APD/GBA (Belgium) - 145/2023
| APD/GBA - DOS-2020-00200 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 4(1) GDPR Article 6(1)(f) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 17.01.2020 |
| Decided: | 26.10.2023 |
| Published: | 27.10.2023 |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | DOS-2020-00200 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | GBA (in NL) |
| Initial Contributor: | Matthias Vandamme |
The Belgian DPA found that a college's communication of the reasons for dismissal of one of its former teachers to their colleagues and students was in violation of Article 6(1)(f) GDPR. Including the reason for dismissal was not necessary.
English Summary
Facts
A college (the controller) dismissed one of its teachers after a student had alleged that they had committed a physical assault against them. Following an internal investigation, the lecturer was dismissed for urgent cause. The college's board informed its staff and the lecturer's students of the dismissal and its reasons in March 2019: 'This [dismissal] follows physical aggression towards one of the students [...] a thorough investigation has shown that this incident makes any further functioning of [complainant's name] as an employee of [controller] impossible'. In January 20202, the teacher lodged a complaint with the Belgian DPA.
Holding
The Belgian DPA held that the emails were unlawful and reprimanded the college. To send them, the controller had relied on Article 6(1)(f) GDPR. The Belgian DPA refuted validity of such legal ground. In reaching its conclusion, the Belgian DPA applied the following three-step test to determine legitimate interest, as outlined by the CJEU in Case C-13/16, Rīgas satiksme (§ 28).
First, the purpose test. The Belgian DPA confirmed that the mere fact that the lecturer has been dismissed for cause justifies the need for an immediate and legitimate need to communicate this to students and colleagues.
Second, the necessity test. Some of the emails had been sent to students who were no longer enrolled. In this respect, the Belgian DPA argued that the communication was not necessary and found a breach of Article 6(1)(f) GDPR. For the emails to current students and colleagues, the Belgian DPA found that there was no need to communicate the reason for dismissal: 'physical aggression'. The Belgian DPA did acknowledged that there may be situations where it is necessary to state the reason for dismissal. However, in this instance, this was not the case.
Third, the balancing test. Finally, the Belgian DPA found that the balancing test was not respected. The Belgian DPA concluded that the college had failed to adequately consider the data subject's fundamental rights and freedoms when sending the emails. The DPA found that the controller in the emails 'did not provide enough objectively substantiated elements' and while the college claimed in its communication that the decision to dismiss had been taken only after 'a thorough investigation', this was insufficient for the purposes of the balancing test. As a result, the DPA found that the rights and freedoms of the data subject were excessively infringed.
Consequently, a breach of Article 6(1)(f) GDPR was found. As a result the Belgian DPA reprimanded the college.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
