APD/GBA (Belgium) - 145/2023
From GDPRhub
| APD/GBA - DOS-2020-00200 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 4(1) GDPR Article 6(1)(f) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 17.01.2020 |
| Decided: | 26.10.2023 |
| Published: | 27.10.2023 |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | DOS-2020-00200 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | GBA (in NL) |
| Initial Contributor: | Matthias Vandamme |
The Belgian DPA found that a college's communication of the reasons for dismissal of one of its former teachers to their colleagues and students was in violation of Article 6(1)(f) GDPR. Including the reason for dismissal was not necessary.
English Summary
Facts
A college (the controller) dismissed one of its teachers after a student had alleged that they had committed a physical assault against them. Following an internal investigation, the lecturer was dismissed for urgent cause. The college's board informed its staff and the lecturer's students of the dismissal and its reasons in March 2019: 'This [dismissal] follows physical aggression towards one of the students [...] a thorough investigation has shown that this incident makes any further functioning of [complainant's name] as an employee of [controller] impossible'. In January 20202, the teacher lodged a complaint with the Belgian DPA.
Holding
The Belgian DPA held that the emails were unlawful and reprimanded the college. To send them, the controller had relied on Article 6(1)(f) GDPR. The Belgian DPA refuted validity of such legal ground. In reaching its conclusion, the Belgian DPA applied the following three-step test to determine legitimate interest, as outlined by the CJEU in Case C-13/16, Rīgas satiksme (§ 28).
First, the purpose test. The Belgian DPA confirmed that the mere fact that the lecturer has been dismissed for cause justifies the need for an immediate and legitimate need to communicate this to students and colleagues.
Second, the necessity test. Some of the emails had been sent to students who were no longer enrolled. In this respect, the Belgian DPA argued that the communication was not necessary and found a breach of Article 6(1)(f) GDPR. For the emails to current students and colleagues, the Belgian DPA found that there was no need to communicate the reason for dismissal: 'physical aggression'. The Belgian DPA did acknowledged that there may be situations where it is necessary to state the reason for dismissal. However, in this instance, this was not the case.
Third, the balancing test. Finally, the Belgian DPA found that the balancing test was not respected. The Belgian DPA concluded that the college had failed to adequately consider the data subject's fundamental rights and freedoms when sending the emails. The DPA found that the controller in the emails 'did not provide enough objectively substantiated elements' and while the college claimed in its communication that the decision to dismiss had been taken only after 'a thorough investigation', this was insufficient for the purposes of the balancing test. As a result, the DPA found that the rights and freedoms of the data subject were excessively infringed.
Consequently, a breach of Article 6(1)(f) GDPR was found. As a result the Belgian DPA reprimanded the college.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/15
Disputes Chamber
Decision on the merits 145/2023 of 26 October 2023
File reference : DOS-2020-00200
Subject : Sending an email to students and colleagues following the dismissal of
a lecturer
The Disputes Chamber of the Data Protection Authority, composed of Mr. Hielke
Hijmans, chairman, and Mr Jelle Stassijns and Mr Dirk Van Der Kelen, members;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of individuals with regard to the processing of
personal data and on the free movement of such data and repealing
Directive 95/46/EC (General Data Protection Regulation), hereinafter AVG;
Having regard to the Act of 3 December 2017 establishing the Data Protection Authority,
hereinafter WOG;
Having regard to the Rules of Internal Procedure, as approved by the Chamber of
Representatives on 20 December 2018 and published in the Belgian Official Gazette on
15 January 2019;
Having regard to the documents on file;
Has taken the following decision regarding:
The complainant: Mr. X, represented by Mr. Lien MICHIELSEN, with offices at
Lange Van Ruusbroecstraat 76, 2018 Antwerp; hereinafter "the complainant", and
The defendant: Y, represented by Mr. Tom PEETERS, with offices at
Borsbeeksebrug 36, 2600 Antwerpen-Berchem; hereinafter "the defendant".
