APD/GBA (Belgium) - 49/2023

From GDPRhub
APD/GBA - 49/2023
LogoBE.png
Authority: APD/GBA (Belgium)
Jurisdiction: Belgium
Relevant Law: Article 6(1)(e) GDPR
Article 9(1) GDPR
Type: Complaint
Outcome: Upheld
Started:
Decided: 28.04.2023
Published:
Fine: n/a
Parties: n/a
National Case Number/Name: 49/2023
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): French
Original Source: APD/GBA (in FR)
Initial Contributor: n/a

The DPA considered that a school informing the pupils' parents that some professors were on strike did not reveal trade union membership and was therefore not a sensitive data under Article 9 GDPR. However, this processing was not necessary to carry out a public task (i.e. the school's education mission) and therefore lacked legal basis.

English Summary[edit | edit source]

Facts[edit | edit source]

In March 2022, a school (controller) organised a parents' meeting and informed the parents that some teachers would not be able to attend because they were on strike. In practice, the school sent out a list of teachers and marked them as 'on strike'. Other teachers were absent for other reasons and the school simply added the word "absent" without additional information.

A few days after the strike, the union delegation contacted the school management to say that this was inappropriate. The school did not respond to this. Five striking teachers therefore lodged a complaint with the DPA, claiming that the controller had violated Article 9(1) GDPR by disclosing their trade union membership without a legal basis. Alternatively, they considered that the controller had violated Articles 5(1) and 6(1) GDPR.

In its defence, the controller explained that the meeting of parents is part of its public interest mission (education) which is a legal basis under Article 6(1)(e) GDPR. It added that calling a teacher a striker did not reveal a trade union membership and that the situation therefore did not fall within the scope of Article 9 GDPR. However, the controller acknowledged that the use of the term striker should have been avoided. It added that this was a human error and that it was taking steps to avoid similar errors in the future.

Holding[edit | edit source]

The DPA joined the complaints and began by examining whether or not the term "striker" fell within the scope of Article 9(1) GDPR. To be covered by this article, the reference must reveal trade union membership. The DPA referred to the English and Dutch versions of the GDPR and considered that being a striker does not reveal trade union membership within the meaning of Article 9(1) GDPR.

On the other hand, the DPA considered that the qualification of "striker" could constitute "highly personal" data within the meaning of the EDPB guidelines on DPIA. This implies that they are sensitive in the common sense of the term which may increase the possible risk to rights and freedoms. The DPA also added that sensitive data must be interpreted broadly, but that even a broad interpretation does not allow the striker to be considered as falling within the scope of Article 9(1) GDPR.

Since Article 9 GDPR was not applicable, the DPA examined the lawfulness of the processing under Article 6(1)(e) GDPR which was put forward by the controller. It considered that the education mission of the controller includes an aspect of communication with the parents of the pupils. However, the communication of the status of striker was not necessary for this task. The DPA explained that simple information that absent teachers could be contacted at another time would have been sufficient.

In conclusion, the DPA considered that the controller had no legal basis for his processing. In view of the measures already taken by the controller, the DPA issued a reprimand.

Comment[edit | edit source]

Share your comments here!

Further Resources[edit | edit source]

Share blogs or news articles here!

English Machine Translation of the Decision[edit | edit source]

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/19






                                                                        Litigation Chamber


                                          Decision on the merits 49/2023 of 28 April 2023




File numbers: DOS-2022-02905 – DOS-2022-02908 – DOS-2022-02910 –

DOS-2022-02912– DOS-2022-02915


Subject: Complaint relating to the communication of the status of striking teacher by a

school when organizing a parent-teacher meeting –

procedure on the merits guaranteeing the confidentiality of the identity of the complainants

against the defendant




The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke
Hijmans, chairman, and Messrs. Romain Robert and Christophe Boeraeve, members;


Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and
to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the

data protection), hereinafter "GDPR";


Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter
ACL);


Having regard to the internal regulations as approved by the House of Representatives on 20

December 2018 and published in the Belgian Official Gazette on January 15, 2019;

Considering the documents in the file;



Made the following decision regarding:


The Complainants:

    1. Mr. X1, hereinafter “Complainant No. 1” (DOS-2022-02905);



    2. Mr. X2, hereinafter “Complainant No. 2” (DOS-2022-02908);


    3. Mr. X3, hereinafter “Complainant No. 3” (DOS-2022-02910); Decision on the merits 49/2023 – 2/19



    4. Ms. X4, hereinafter "Complainant No. 4" (DOS-2022-02912);


    5. Mr. X5, hereinafter "Complainant No. 5" (DOS-2022-02915);


    All 5 represented by their counsel, Maître Laurence RASE, lawyer, whose firm is

    established at 4000 Liège, Quai de Rome, 2.



