle of correctness of Article 5, paragraph 1, d) of the GDPR implies that the data
collected must “be accurate and, where necessary, kept up to date; all measurements
reasonable steps should be taken to ensure that the personal data which is
inaccurate, having regard to the purposes for which they are processed, are erased or
rectified without delay”. In concrete terms, this measure of accuracy translates into
specific guarantees which are the rectification of data, the erasure of data which
are inaccurate and no longer necessary in relation to the purposes for which they were
collected 87 or the limitation of processing for a period allowing the
controller to verify the accuracy of the personal data. 88
An additional link to the principle of accuracy, updating data takes on a
89
much more concrete practicality. As soon as an update opportunity arises
to the controller, the latter must enter it.
160. The purpose of this principle is to fight against obsolete data whose use is made of it
may be irrelevant or even harmful to the data subject.
161. In its Nowak judgment, the Court of Justice of the European Union clarified how the
compliance with this principle had to be assessed: "the completeness and accuracy of data to be
personal character must be assessed with regard to the purpose for which these data were
been collected”. This implies that the data controller adopts measures
reasonable to ensure the accuracy of the personal data it processes.
Compliance with this principle is assessed with more or less severity depending on the effects
86 GDPR, art. 16
87 GDPR, art. 17.1.a
88 GDPR, art. 18.1.a
89
G.HAAS, GDPR legal guide: the regulations on the protection of personal data, 3rd edition, Edition ENI, 2022,
90 86 to 89.
CJEU, judgment of December 20, 2017, Nowak v. Data Protection Commissioner, C-434/16, § 53. Decision on the merits 77/2023 – 35/49
the processing of inaccurate data on the rights and interests of the data subject. This
principle of accuracy establishes an obligation of means. 91
162. The GDPR does not define the term “accuracy”. The Article 29 Working Party
clarified that: “As a general rule, “accurate” means “accurate with respect to a
92
do " . It follows from this interpretation that the accuracy of subjective information cannot
be challenged under the principle of accuracy of the GDPR. However, the border between the
93
objective and subjective character of a datum is not always clear. Therefore, in the
within the framework of the processing of a sanction or a formal opinion issued by a disciplinary body,
when such an opinion is based on normative texts whose legality has been contested, the
processing of the review in question may be challenged under the principle of accuracy. 94
163. As a reminder, the Litigation Division is not competent to determine whether a
sanction adopted following the acts carried out by the complainant could be pronounced under
of the new Code of Ethics of the Order of Pharmacists. Likewise, the House
Litigation does not question the existence of the acts carried out by the complainant which
led the French-speaking Appeals Council of the Order to find a breach of the principles
essentials of the profession of pharmacist and to sanction it (point 11).
164. However, the Litigation Chamber is surprised that the disciplinary bodies of the Order
WERE NOT MORE ALARMED ABOUT A POTENTIAL UPDATE OF THE disciplinary file
the adoption of the new Code of Ethics and/or decisions of the ABC within the framework of
the management of disciplinary cases. The Litigation Chamber considers that the authorities
disciplinary measures of the Order should reasonably foresee – at least after the adoption
the new Code of Ethics – updates to disciplinary records, including
to verify whether the retained data still reflected an accurate disciplinary status at the
regardtothenormativeframeworkoftheprofessionofpharmacist.Inthiscase,thedefendant
should have checked whether the sanctions imposed on the complainant on the basis of
the old edition of the Code of Ethics would be pronounced again under this
new Code and whether, in the light of this review, the maintenance of the disciplinary sanction
pronounced against the Complainant still reflected an accurate disciplinary status.
165. In addition, the Litigation Chamber once again reminds the controller
that, as indicated above (point 160), the purpose of this principle is to fight against data
obsolete whose use may appear irrelevant, or even
detrimental to the person concerned. This situation appears to be the case here.
91C. DE TERWANGNE, “Principles relating to the processing of personal data and its legality”, in C. DE
TERWANGNE, K. ROSIER (dir.), The General Data Protection Regulation (RGPD/GDPR) – In-depth analysis,
Brussels, 2018, p. 111.
92G29, Guidelines relating to the execution of the judgment of the Court of Justice of the European Union in the case “Google
Spain and Inc. / Agencia Espanolade Protection de Datos (AEPD) and Mario Costeja Gonzalez”, C-131/12, p. 17.
93C. DE TERWANGNE, op. quoted, p. 111.
