APD/GBA (Belgium) - 141/2022

From GDPRhub
Revision as of 18:31, 8 November 2022 by Kv (talk | contribs) (-Named the controller instead of ‘the newspaper’ -An online page of a newspaper, not the online newspaper. -Data subject is male, from the decision. - Holiday house or normal house? - Don’t use abbreviations like ‘hadn’t’, but write the full two words: had not - : the data subject first requested the newspaper to amend / redact the article, after which it contacted the DPO of the newspaper - Added consideration of the DPA regarding requirements for dismissing a complaint - use CJEU)
APD/GBA - 141/2022
LogoBE.png
Authority: APD/GBA (Belgium)
Jurisdiction: Belgium
Relevant Law: Article 17 GDPR
Article 17(3) GDPR
Article 17(3)(a) GDPR
Article 89 GDPR
Type: Complaint
Outcome: Rejected
Started: 19.02.2021
Decided: 04.10.2022
Published: 04.10.2022
Fine: n/a
Parties: n/a
National Case Number/Name: 141/2022
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): French
Original Source: Gegevensbeschermingsautoriteit (in FR)
Initial Contributor: Enzo Marquet

The Belgian DPA closed a complaint without further action as there was insufficient evidence to balance the freedom of expression/journalism against right of removal. The DPA does hold that a compelling reason must be provided to justify removal in such a case.

English Summary

Facts

A picture of a house, owned by the data subject, was used in a news article. This article was posted on an online page of a newspaper (Controller). The article was about a lock down party which had taken place in the pictured house.

The data subject first contacted the newspaper and requested the removal of the picture of his house because according to him, the article contained several mistakes. Amongst other things. He stated that the lock down party had not taken place in this house. He also stated that the publication of the photo was in essence the same as the publication of his address. The data subject also stated that he was discredited by the local community because of the article, suffered damage to one of his Gîtes (Vacation home) and that he was even harassed on online social media platforms.

Before submitting the complaint at the Belgian DPA (DPA), the data subject contacted the DPO of the controller with the request to either delete the published information or to correct it. The data subject especially requested to delete the photo, because he felt that the publication of the photo was disproportionate and not necessary for the article, which described the lock down party. The data subject also stated in an e-mail to the controller that he found it unacceptable that the press published incorrect data without verifying the accuracy and assessing the consequences of publication, while the information did not provide the public any added safety, nor did it provide any useful information.

The controller replied that the information was, in fact, accurate and processed according to article 24(2) LDA. This was determined after an investigation regarding the concerned journalist.

Holding

The DPA determined that it would dismiss the complaint pursuant of Article 95(1)(3) LCA.

The DPA stated when it decided to end a procedure, it should pronounce a technical dismissal if there were insufficient elements that could lead to a sanction or when there was a technical hurdle that would prevent the DPA to make its decision. The other option is to end a procedure on the basis of expediency. This can be the case when despite the presence of elements that could lead to a sanction, further investigation of the case does not appear appropriate in the light of the priorities of the DPA. When a procedure is dismissed for multiple reasons, the DPA will have assess the reasons in order of importance.

In this decision, the DPA closed the case on the basis of expediency. According to the DPA, the grievances raised by the data subject did not meet the criteria of high general or personal impact. The DPA stated that it also had to balance the personal impact for the fundamental rights and freedoms of the data subject against the effectiveness of action, in order to decide if it is expedient to continue the proceedings.

The DPA stated that Article 17(1)(c) GDPR gives the data subject the right to request the immediate deletion of his personal data when one of the requirements of Article 17 GDPR is applicable, especially when personal data is no longer necessary for the purposes for which they were originally collected (Article 17(1)(a) GDPR).  

Therefore, the DPA determined that it was authorized to determine if the controller had applied Article 17 GDPR correctly in its reaction to the data subject.

