| APD/GBA - 53/2020 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 6(1) GDPR Article 25(1) GDPR Article 25(2) GDPR Article 32 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 01.09.2020 |
| Published: | 01.09.2020 |
| Fine: | 5000 EUR |
| Parties: | n/a |
| National Case Number/Name: | 53/2020 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | French |
| Original Source: | APD (in FR) |
| Initial Contributor: | n/a |
The Belgian DPA (APB/GBA) imposed a fine of € 5000 to a politician for sending unsolicited political email to the plaintiff, violating among others the purpose limitation principle.
English Summary
Facts
A mayor of a Belgian village sent unsolicited political emails using email addresses collected during his time as mayor. In this specific case it concerned emails a citizen sent to the mayor's office to complain in 2014. The mayor used these emails for his most recent election campaign.
Dispute
Can a politician reuse the emails collected during his time as mayor to send political campaign emails ?
Holding
The litigation chamber decided that the politician violated the purpose limitation principle and imposed a fine of € 5000.
Comment
This decision has been appealed to the Brussels Court which cancelled the DPA decision in 27 January 2021 for lack of proportionality of the fine with regard to the goodwill of the appealant.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/13 Litigation Chamber Decision on the merits 53/2020 September 1, 2020 File No.: DOS-2019-02974 Subject: Complaint due to the sending of an email of electoral propaganda The Litigation Chamber of the Data Protection Authority, consisting of Mr. Hielke Hijmans, Chairman, and Messrs Frank de Smet and Christophe Boeraeve, members ; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the free movement of data protection), hereinafter referred to as RGPD ; Having regard to the law of 3 December 2017 creating the Data Protection Authority, hereinafter LCA ; Having regard to the internal rules of procedure as approved by the House of Representatives on December 20, 2018 and published in the Moniteur belge on January 15, 2019 ; Having regard to the documents in the file ; has taken the following decision concerning : - the plaintiff ; - the defendant: a politician. 1. Facts and procedure Decision on the merits 53/2020 - 2/13 1. On May 25, 2019, the complainant filed a request for information with the protection of data concerning the defendant's use of his e-mail address received on May 22, 2019, sent on his behalf by his personal email for the sending of an electoral message received on secretary. The complainant points out that he never gave his consent to the use of his address. for this purpose by the defendant. The plaintiff also complains that this message was sent to many recipients placed copies, which favoured the unsolicited distribution of his address to these third parties. 2. The letter was worded as follows: "Ladies, Gentlemen, Dear friends, I I am proud to be the [Xth] candidate of the [Y] list for our district [list of communes]. concerned .] May I be allowed to ask for your vote. A good result will allow me with our team at the College and Provincial Council to be even more effective. I wish to put everything to also support our local agents and their projects. ». 3. By letter dated July 2, 2019, the Data Protection Authority's Front-Line Service invited the plaintiff to exercise his rights with the defendant, in this case, his right of opposition to the processing of his personal data. At the same time, by letter dated July 2, 2019, the the defendant to ask him, among other things, how he had obtained the information he needed. the complainant's e-mail address, if he or she had filed a data leakage notification with ODA and what steps have been taken to ensure that this type of incident does not happen again. 4. 4. From the responses that the respondent provided to the complainant and to the front-line service, he or she will indicates that the complainant's email address was collected in connection with a request for information addressed in March 2014 by the complainant to the secretariat of the mayor of the city of X. to report a problem of public cleanliness. More specifically, it was an e-mail addressed to "secretariat.bourgmestre@X.be " concerning a clandestine landfill site near the former city walls for which the complainant requested the cleanup. On July 4, in his letter Addressed to the Front Line Service, co-signed by the defendant's secretary writes the following explanation concerning the collection of the disputed e-mail address: "The addresses come from a "permanences" file organized by the defendant when he was mayor of the city. The complainant is therefore included in the report for having, at one time or another, had contact with the city. the defendant. "The Litigation Chamber cannot therefore follow the defendant in his explanations. (July 