94C. DE TERWANGNE, op. cit., p. 112. Decision on the merits 77/2023 – 36/49
since the disputed data, namely the sanction pronounced in 2018 against the
complainant on the basis of the old Code, are processed to assess the recidivism and/or the
conditions of eligibility of the complainant to the various councils of the Order.
166. The Litigation Chamber finds that the defendant has, despite the adoption of the new Code
of ethics, continued to process the disputed data of the complainant without even
consider a potential update of her disciplinary file since the complainant does not
still could not stand for election to the organs of the defendant. On the other hand, the
facts at the origin of the sanction could expose it, within the framework of new procedures
disciplinary measures, to a more severe sanction due to a recidivism. When requesting
deletion of the complainant in 2020, such damages should have motivated the Board
provincial to re-examine the relevance of maintaining the disciplinary sanction of the
complainant in his disciplinary file, for which he was responsible. In its conclusions and when
of the hearing, the defendant could not moreover affirm that such a sanction would be
pronounced again after the adoption of the new ROI, proving that the revaluation of the
continuation of the disciplinary sanction in the complainant's file was not examined.
167. This evaluation on the part of the Provincial Council should not be understood as an
second chance of an appeal against the decision to cancel the sanction. It aims to assess the
relevance of updating the disciplinary status of a pharmacist by determining whether the
presence of a disciplinary decision is always relevant in his disciplinary file.
This update of the disciplinary file does not entail the cancellation of the decision
disciplinary in the case law of counsel for the respondent.
168. In light of the foregoing, the Litigation Division finds that the defendant has not
mobilized sufficient resources to respect the principle of accuracy. By not having
re-examined the complainant's disciplinary file after the adoption of the
new Code of Ethics, despite the prejudices raised by the complainant and the
serious indications of the lack of merit in maintaining such a sanction, the defendant
violates Article 5(1)(d) GDPR.
II.7. Regarding the violation of Article 10 of the GDPR
169. Regarding the processing of personal data relating to convictions
criminal offenses and offences, Article 10 of the GDPR specifies that “any complete register of
criminal convictions can only be held under the control of public authority”. THE
GDPR requires that such processing, when not carried out under the control of
public authority, are governed by Union law or by the law of a Member State
which provides appropriate safeguards for the rights and freedoms of data subjects. Decision on the merits 77/2023 – 37/49
170. In order to delimit the material scope of the GDPR, the Litigation Chamber verifies
if the processing of ethical sanctions is not included in the processing of
personal data excluded from the scope of the GDPR. Indeed, article 2,
paragraph 2, d) of the GDPR 95 excludes from the material scope of the GDPR the processing
of data protected by Directive 2016/680 of April 27, 2016 (hereafter the Police Directive-
96
Justice) .
171. To fall within the scope of the Police-Justice Directive, data processing
data must meet two cumulative conditions. On the one hand, it must pursue one of the
er
purposes mentioned in Article 1, namely the prevention and detection of offenses
criminal proceedings, investigations and prosecutions in this area or the execution of criminal sanctions . 97
On the other hand, the processing, whatever its purpose, must be implemented by an authority
competent within the meaning of Article 3(7) of the Police-Justice Directive. 98
172. Conversely, Article 10 of the law of 30 July 2018 on the protection of persons
with regard to the processing of personal data (hereinafter “framework law”)
specifies that the entities referred to in Article 10 of the GDPR, and therefore which are not authorities
authorities within the meaning of Article 3.7 of the Police-Justice Directive, may be
legal persons governed by public law, provided that the management of their own litigation
requires it. The Litigation Chamber considers that the Order of Pharmacists corresponds to
this definition, due to its findings in Section II.1. The defendant is therefore excluded
of the personal scope of the Police-Justice Directive and Article 10 of the GDPR can
potentially be applied to it.
173. The Litigation Division must still determine whether a disciplinary sanction can be
considered as a criminal conviction, a concept which is not defined by the GDPR.
therefore turn to the Police-Justice Directive. According to recital 13 of the directive
Police-Justice, the concept of criminal offense is an autonomous concept of EU law
95
Article 2.2.d): “[…]2. This Regulation does not apply to the processing of personal data carried out:
[…] (d) by competent authorities for the purposes of the prevention, detection, investigation and prosecution of criminal offences.
prosecution or execution of criminal penalties, including protection against security threats
public and the prevention of such threats. »
96
Directive 2016/680 of the Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to
the processing of personal data by the competent authorities for the purposes of prevention and detection
criminal offences, investigation and prosecution thereof or the execution of criminal penalties, and to the free
movement of such data, and repealing Council Framework Decision 2008/977/JHA.