    Hereinafter referred to together as “the (striking) teachers” or “the plaintiffs”.




The defendant: Secondary school Y, hereinafter “the defendant”.







I. Facts and procedure


1. During the months of May and June 2022, the complainants each lodged a complaint with
    of the Data Protection Authority (APD) against the defendant. 1


2. The subject of their complaint concerns the communication by the defendant of their status

    striking teacher when sending by e-mail to all the parents of pupils of the list of

    teachers who can be met during the meeting of parents of pupils of

    the establishment of March 29, 2022. The facts are more fully detailed in the points which

    follow.


3. On July 7, 2022, the 5 complaints were declared admissible by the Front Line Service (SPL)
    DPA ON THE BASIS OF ARTICLES 58 AND 60 OF THE ACL AND COMPLAINTS ARE FORWARDED TO THE Chamber

    Litigation under Article 62, § 1 of the LCA.


4. Under the terms of his complaint, each complainant requests, ticking the box provided for this purpose in

    the complaint form, whether its data is masked, or whether it is not

    communicated to the defendant.


5. At the end of August 2022, the Litigation Chamber asked each plaintiff whether he
    whether or not he agreed to his identity being communicated to the other complainants, the

    confidentiality remains preserved with regard to the defendant.


6. Each complainant, in response, indicated his agreement to the communication of his identity to the

    other complainants.






1 Complaints 1, 2 and 5 are dated May 10, 2022 (complaint 2 was received on July 4, 2022). Complaint 3 is dated May 30, 2022 and
4 is dated June 6, 2022. Decision on the merits 49/2023 – 3/19


7. The plaintiffs are all members of the teaching staff of the defendant and employees

    of it within the Y secondary school.


8. On March 29, 2022, a strike was organized at the initiative of the trade unions
    representatives of staff in the education sector.


9. On the same March 29, 2022, a parents' meeting was organized within the defendant in order to

    to allow the parents of the pupils of the school to meet the teachers individually.


10. The parties report that by an email dated March 25, 2022, the management of the defendant
    appealed to all of its teachers in these terms:


        "As you know, the parents' meeting will take place on March 28, 2022 (read March 29

        2022). However, the strike will take place this Tuesday as well. I ask those who intend to do

        strike to report it to me for this Monday at 9am at the latest so that I report your absence to the

        educators and parents.


       On the other hand, if you are absent, you will have to ensure the parents' permanence this Thursday at

       from 3:30 p.m. instead of this Tuesday, unless you still participate in

       parent's meeting.


11. The complainants point out that several members of the teaching staff – including

    union representatives – in response, informed the school management that they would participate in

    strike action.

12. On March 29, 2022, the management of the defendant informed the parents of the students of the terms

    organizing the parent meeting on the same day. A letter is sent to the parents

    of students by email. The complainants specify that they are several hundred parents. THE

    complainants report that this mail was also distributed, by hand, on the spot

    at school on the day of the parents' meeting by the management present at the entrance of the establishment.

13. This letter states this:


        “As announced in the media, some teachers have decided to follow the

        strike action organized today. On the back you will find the list of

        striking teachers as well as sick teachers who will not be present at the

        parent meeting. However, the striking teachers were asked to take
        contact with the parents concerned in order to fix an appointment this Thursday afternoon for

        meet you ".



14. The list of school teachers is attached to the letter. It lists the premises where the
    teachers will be present. Considering the names of the teachers who announced to the management

    their participation in the strike (point 10 above), the mention "striker" is affixed. This was Decision on the merits 49/2023 – 4/19


    in particular the case with regard to the name of the complainants. For other teachers absent during

    of the parents' meeting, it is indicated "abs", without specifying the reason for their absence.


15. The complainants add that a few days after March 29, 2022, a trade union delegation
    challenged Y's management team orally about this way of proceeding. She has him

    reports the inappropriate nature of such a communication which mentions data to be

    "sensitive" personal character according to her to third parties, communication querien justified. THE

    complainants further add that the management of Y did not intend to follow up on this

    questioning and that the trade union representatives concerned were dismissed.

16. Following these events, five members of the striking teaching staff were, as he

    has been set out in point 1, lodges a complaint with the DPA, in order to denounce a violation of the

    GDPR. They insist on the deleterious climate within the establishment and the contempt opposed to the

    right to strike more generally.