Decision on the merits 145/2023 - 2/15
I. Facts and procedure
I.1. Facts
1. The subject matter of the complaint concerns the sending of e-mails containing personal data of
the complainant to (former) students and colleagues by the respondent, an
educational institution, following the dismissal of the complainant by the respondent
pursuant to a disciplinary measure.
2. The disciplinary action followed an incident between the complainant and one of its students in
the edge of a lesson taught by the complainant. The complainant does not deny that he physically hit a
student physically, but argues that this happened accidentally by making
a waving away gesture and that this did not constitute a deliberate act of physical aggression. This
all allegedly took place in the aftermath of an oral discussion after the
student allegedly tried to covertly look into his points on the computer screen of
the complainant.
3. The administration of the respondent decided to dismiss the complainant for urgent reasons, and a
There followed a communication from the defendant's management regarding students and
staff who were taught or worked with the complainant. In addition, there was quasi-
identical communications towards the [...] committee. Each of these communications
occurred through three emails on 21 and 22 March 2019, notifying the dismissal in the
following wording: "This following physical aggression towards one of the
students [...] a thorough investigation has shown that this incident has caused any further functioning of
[name of complainant] as an employee of [respondent] is impossible."
Based on the documents on file, it can be said that at least 195 (former) students
were sent the message and potentially able to read it, regardless of the number of
addressees in the other two messages.
4. After an appeal was lodged by the complainant against the disciplinary measure on which the dismissal
with urgent cause followed, [...] (hereinafter Board of Appeal) - which has jurisdiction
for appeals against disciplinary measures of the Defendant's Administrative Council -
found that, although the complainant had been at fault, the board of the
defendant did not conduct a sufficiently thorough investigation in preparation for the decision
to dismiss the complainant.
5. The Appeals Board stated in this regard, inter alia, "[...] although there are some 40 possible
witnesses to the incident, the college administration [limited] itself [] to questioning
only fellow students who were then provided by the father of the student involved in the incident ,
were put forward. Moreover, the summary records of the interrogations of all the
involved are not unequivocal."
Decision on the merits 145/2023 - 3/15
It then concludes, "For all these reasons, it [...] declares the dismissal for urgent reasons
reasons of the [complainant] unfounded. Given the lack of clarity as to the gravity of
the misconduct committed, the College decides . . . to the preventive suspension of the [complainant], with a
disciplinary proceedings as a result."
6. On 3 May 2019, according to its summary conclusion, the respondent stated that the members of the
aforementioned committee and "the lecturers of the professional bachelor [...] (not the lecturers [...])"
informed of the decision of the Appeals Board.
7. Thereafter, the Board of the respondent instituted a disciplinary enquiry, the report of which
ultimately proposes dismissal. This decision is then again
appeal by the complainant. The Appeals Board then issues its own
disciplinary decision in lieu of that of the respondent board, with the
disciplinary sanction the return to temporary appointment.
8. Following this temporary appointment, the complainant is then dismissed by the respondent
dismissed through the employee dismissal procedure. About this dismissal, on 11 December
2019, a notice was sent by the respondent - according to its summary conclusion - to the complainant's
colleagues of the complainant.
I.2. Procedure
9. On 17 January 2020, the complaint was declared admissible by the Honour Service and
transferred to the Disputes Chamber pursuant to article 62, § 1 j° article 92, 1° WOG.
10. On 7 February 2020, the Disputes Chamber invites the parties to file conclusions
according to the time limits set therein. Both parties shall subsequently submit their
conclusions with pleas to the Dispute Chamber. On 30 May 2023, the
Disputes Chamber a letter to the parties, whereby the parties, pursuant to Article 52
of the Rules of Internal Procedure1 of the Data Protection Authority, the parties are automatically
be invited to a hearing.