97 Police-Justice Directive, art. 1.1.
98Article 3.7 of the Police-Justice Directive: ““competent authority”:
(a) Any public authority competent for the prevention and detection of criminal offences, investigations and
prosecution or execution of criminal penalties, including protection against security threats
public and the prevention of such threats; Or
b) Any other body or entity to which the law of a Member State entrusts the exercise of official authority and prerogatives
of public power for the purposes of prevention, investigation and prosecution of criminal offences.
matter or execution of criminal sanctions, including protection against threats to public security and
prevention of such threats; »
99 st
Framework law, art. 10, §1:
“In execution of Article 10 of the Regulation, the processing of personal data relating to convictions
offenses and criminal offenses or related security measures is carried out:
1° by natural persons or by legal persons governed by public or private law, provided that the management of
their own litigation requires it; […]” Decision on the merits 77/2023 – 38/49
European Union and in accordance with the interpretation of the Court of Justice of the European Union (here
after "CJEU"). To assess the criminal nature of a sanction, the CJEU 100 adopted the
same criteria as the European Court of Human Rights in its judgment Engel 101: the
first is the legal qualification in domestic law of the sanction, the second, the nature
of the offense itself and, the third, the degree of severity of the sanction 102.
174. On the basis of these elements, the Litigation Division finds that a disciplinary sanction
is not considered criminal in nature under Belgian law. This criterion is not
however not determinative 10. The nature of the offence, as targeted by sanctions
major, has repressive objectives against behavior deemed to be contrary
to the essential principles of the profession, with the aim of preserving the interests
generals of society, such as public health. The severity of a disciplinary sanction
major, by prohibiting the exercise of a professional practice, would likewise
high enough to meet the third condition set out in case law
of the ECHR. The second and third conditions are therefore met for sanctions
majors. But this is not the case for a minor sanction such as a reprimand.
Therefore, the Litigation Chamber concludes that Article 10 of the GDPR does not apply to
processing carried out on the data of the complainant.
II.8. As to the request for erasure of the complainant's data and the breach of
GDPR article 17
II.8.1. On the violation of Article 17 in 2020
175. First of all, with regard to the request for erasure submitted by the complainant in
January 2020, the Litigation Chamber finds that its request was mainly
based on the fact that, according to the complainant, the sanction adopted in 2016 was to be
considered illegal following the decisions of the ABC and the adoption of the new Code. There
Litigation Chamber is not competent to rule on the legality of the sanction
in question with regard to competition law or pharmaceutical ethics
current. It cannot therefore find a violation of Article 17.1.d committed by the
defendant when he indicated that the sanction adopted was not illegal, and therefore the
subsequent processing of the data of this sanction either. 104
100
101 CJEU (gde ch.), June 5, 2012, judgment Prokurator Generalny v Łukasz Marcin Bonda, C-489/10, § 37.
ECHR, June 8, 1976, judgments Engelet autres c. Netherlands, 5100/71, 5101/71, 5102/71, 5354/72, 5370/72, § 80-83.
10 See, incense, CJEU, 5 June 2012, Bonda, C‑489/10, §37; CJEU, 20 March 2018, judgment GarlssonRealEstatee.a., C‑537/16,
§ 28, as well as CJEU, 2 February 2021, Consob judgment, C‑481/19, § 42.
10 CJUE, 22 June 202, Latvijas Republikas Saelma, C-439/19, § 88.
104
If the defendant was not required to erase any reference to the disputed data and stop all processing
involving this disputed data, at least he should then have examined the accuracy of the complainant's disciplinary status
(Section II.6). Decision on the merits 77/2023 – 39/49
176. Moreover, as of 2020, the complainant also raised the lack of an adequate policy of duration
of preservation on the part of the defendant was lifted that her sanction had been preserved for
excessive duration. Erasure therefore had to be applied due to processing
unlawful in accordance with Article 17.1.d of the GDPR. The Litigation Chamber cannot
however, to follow the complainant's reasoning. A shelf life of less than
four years for a minor disciplinary sanction does not seem a priori excessive
Litigation Chamber. And only the absence of a retention period policy for
disputed data is not an offense serious enough to warrant erasure
disputed data requested. The Respondent therefore did not violate Article 17.1.d when
his refusal to comply with the complainant's request in 2020.