2020) according to which the disputed e-mail address (and others) were collected via e-mails addressed to him personally and not via an administrative or other service of the company. the municipal administration.1 The Dispute Chamber understands that the data collected 1 The defendant sets out the facts as follows: "In addition to the answers I give in the form you will find duly completed in the appendix, allow me to contradict a few elements contained in your letter: page 3- point 1 - Decision on the merits 53/2020 - 3/13 by the mayor are not only the result of contacts of citizens with the city administration but also, according to the defendant's statements, of emails addressed to him personally, which were which was not the case with regard to the complainant's e-mail which was indeed collected via the secretariat of the mayor. 5. With regard to the modus operandi for sending the disputed email, the defendant responded to the questions from the Data Protection Authority by co-signing the following explanation provided by the municipal employee who was his secretary when he was mayor: "In fact, from my private messaging service, I sent an election advertisement for the defendant, in order to to avoid using his professional messaging in his capacity as an MPP. [...] And this e-mail has was sent spontaneously, omitting to put in CCI the recipients. There is therefore no intention to misuse these addresses or harm anyone else. It is just a mistake of manipulation that we regret. We have apologized to the complainant as you have could read it".2 6. As a result of these responses, the complainant confirmed to ODA's Front-Line Service that he was willing to that his request for information be forwarded as a complaint to the ODA Litigation Chamber, by letters dated July 11 and 26, 2019. On August 6, 2019, the Front Line Service of the Authority of The data protection authority declared the complaint admissible and forwarded it to the Litigation Chamber. 7. On August 25, 2019, the Litigation Chamber considered the file ready for processing. as to the substance pursuant to articles 95 § 1, 1° and 98 LCA. On the same date, the Dispute Chamber forwarded the complaint and exhibits to the defendant by registered letter and invited the parties to argue their case according to a set timetable. The letter stated that "each of the parties is to transmit its conclusions simultaneously to the secretariat of the Litigation Chamber and to the other party". 8. By letter dated October 14, 2019, received October 18, 2019, the defendant states that it is is at the disposal of the Litigation Chamber to be heard if the Chamber so wishes. The in his brief letter, the defendant explains that he confirms "that the sending of the file to all of the people was a simple handling error at the time of sending the document that was [sic] individualized". 2nd paragraph - it is affirmed: "the defendant used in order to send electoral mail a list of citizens who have been in contact with the commune for various questions". Answer: this statement is not correct. I had of a file of persons who have contacted me personally and not an administrative or other service of the municipal administration" (letter of the defendant of July 6, 2020 addressed to the Litigation Chamber by e-mail of July 7, 2020). 2020). 2 Letter from Respondent to ODA Frontline Service, July 4, 2019. Decision on the merits 53/2020 - 4/13 9. The respondent also states that it "sought the advice of an expert in the new legislation "to help him coach his team" in order to avoid any future mistakes by the like". The defendant states that the question of what precautions should be taken with e-mail addresses that people have not spontaneously transmitted, is still under analysis. The the defendant concluded that he thought he was entitled to contact the persons who had given him their address, and that he is now aware that this is "obviously not so obvious". 10. In an email dated November 7, 2019, the plaintiff introduced his arguments such as the calendar of conclusion invited him to do so. On that occasion, the complainant reported that he had not received the findings of the the elements of his complaint, and asks to retain as an aggravating circumstance the following that the denounced violations were committed by a politician in the exercise of his mandate. 11. The Litigation Chamber resumed the case by written procedure on July 3, 2020 and adopted the following decision a draft decision. On the same day, the Litigation Chamber communicated by e-mail to the defendant the amount of the fine envisaged against it, as well as a list of the breaches observed at the RGPD and justifying this amount. In particular, the Chamber found that the Respondent did not submit its findings to the complainant. The defendant was invited, by the same e-mail, to put forward its pleas in law. defence to the amount of the proposed fine. In this communication, the Chamber The litigator stressed that the debates on the merits were closed. The Litigation Chamber received the defendant's reply by email on July 7, 2020 (completed fine form and letter). dated July 6, 2020). 