17. On October 6, 2022, the Litigation Chamber informs the parties by registered mail of the
    provisions as set out in article 95, § 2 as well as in article 98 of the LCA. In this

    mail, the Litigation Chamber, taking into account the request for confidentiality of the

    plaintiffs against the defendant:


            To. Decides to join the complaints which it considers to be so closely related that there is

                interest in instructing them and making a decision about them at the same time in order to
                guarantee the consistency of its decisions;


            b. Takes note that the Complainants request confidential treatment of their

                identity with respect to the defendant. The Litigation Chamber considers in this

                respect that it is able to pursue the examination of complaints without disclosing

                the identity of the plaintiffs to the defendant;

            vs. Takes note that the complainants have each given their agreement that their

                identity is shared with other complainants;


            d. Summarizes the facts reported by the complainants under each of their complaints

                and specifies that at the request of the defendant, the anonymized file relating to
                each complaint will be communicated to him;


            e. Invites the parties to submit their respective arguments to it in the form of

                conclusions. The Litigation Chamber more particularly invites the

                defendant to specify the methods of the communication of the letter of March 29
                2022 as well as to put forward its arguments with regard to potential breaches

                revealed by the facts, in particular with regard to the basis of lawfulness on which it

                believes that he can justify the processing (internal registration, communication

                to the parents) of the “striking” data attached to each of the complainants. The Chamber Decision on the merits 49/2023 – 5/19


                Litigation cannot exclude at this stage of the procedure the application of the article

                9 of the GDPR, it invites the defendant to defend itself both with regard to articles

                5.1.a) and 6 of the GDPR only with regard to Article 9 combined with Article 6 of the GDPR;

            f. Defines that the defendant must file its submissions in response no later than

                on November 17, 2022 and its submissions in reply no later than January 2, 2023.

                The plaintiffs are invited to file their joint conclusions on

                if applicable – 9 December 2022 at the latest (article 99 LCA);


            g. Indicates that in view of the complainants' request for confidentiality, it
                will itself communicate the conclusions to the other party for

                guarantee the adversarial nature of the procedure while preserving this

                request for confidentiality. The Litigation Chamber adds that these conclusions

                will be communicated as is to the other party and that it is therefore the responsibility of the

                complainants to draft them in such a way as to preserve the confidentiality of their

                identity with respect to the defendant.

            h. Indicates that if the parties wish to file exhibits in support of their

                conclusions, they are invited to do so at the same time as submitting these

                latest. The procedures for preserving the confidentiality of the identity of the

                plaintiffs with regard to the defendant will be identical to those provided for in point

                g).

            i. Finally, specifies that taking into account the complainants' request for confidentiality, a

                hearing cannot be granted to them. Indeed, as soon as a party requests

                hearing, all parties are invited to attend. The anonymity of the parties e

                can therefore be guaranteed during the hearing, the parties being heard together and

                not separately (Article 53 of the RoI).

18. On November 16, 2022, the Litigation Chamber receives the submissions in response from the

    defendant. The summary of the defendant's position is set out in point 20 above

    including his reply.


19. On December 8, 2022, the Litigation Chamber receives from the complainants their conclusions in
    common replicas.


        To. The plaintiffs mainly denounce a violation of Article 9 of the GDPR. They

            indeed consider that by communicating their status as striker, the defendant treated

            sensitive data concerning them – more particularly their membership

            trade union – without having any basis of lawfulness to do so.

        b. Union membership, according to the complainants, includes any expression of an activity

            union, which must be understood in a broad sense. It is not synonymous Decision on the merits 49/2023 – 6/19


    of union affiliation. Participation in a strike organized at the initiative

    of trade union organizations representing workers constitutes an activity

    union, regardless of whether or not the participants are

    affiliated with a union. This is the exercise of the fundamental rights of freedom
    of expression (Article 10 of the European Convention on Human Rights - ECHR) and

    freedom of assembly and association (article 11 of the same ECHR).


vs. Reveal to third parties - in this case to parents of pupils - the status of "striker" of a

    group of teachers therefore constitutes data processing referred to in Article 9 of the
    GDPR. The term "striker" reveals the participation of teachers in an activity

    union and, consequently, their union membership. It is undisputed that the

    complainants have not consented (article 9.2.a) of the GDPR) and the complainants believe

    that no other basis of lawfulness provided for in Article 9.2 of the GDPR applies.

d. In the alternative, failing the Litigation Chamber to find a violation

    of Article 9 of the GDPR, the plaintiffs believe that the defendants have at least

    found guilty of a breach of Articles 5.1 and 6.1 of the GDPR.

        i. The plaintiffs exclude the bases of lawfulness listed in Article 6.1 of the GDPR, that

            it is their consent, the legal obligation to which the defendant would be

            held, or even the mission of public interest with which the latter would be invested.