II.8.2. On the application of the right to erasure as provided for in Article 17 of the GDPR
177. In its complaint filed in 2022, the Litigation Chamber notes that the complainant
invokes Article 17, paragraph 1, a), d) and e) of the GDPR to request the erasure of these
disputed data. The complainant's request seeks to erase the disputed data from the
individualfileofthecomplainant.Basedontheconclusionsofthecomplainantandhercomplaint,
the Litigation Chamber understands that the complainant wishes that the disciplinary sanction
pronounced in 2016 be removed from his disciplinary file and that, consequently, the
processing in connection with his disciplinary status (more particularly the evaluation of
conditions of eligibility for elections to the organs of the defendant and for the status of master of
internship) come to an end.
178. Pursuant to Article 17(1)(d) of the GDPR, a data subject may request
this deletion when the processing of his data is unlawful. This provision is between
otherviolation of the principle of lawfulness of article 5.1.a of the GDPR.
the scope of this provision and specified that unlawful processing may result from other
situations in which the data is “inadequate, irrelevant or excessive to the
with regard to the purposes of the processing, that they are not updated or that they are kept
for a period exceeding that necessary, unless their retention is required for
historical, statistical or scientific purposes. »0. This interpretation is also
confirmed by the European Data Protection Board: “the notion of processing
unlawful must be interpreted in the light of Article 6 of the GDPR relating to the lawfulness of the processing.
Other principles established by the GDPR (such as the principles referred to in Article 5 or in
106
other provisions of Chapter II) may favor this interpretation”.
10 CJEU, judgment of May 13, 2014, Google Spain SL and Google Inc, C-131/12, §92.
10 EDPS, Guidelines 5/2019 on the criteria for the right to be forgotten under the GDPR in the context of search engines
p. 10 §35-36. Decision on the merits 77/2023 – 40/49
179. In view of all the foregoing considerations, the Litigation Chamber finds
that the defendant fails to demonstrate compliance with the principle of purpose limitation and
minimization of data (see sections II.4 and II.5) or compliance with the principle
of accuracy (see section II.6) in the context of the processing carried out with the data
The Litigation Chamber then declared the processing of disputed data
illicit.
180. This unlawful processing involves serious offences, including the violation of several
essential principles of the GDPR and, therefore, the complainant is entitled to request
the erasure of the disputed data from his disciplinary file pursuant to Article 17,
paragraph 1, d) of the GDPR.
181. The retention of the disputed data in the complainant's disciplinary file,
retained for more than five years at the time of the adoption of this decision, is no longer
relevant.
182. The Litigation Chamber notes that the defendant raises two exceptions to the right
deletion of personal data applicable to his situation: the processing is
necessary to comply with a legal obligation (article 17.3.b of the GDPR) and to defend
his legal rights (article 17.3.e of the GDPR).
183. Among the legal obligations invoked, the Respondent mentions the provisions of Royal Decree
#80. As expressed by the Litigation Chamber above, article 15 of RD n°80
indeed mentions the keeping of a register of disciplinary decisions but whose purpose is
well-delimited: “to adapt, if necessary, the code of ethics with a view to supplementing or
specify the provisions on the basis of this case law”. This specific treatment has not
linkwiththemanagementofdisciplinarycasesanddoesnotrequirethemaintenanceofdata
contentious in his disciplinary file.
184. Moreover, the mission put forward by the defendant to keep the roll of the Order cannot be
opposed to the request for erasure: the personal data included in the
table of the Order must reflect the disciplinary status of a pharmacist, which depends on a
updated disciplinary record. In reality, the erasure of the disputed data from the file
disciplinary action should lead de facto to the erasure of the mention of the sanction on the
table of the Order. Regarding the other purposes pursued with the disputed data
(evaluation of the conditions of eligibility for elections and for the status of internship supervisor), the
same reasoning can be applied to them: the cancellation of a disciplinary sanction
should logically lead to the cessation of these treatments.
185. With regard to the other legal obligations put forward by the Respondent, which consist in
communicate personal data relating to all sanctions
disciplinary orders, whether minor or major, to two databases Decision on the merits 77/2023 – 41/49
under the coordinated law of 10 May 2015, as mentioned above, the
disputed data in question are not relevant to achieve these purposes (points 155
at 157). The defendant cannot therefore set up these two legal obligations against the request
erasure of the complainant.
186. With regard to the exception raised to defend its interests in court (Article 17.3.e
of the GDPR), the Litigation Chamber found that the defendant could use the data
disputes before the Council of State.
disputed data by the National Council, the only body empowered to represent the
respondent. It does not require the contentious data to be kept in the file
disciplinary proceedings against the complainant, held by the competent Provincial Council.
187. In conclusion, on the basis of the elements noted above, the Litigation Division
orders the defendant to erase the disputed data from the disciplinary file of the
complainant.