2. Violations of the GDMP 12. The defendant in his capacity as burgomaster at the time of the collection of the e-mail address concerned, is the person responsible for processing the personal data file that he or she has constituted from the data of citizens addressing his secretariat and/or himself personally for various requests. It is his responsibility to ensure that the data have been processed on an appropriate legal basis and in compliance with the law. strictly the principles set out in the RGPD. It is also responsible for appropriate technical and organizational measures to ensure, in particular, that the data does not will not be further processed for a purpose that is incompatible with the purpose for which they were were initially collected and processed (Articles 5.1(f), 6.4 and 32 of the GDMP). From the documents provided, it appears that by the defendant himself that he was a mayor at the time the disputed e-mail address was collected (email to "secretariat.bourgmestre@....be"). The Dispute Chamber takes note Decision on the merits 53/2020 - 5/13 the fact that the defendant was no longer mayor at the time the disputed email was sent3. For the part of the data collected from emails sent to the secretariat of the mayor, the Chamber the defendant has therefore personally processed data collected as a result of the litigation. that mayor, at the very least, the email of the complainant. 13. On the basis of these elements of the file, the Litigation Chamber considers that it is established that the defendant used to send out election mailings a list of citizens who were in contact with the commune of which the defendant was then mayor, for various questions related to to its function as a public representative, and that the personal data collected in this context would have had to be processed with the strict purpose of answering questions asked by citizens. 14. In his capacity as data controller, the defendant is obliged to comply with the principles of the law. protection of data and must be able to demonstrate compliance (principle of data protection). of liability - section 5.2. of the GDMP). It must also implement all measures to ensure that necessary for this purpose (Article 24 of the GDMP). 15. The purpose principle is an angular principle of data protection. Dedicated from 1981 to Article 5 b) of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data. of the Council of Europe (ETS 108), it is set out at Article 6.1.b) of Directive 95/46/EC of the European Parliament and of the Council of October 24, 1995 relating to the protection of individuals with regard to the processing of personal data and the free circulation of this data as well as in article 4 § 1, 2° of the Law of December 8, 2009. 1992 relating to the protection of privacy with regard to the processing of personal data personal. When the right to data protection is enshrined as a fundamental right by Article 8 of the Charter of Fundamental Rights of the European Union in 2000, the principle of purpose has been stated as a key element of this right4. This principle has, logically, been taken up again at Article 5.1(b) of the GDPR under the Principles for the Processing of Personal Data (Chapter II). 16. Article 5.1(b) of the GDMP provides that : « 1. Personal data must be : (...) (b) collected for the following purposes and legitimate, and not to be further processed in a particular, explicit and legitimate manner, and not to be incompatible with these purposes; further processing for archival purposes in the interest of public, for the purposes of scientific or historical research or for statistical purposes is not 3 Letter of the Respondent to the Litigation Chamber of July 6, 2020. 4 Article 8 of the Charter of Fundamental Rights of the European Union: 1 Everyone has the right to data protection. of a personal nature concerning it. Decision on the merits 53/2020 - 6/13 considered in accordance with Article 89(1) as incompatible with the purposes of initials" (limitation of purposes). » 17. 17. Personal data may not be further processed in a way that is contrary to the law. incompatible with their collection purpose (section 5.1.b. of the GDGR)5. Further processing of data personal data for purposes other than the one(s) for which they were collected. initially collected is permitted only if such further processing is compatible with the purposes for which it was collected. for which the personal data were initially collected, taking into account the link between the purposes for which they were collected and the purposes of further processing considered, also taking into account the framework in which the personal data were considered, and the collected, the possible consequences of the envisaged further processing for the data subject and the existence of appropriate guarantees. 