11. On 16 June 2023, the defendant - in light of the hearing - submits a "supplementary
note" to the Disputes Chamber. This supplementary note makes reference to a judgment
of the Labour Court [...], and attaches it in an annex. The judgment, which the respondent
enclosed, states, "On the complaint filed by Mr X with the
Data Protection Authority for violation of his right to privacy, the
labour court cannot rule ." Further in the judgment it states, "In the opinion of the
court, these communications [in this case, the above-mentioned litigious
communications] merely reflects the facts, namely that [the complainant] was dismissed because of
1 Available at: https://www.gegevensbeschermingsautoriteit.be/publications/reglement-van-interne-orde.pdf.
Decision on the merits 145/2023 - 4/15
physical aggression towards one of the students."
Further, the party's supplementary note also states that the imposition of any measure "is in
violates the reasonable time requirement" within the meaning of Article 100 of the CPC.
12. A hearing will be held on 23 June 2023. At this hearing, the parties set out their
conclusions. Moreover, the parties also elaborate on the request of the
Dispute Chamber - which was transmitted to them prior to the hearing - to express their views
on the lawfulness of any processing operations (within the meaning of
Article 6.1. AVG), as well as on the application of the principle of minimum
data processing to the possible processing operations (within the meaning of Article 5.1.c. AVG).
13. The transcript of the hearing is subsequently transmitted to the parties on 28
June 2023; in accordance with Article 54 of the GBA's Rules of Internal Procedure
the parties are given the opportunity to have comments added to the minutes.
Both parties shall provide such comments, which shall be added in full to the
file and of which the Disputes Chamber has taken note as part of the
deliberations prior to the decision before it.
II. Statement of reasons
II.1. Admissibility of the complaint and competence of the Data Protection Authority
14. In its summary conclusion, the defendant argues that the processing at issue
namely, the sending of an e-mail to students and staff members regarding the
dismissal of the complainant, does not constitute processing within the meaning of the AVG. The defendant
specifically states in this regard:
"In the present case, there is no processing of personal data as
defined in Article 4(1) and (2) of the AVG [...] Nor is there any
automatic processing of data or a manual processing of data
intended to form part of a filing system within the meaning of Article 2 of
the AVG. In this case, it is merely an internal communication by e-mail . . ."
15. The defendant's reasoning cannot be followed and would be at odds with the
spirit and letter of the relevant regulations. Indeed, the reasoning would imply that
as soon as a document containing personal data would qualify as "internal",
Decision on the merits 145/2023 - 5/15
the processing of such personal data would escape the protection of the
AVG, including its supervision by the competent authorities (in this case, the GBA).
16. The Disputes Chamber maintains that there is no doubt that the AVG applies and that
the GBA is competent to take enforcement action in accordance with Article 4 WOG.
17. First, it is clear that the content of the disputed e-mail messages
constitute personal data within the meaning of Article 4.1. AVG.
Indeed, as the complainant rightly points out in his conclusions, it concerns information
concerning him as an identified person. More specifically, the e-mail contains information
about the complainant, in particular the fact that the complainant is dismissed from the educational institution
where he teaches, as well as the reason for that dismissal ("physical aggression"). The complainant can also
undoubtedly qualify as an identified person, as the complainant is explicitly
(by name) is mentioned in the litigious communications.
18. Next, there is also no doubt that the mention of certain data in the contested
e-mail messages entail processing operations within the meaning of Article 4.2. AVG, as the
processing operations are carried out through an automated process. The disputed e-
e-mail messages were created on the initiative of the defendant, which entered the personal data
entered and structured in a certain way - with the defendant choosing which
data it specifically mentioned - after which the message was then addressed to a certain number of
persons so that the information was accessed by sending
an e-mail (i.e. an automated process).
19. In this sense, it is clear that within the definitions provided by the AVG, the facts of the
complaint clearly fall within the material scope of application of the AVG (Article 2.1. AVG).
None of the 4 grounds for exception under article 2.2. AVG apply here. As the
Defendant does not expressly base its plea on this provision, it is not necessary to address
address these grounds for exception in the decision.