        ii. The plaintiffs point out that the defendant does not dispute the character
            inadequate communication but Islam minimizes it. An alternative should have

            complainants be put in place which would simply indicate that some

            members of the teaching staff unavailable on March 29, 2022 would ensure

            a permanence on March 31, 2022 or later.

        iii. The plaintiffs also believe that the defendant cannot be followed

            when it claims that the communication would have been made in a fair and

            transparent to the staff members concerned. They point out that

            in its letter of March 25, 2022 (point 10), the management of Y told them that

            this information was requested from them in order to be able to warn the parents of their

            absence, and not the reasons for this absence. The data communicated
            have therefore not been treated fairly or adequately,

            relevant and limited to what was necessary for that purpose. THE

            sections 5.1. a) and c) of the GDPR have thus been violated as well as article 6.1. of

            GDPR.

e. The plaintiffs asking the Litigation Chamber to pronounce a sanction

    exemplary (an administrative fine or at the very least a reprimand) with regard to

    the defendant who takes into account a) the sensitive nature of the data communicated

    which is indicative of the complainants' union conviction and is the subject of a Decision on the merits 49/2023 – 7/19


            special protection under Article 9 of the GDPR in the form of a prohibition

            of principle with exceptions as well as b) the distribution by e-mail of this

            information to several hundred parents of students.


        f. On the basis of article 100.1, 9° of the LCA, the plaintiffs also postulate that it is
            ordered the defendant to formally remind its management of its obligations in

            regarding the protection of personal data and to prohibit any

            subsequent disclosure of data without first obtaining consent

            expressly from the staff members concerned as to this disclosure and the purposes

            for which it is authorized.

 20. On December 29, 2022, the Litigation Chamber receives the conclusions in reply of the

       defendant. The defendant's argument – as developed both in its

       conclusions in reply than in those in reply – can be summarized as follows:


            To. The date of March 29 scheduled for the parents' meeting had been set in

                consultation with staff representatives at the end of the school year
                former.


            b. This parent meeting is an important deadline for parents of students –

                especially for those who encounter difficulties – which allows them to

                receive information and educational advice aimed at the success of their

                child at the end of the school year.

            vs. This meeting fits in a very essential way within the framework of

                the execution of its mission as provided for by the Decree defining the missions

                priorities for basic education and secondary education in the 24
                             2
                July 1997. It contributes to the necessary cooperation between parents and

                teachers, who are also part of all the schools' educational projects. She

                results from the exercise of its public interest mission within the meaning of Article 6.1.e) of the
                GDPR.


            d. The information that some teachers are on strike has been collected

                in a fair and transparent manner following communication by the management of the

                email of March 25, 2022 cited in point 10 above.

            e. Contrary to what the plaintiffs state, the term "striker" does not reveal

                not union membership. The reasoning of the defendant is in this

                regard to the following:








2M.B., September 23, 1997. Decision on the merits 49/2023 – 8/19


                     i. The right to strike is recognized for all workers whether they belong or

                        no to a union and any worker, unionized or not, can choose to

                        participate in such and such a strike;


                     ii. A strike can occur without union intervention. She is not

                        conditioned by a union initiative;

                    iii. As a result, assimilating the fact of participating in a strike (and therefore of being

                        “striker”) to that of belonging to a union organization is based on

                        erroneous premises;

                    iv. Trade union membership consists of affiliation to a trade union. There

                        English GDPR terminology “trade -union membership” is in this regard

                        enlightening. It is also this status that is likely to lead to

                        discrimination at the very least differential treatment, which Article 9

                        of the RGP D seeks to avoid. Participation in a strike may, on the other hand,

                        be a one-off act like any exercise of other rights related to the right of the

                        work.

                     v. The notion of union membership is strictly interpreted. Account

                        given that Article 9 of the GDPR consists of an exception to Article 6 of the

                        GDPR, the interpretation of the ban on data processing

                        “revealing trade union membership” must be interpreted restrictively. A

                        excerpt from recital 51 of the GDPR is invoked by analogy in this respect. 3


                    vi. Finally, the defendant wonders whether the fact of
                        infer that a person, by virtue of his participation in a strike, belongs

                        necessarily to a union would not constitute an inference to the contrary

                        the principle of data accuracy set out in Article 5.1.c) of the GDPR.


            f. The qualifier "striker" should have been avoided and the defendant expresses its

                sorry about the use of this terminology. The terms “absent (for

                sick teachers) and “contactable” (for strikers absent on March 29
                but that the parents could contact) would have been preferable according to her.


