APD/GBA (Belgium) - 130/2021
| APD/GBA (Belgium) - 130/2021 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 5(1)(b) GDPR Article 6(1)(a) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 29.11.2021 |
| Published: | 29.12.2021 |
| Fine: | None |
| Parties: | n/a |
| National Case Number/Name: | 130/2021 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Dutch |
| Original Source: | autoriteprotectiondonnees (in NL) |
| Initial Contributor: | Jonathan Crabbe |
The Belgian DPA decided not to adopt a decision on the merits against a public authority because, despite the existence of a GDPR infringement, the authority had made a timely notification and taken the necessary measures to avoid future infringements.
English Summary
Facts
On 19 August 2021, a data subject (the Complainant) reported illegal dumping to the competent municipal services. The complaint resulted in an official report identifying four suspects. This official report, including its non-anonymised annexes, was then submitted to the competent authority (the Authority) in the framework of a municipal administrative sanction procedure (Gemeentelijke Administratieve Sanctie or 'GAS' procedure). The fine, including its non-anonymised attachments, was then passed on from the Authority to the four suspects. As a result, the four suspects were informed about the identity of the Complainant.
On 16 September 2021, the Complainant was approached by one of the four suspects; the latter confronted her about her initial complaint on the illegal dumping. The Complainant then realised that her identity had been revealed by the Authority to the four suspects as part of the GAS procedure.
On 20 September 2021, the Complainant therefore filed a complaint with the Belgian DPA against the Authority, on the ground that the latter had unlawfully transferred her personal data to the four suspects without her consent within the framework of the GAS procedure.
Holding
The Belgian DPA found that the Authority had obtained personal data for a specific purpose, namely to investigate and impose a fine for illegal dumping. The controller cannot pass on the data obtained from the data subject to others without obtaining the prior consent of the data subject.
The Dispute Resolution Chamber finds that there has been a breach of the principle of purpose limitation (Art. 5(1)(b) GDPR) as the controller transferred the personal data to the 4 defendants. This was not in accordance with the intended purpose for which the data were provided by the data subject, namely to take appropriate action against illegal dumping. It is an established fact that the recipients of the fine did not belong to the group of possible recipients in order to realise this purpose.
Furthermore, the Court finds that the transfer was made without prior consent, so that there is no legitimate basis for the transfer and, consequently, Article 6(1)(a) GDPR has not been complied with.
The Controller explicitly acknowledges having committed a serious error, stating that it is extremely important to handle confidential data with care. The Controller also timely reported this incident to the Authority, presenting concrete measures to avoid such incidents in the future.
For these reasons, the Dispute Resolution Chamber has decided not to hear the substance of the case.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/5
Dispute room
Decision 130/2021 of 29 November 2021
File number : DOS-2021-06086
Subject : Complaint regarding the transfer of personal data in the context of a GAS
procedure
The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke Hijmans,
single chairperson;
Having regard to Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 on
the protection of natural persons with regard to the processing of personal data and
on the free movement of such data and repealing Directive 95/46/EC (General
Data Protection Regulation), hereinafter GDPR;
Having regard to the law of 3 December 2017 establishing the Data Protection Authority, hereinafter WOG;
Having regard to the internal rules of procedure, as approved by the Chamber of Representatives
on December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;
Having regard to the documents in the file;
has taken the following decision regarding:
The complainant: Mrs. X “the complainant”;
Defendant Y, hereinafter referred to as “the controller”. Decision 130/2021 - 2/5
I. Facts procedure
1. On 20 September 2021, the complainant lodged a complaint with the Data Protection Authority
against the controller.
The subject of the complaint concerns the transfer of personal data in the context of a GAS
procedure. On 19 August 2021, the complainant reported the illegal dumping to the competent authorities
municipal services. Based on this report from the complainant, an inspector or agent of
the competent police zone draws up an official report. This official report, including the non-
anonymised attachments, including the aforementioned notification, were then transferred to
the controller with a view to drawing up the GAS fine. Afterwards made
the controller the GAS fine by letter, also with appendices, including the
non-anonymized report from the complainant in turn to each of the four suspects.
The complainant indicates that he was approached by one of the 4 suspects on September 16, 2021
who confronted her with the report of the illegal dumping. in addition
does the complainant state that the personal data of the 3 other persons is also included in the GAS fine?
suspects are displayed.
2. On 1 October 2021, the complaint will be declared admissible by the Frontline Service on the basis of the
Articles 58 and 60 WOG and the complaint on the basis of art. 62, §1 WOG transferred to the
Dispute room.
II. Competence of the Data Protection Authority
3. The Disputes Chamber states that the complaint relates to the processing of personal data
1
of both the complainant and the other data subjects within the meaning of Article 4, 2° of the GDPR to which the
GDPR applies.
4. The GAS service of the controller acts in accordance with the Act on
2
the municipal administrative sanction as sanctioning GAS official in the present
matter. As a controller, they draw up GAS sanctions based on the processes
verbally as drawn up by the inspectors or agents of the competent police zone. In
within this framework they also send a copy of the official report and all appendices to the
suspects.
5. For this aspect, acting as a sanctioning GAS official and all associated
processing, the Y acts as a controller and not as a processor of the
1Article 4,2)GDPR:““processing”:anoperation or a set of operations relating to personal data or a set of
of personal data, whether or not performed via automated processes, such as collecting, recording, organizing,
to structure, to store, to update or modify, to request, to consult, to use, to provide by transmission, to distribute
or otherwise make available, align or combine, block, erase or destroy data”
2Law of 24 June 2013 on municipal administrative sanctions, Belgian Official Gazette 1 July 2013. Decision 130/2021 - 3/5
police zone. Therefore, the Data Protection Authority is authorized to take cognizance of the
complaint.