188. The Litigation Chamber recalls that the data controller is required,
in accordance with Article 19 of the GDPR, by a notification obligation with regard to
erasure of personal data. The controller notifies the
each recipient to whom the personal data has been communicated
erasure of personal data carried out in accordance with Article 17.1 of the
GDPR, unless such communication proves impossible or requires efforts
disproportionate. The controller provides the data subject with
information on these recipients if the latter so requests.
II.9. As for the adoption of new internal regulations and violations of
GDPR articles 23, 35 and 36
II.9.1. Position of parties
189. The defendant announced the adoption of the new ROI of the National Council.
put in place mechanisms for erasure and rehabilitation. They aim to erase the sanctions
minor and major disciplinary actions, with respective procedures. According to the defendant,
this new ROI would make it possible to respond to the complainant's grievance.
190. The complainant points out that each organ of the Order has been granted the power to establish
its own ROI to regulate its internal functioning: each of the provincial councils
(art. 5 AR n°80), each of the appeal boards (art. 12 AR n°80) and the National Council (art. 14
AR no. 80). The complainant emphasizes that the ROI of the National Council aims, like all
the ROI of the other bodies of the order, to regulate the internal functioning of the Council
national, and not to create rules of law enforceable against other counsel and
pharmacists. Decision on the merits 77/2023 – 42/49
191. The Complainant is surprised that the Respondent has – to complete the current legal framework –
amended the ROI of the National Council to comply with the provisions of the GDPR, which
would violate Articles 23, 35 and 36 of the GDPR and Articles 6 and 13 ECHR.
192. With regard to the status of the new ROI adopted on September 22, 2022, the complainant
regrets that the defendant does not communicate the entirety of the new ROI but only
excerpts, nor the complete deliberation of September 22, 2022. She adds that no one
can say that this new ROI will actually be in effect one day.
193. With regard to the content of the new ROI, the plaintiff is surprised that the defendant
be set aside from the recommendations (adoption of a formal law) which he nevertheless requested from
the share of ODA in 2020 and completed the current legal framework by modifying the ROI of
National Council to comply with the provisions of the GDPR, which would violate Article 23 of the
GDPR.
194. The Respondent contests the violations alleged by the Complainant arising from the adoption of
this king. Articles 23, 35 and 36 of the GDPR establish obligations on the part of the
authorities of the Member States, and not on the part of the data controllers.
II.9.2. Position of the Chamber
195. The Litigation Chamber finds that each organ of the Order is competent to
adopt its own ROI. Unlike the National Council 107, each Provincial Council 108
and each Appeals Council 109establish their own ROI which they submit to the Council
National which definitively adopts the text.
196. In view of all the foregoing considerations, the Litigation Chamber concludes
that the National Council is not empowered to adopt a ROI applicable to all bodies.
The National Council could not then impose its ROI on the defendant's other bodies,
namely the Provincial Councils and the Appeals Councils. Therefore, the Litigation Chamber
excludes from its examination the new ROI proposed by the defendant and ultimately excludes from the analysis
the alleged violations of Articles 23, 35 and 36 of the GDPR as well as Articles 6 and 13 of
the ECHR alleged by the complainant.
III. Corrective measures and sanction
197. In addition to the corrective measures aimed at bringing the processing into compliance with Articles
5.1.a, 5.1.b, 5.1.c, 5.1.b and 5.1.e of the GDPR and to comply with the request for erasure of data
10AR no. 80, art. 14, §2.
10AR no. 80, art. 5, paragraph 1.
10AR no. 80, art. 12 and 13. Decision on the merits 77/2023 – 43/49
litigation of the plaintiff of her disciplinary file, the Litigation Chamber decides
also to impose an administrative fine of 30,000 Euro, the purpose of which is not to
put an end to an offense committed but also to effectively apply the rules of the
GDPR. As is clear from recital 148, the GDPR provides that
sanctions, including administrative fines, be imposed for any violation
serious - therefore including the first observation of a violation -, in addition to or
instead of the appropriate measures that are imposed. 110The Litigation Chamber demonstrates
hereinafter that the violations of the principles of Article 5 of the GDPR committed by the defendant
are by no means minor violations and that the fine would not constitute a
disproportionate burden on a natural person within the meaning of recital 148 of the GDPR,
two cases in which a fine could be waived. The fact that this is a first
finding of a violation of the GDPR committed by the defendant does not affect the
possibility for the Contentious Chamber to impose an administrative fine. Bedroom
Litigation imposes an administrative fine pursuant to Article 58.2 i) of the GDPR.
