APD/GBA (Belgium) - 188/2022
|APD/GBA - 188/2022|
|Relevant Law:||Article 4(1) GDPR|
Article 5(1) GDPR
Article 5(1)(a) GDPR
Article 5(2) GDPR
Article 6 GDPR
Article 6(1)(f) GDPR
Article 12(1) GDPR
Article 12(4) GDPR
Article 17 GDPR
Article 17(1) GDPR
Article 17(1)(c) GDPR
Article 17(3) GDPR
Article 24(1) GDPR
Article 25(1) GDPR
Article 25(2) GDPR
Article 38 GDPR
Article 38(1) GDPR
Wet van 30 juli 2018 betreffende de bescherming van natuurlijke personen met betrekking tot de verwerking van persoonsgegevens
|National Case Number/Name:||188/2022|
|European Case Law Identifier:||n/a|
|Original Source:||Gegevensbeschermingsautoriteit (in NL)|
|Initial Contributor:||Enzo Marquet|
A TV show correctly invoked artistic freedom under Article 17(3)(a) GDPR in order to dismiss an erasure request.
English Summary[edit | edit source]
Facts[edit | edit source]
The data subject used a personalised license plate for his car, which he used for his business. The data subject was the sole owner of his company and did not have any employees. The personalised license plate he was using referred to Galatasaray, a well known Turkish football club. The licence plate contained letters and numbers that referred to this club. The producer of a television show (controller) used the same personalised licence plate on a similar looking car displayed in certain scenes of the show. This car in the series belonged to a fictional character, who was part of a fictional criminal organisation.
In Belgium, the registration of (personalised) licence plates is conducted by a federal institution. Using the website of this institution, people could verify if a licence plate was already in use by someone else, without disclosing the respective identity. This way, it could be checked beforehand if a desired personalised licence plate was already in use.
The data subject asked the controller to remove the license plate from the TV show pursuant to Article 17(1)(c) GDPR, because people recognised his licence plate as the one appearing in the TV show. According to the data subject, people also associated the data subject with the fictional criminal organisation from the show. The controller refused to remove the licence plate because, she argued, the license plate did not constitute personal data. In case that the licence plate was personal data, the controller stated that she was allowed to use this licence plate because of their freedom of (artistic) expression. In its reply to the data subject on 21 January 2022, the controller did not refer to the legal provision of Article 17(3)(a) GDPR, when refusing the data subject's request for erasure.
The data subject filed a complaint at the Belgian DPA on 22 February 2022, who started an investigation into the controller.
Holding[edit | edit source]
Is a licence plate personal data (Article 4(1) GDPR)?
The Belgian DPA determined that the licence plate was personal data (Article 4(1) GDPR) in these specific circumstances. The DPA started by acknowledging that a licence plate could constitute indirectly identifiable data. Family, neighbours and acquaintances could use the licence plate to identify the data subject. The DPA also considered the purpose of the processing, which was the appearance of the car in the TV show, and the way the processing took place, which was the publication of the TV series on a large television network and on a streaming service. The DPA also determined that that the license plate was data relating to a natural person, despite the fact that the licence plate was registered to a company car. Because there was only one company car, people could easily associate this car with the owner of the company, the data subject.
Was the controller's processing lawful? (Articles 5(1)(a) and 6 GDPR)
The DPA also assessed if the data processing was lawful in accordance with Article 6(1)(f) GDPR, for which the controller had to fulfill three criteria.
(1) The interest of the controller was the creation of the TV show, which was a legitimate interest. This interest was based on the freedom of artistic expression protected by the constitutional right of freedom of expression. The use of this fictional licence plate was purely an artistic expression in order to create and flesh out a fictional character.
(2) The second aspect was also fulfilled since the processing was necessarry to pursue the legitimate interest(s), looking at the artistic goal to emphasise the link with Galatasaray and the artistic freedom to choose a suitable way to achieve this goal.