The DPA stated that the request of the data subject was a request for erasure from an online archive, belonging to press organization. The DPA reiterated that Article 89 GDPR acknowledged the importance of processing personal data for archiving purposes in the public interest. The DPA also stated that, according to the case law of the CJEU, internet archives were protected under Article 10 ECHR and Article 11 of the charter. The DPA also added that Article 17(3)(a) GDPR prescribes that 17(1) GDPR is not applicable when processing is necessary for the freedom of expression and information. For this exception, a balancing exercise has to be conducted between the freedom of expression and the right to data protection.

The DPA also referred to Google Spain and stated that the rights of privacy and data protection (Article 7 and 8 of the Charter) usually prevail, However, this balancing exercise can in special cases depend on the nature of the specific information and the sensitivity of this information for the privacy of the data subject, as well as the public’s interest in having access to this information, which can vary depending on the role of the data subject in public life. (C -131/12, Google Spain en Google, par 81).

The DPA determined that the sole wish of a data subject to be removed from the online archive was not sufficient. Digital archives contain valuable information for which accessibility must be preserved. Archives contribute also to democratic opinion-forming. Any measure preventing access to these archives must therefore be justified using particularly compelling reasons. Therefore, the data subject had to provide a compelling reason to justify the removal. The DPA also added that the CJEU had stated that there is more room for balancing conflicting interests when the archived information relates to past events than when it relates to current, recent events.

The DPA stated that the photo of the house constituted personal data, because the data subject was the owner of the house, which made him indirectly identifiable. Therefore, the data subject was entitled to use Article 17 GDPR to request removal, if any of the requirements in Article 17 GDPR were applicable.

The DPA determined that the processing in this case fell under the journalistic exception. The DPA also held that the controller could have a legitimate interest for the processing of this information. The erasure request had also been assessed by the controller according to the journalistic ethical code, especially regarding the accuracy of the information and confidentiallity of sources.

The DPA stated that the controller had answered all the requests of the data subject. The data subject stated, without providing evidence, that the lockdown party did not take place in his building. The controller stated that this was incorrect, after checking this fact with the responsible journalist. The DPA determined that the positions of both parties were direct opposites. Because there was no decisive evidence, a balancing act pursuant of Article 17(3)(a) GDPR was deemed impossible.

The DPA continued by stating that at first glance, the complaint was not precise enough and provided to little evidence to enable the DPA to make a decision without starting an investigation. The DPA determined that it was not expedient to enlist the help of its investigation service, because an investigation would not be proportionate, looking at the resources which would be necessary to make the investigation a success. Also, at first glance, the DPA would not be able to gather evidence in this case, unless it would interview the journalist and ask questions about the sources. This kind of investigation did not fall under under the priorities of the DPA.

The DPA did recommend that data subject would select a more appropriate legal remedy.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/7







                                                                        Litigation Chamber



                                                       Decision 141/2022 of October 4, 2022



File number: DOS-2021-00827



Subject: Complaint relating to the publication of personal data in the press




The Litigation Chamber of the Data Protection Authority, made up of Mr Hielke

Hijmans, President, sitting alone;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and

to the free movement of such data, and repealing Directive 95/46/EC (general regulation on the

data protection), hereinafter GDPR;

Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter

ACL);


Having regard to the Law of 30 July 2018 relating to the protection of natural persons with regard to

processing of personal data (hereinafter LTD);

Having regard to the Rules of Procedure as approved by the House of Representatives on 20

December 2018 and published in the Belgian Official Gazette on January 15, 2019;


Considering the documents in the file;




Made the following decision regarding:

The complainant: Mr. X, hereinafter “the complainant”;

The defendant: Y, hereinafter “the defendant”. Decision 141/-2/7


I. Facts and procedure


    1. The complainant filed a complaint with the Data Protection Authority (DPA) on 19

        February 2021 regarding the publication of the photo of the house he owns in

        the online pages of the defendant's newspaper. This photo illustrated an article relating

        a “lock-down” party in an Ardennes village that took place in said house, according to
        the press article “lockdown party at [locality] – (…)”.