            g. The defendant adds that it has endeavored to implement all of the

                obligations arising from the GDPR and that it has, for this purpose, engaged a delegate for the

                external data protection (DPO) in 2021 which has done a substantial job

                and helped to train and sensitize staff members on issues of

                Data protection. In terms of achievements, the defendant cites:



3Recital 51: (…) The processing of photographs should not systematically be considered as constituting
processing of special categories of personal data, given that these do not fall under the
definition of biometric data only when they are processed according to a specific technical method allowing
unique identification or authentication of a natural person. (…) Decision on the merits 49/2023 – 9/19


    the establishment of the various registers (of processing activities, breaches

    data, access), mandatory training for staff members,

    the publication of a document containing the essential points of the GDPR to be respected

    or the implementation of information security measures.

h. This is a one-time incident resulting from human clumsiness on the part of a

    school collaborator when sending a single communication in a

    emergency context. This is not a decision of the defendant in the sense of a

    decision that would have been taken by the organizing authority. The defendant indicates
    that it would like to point out in this respect that it does not have a database in

    which this quality would be listed and which it in no way intends

    categorize its staff members on this basis in its processes

    administrative.

i. The defendant further observes that if the plaintiffs were to be

    union representatives, it cannot be excluded that Article 9.2. e) GDPR

    applies. Under this article, the prohibition of data processing

    sensitive (including those revealing trade union membership) is lifted when “the

    processing relates to personal data which are manifestly

    made public by the data subject”. Confirmation of applicability
    of this article could result in the lifting of the “anonymity” of the complainants.


d. To prevent this error from recurring in the future, the defendant indicates

    that she will take the following additional actions suggested to her are
    DPO:


         i. Implementation of an obligation to monitor the training provided in 2021

            within 3 months of taking office, with particular attention to

            school administrative staff;

        ii. Organization of a question-and-answer session with the DPO during

            pedagogical daysforexampleificeladewouldrespondtoarequest

            Staff ;

        iii. Putting on the agenda of a meeting with the local authorities of

            competent consultation (Works Council and Committee for the

            prevention and protection at work - CPPT) with a view to determining

            together the procedures and terms to be used when communicating
            different types of school absences.


k. Finally, the defendant regrets not having been questioned directly by the

    complainants following the distribution of the list, which would have allowed a dialogue. She

    furthermore denies any denial of the right to strike within it underlining by Decision on the merits 49/2023 – 10/19


                elsewhere the lack of competence of the Litigation Chamber to hear

                this type of grievance.

21. The filing of these submissions in reply closes the exchange of arguments between the parties. None

    of them not having requested a hearing and the Litigation Chamber not having convened a hearing

    on its own initiative, the Litigation Chamber decides as set out below.




II. Motivation


    II.1. As to the jurisdiction of the Litigation Chamber


22. Pursuant to Article 4 § 1 of the LCA, the DPA is responsible for monitoring the principles of

    data protection contained in the GDPR and other laws containing provisions

    relating to the protection of the processing of personal data. In application of

    Article 33 § 1 of the LCA, the Litigation Chamber is the administrative litigation body

    of ODA. It receives complaints that the SPL transmits to it pursuant to Article 62 § 1.
    LCA, or admissible complaints.


23. As the Litigation Chamber has already had occasion to state, data processing

    data are operated in multiple sectors of activity, in particular within the framework

    professional as in the present case. The fact remains that the competence of
    the APD in general, and of the Litigation Chamber in particular, is limited to the control of the

    compliance with the regulations applicable to data processing, regardless of the sector

    of activity in which this data processing takes place. Its role is not to

    substitute for the courts of the judiciary in the exercise of the powers which are the

    their labor rights and the right to strike, for example




    II.2. Regarding the alleged violations of the GDPR


      II.2.1. Regarding the principles of lawfulness and minimization (Article 5.1.a) and 5.1.c) of the GDPR
              as well as Articles 6 and 9 of the GDPR)


24. Any processing of personal data must, in application of the principle of lawfulness

    devoted to Article 5.1. a) of the GDPR, rely on one of the bases of lawfulness of Article 6.1. of

    GDPR. When the data controller processes data that comes out of the "categories

    specific data”, he must also comply with the conditions of article 9 of the GDPR read in
    combination with Article 6 GDPR.


25. Article 6 of the GDPR thus provides that personal data may be processed

    if their processing can validly be based on one of the 6 bases that it lists, namely: the

    consent of the data subject (Article 6.1.a)), the performance of the contract or measures Decision on the substance 49/2023 – 11/19


    pre-contractual obligations taken at the request of the data subject (Article 6.1.b)), the execution

    a legal obligation (Article 6.1.c)), the vital interest of the data subject (Article 6.1.d)),

    the execution of the public authority or the public interest mission with which the

    controller (article 6.1. e)) or legitimate interest (article 6.1.f)). In all

    cases, the data processing must be necessary.