20. For all the foregoing reasons, it is clear that the e-mail messages that formed the basis
of the complaint in this file constitute personal data processing operations that fall within the
material scope of application of the AVG (Art. 2 AVG), the definitions used there being
definitions (specifically those in Article 4(1) and (2) AVG) undeniably apply to the facts.
apply.
II.2 Additional document for hearing, addition to the administrative file and
consequences for the proceedings
21. The document filed by the respondent at the hearing, which includes the aforementioned
judgment of the labour court is accepted and added to the file by
the Disputes Chamber as it can be considered manifestly relevant in the context of
Decision on the merits 145/2023 - 6/15
safeguarding the rights and freedoms of the parties - including the rights of
defence of the defendant. The complainant was able to take cognisance of the document
prior to the hearing, and was given the opportunity to comment on it
during the hearing. The admissibility of the document is - according to the
minutes of the hearing - is not disputed by any of the parties.
22. That the grievances in the complaint had become without object by the aforementioned
22. That the grievances in the complaint have become devoid of object by the above-mentioned judgment of the labour court - as the defendant puts forward - cannot be followed by the
Disputes Chamber for several reasons cannot be followed.
23. First, the complainant's claim in the proceedings before the labour court was
dismissed, so there can be no question of double punishment. Secondly
it should be emphasised that the proceedings before the Disputes Chamber are - albeit sui
generis - administrative procedure, clearly distinct from any
civil or criminal proceedings. While it is certainly the case that the ne bis in idem
principle should apply in that context, it is important to underline that the
Dispute Chamber rules on facts specifically
relate to data protection, and does not 'holistically' tranche the civil
claims of the parties.
24. For this reason, the judgment of the labour court also expressly acknowledges that that
court cannot rule on the ongoing proceedings before "the
Data Protection Authority". The judgment only pronounces on the possible
damage that the communication did or did not cause, but in no way on the
specific data protection law aspects.
Moreover, the judgment does not address any legal provision in this respect, as a result of which
it can hardly be said that a concrete assessment of data
data protection law aspects already took place.
For each of these reasons, it cannot be accepted that the handling of this complaint file
would be discontinued by the Dispute Chamber, within the concrete circumstances.
II.3 The lawfulness of the processing and the principles governing the processing of
personal data:
Position of the complainant:
25. The complainant argues that several principles on the protection of
personal data (Article 5 AVG) have been violated. Specifically, the complainant states in this regard:
"There is no lawful, proper and transparent processing
of the data.
Decision on the merits 145/2023 - 7/15
The [defendant] does not explain for what specific, explicitly defined
and legitimate purposes the data were processed as they were
processed.
There is no minimal data processing at all,
on the contrary. Minimal data processing occurs when it is adequate
relevant and limited to what is necessary for the purposes for which they are processed.
for which they are processed. A minimal data processing would have been
a communication to colleagues and students - not ex-students - that the [complainant]
would no longer come to work and possibly be replaced by person X. Without
communicating a sufficiently objective investigation following physical
aggression towards one of the students is by no means minimal
data processing.
Data should be accurate and updated. According to the decision of the
Appeals Board dated 23 April 2019, insufficient investigation was conducted into the
nature of the facts, moreover, the [respondent's] decision was declared unfounded
was declared unfounded. Both on March 21 and after the college's decision, there was
consequently a violation of the processing of personal data.
The [defendant] prematurely and unnecessarily circulated the message with the
information of the physical aggression.
The defendant also states in its conclusions that it "never went into detail"
regarding the reasons for dismissal in the emails to students and colleagues of
the complainant. On the one hand, this assertion is not correct, as it did mention
made of the facts of physical aggression. On the other hand, that wording is so
general that it may just lead to additional speculation about the scope of
this (alleged) aggression by the complainant; the use of such wording
does not demonstrate a proper view of personal data processing on the part of
the defendant. "2
Defendant's position:
26. The defendant defends itself on this point as follows, albeit in secondary
order as it challenged the jurisdiction of the Disputes Chamber in the main order:
"[The defendant] sent the emails internally for the sole purpose of informing colleagues and
physical education students about the fact that the [complainant]
was dismissed for an urgent reason and will no longer be active as a teacher, nothing
more and nothing less.