    2. The complainant contacted the newspaper to request the deletion or rectification of

        the article which according to him gives erroneous information:

        - The lockdown party would not have taken place in that accommodation;

        - The people responsible for a lockdown party in the village would never have

            wanted to organize a seminar.




    3. The Complainant believes that publication of the photo is equivalent to publication of his address
        and deplores having suffered damage following this publication: “we have suffered

        degradation of the local population to one of our lodgings, messages of hatred rang out on

        social networks ; we are very badly regarded in the commune”.



    4. Prior to filing his complaint, the complainant contacted the delegate for
        protection of the defendant's data to claim the deletion and/or the

        rectification of the data published, in particular the deletion of the photo estimating this

        disproportionate and unnecessary data for press information on the holding of a

        lockdown party in a Belgian border village, with the corollary, according to the complainant, the

        suspicion of having imported the virus there. In his email of February 16, 2021 to the defendant,
        the plaintiff considered it "unacceptable for the press to throw out erroneous data, without verifying

        their accuracy and without measuring the impact on the lives of its targets, while the information

        brings nothing to the public, neither safety nor useful information”. The defendant has

        replied that after investigation with the journalist concerned, the information

        mentioned in the article are exact and have been treated on the basis of article 24 § 2 of the LTD.



II. Motivation


    5. Based on the facts described in the complaint file as summarized above, and on

        basis of the powers attributed to it by the legislator under Article 95.1.

        LCA, the Litigation Chamber decides to proceed with the classification without follow-up of the

        complaint, in accordance with article 95.1, 3° LCA, for the reasons set out below. Decision 141/-3/7



    6. In terms of classification without follow-up, the Litigation Chamber must justify its decision by

        step and:


        - to pronounce a classification without technical continuation if the file does not contain or not

                sufficient elements likely to lead to a sanction or if it includes a

                technical obstacle preventing him from rendering a decision;


        - or pronounce a classification without further opportunity, if despite the presence

                elements likely to lead to a sanction, the continuation of the examination of the

                file does not seem to him to be appropriate given the priorities of ODA such as

                specified and illustrated in the Chamber's Discontinued Classification Policy

                Litigation. 2





    7. In the event of dismissal on the basis of several reasons (respectively, dismissal

        without technical and/or opportunity follow-up), the reasons for the classification without follow-up must be

        treated in order of importance.



    8. In the present case, the Litigation Chamber proceeds to a dismissal for

        motive of opportunity. Indeed, the Litigation Division notes that the grievances raised by the

        complainant do not meet the high general or personal impact criteria, such as

        defined by the DPA in its note on the classification policy without follow-up of June 18, 2021.



    9. Furthermore, the Litigation Chamber weighs the personal impact of the circumstances

        of the complaint for the fundamental rights and freedoms of the complainant and the efficiency of his

        intervention, to decide whether it considers it appropriate to deal with the complaint in a

        thorough.



    10. According to Article 17.1.c) of the GDPR, a data subject has the right to obtain from the controller

        the processing the erasure, as soon as possible, of personal data the

        concerning when one of the conditions of application of this article applies,

        thus in particular, when the personal data are no longer necessary for the

        with regard to the purposes for which they were collected or otherwise processed

        (Art. 17.1.a) GDPR).








1
2Cour des marchés (Brussels Court of Appeal), September 2, 2020, 2020/AR/329, p. 18.
   See Discontinued classification policy of the Litigation Chamber, 06/18/2021, available at
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
litigation.pdf. Decision 141/-4/7



    11. In this case, the Litigation Chamber is entitled to check whether a person responsible for

        processing has, in its response to the exercise of his right of erasure by a person

        concerned, correctly applied Article 17 of the GDPR. This control also covers

        whether or not it is appropriate to use Article 17.3 of the GDPR, which requires the controller to

        treatment (i.e. the defendant) to operate a balance of interests to conclude or not to

        the need for treatment in the name of freedom of expression.