III. Justification
6. The problem presented by the complainant concerns the transfer by the
controller, without having given his consent, of
personal data relating to her to 4 suspects of the GAS fine regarding
illegal dumping.
7. The Disputes Chamber establishes that the controller is responsible for the personal data,
know has obtained the name and e-mail address of the complainant with a view to a specific
purpose, namely to take appropriate measures, in this case a GAS fine to
to solve the illegal dumping problem in the municipality. The controller may
Do not pass on information obtained from the complainant as provided in her complaint to others
without the prior consent of the complainant.
8. However, it is common ground that the controller will process the complainant's personal data
as provided through her complaint to the 4 defendants. This was
was in no way consistent with the intended purpose for which the data was
provided by the complainant, namely taking appropriate measures to act against
illegal dumping. It is established that the recipients of the GAS fine for illegal dumping of the complainant did not
belonged to the group of possible recipients in order to achieve this purpose. Thus
there is a violation of the purpose limitation principle (Article 5.1 b) GDPR).
9. In addition, this transfer to the recipients of the GAS fine in question took place without
to have obtained the prior consent of the complainant for this purpose, so that no
there was a lawful basis for such transfer and therefore Article 6.1 a) GDPR did not
was respected.
10. In view of these findings, the Disputes Chamber is of the opinion that the infringement of Article 5.1 b) GDPR
and Article 6.1 a) GDPR is proven. However, the controller expressly acknowledges a
serious mistake in which she herself indicates that it is extremely important to
handle confidential information with care. The controller has
also timely reported this incident to the Data Protection Authority, whereby
some concrete measures have already been presented to prevent these incidents in the future
to avoid. In view of the aforementioned reasons, the Disputes Chamber decides not to proceed with a
treatment on the merits of this case.
11. The present decision is a prima facie decision made by the Disputes Chamber
in accordance with Article 95WOG on the basis of the complaint lodged by the complainant, in the context of Decision 130/2021 - 4/5
the “procedure prior to the decision on the merits” and not a decision on the merits of the
Disputes Chamber within the meaning of Article 100 WOG. As a result, the Disputes Chamber will only
can impose sanctions listed in Article 95 WOG on the controller and not
4
the sanctions from article 100 WOG, such as an administrative fine.
12. The purpose of this decision is to inform the controller of the
fact that it has committed a violation of the provisions of the GDPR and that it is in the possibility
to still comply with the aforementioned provisions.
13. However, if the controller does not agree with the content of this
prima facie decision and considers that it may allow factual and/or legal arguments
money that could lead to a different decision, can be sent to the email address
litigationchamber@apd-gba.be submit a request for treatment on the merits of the case to the
Disputes Chamber and this within the period of 14 days after notification of this decision. The
enforcement of this decision will, if necessary, be during the aforementioned period
suspended.
14. In the event of a continuation of the handling of the case on the merits, the Disputes Chamber will
the parties on the basis of Articles 98, 2° and 3° in conjunction with Article 99 WOG invite their
to submit defenses and to attach to the file any documents they deem useful. The
If necessary, this decision will be definitively suspended.
15. For the sake of completeness, the Disputes Chamber points out that a hearing on the merits of the case may be
lead to the imposition of the measures stated in Article 100 WOG.
16. Finally, the Disputes Chamber points out the following:
If one of the parties wishes to make use of the possibility to consult and
copying the file (art. 95, §2, 3° WOG), this should contact the secretariat
of the Disputes Chamber, preferably via litigationchamber@apd-gba.be, in order to make an appointment
3
Section 3, Subsection 2 WOG (Articles 94 to 97).
41° to dismiss a complaint;
2° order the suspension of prosecution;
3° order the suspension of the judgment;
4° propose a settlement;
5° to formulate warnings and reprimands;
6° order compliance with the data subject's requests to exercise his/her rights;
7° to order that the data subject is informed of the security problem;
8° to order that the processing be temporarily or permanently frozen, restricted or prohibited;
9° to order that the processing is brought into conformity;
10° the rectification, restriction or deletion of data and notification thereof to the recipients of the data
to command;
11° to order the withdrawal of the recognition of certification bodies;
12° to impose periodic penalty payments;
13° impose administrative fines;
14° order the suspension of cross-border data flows to another State or an international institution;
15° to transfer the file to the public prosecutor's office of the Public Prosecutor in Brussels, who will inform it of the consequence that
the file is given;
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. Decision 130/2021 - 5/5
to capture. If a copy of the file is requested, the documents will be
5
delivered electronically or otherwise by regular mail.
IV. Publication of the decision
17. Given the importance of transparency in the decision-making of the
Litigation Chamber, this decision will be published on the website of the
Data Protection Authority. It is not necessary, however, that the identification data
of the parties be made public directly.
FOR THESE REASONS,
the Disputes Chamber of the Data Protection Authority decides, after deliberation, to:
- Pursuant to Article 58.2.a) GDPR and Article 95, § 1, 4° WOG, to contact the controller
warn that intended processing infringes Article 5.1, b) GDPR and Article 6.1 a) GDPR
matters.
Against this decision, pursuant to art. 108, §1 WOG, appeals must be lodged within a
period of thirty days, from the notification, to the Marktenhof, with the
Data Protection Authority as Defendant.
(get). Hielke Hijmans
Chairman of the Disputes Chamber
5Due to the extraordinary circumstances due to COVID-19, the possibility of collection at the secretariat of
the Disputes Chamber is NOT provided. Moreover, in principle all communication takes place electronically.