2 Counterclaim Complainant.
Decision on the merits 145/2023 - 8/15
Given the fact that these days there is a heightened drive for transparency
towards executives, [the defendant] has thus provided a general
and caring communication to colleagues and students. [The defendant] tried to
adhere to her duty of information and tried to get rid of the
culture of silence often prevalent among managers towards their employees.
In addition, no document shows that concluante would use the complainant's data for any other purpose.
use the complainant's data for any other purpose [...].
Moreover, the concluant adheres to the principle of minimal data processing
by only processing the name of the complainant in light of the intended purpose
processed (Article 5.1(c) of the AVG) [...] Concluante, moreover, never went into details
addressed.
Furthermore, this internal communication was only transmitted to colleagues . . . . and to
his students . . . The information was not transmitted to private mail addresses ,
but only to professional mail addresses. As for the [complainant's] allegation
that the information was sent to former students, it is somewhat true that
a few students were no longer taking lessons from [the complainant] at the time, but these
only concerned students who had already graduated in the first semester.
If students graduate in the first semester, their ability to
access to certain internal websites and the mailbox . . . . only in October in the
next academic year [...].
Moreover, the processing is lawful [...]
The dismissal for urgent reasons has raised a lot of questions and concerns
raised among students and colleagues [...] Moreover, only the relevant and
proportionate information was processed. As explained above, only
mentioned was the name of the complainant and the fact that he was dismissed
for cause due to physical aggression. The
proportionality principle was therefore complied with."
Assessment Disputes Chamber
Decision on the merits 145/2023 - 9/15
27. The Dispute Chamber is not a (civil) court, but is part of an
administrative body. According to the powers assigned to it3, the
Dispute Chamber to review the facts in the file against the
data protection law framework, with the application of some policy considerations
considerations - such as regarding the appropriateness of acting on a complaint.4 It
in other words, it is not for the Dispute Resolution Chamber to comment on aspects and means that are
put forward by the parties to make rulings that ignore the relevant
data protection law test.
28. In the present case, the relevant disputed facts for the assessment by the
Disputes Chamber three e-mail messages sent under the responsibility of the
respondent. The complainant cites several elements, each of which, in its view, constitute
constitute infringements of the principles relating to the processing of personal data. It
appears to the Disputes Chamber that one conduct in each of the three
communications, with the manner in which personal data is processed constituting a
potential breach of one provision.5 Due to the speciality of Article 6(1) AVG, it is
at issue to examine merely the lawfulness of the processing - yet
however, in light of the principles contained under Article 5 AVG.
29. The Disputes Chamber limits its review of the lawfulness of the processing to the
mention of the "dismissal for urgent reasons" and the use of the wording
"physical aggression" in three e-mail messages from the respondent dated 21 March 2019 and 22
March 2019, also taking into account the number of addressees and the
relevance of writing to all these addressees.
30. The following is an extract from the communication of the email dated March 22, 2019 to "195
students and former students" (according to the complainant's conclusions, not disputed by the
respondent):
"Dear student . . . .
Yesterday, the management proceeded to dismiss for urgent reasons [for-
and surname of the complainant], [...] teacher. This following a case of physical
3 According to Article 4, §1 WOG, the Data Protection Authority, to which the Disputes Chamber belongs,
"responsible for monitoring compliance with the fundamental principles of personal data protection, in
the context of this Act and of laws containing provisions on the protection of the processing of
personal data."
4 See, inter alia, to this effect, the Dispute Chamber's Sepotation Policy, available at:
https://www.gegevensbeschermingsautoriteit.be/burger/sepotbeleid-in-het-kort; noting that a
supervisory authority should examine a complaint "with due diligence and care", see Judgment
of the Court of Justice of the EU of 6 October 2015, Schrems v DPC, C-362/14.