    12. The Litigation Chamber understands that in this case, the request for erasure concerns

        on the online archives of a press organ. The Litigation Chamber reminds this

        respect that the GDPR recognizes the importance of the processing of personal data for

        archival purposes in the public interest in Article 89. Such processing is subject to

        appropriate safeguards for the rights and freedoms of data subjects.

        In accordance with the case law of the European Court of Human Rights, the 3

        Internet archives are indeed content protected by the right to freedom of expression

        and information (Article 10 of the European Convention on Human Rights (ECHR) and

        Article 11 of the EU Charter of Fundamental Rights).



    13. Article 17.3.a) of the GDPR adds that Article 17.1 will not apply insofar as this

        processing is necessary for the exercise of the right to freedom of expression and information,

        thus providing, under the very terms of Article 17 of the GDPR, an exceptional regime which

        implies a balance of interests between two fundamental rights (the right to freedom

        of expression and the protection of personal data). 4



        In its “Google Spain” judgment of 13 May 2014, the Court of Justice of the European Union

        sets out that, as a general rule, the rights of the data subject enshrined in Articles

        7 and 8 of the Charter of Fundamental Rights of the European Union (EU) (i.e. the right to life

        privacy and the protection of personal data) prevail. Nevertheless, "this

        balance may however depend, in particular cases, on the nature of the information in

        issue and its sensitivity to the privacy of the data subject as well as

        the interest of the public in having this information, which may vary, in particular,

        depending on the role played by that person in public life”.5



    14. As the European Court of Human Rights has repeatedly pointed out,

        the wish of a (concerned) person to erase his past is not sufficient to justify a

        measure of modification of the archives precisely because these archives participate, at the


3
 eur. D.H., HURBAIN v. Belgium, 22 June 2021, req. No. 57292/16. ; see also Litigation Chamber, Decision
439/21, available at https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-139-2021.pdf.
 Litigation Chamber, Decision 139/21, available at https://www.autoriteprotectiondonnees.be/publications/decision-
quant-au-fonds-n-139-2021.pdf.
5C.J.U.E., May 13, 2014, C-131/12, Google Spain and Google judgment, paragraph 81. Decision 141/-5/7



        same title as the initial publication, to the effectiveness of the freedom of expression and

        information as mentioned above. Digital archives are a

        valuable source of information whose accessibility must be preserved. They participate in

        the formation of democratic opinion and any measure limiting access by the public – which

        has the right to receive them – must be justified by particularly compelling reasons .6



    15. The European Court of Human Rights adds that a wider latitude exists for

        balancing competing interests when information is archived

        and relate to past events only when they relate to events

        current, recent..7



    16. In the present case, the image which the complainant requests to be deleted, namely the

        photograph of a house he owns, allows, according to the complainant, to identify him

        indirectly, in connection with the facts reported in the newspaper. This image therefore constitutes a

        personal data within the meaning of the GDPR and the complainant is entitled to request the deletion

        of this data if he demonstrates the conditions of application of Article 17 of the GDPR.



    17. The processing of this data seems to fall within the scope of the journalistic exception

        referred to above and the press organization may have a legitimate interest in processing this

        information. The request for erasure of a journalistic article by the press organ

        itself is subject to the rules of journalistic ethics, in particular with regard to

        concerns the veracity of the data and the secrecy of the sources.



    18. The Litigation Chamber emphasizes - that in support of all the elements which have been

        presented - the complainant's request was the subject of a response from the newspaper. The complainant

        claims without further evidence that the incriminated "lockdown party" would not have taken place

        held in its building. The defendant's organ asserts the opposite after having checked

        this point internally with the journalist in charge



    19. The Litigation Chamber submits that the position adopted by the Complainant and the Respondent

        are diametrically opposed and that the absence of conclusive evidence prevents a

        balancing the interests to operate between the right to data protection on the one hand and the

        right to freedom of expression on the other hand pursuant to Article 17.3. a) GDPR.