(3) When conducting the balancing test, the DPA determined that the potential damage to the data subject was minimal. Only his personal and business contacts could link this licence plate to the data subject, who could all understand that the data subject was not the same person as the fictional character in the TV show. The TV show also contained a disclaimer that any link between the production and reality was purely incidental. The controller also had no knowledge of the existence of the licence plate of the data subject. The controller created her own licence plate and the similarity was purely coincidental. Lastly, the data subject chose to create a personalised license plate based on a well-known Turkish football club. It was foreseeable that such a licence plate could also be used for artistic purposes. The fact that the controller could have used a different license plate did not make the controller's use of this licence plate unlawful.
In this case, the controller's freedom of artistic expression outweighed the protection of personal data of the data subject. Therefore, the DPA determined that there was no breach of Articles 5(1)(a) GDPR and 6(1)(f) GDPR.
Did the controller violate Article 17 GDPR?
The DPA then considered whether the controller was allowed to use Article 17(3)(a) GDPR to deny the erasure request of the data subject pursuant to Article 17(1)(c) GDPR. The DPA referred to Article 85 GDPR and the national implementation of this GDPR provision into Article 24 of the Belgian law of 30 july 2018 (Act on the protection of natural persons with regard to the processing of personal data. This national law excluded the applicability of several GDPR articles in order to ensure freedom of speech. Article 17 GDPR was not part of this law. However, the DPA noted that that Article 17(3) GDPR explicitly provides the possibility to not comply with an erasure request for journalistic, academic, artistic or literary purposes. Since it was a GDPR provision, it was directly applicable into Belgian Law. The fact that the Belgian law did not mention Article 17 GDPR was therefore of no consequence.
The DPA held that the car and its license plate constituted an artistic expression, which fell under Article 10 ECHR (Freedom of Expression). The DPA stated that this was a case of a balancing act between two fundamental rights, with the freedom of expression (Article 10 ECHR and Article 11 CFR) on the one hand, and the right of protection of personal data (Article 8 CFR) on the other hand. To determine which fundamental right would prevail, a balancing exercise would have to be conducted with all of the relevant circumstances of the case.
The DPA considered that the football club Galatasaray was well known. It was therefore not impossible to imagine that the license plate would be used for the creation of a fictional character. It was also plausible that both the controller and data subject had followed the same reasoning to choose the license plate (i.e. showing affinity and association with the football club). Since there were no links between the data subject, the controller and the fictional character, the DPA stated that it was most likely just coincidence that 2 identical licence plates were used. It was also not possible for the controller to identify the data subject using the website of the federal institution, which only provided the option to check if a licence plate was in use. Thus, it was impossible for the controller to identify the data subject. The controller also had the freedom to choose this specific licence plate under her freedom of expression under Article 10 ECHR. Lastly, the data subject could have reasonably foreseen that other people could have used the recognisable numbers and letters for this personalised licence plate as well.
Considering all these factors, the DPA determined that the controller did not violate Article 17 GDPR. The artistic expression of the controller prevailed in the balancing exercise.
Violation of Article 12(1) GDPR
Then, the DPA assessed whether the controller did not adequately inform the data subject pursuant to Articles 12(1) and 12(4) GDPR. The DPA determined that the controller should have been more comprehensive in her answer, and should have included the specific legal ground it was using to deny the erasure request. The fact that the data subject was represented by legal council did not remove the obligation for the controller to comply with the transparency requirements of Article 12(4) GDPR. As such, the DPA concluded a breach of Article 12(1) GDPR, but only a minor one.
The DPA issued a warning pursuant to Article 100(1)(5) WOG in order to make the controller aware of the obligation to comply with the transparency requirements of Article 12(4) GDPR.
Comment[edit | edit source]
The federal institution registering licence plates in Belgium is the 'Federale overheidsdienst mobiliteit'. Within this organisation, the service 'dienst voor inschrijving van voertuigen' was responsible for the registering of licence plates.
The DPA also assessed several other violations regarding the controller, such as alleged violations of Articles 5, 24, 25, 37(1), 38(1) and 39 GDPR. The DPA did not find any violations regarding these provision. These considerations by the DPA were left out of this summary. This summary mainly focusses on the relation between the right of erasure and artistic freedom on the one hand, and the minor violation of not providing the specific legal ground for rejecting an erasure request on the other hand, since the latter was the only violation found in this decision.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.