26. Article 9 of the GDPR (special categories of data) provides for its part n its § 1 , a

    ban on the processing of so-called “sensitive” data in these terms: “the processing of

    personal data that reveals racial or ethnic origin, political opinions,

    religious or philosophical beliefs or trade union membership, as well as the

    processing of genetic data, biometric data for the purpose of identifying a

    natural person in a unique way, data concerning health or data
    concerning the sex life or sexual orientation of a natural person are prohibited”.


27. Recital 51, which explains Article 9 of the GDPR, specifies in particular that "in addition to the requirements

    applicable to this processing [read the processing of these special categories of

    data], the general principles and other rules of this Regulation should

    apply, in particular with regard to the conditions of lawfulness of the processing”. In

    in other words the application of article 9.2. of the GDPR which authorizes the processing of said
    data in some cases should be read in conjunction with Section 6.1. of the GDPR which requires

    that any processing is based on one of the 6 bases of lawfulness that it sets out.


28. Consequently, it is essential before being able to consider whether or not a basis of lawfulness

    failure, as denounced by the complainants, to qualify the data processed to determine whether the

    compliance with Article 6 GDPR alone must be verified or whether, in the presence of data falling within the

    article 9.1. of the GDPR (i.e. data qualified as “sensitive”), this is compliance with article 9.2
    read in conjunction with Article 6 of the GDPR which should be checked.


29. In the present case, it is not disputed that the mention “striker” attached to the identity of the complainants

    and other staff consists of personal data relating to

    the latter within the meaning of Article 4.1. of the GDPR. In fact, this is information relating

    to directly identified natural persons since the statement is affixed opposite

    of their first and last name.

30. Nor is it contested that the communication made by the defendant via her e-mail

    of March 29, 2022 sent to parents of students is processing within the meaning of Article 4.2. of

    RGD. It is indeed a communication made in this case using methods

    automated.

31. The views of the parties differ on the other hand on the question of whether the qualifier

    “striker” falls under Article 9.1 or not. of the GDPR, more particularly if it reveals, within the meaning of Decision on the merits 49/2023 – 12/19


    this provision, the trade union membership of the complainants. The summaries of the conclusions of the

    parties set out in points 19 and 20 state their respective arguments in this regard.


32. The Litigation Chamber notes that in order to be covered by Article 9 of the GDPR, the information

    status as a striker must reveal union membership. The Litigation Chamber is

    of the opinion that the fact of being a striker does not reveal this membership. Union membership

    indeed consists of trade union membership, which the English version of the GDPR translates better

    as well as the French term "affiliation". The English version retains the terms of

    "trade-union membership" which translates the idea that the person concerned is a member

    “member”) of a trade union. The Dutch version also clearly mentions being

    affiliated to a trade union using the term "lidmaatschap" either which is "lid" or which is

    “member”. However, the right to strike is open to all workers whether or not they are affiliated to

    a syndicate. A strike does not necessarily have to be organized at the initiative of a
    union. In other words, a participant in a strike is not necessarily a member of a

    union. He may be, but if necessary, his participation in the strike will not be revealed. In other

    In other words, being a striker does not reveal union membership. The Litigation Chamber

    considers, moreover, that the fact of deducing that a person, because of his participation in a

    strike, would necessarily belong to a trade union would constitute an inference contrary to the

    principle of data accuracy enshrined in Article 5.1.c) of the GDPR.


33. The Litigation Chamber concludes that the mention of the quality of striker of the complainants

    does not consist of processing data revealing trade union membership within the meaning of Article

    9.1 GDPR. The Litigation Chamber, on the other hand, is of the opinion that the qualification of

    "striker" can be considered as "highly personal" data in the
    meaning that the European Data Protection Board (EDPB) has given to this concept in

    its Data Protection Impact Assessment (DPIA) Guidelines . 4

    The EDPS stresses that, beyond the provisions of the GDPR, certain categories of data

    may be considered to increase the possible risk to the rights and freedoms of

    people. They are “sensitive” in the common sense of the term and require attention

    particular when they are processed, the philosophy of the GDPR being characterized by a

    approach on the risk and on the taking of measures intended to take them into account and

    minimize.