5 Compare mutatis mutandis the reasoning of the European Data Protection Board in Chapter 3 ("Chapter
III") of its "Guidelines 04/2022 on the calculation of administrative fines under the GDPR", v 2.1. dated 24 May 2023,
available at: https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-042022-calculation-
administrative-fines-under_en (available in English only for now).
Decision on the merits 145/2023 - 10/15
aggression towards one of the students during class [...] last Monday.
A thorough investigation after Monday revealed that the continued functioning of Mr.
[complainant's surname] as a teacher at [respondent] is no longer possible.
We understand that this message and decision may raise a lot of questions and concerns
may raise for you and other students[...]"
The notice subsequently adds information regarding contact moments and people following
response to the event.
31. In the case before us, none of the parties argue that there is any
lawful processing would be through the granting of consent by the complainant to process his
personal data processing (Article 6.1.a. AVG), nor that there would be an agreement
between the parties on which the personal data processing would be based (Article 6.1.b.
AVG). It is further nowhere raised - particularly by the defendant - that the
contested processing operations would be required by law (Article 6.1.c. AVG) or that these
processing is necessary for the vital interests of any person (Article 6.1.d. AVG)
or necessary for the performance of a task carried out in the public interest or in the context
in the exercise of official authority vested in the defendant (Article
6.1.e. AVG).
32. In its conclusions, the defendant bases the lawfulness of the aforementioned
processing operations on Article 6.1.f. AVG. Since the Defendant, as a controller, refers
refers to this basis,6 it is for the Disputes Chamber to test whether all the
conditions of this statutory provision are met in order to speak of lawful
processing.
33. In accordance with the case law of the Court of Justice,7 the second defendant, as the
controller must therefore demonstrate that:
1) the interests they are pursuing with the processing can be recognised as legitimate
recognised (the "purpose test");
2) the intended processing is necessary for the achievement of those interests (the
"necessity test"); and
3) the balancing of those interests against the interests, fundamental freedoms and
fundamental rights of data subjects weighs in favour of the
controllers or of a third party (the "balancing test").
6 Paragraph 12 et seq. of the defendant's summary conclusion.
7 CJEU judgment of 4 May 2017, Rigas satiksme, C-13/16, EU:C:2017:336, para 28.
Decision on the merits 145/2023 - 11/15
(a) Purpose test
34. In the view of the Disputes Chamber, personnel-related communications can indeed be
indeed - following dismissal or prolonged absence - be justified. In
this sense, a communication concerning a dismissal - including the reason for that
dismissal - of a staff member or lecturer can be justified in itself.
35. In this regard, the defendant rightly cites that there is an emphatic social demand
for transparency regarding measures taken by managers in respect of
towards staff. In addition to communications to colleagues of those involved, the
situation also proves that communications to students can also pursue such a legitimate
objective can be pursued.
36. Communicating about a dismissal, and the reason for that dismissal, in itself pursues a
legitimate objective. There is no indication in this regard that the communications pursue other
objectives - such as deliberately harming the complainant - would have been sent. The
Disputes Chamber here, in particular, expressly does not follow the complainant's reasoning as
would a communication at the time be "premature".8 Since the dismissal for
urgent reasons occurred, regardless of whether or not that dismissal was justified,
an immediate and legitimate need arose to communicate about that dismissal to
students and colleagues of the complainant.
(b) Necessity test
37. To apply this test, a distinction must first be made at a general level between two types of processing
be made between two types of processing that should be distilled
from the disputed facts and the three e-mails. First, the necessity of
writing to former students is discussed, via the disputed e-mail message dated 22 March
2019. Second, the necessity of communications to colleagues, members
of the above-mentioned committee and "current" students of the complainant (at the time of
the facts), as well as how the complainant's personal data
were employed in the two communications to that effect on 21 and 22 March 2019, respectively.
b.1. Communications to former students:
38. With regard to communications to former students, it can be said in short that
it can hardly be called "necessary" to inform these persons about
the dismissal - let alone the reason for the dismissal - of the complainant. The defence on this point
8 Plaintiff's Synthesis Conclusion, p. 7: "The [defendant] prematurely and unnecessarily circulated the message with the information of
the physical aggression."