6
 See. for example eur court. D.H., Timpul Info-Magazin and Anghel v. Moldova, 27 November 2007; judgment M.L. and W.W.
vs. Germany, June 28, 2008 and Times Newspapers Limited v. United Kingdom judgment, March 10, 2009.
7 European Court. D.H., Times Newspapers Limited v. United Kingdom, 10 March 2009, req. 3002/03 and 2676/03, point 45.
8 GDPR, Art. 6.1.f). Decision 141/-6/7



    20. Indeed, it seems prima facie that the complaint is not sufficiently precise and does not provide

        insufficient evidence to allow the Litigation Chamber to take a

        decision without recourse to an investigation by the Inspection Service. The Litigation Chamber

        considers that it is not appropriate to call on the Inspection Service to substantiate the complaint

        since an examination of the complaint would not be proportionate taking into account the means
                                                                                                 9
        necessary to put the complaint in a state of being examined and of the chances of success . Of
        In fact, it appears prima facie that the DPA would not have the possibility of collecting evidence on this

        subject except to question the journalist and ask him to reveal his sources. This guy

        examination, in principle, does not fall within the priorities of a supervisory authority such as

        ODA.



    21. Accordingly, the Litigation Chamber considers that it does not have the opportunity to rule on

        the existence of a breach of the GDPR based on the elements provided in the complaint.



    22. Furthermore, the Litigation Chamber recalls that the complainant has the possibility of choosing a

        more appropriate legal remedy (e.g. seize the Belgian courts and tribunals, demand a right of

        response and/or seize the ad hoc ethical bodies) in the context of a

        news publication.




III. Publication and communication of the decision


    23. Given the importance of transparency with regard to the decision-making process and the

        decisions of the Litigation Chamber, this decision will be published on the website of

        the Data Protection Authority. However, for this purpose it is not necessary that the

        identification data of the parties are directly communicated.



    24. In accordance with its policy of dismissal, the Litigation Chamber

        communicate the decision to the defendant(s).

        to communicate the decisions of classification without follow-up to the defendants by default. The

        However, the Litigation Chamber refrains from such communication when the complainant

        requested anonymity and when the communication of the decision to the defendant, even

        pseudonymized, risk of allowing the identification of the latter by the person in charge of the

        treatment. This is not the case in this case, the complainant having not requested anonymity.







9 See Discontinuance policy of the Litigation Chamber, “Title 3 – In which cases is my complaint
likely to be dismissed by the Litigation Chamber? », 06/18/2021.
10Cf Discontinued classification policy of the Litigation Chamber, “Title 5 - Will the discontinued classification be published?
will the opposing party be informed? », 06/18/2021. Decision 141/20-7/7






  FOR THESE REASONS,


  The Litigation Chamber of the Data Protection Authority decides, after

  deliberation to close the present complaint without follow-up pursuant to article 95.1,

  3° the Law of 3 December 2017 establishing the Authority for the Protection of


  data.




                                   er
Under Article 108, § 1 of the LCA, this decision may be appealed to the

Court of Markets within thirty days of its notification, with the Authority of

data protection as defendant.


Such an appeal may be introduced by means of an interlocutory request which must contain the

information listed in article 1034ter of the Judicial Code. The interlocutory motion must be

filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 12

via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).


To allow him to consider any other possible course of action, the Litigation Chamber sends

                                                                                                    13
the complainant to the explanations provided in its dismissal policy.








(Sé). Hielke Hijmans


President of the Litigation Chamber

















11The request contains on pain of nullity:
  (1) indication of the day, month and year;
  2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or

     Business Number;
  3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
  (4) the object and summary of the grounds of the application;
  (5) the indication of the judge who is seized of the application;
  6° the signature of the applicant or his lawyer.
12The request, accompanied by its annex, shall be sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.
13Cf. Title 4 – What can I do if my complaint is dismissed? of the Chamber's policy of classification without follow-up

Litigation.