34. The Litigation Chamber adds abundantly that it does not, however, share the point

    Defendant's view that Article 9.1. of the GDPR should, in principle, be
                                                      er
    interpreted restrictively, In a judgment of August 1, 2022, the Court of Justice of the European Union
    (CJEU) has clearly specified that “(…) a broad interpretation of the notions



4Article 29 Group, Guidelines on Data Protection Impact Assessment (DPIA) and Data Protection
how to determine whether the processing is “likely to create a high risk” for the purposes of Regulation (EU) 2016/679,
WP 248 of October 4, 2017: https://www.cnil.fr/sites/default/files/atoms/files/wp248_rev.01_fr.pdf. These guidelines
were endorsed by the European Data Protection Board at its inaugural meeting on 25 May
2018: https://edpb.europa.eu/sites/default/files/files/news/endorsement_of_wp29_documents_en_0.pdf Decision on substance 49/2023 – 13/19



    of “special categories of personal data” and of “sensitive data” is

    supported by the objective of Directive 95/46 and the GDPR, recalled in paragraph 61 of this judgment,

    which is to guarantee a high level of protection of the fundamental rights and freedoms of

    natural persons, in particular their privacy, with regard to the processing of personal data.

    personal character concerning them (see, to this effect, judgment of 6 November 2003, Lindqvist,
                                           5
    C-101/01, EU:C:2003:596, point 50)’.

    The Court adds that "the contrary interpretation would, moreover, run counter to the purpose of

    Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR,

    consisting in ensuring increased protection against processing which, because of the

    particular sensitivity of the data which is the subject of it, are likely to constitute, as well as

    that it appears from recital 33 of Directive 95/46 and recital 51 of the GDPR, a

    particularly serious interference with the fundamental rights to respect for private life and to

    the protection of personal data, guaranteed by Articles 7 and 8 of the Charter

    [see, incense, judgment of September 24, 2019, GCe.a. (Dereferencing of sensitive data),

    C-136/17, EU:C:2019:773, point 44] » .6


35. In this case, the Litigation Division considers that this interpretation, even broad (and not

    not restrictive as the defendant postulates) does not allow to consider that the quality

    striker reveals, even indirectly, trade union membership and should therefore be

    considered as sensitive data within the meaning of article 9.1. of the GDPR. as well as the room

    Litigation she explained, this qualification would be based on the erroneous premise that any

    striker is unionized and would otherwise violate the principle of data accuracy

    as also already mentioned.


36. Since the defendant was not processing sensitive data, Article 9 of the GDPR is not applicable.
    application. The Litigation Chamber's assessment of the legality of the processing of the

    "striker" data will therefore be made from article 6.1 alone. of the GDPR and the principles

    general terms set out in Article 5 of the GDPR and not at the start of Article 9.2. read in combination with

    GDPR Article 6.


37. As a basis of lawfulness, the defendant indicates that the disputed communication was part of

    within the framework of the execution of its mission of public interest of teaching and that it was from

    therefore founded on the basis of Article 6.1.e) of the GDPR which authorizes the processing of data

    when "the processing is necessary for the performance of a task in the public interest or falling

    the exercise of official authority vested in the controller”. She returns






5CJEU, judgment of August 1, 2022, OTagainst Vyriausioji tarnybinės etikos komisija, C-184/20, ECLI:EU:C:2022:601, point
125). It is the Litigation Chamber which underlines.


6Point 126 of the aforementioned judgment. It is the Litigation Chamber which underlines. Decision on the merits 49/2023 – 14/19


    to the "Missions" decree already cited without further clarification as well as to the educational regulations of the

    schools (item 20).

38. The mobilization of article 6.1.e) of the GDPR presupposes the meeting of the conditions below that

    the Litigation Chamber will endeavor to verify:


    - The data controller must, in accordance with Article 6.3.b) of the GDPR read in the light

        of recitals 41 and 45, be entrusted with the performance of a task in the public interest or

        relating to the exercise of official authority by virtue of a legal basis, whether in law

        of the European Union or under the law of the Member State;

    - The purposes of the processing must be necessary for the performance of the mission of interest

        public or the exercise of public authority.


39. Recital 41 clarifies the quality of this legal basis. : :" When

    this Regulation refers to a legal basis or a legislative measure, this does not
    does not necessarily mean that the adoption of a legislative act by a parliament is required, without

    prejudice to the obligations provided for under the constitutional order of the Member State

    concerned. However, this legal basis or legislative measure should be clear and

    precise and its application should be foreseeable for litigants, in accordance with the

    case law of the Court of Justice of the European Union (CJEU) and of the European Court of
    human rights (Eur. Court D.H.)”.


40. In other words, according to recital 41, this legal basis or measure

    legislation should be clear and precise and its application should be predictable for
    litigants, in accordance with the case law of the CJEU and the Eur. D.H.