Decision on the merits 145/2023 - 12/15
of the respondent, as if it were difficult or impossible to work with an
updated list of students, cannot be withheld in this regard.
39. The Disputes Chamber finds that under the accountability obligation under the AVG of
a large organisation such as the defendant's, it can be expected that it will take the technical and
organisational measures to ensure that its lists - be it here the accounts and associated
mailboxes - with students on an ongoing basis, and at least more frequently than
per academic year. This applies a fortiori when such "student lists" are used
for communications such as those made on 22 March 2019 by the defendant, in which
personal data of the complainant were employed and processed in a delicate manner.
40. With the defendant expressly acknowledging in its conclusions that some of the
addressees "no longer had lessons from [the complainant]", it clearly follows that in respect of
those addressees, the communications at issue should clearly be classified as not necessary.
classified. By failing to meet the necessity test as regards
the communications to former students on 22 March 2019, in any event, a breach can already be established separately for this processing
already separately established a breach of Art. 6.1.f. AVG.
b.2. Communication to "current" students and colleagues:
41. As stated above, informing students and colleagues about a dismissal constitutes
a real and societal need that can be considered relevant and legitimate
according to the Dispute Chamber.
However, the Disputes Chamber must find on this point that the communications in question,
and more specifically the references to "physical aggression" - in the light of the general
principle of minimum data processing within the meaning of Article 5.1.c. AVG - were not
necessary.
42. More specifically, while it may be necessary for the defendant to "transparently"
communicate regarding the dismissal, however, it in no way appears to the Disputes Chamber as
necessary to mention the "physical aggression", especially since there is
communicated about a dismissal. The students and colleagues and other persons to whom
are being communicated, after all, have no current need to know that reason.
That there would be backbiting or mistrust as a result of not communicating the
reason for dismissal, is not as such the (social, let alone legal)
responsibility of the defendant. Indeed, in no case are there circumstances that
the defendant has put forward in the present proceedings, which in any way demonstrate the effective
and immediate need to disclose these personal data.
Decision on the merits 145/2023 - 13/15
43. As the communication to both colleagues and "current" students at the time of the
facts cannot in itself be regarded as necessary for the achievement of the interests of the
defendant, the Disputes Chamber finds that the necessity test is not met
the necessity test and therefore does not meet the conditions of Article 6.1.f. AVG
for the facts at issue through the three e-mail messages sent by the defendant.
For that reason in itself, the processing operations dated 21 and 22 March 2019 infringe that
provision. This breach is due to the inclusion of the reason "physical aggression".
44. For the sake of completeness, the Disputes Chamber notes that the fact that such communications are "internal"
occur and are addressed to e-mail addresses linked to the institution, is not relevant
to the assessment of necessity. The fact that certain facts happened in a
work-related context, or that communications were sent on an "internal platform"
were sent, is irrelevant in that assessment.9
(c) Balancing test
45. Taking into account several elements, the Disputes Chamber concludes that the
rights and freedoms of the complainant were not adequately considered by the
defendant when sending the communications at issue. Each of these elements in
themselves demonstrate a violation of the balancing test, leading to a breach of Article 6.1.f.
AVG, on which the contested processing operations would be based.
46. First, the Disputes Chamber notes that the communications refer to a
"thorough investigation", while the decision of the Board of Appeal dated 23 April 2019 states
that the management of the respondent "did not provide enough objectively substantiated elements"
would have attached. The fact that these communications - albeit a posteriori by the
Board of Appeal - can be labelled as at least partially erroneous , in itself shows
that the rights and freedoms of the complainant were excessively infringed.10 This is also apparent
incidentally, also from the decision of the court which awarded damages
for the conduct of the complainant's dismissal by the respondent. This aspect in itself shows
that the rights and freedoms of the complainant were excessively harmed by the
communications in light of the balancing test, where the defendant's dismissal due to
of "physical aggression" is at least partly unjustifiably linked to a "thorough
investigation".