The instrument of the administrative fine is in no way intended to put an end to violations.
To this end, the GDPR and the LCA provide for several corrective measures, including the orders cited
in article 100, § 1, 8° and 9° of the LCA.
111
198. Having regard to Article 83 of the GDPR, the case law of the Court of Markets as well as the criteria
112
set out in the EDPB guidelines on the calculation of administrative fines, the
Litigation Chamber justifies the imposition of an administrative fine in a
concrete :
- The faulty behavior of the defendant: The observed infringement relates to the principles
basis for the processing of data provided for in Article 5 of the GDPR. However, these principles
have been in effect since May 25, 2018. The Respondent admitted to conducting a reflection
on an adaptation of its data protection policy, since 2020.
However, a reflection is not enough and should materialize in
measures to bring the processing carried out into compliance with the
disputed data. This reflection has not yet solved the problems
11 Recital 148 provides the following: "In order to reinforce the application of the rules of this Regulation, sanctions
including administrative fines should be imposed for any violation of this Regulation, in addition
orinsteadoftheappropriatemeasuresimposedbythesupervisoryauthoritypursuant totheseregulations.
minor or if the fine may be imposed constitutes a disproportionate burden on a natural person, a
a call to order may be issued rather than a fine. However, due consideration should be given to the nature,
seriousness and duration of the violation, the intentional nature of the violation and the measures taken to mitigate the
damage suffered, the degree of liability or any relevant violation previously committed, the manner in which
the supervisory authority became aware of the violation, compliance with the measures ordered against the person responsible for the
treatment or the processor, the application of a code of conduct, and any other aggravating or
mitigating. The application of sanctions, including administrative fines, should be subject to procedural safeguards
appropriate in accordance with the general principles of Union law and the Charter, including the right to protection
effective jurisdiction and due process. [proper underline]
11 Brussels Court of Appeal (Cour des Marchés section), X c. DPA, Judgment 2020/1471 of February 19, 2020.
112
EDPB, Guidelines 04/2022 on the calculation of administrative fines under the GDPR, version 2.0, p.17-25, available
at https://edpb.europa.eu/system/files/2023-06/edpb_guidelines_042022_calculationofadministrativefines_en.pdf Decision on substance 77/2023 – 44/49
evident by the plaintiff and of which the defendant knew of the existence and its
potential damage for several years. Consequently, the Chamber
Litigation finds the defendant's behavior negligent. This finding allows him
to consider the imposition of an administrative fine. 113
- The seriousness of the breach: the provisions breached are at the heart of the GDPR: the
basicprinciplesforprocessingunderArticle5GDPR.Violationsof
aforementioned items carry the highest fines of section 83.5
GDPR.
In addition, the processing in question concerns the management of sanctions
disciplinary proceedings against pharmacists.
therefore likely to cause harm to the persons concerned. The defendant being
mandated by law to pursue a mission of public interest at the national level, the
processing operations in question are also national in scope and may affect
all pharmacists practicing in Belgium given that the offenses
stem from gaps in the overall privacy policy of the
defendant, and not an isolated case.
- As for the level of damage suffered, the plaintiff advances a non-pecuniary damage in
due to damage to the reputation as well as a possible refusal of approval by the master
internship and non-eligibility with the various organs of the defendant. These
damage can reach all the persons concerned having been
sanctioned by the defendant. The Litigation Chamber does not have the
exact number of pharmacists who have been or are subject to a sanction
disciplinary.15The Chamber therefore finds that a moderate number of persons
concerned may potentially suffer moderate damage due to
the observed violation.
- The duration of the violation: the Litigation Chamber finds that the defendant has a
inadequate data protection policy, in particular with regard to
113
See in particular the opinion of Advocate General N. EMILIOU in case C-683/21, §77-78, for whom the finding of a
Due diligence is a minimum requirement for imposing an administrative fine.
See in particular recital 75 of the GDPR.
11As an example, according to the 2021 Annual Report of the National Council of the Order of Pharmacists, 44 sanctions were
pronounced in 2021, figures up on previous years. The Litigation Division deduces from this that it
there is a moderate number of pharmacists for whom the defendant maintains a disciplinary file. Decision on the merits 77/2023 – 45/49
the application of the principles of legality, minimization of data, limitation of
purposes and limitation of storage, since at least February 5, 2018,
the adoption of the sanction against the complainant. The violation of these principles
for which the Litigation Chamber is competent therefore lasts since May 25
2018.