18. A compatible purpose is, for example, a purpose that the data subject can foresee or that can be considered compatible by virtue of a legal provision (see Article 6.4. of the RGPD). Based on the criteria in section 6.4 of the EDR: there is no link between the two. purposes of processing, and the contexts of data collection are totally foreign, one of the most important concerning the management of the commune in the treatment of the answers to the questions of the citizens, the other that of the relations between an elector and a candidate for an elective mandate. This incompatibility is further evidenced by the fact that the applicable law allows candidates in elections to have access to to a voters' list specially dedicated to the realization of their campaign. 19. Any subsequent incompatible use is prohibited with two exceptions provided for in Article 6.4. of the RGPD. Where the data subject has given his consent to further processing in order to a distinct purpose or where the processing operation is based on a legal provision which constitutes an necessary and proportionate measure in a democratic society, in particular to ensure the guarantee of important purposes in the public interest, the data controller has the possibility of processing subsequently these personal data for other purposes, whether or not they are compatible with the purpose for which they were collected. or not with the initial purposes. In this case, the defendant may not base his subsequent treatment of data neither on the consent of the persons concerned nor on a legal basis under Belgian law or European Union as a necessary and proportionate measure in a democratic society for ensure the objectives set out in section 23.1 of the MDR (section 6.4 of the MDR). 5 Article 5(1)(b) of the GDPMR states that "personal data must be : (...) b) collected for the purpose of legitimate, explicit and specified purposes, and not to be further processed in a manner inconsistent with those purposes. purposes". See the explanations on this principle of finality in the decision of the Litigation Chamber 11/2019 of November 25. 2019. Decision on the merits 53/2020 - 7/13 20. The purpose of advertising/electoral propaganda is not a further purpose of processing data compatible with the original purpose of collecting data from citizens in the context of evoked. In its note "Elections" published in the early 2000s on its website and put in Updated following the implementation of the DPGR6 the Data Protection Authority mentions that : "However, political parties and their candidates in an election may be tempted to have use of personal data collected in the context of other processing operations whose primary purpose had nothing to do with electoral propaganda. This is true as well for data retrieved from public sector files (such as the National Registry, the data from public service personnel files, a list of people assisted by a CPAS, data obtained in the exercise of an alderman's mandate, ...) that for data from private sector files (company customer files, list of members of an association, ...)". 21. The note goes on to state: "From this point of view, it is therefore not permitted to reuse the personal data recorded in the above-mentioned files for propaganda purposes election. Such processing is incompatible with the purposes for which the data were collected. initially harvested, which is punishable under section 83.5 of the GDMP". 22. With respect to the prohibition on the re-use of election propaganda data for electioneering purposes, the obtained in the exercise of an alderman's or burgomaster's mandate, the Chamber shall also refers to the explanations provided on this subject in its decision on the merits of the case. 11/2019 of November 25, 20197. The Litigation Chamber also emphasizes that the reuse by a burgomaster of personal data collected in the course of his duties for the purposes of incompatible, is such as to undermine the foundations of democracy and equality between the candidates. 23. Under these conditions and on the basis of all the preceding elements, the Chamber of Deputies shall Litigation considers that the defendant, according to its own statements, processed data to personal character of the citizens of his commune, and in particular those of the complainant, in violation of section 5.1.b of the MDR (purpose limitation) of the MDR and section 6 of the MDR (lawfulness of the treatment). The Litigation Chamber also finds a violation of articles 25.1 and 25.2 of the 6 Processing of personal data for the purposes of personalized election propaganda and respect for life privacy of citizens: fundamental principles, https://www.autoriteprotectiondonnees.be/publications/note-juridique-sur-leselections.pdf. 7 See https://www.autoriteprotectiondonnees.be/citoyen/chercher?q=&search_category%5B%5D=taxonomy%3Apublications&sear ch_type%5B%5D=decision&search_subtype%5B%5D=taxonomy%3Adispute_chamber_substance_decisions&s=recent&l=25 (DEDF11-2019), pp. 5-6. Decision on the merits 53/2020 - 8/13 RGPD, under which it is the responsibility of the data controller to implement the measures appropriate technical and organizational measures to ensure that, by default, only the data to be used for the personal data which are necessary for each specific purpose of the processing are treated. 