47. Second, the Disputes Chamber notes that the initial communication also fails to mention
is made of the fact that the complainant can also appeal the
decision of the defendant's board, and the associated considerations
9 Compare also, mutatis mutandis, the dissemination of personal data in an employment law context on an internal
platform: Decision Geschillenkamer GBA 115/2022 of 15 July 2022, available in Dutch at:
https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-115-2022.pdf.
10 Compare also in light of the principle of accuracy of personal data: Article 5.1.b. AVG
Decision on the merits 145/2023 - 14/15
which the board observed in order to proceed with the dismissal. When the defendant
mentions a dismissal after "thorough investigation" that established "physical aggression",
the defendant could at least have mentioned that the decision was still subject to appeal
open to an appeal body. The fact that this appeal option was not mentioned
mentioned in the communications at issue - even though those communications mention
dismissal for urgent reasons after a thorough investigation indicating physical aggression as the reason for the dismissal
shows that the rights and freedoms of the complainant have been
have been excessively impaired by the communications in light of the balancing test.
48. For both elements separately, the Disputes Chamber concludes that the balancing test was not
has been respected. Thus, for each of those two elements, by violating
the balancing test, the breach of Article 6.1.f. AVG is established for the contested processing operations in
the three e-mail messages.
II.4. Sanctioning
49. Now that the Disputes Chamber has established that the three emails containing communications
to students, former students, colleagues and members of the above-mentioned committee,
contain personal data processing operations that infringe Article 6.1. AVG, it is
to take corrective measures on behalf of the defendant.
50. In the context of effective judicial protection under Article 47 of the Charter of
the European Union, and the effective enforcement that the legislature seeks to achieve through the AVG, it is
it is still appropriate even now to reprimand the defendant in this regard.
51. For this reason, it appears appropriate to the Disputes Chamber to reprimand the defendant
because of the mention in the disputed communications that the dismissal of the
reasons of physical aggression, as well as for writing to former
students, for whom there was certainly no need to know about the
dismissal, let alone in such a way.
III. Publication of the decision
52. In view of the importance of transparency regarding the decision-making of the
Disputes Chamber, this decision shall be published on the website of the
Data Protection Authority. However, it is not necessary that the
identification details of the parties be published directly.
Decision on the merits 145/2023 - 15/15
Pursuant to Article 108 § 1 of the CPC, within a period of thirty days from the
notification, this decision may be appealed to the Market Court (Court of Appeal
Appeal Brussels), with the Data Protection Authority as defendant.
Such an appeal may be lodged by means of an interlocutory application which must satisfy the
enumerated in Article 1034ter of the Judicial Code11. The
contradictory application should be filed with the registry of the Market Court
pursuant to Article 1034quinquies of the Ger.W.12, or via the e-Deposit
computer system of Justice (Article 32ter of the Ger.W.).
(get). Hielke HIJMANS
President of the Disputes Chamber
11 The petition shall state on penalty of nullity:
1° the day, month and year;
2° the surname, first name, place of residence of the applicant and, where appropriate, his capacity and national or
company number;
3° the surname, first name, place of residence and, if appropriate, the capacity of the person to be summoned
summoned;
4° the object and brief summary of the pleas in law of the claim
5° the court before which the claim is brought;
6° the signature of the applicant or his lawyer.
12 The petition and its annex, in as many copies as there are parties involved, shall be sent by registered letter
to the clerk of the court or deposited at the registry.
FOR THESE REASONS,
the Disputes Chamber of the Data Protection Authority, after deliberation, shall decide to:
- Under Article 100, §1, 5° of the CPC, reprimand the respondent.