Regarding the violation of the principle of accuracy, the Litigation Chamber
notes that the Respondent adopted a new Code of Ethics in January 2020,
Code that should be more liberal towards new advertising methods. There
complainant also challenged the merits of her sanction on January 27, 2020 by
sending a formal notice to the defendant. In 2023, the defendant had no
verified the relevance of maintaining the complainant's sanction with regard to the
new provisions of the Code of Ethics. The Litigation Chamber
therefore considers that this part of the infringement began in January 2020.
- On the absence of mitigating circumstances: the Litigation Chamber that the
initiatives mentioned by the defendant are not in order to mitigate the fine
imposed. Indeed, the GDPR was adopted in 2016, and came into force in 2018.
Compliance with the principles of the GDPR should have been achieved from the entry into force
of the GDPR. Moreover, in the light of the findings of this decision, these efforts
were not sufficient to resolve the subject matter of the complaint.
- The necessary deterrent effect in order to prevent new violations: The
defendant considers that its data protection policy is not illegal.
In order to justify possible breaches of the GDPR, the defendant argued that he
was not his responsibility to solve this problem, but the legislator. Such a
position demonstrates a misunderstanding of the importance of legislation in
with regard to the protection of personal data, in particular
basic principles of data processing. The Litigation Chamber considers
therefore, recourse to an administrative fine is necessary.
All of the elements set out above justify an effective, proportionate sanction
and dissuasive, as referred to in Article 83 of the GDPR, taking into account the assessment criteria
that it contains. The Litigation Chamber draws attention to the fact that the other criteria
of Article 83.2 of the GDPR are not, in this case, such as to lead to another fine Decision on the substance 77/2023 – 46/49
administrative than that defined by the Litigation Chamber within the framework of this
decision.
199. In response to the Sanction Form, Respondent submits in summary that the
Litigation Chamber is based on elements contrary to those appearing in the documents
of the file and demonstrates a lack of understanding of the legislative framework, the role and the competences
of the order. The Respondent advances arguments on the merits to illustrate its point.
folder. The Litigation Division considers that the reasoning for this decision
responds to the arguments put forward by the defendant in its reaction.
200. With regard to the criteria taken into consideration for imposing a fine
administrative, the respondent argues that:
i. The Litigation Division indicated that the duration of the offense should be calculated at
from December 22, 2016 but that it was competent only from May 25
2018. However, according to the defendant, the date of December 22, 2016 should not be taken
taken into account, given that the sanction only became effective from the 5
February 2018. Moreover, even if the Litigation Division is only competent to
from May 25, 2018, it does not take into account the measures taken by
Order to address data retention issues.
ii. The Litigation Chamber indicated that the defendant should have taken
initiatives as soon as the GDPR comes into force, and that the solution to the problems of
data protection could not be the sole responsibility of the legislator. According to him, the
defendant assumed its responsibilities, going so far as to adopt countermeasures
legem, in order to bring the processing carried out into compliance with the principles of
GDPR.
iii. The defendant disputes the characterization of his behavior as “negligent”.
Contrary to what the Litigation Chamber wrote in its form, the
the defendant's reflection began as early as 2020 (and not in 2023), as demonstrated
documents in the file. The defendant would be the only order, among the professions
regulated, to have taken concrete measures to remedy this problem.
iv. The defendant argues that the moral damage suffered by the plaintiff is not
sufficiently proven, and is based only on the statements of the complainant.
v. The defendant indicates that he is not responsible for the negative opinions given by the
universities due to the existence of a disciplinary sanction, or the non-
eligibility of candidates to the organs of the Order. According to the defendant, it is the
legislator who has provided for ineligibility without time limit.
vi. The Litigation Chamber is not competent to decide whether a sanction
discipline is warranted or not. Decision on the merits 77/2023 – 47/49
vii. The Litigation Chamber takes no mitigating circumstances in
consideration.
er
viii. The sanction imposed on the complainant was canceled on March 1, 2023,
following the adoption of the new ROI of the National Council.
201. The elements of the sanction form taken into consideration by the Litigation Division
are discussed below.
202. The Litigation Division took into consideration the Respondent's remarks regarding the
effective date of the disciplinary sanction, and therefore of the start date of the processing
carried out with the disputed data: the sanction became effective on February 5, 2018. This
change of date, however, has no influence on the relevant duration of the infringement of the
GDPR, which started on May 25, 2018.
203. As to the arguments put forward in point 200, i. and ii., the measurements shown were not
still adopted when the debates were closed. No tangible proof of adoption
of such measures was brought before the Litigation Chamber.
even reflections began in 2020, the GDPR requires compliance of all processing,
etc from May 25, 2018. A reflection that did not resolve the subject of the complaint before the closure
of the debates cannot exonerate a data controller of his breaches of the GDPR.