24. With regard to the sending of an email where all recipients are visible, the Chamber the defendant does not contest the facts and declares that the person acting as defendant does not contest the facts. under its authority made an error in the processing of the personal data of the The complainant "by failing to put in TCC the addressees "8 . Whether or not there was an error in the manipulation, the Contentious Chamber considers that there has been a violation of articles 32.1 and 32.4 of the RGPD9 and that these facts constitute a breach of security within the meaning of section 4.12 of the GDPR, such that denounced by the complainant in his complaint. The Litigation Chamber recalls that it is also responsible for the data controller to implement technical and organizational measures appropriate to ensure that, by default, only the data necessary for the purposes of each specific purpose, including from the point of view of their accessibility (s. 25.2 of the GDGR). The Chambre contentieuse also recalls that it is the responsibility of the controller to notify such data breaches to the competent authority when the conditions for the application of Article 33 of the RGPD are gathered together. In this case, no such notification has been introduced, which constitutes also an infringement of the GDMP. 25. In summary, in light of the inspection report and taking into account the Respondent's findings, the Litigation Chamber establishes the following violations of the GDR : - Violation of articles 5.1.a, 5.1.b) and 6.1 of the RGPD, given that by sending the disputed email, the defendant processed the plaintiff's personal data without a legal basis and in violation of the purpose for which these data were collected by the Secretariat of the mayor (answer his questions). - Violation of sections 25.1 and 25.2 of the MPR, which require the person responsible to processing to implement the appropriate technical and organizational measures to guarantee that, by default, only the personal data that are necessary to the with regard to each specific purpose of the treatment are processed. - Violation of articles 32.1 and 32.4 of the RGPD, since a person acting under the defendant's authority has sent the plaintiff's email contact information to third parties, in the context of of an e-mail where all the recipients were visible. Violation of article 33 of the RGPD being given that this data leak was not notified to the DPA. 8 Letter from Respondent to ODA Frontline Service, July 4, 2019. 9 In the same sense, see the decision of the Litigation Chamber ANO 2/2019 of April 2, 2019, see https://www.autoriteprotectiondonnees.be/citoyen/chercher?q=&search_category%5B%5D=taxonomy%3Apublications&sear ch_type%5B%5D=decision&search_subtype%5B%5D=taxonomy%3Adispute_chamber_substance_decisions&s=recent&l=2. Decision on the merits 53/2020 - 9/13 3. Corrective action 26. The Litigation Chamber has already had the opportunity to rule on cases of unlawful treatment of data for electoral purposes in the following cases : Decision 11-2019 of November 25, 2019; Decision 10-2019 of November 25, 2019; Decision 04/2019 of May 28, 2019 and Decision 30/2020 of November 8, 2019; Decision 10-2019 of November 25, 2019; Decision 04/2019 of May 28, 2019 and Decision 30/2020 of May 8, 2019. June 202010. 27. In these four cases, the Litigation Chamber imposed administrative fines, in particular for non-compliance with the principle of finality, enshrined in article 5.1.b of the GDMP. These were in these cases, the unlawful further processing for electoral purposes of data of a personal nature for the personal data collected (at least with regard to the e-mail address at issue on 22 May 2019) within the framework of the exercise of communal competences. The present case is part of this jurisprudence. 28. The Litigation Chamber considers that the breaches it has identified (infra, § 22) justify the imposition of administrative fines in accordance with articles 100, 13° and 101 of the ACL as well as 83 of the DPGR, and this taking into account the following. 29. First, the nature and seriousness of the breaches are taken into account (section 83, 1, (a) of the DPGR). Indeed, breaches of Articles 5.1.b (inconsistent subsequent treatment),5.1.a (lawfulness) and 6.1 of the GDPMR (unlawful processing) identified in this Decision constitute breaches of the fundamental principles of data protection. These include violations for which the maximum fine amounts are the highest (Section 83.5 of the RGPD). 30. Second, the Litigation Chamber considers that the quality of the defendant, at the time of the data collection, namely that of the mayor, and subsequently the quality of the time the litigious e-mail was sent11 , constitutes an aggravating circumstance at the time of the sending of the litigious e-mail. under section 83.2.k. In view of this role played by the defendant in public life, he could legitimately be expected to take the greatest care not to reuse data for personal use. collected through the secretariat of the city of which he had been mayor, and conduct an election campaign. 10 Available on the ODA website under the publications tab "Decisions of the Litigation Chamber", https://www.autoriteprotectiondonnees.be/citoyen/publications/decisions. 11 The Litigation Chamber notes the clarification made by the defendant in his letter of 6 July 2020 to the Chamber that he was no longer mayor at the time the disputed email was sent. The contentious Chamber notes information available to him, the defendant was at the time a member of the provincial legislature, a position he held until he was elected to the House of Commons. is still occupied in July 2019. The Litigation Chamber relies on public information available on the province represented by the defendant where the defendant's CV is described. In July 2019 and July 2020, the defendant signed its Letters to the Litigation Chamber as a Member of the Legislative Assembly of the province he or she represents. Decision on the merits 53/2020 - 10/13 in compliance with all applicable rules and, in this case, with the rules for the protection of data. 31. Finally, the Litigation Chamber takes note of the fact that the defendant exposes his good willingness to implement the DPGR, in that it states that it "sought the advice of an expert in the new legislation "to help him coach his team" in order to avoid any new mistakes in the future. of the kind" (see § 9 above). The Litigation Chamber cannot take into account the entry into force of the of the DPGR as a mitigating circumstance, as the observed violations of the purpose and principles of the lawfulness are not new elements in data protection legislation. personal. In its note on "Elections" published in the early 2000s on the website of the DPA and updated following the entry into force of the DPR12, the Data Protection Authority already mentioned the ban on reusing data extracted from the public sector (such as the National Registry, data from the list of people assisted by a CPAS, data obtained from the public health care system, a list of the exercise of an alderman's mandate, ...) or data from private sector files (client file of a company, list of members of an association, ...)". 32. These principles already formed the cornerstone of the Parliament Directive 95/46/EC European Parliament and Council of October 24, 1995 (art. 6.1.b and art. 6.1.a and 7), which the RGPD replaced. It The same applies to the obligation to implement organizational and security measures. under the old Directive (art. 17), which has been strengthened and clarified in the GDMP in article 32 in particular. 33. The Litigation Chamber further notes that according to the facts transmitted to it, the failed to communicate its findings to the plaintiff, or at least to reserve the right to make the proof that such a communication has been made (recommended or proof of sending an email). The mail the Litigation Chamber on September 25, 2019 indicated in a registered letter addressed to the defendant by the Each of the parties is required to submit its conclusions simultaneously. to the secretariat of the Litigation Chamber and to the other party". However, the plaintiff pointed out that he had not not received the conclusions of the defendant, who is therefore in default of at least providing proof of its full cooperation in this procedure. However, the defendant did receive the letter of September 25, 2019 inviting it to conclude by October 25, 2019 at the latest, and to forward its conclusions simultaneously to the other party. The defendant has acknowledged receipt of this letter. by letter dated October 14, 201913. The Litigation Chamber cannot therefore follow the defendant in 12 Processing of personal data for the purposes of personalized election propaganda and respect for life Citizen privacy: fundamental principles, https://www.autoriteprotectiondonnees.be/publications/note-juridique-sur-leselections.pdf. 13 The Litigation Chamber did send this registered letter dated 30-09 to the defendant's business address. Decision on the merits 53/2020 - 11/13 the statement that "I have never been asked or even advised to send in any conclusions to the complainant. The registered letter of the Litigation Chamber also offered the following the possibility for the defendant to ask for a copy of the file of exhibits, in which he could have reread his own statements to ensure the consistency of his own defence, which he did not do. 34. 