204. As for the moral damage suffered, recital 75 of the GDPR indicates that the supervisory authorities
must take into account not only the damage suffered, but also the risks
damages. The data processed by the defendant relating to disciplinary sanctions,
an absence of retention limits for such data is highly likely to
stigmatize the persons concerned whose disciplinary, minor or
major, kept in a disciplinary file and processed without time limit.
205. The respondent is the controller of the processing mentioned in this decision. He
It is therefore up to the defendant to apply the principles of the GDPR to such processing.
The argument in point 200, v., is irrelevant.
206. If the Litigation Chamber is not competent to rule on the legality or
advisability of adopting a disciplinary sanction, it is however appropriate for
issues relating to the processing of data contained in these sanctions.
207. As for the assessment of mitigating circumstances, the steps taken by the
defendant did not prove to be effective in the eyes of the Litigation Chamber. However, the
EDPS guidelines indicate that the measures undertaken by a respondent must
be examined with regard to their effectiveness and their time frame for adoption.
find that the measures put forward by the defendant had not yet been adopted
11EDPB, Guidelines 04/2022 on the calculation of administrative fines under the GDPR, version 2.0, p. 27, § 76. Decision on the merits 77/2023 – 48/49
at the close of the debate. Moreover, the defendant's reflection spanned from 2020 to
2023. The Litigation Chamber does not claim only a compliance of processing
made by the defendant is an easy task and does not dispute the difficulties
by the health crisis. But the GDPR having entered into force as of May 25, 2018, this
The process should therefore have started much earlier.
208. As to the cancellation of the disciplinary sanction on March 1, 2023, the Respondent does not
no concrete evidence. Moreover, if this deletion took place, it was carried out after the
closure of the debates.
209. On the basis of all the elements set out above, the Litigation Chamber decides
to adjust the proposed penalty from 50,000 euros to 30,000 euros. The shortcomings
identified justify an effective, proportionate and dissuasive sanction referred to in Article 83
AVG, taking into account the evaluation criteria set out therein. The Litigation Chamber
considers that a lower fine would not meet the criteria required by Article 83,
paragraph 1 of the AVG, according to which the administrative fine must not only be
proportionate, but also effective and dissuasive.
IV. Publication of the decision
210. Given the importance of transparency regarding the decision-making process of the Chamber
Litigation, this decision is published on the website of the Protection Authority
data. However, it is not necessary for this purpose that the identification data of
the complainant are communicated directly.
211. In this case, the Litigation Chamber decides to publish this decision with
identification of the defendant's data.
212. The Litigation Chamber specifies that this publication with identification pursues
several goals.
213. It pursues, as far as the defendant is concerned, an objective of general interest. The identification of
the defendant is moreover necessary for the proper understanding of the decision and therefore,
the materialization of the objective of transparency pursued by the policy of publication of
decisions of the Litigation Chamber. Decision on the merits 77/2023 – 49/49
FOR THESE REASONS,
the Litigation Chamber of the Data Protection Authority decides, after deliberation:
- Pursuant to Article 100, §1, 13° and 101 of the LCA, to impose an administrative fine
€30,000 to the defendant for violations of articles 5.1.a, 5.1.b, 5.1.c, 5.1.d,
5.1.e GDPR.
er
- Pursuant to Article 100, §1, 6° of the LCA, to comply with the request of the
complainant, i.e. to erase the data relating to his disciplinary sanction from his
disciplinary record.
- Pursuant to Article 100, §1, 9° of the LCA, to order compliance of the
treatment, more particularly with articles 5.1.a, 5.1.b, 5.1.c, 5.1.d and 5.1.e of the
GDPR.
In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged,
within thirty days of its notification, to the Court of Markets (court
d'appel de Bruxelles), with the Data Protection Authority as defendant.
Such an appeal may be introduced by means of an interlocutory request which must contain the
information listed in article 1034ter of the Judicial Code. The interlocutory motion must be
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 118
via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).
(se). Hielke H IJMANS
President of the Litigation Chamber
117
The request contains on pain of nullity:
(1) indication of the day, month and year;
2° the surname, first name, residence of the applicant, as well as, where appropriate, his qualifications and his national register number or number
business;
3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
(4) the object and summary of the grounds of the application;
(5) the indication of the judge who is seized of the application;
6° 118 signature of the applicant or his lawyer.
The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.