34. The defendant did not follow the procedure communicated to him by registered mail. and by email. His response that he had not been informed of the obligation to send conclusions to the complainant is contrary to the facts. The Litigation Chamber is of the opinion that by this omission and erroneous denials of facts, the defendant did not provide full cooperation in the procedure, which constitutes an aggravating circumstance. 35. In his reply to the form of reaction to a proposed fine, the defendant shall argues mainly that the sending of this mail is the result of an error of its view of handling. In this respect, the Litigation Chamber recalls that such a mistake of manipulation, the if applicable, constitutes a security breach and as such a data breach within the meaning of Article 4.12 of the DP Regs that result in the defendant's liability for implementation adequate safety measures to avoid such errors (see § 20 above). The The Litigation Chamber notes, however, that there is no evidence in the file that the infringement would have been committed deliberately, on the instructions of the defendant. The Litigation Chamber therefore holds that the non-deliberate nature of the infringement as a mitigating circumstance. 36. The defendant's arguments do not change the fact that the personal data of the complainant and of all persons included in the "permanence" file were unlawfully processed, namely all persons calling on the mayor's secretariat (see above, §. 5). 37. Lastly, as regards the amount of the fine, the Litigation Chamber adopts the same criteria as for the those set out above to withhold the amount of EUR 5,000 in order to deter the defendant from repeating such failures. 38. With regard to the amount, the defendant points out that the amount of the fine seems to him disproportionate in view of the fact that, in his opinion, it is a handling error which would not have been brought no benefit. In this respect, the Litigation Chamber has no information at its disposal that could to reasonably assess the extent to which the processing of the data in the file Whether or not "permanence" positively influenced the outcome of the elections. The House 14 Letter of the Respondent to the Litigation Chamber of July 6, 2020. Decision on the merits 53/2020 - 12/13 cannot, therefore, accept this element put forward by the defendant as a circumstance that is not in dispute. mitigating factor within the meaning of section 83.2.k of the DP Regs. 39. Concerning the financial means, the defendant reports financial difficulties following a litigation in which he won and which caused him to incur significant legal costs again. undischarged. The Respondent points out that the amount claimed today by the Litigation Chamber would only add to these difficulties. The defendant does not, however, bring any element of a nature to statements, and does not propose to be at the disposal of the Litigation Chamber to this topic. The plaintiff bears the burden of proof for the elements he or she puts forward in response to the fine form. At this stage of the procedure, the Dispute Chamber decides not to reopen the case. debates on this point. 40. The contentious Chamber retains the quality of the defendant at the time of the facts (mayor, mayor of the town). then MLA), as an aggravating circumstance in the present case (see supra, § 5 and 30). Indeed, it is incumbent on every public agent to adopt exemplary conduct, including in relation to concerns the respect of the legislation regarding the protection of personal data. 41. For these reasons, the Litigation Chamber considers that it is appropriate to maintain the amount of the envisaged fine of EUR 5,000. 42. In view of the importance of transparency with regard to the decision making process and the decisions of the Litigation Chamber, this decision will be published on the Authority's website data protection by deletion of directly identifying data of the parties and the persons mentioned, whether they are individuals or legal entities. BY THESE REASONS, THE LITIGATION CHAMBER, Decides, after deliberation, to impose on the controller a fine of EUR 5,000 on the based on articles 100, 13° and 101 of the LCA and 83 of the RGPD, for all breaches of the law. (b) for failure to comply with section 5.1(b) of the MDR, and for failure to comply with section 5.1(a) of the MDR. and 5.1(b), 6.1, 25.1 and 25.2, 32.1 and 32.4 of the MDR read together. Decision on the merits 53/2020 - 13/13 This decision may be appealed against within thirty days from the date of the decision. notification, to the Market Court15 (article 108, § 1 of the LCA), with the Autorité de protection des given as a defendant. (Sé.) Hielke Hijmans President of the Litigation Chamber 15 The Court of Appeal of Brussels.