41. This requirement of foreseeability implies that certain constituent elements of the processing be

    registered in the legal basis, including in particular the purpose of the processing.

42. As to the requirement of necessity (the processing is lawful only if and insofar as it is

    necessary for the execution of the mission of public interest to take only one of the hypotheses

    covered by Article 6.1 of the GDPR), the Litigation Chamber has already pointed out that the legislation does not

    often contains no specific provision for the necessary data processing. THE

    data controllers who wish to invoke Article 6.1.e) of the GDPR under such
    legal basis must then themselves carry out a weighting between the need for the

    processing for the task of public interest and the interests of data subjects.


43. As mentioned in point 39, the Litigation Division will endeavor to verify whether the

    conditions for recourse to Article 6.1. e) of the GDPR were met in this case. Decision on the merits 49/2023 – 15/19



    As for the mission of public interest and the quality of the legal basis which consecrates it


44. The defendant invokes in this respect its teaching mission as it is in particular
                                                                                        7
    regulated by the “Missions” decree of the French community in Belgium. Bedroom

    Litigation considers that a school such as that of the defendant is

    certainly vested with a mission of public interest within the meaning of Article 6.1. e) GDPR.

45. The “Missions” decree already cited provides for several provisions under which parents

    secondary school students are informed and/or involved in decision-making

    about their child. Thus, for example, the class council is designated as being

    responsible for student guidance. “To this end, it associates the psycho-

    medico-social and parents. To this end, he guides each student in the construction of a project

    school and professional life according to the methods described in article 67” (article 22).


46. Article 67.1 of the "Missions" decree provides for the mandatory adoption by the establishment

    of a school project which must be drawn up taking into account "(…): 2° the

    aspirations of students and their parents in terms of career plans and

    continuation of studies » .8


47. Article 67.2 of the decree provides that “the management plan, whose model and

    termsaredecidedbytheGovernment,includesinparticularthefollowingpoints:(…)g)

    the partnership and collaboration strategy with the parents of the school's students,

    in consultation with the participation council”.


48. Finally, numerous provisions of the “Missions” decree mention contact with the

    parents in the provisions relating to a change of establishment, the evaluation of

    specific needs, in cases of absenteeism and exclusion decisions in particular.

                                                                                                      9
49. The decree of February 2, 2007 establishing the status of principals and directors in education,

    provides for its part that the profile of a director necessarily includes a responsibility in

    terms of internal and external communication, particularly with regard to parents.


50. In conclusion, it emerges from the aforementioned texts that the public mission of teaching a

    school such as the defendant includes communication with parents about

    their child's experience in the school.

51. In line with point 47, the defendant's business plan provides for contacts

    regularly with parents. .





7
 Decree defining the priority missions of basic education and secondary education and organizing
structures to achieve them, French Community, July 24, 1997, M.B., September 23, 1997.
8It is the Litigation Chamber that underlines.
9
 Decree of the French Community of February 2, 2007 establishing the status of directors in education,
M.B., 15 May 2007. Decision on the merits 49/2023 – 16/19


52. The Litigation Chamber considers that the organization of parents' meetings in a school

    secondary requires that parents be informed of where they can meet the

    present teachers of their children, these teachers being different according to the subjects

    dispensed.

53. In conclusion on this point, the Litigation Division is of the opinion that the organization of the meeting

    of parents of March 29 and the communication of the presence or absence of one or

    the other teacher that the parents would like to meet participates in the execution of the

    defendant's public teaching mission. This communication pursues a

    legitimate and necessary purpose for the performance of this mission which is based on
    various legal texts governing the exercise by a school of its mission

    teaching, including communication with the parents of students regarding schooling

    of their child.


    As for the need to process “striking” data

54. On the other hand, with regard to the communication of the complainants' status as strikers, the

    Litigation Chamber considers that it was not necessary for the achievement of the purpose of the

    treatment which consisted in indicating to the parents which teachers would be present that they

    could meet during the parents' meeting of March 29, 2022. In this respect, only the

    mention of the absence of certain teachers, for any reason whatsoever, having been

    sufficient. The distinction that the defendant actually intended to make between teachers
    strikers who would have been “contactable” two days later and the others who would not have been

    not been due to their absence, for example for illness, does not convince the Chamber

    Litigation. Indeed, a teacher who is ill or absent for any other reason on the day of the

    parents' meeting could, a priori, if necessary, be contacted at short notice also by the

    parents too. The Litigation Chamber is in this respect of the opinion that it was sufficient for the

    defendant to put in place general information according to which, as far as
    concerned absent teachers, another time to be agreed could be fixed.


    Conclusion


55. In conclusion, it appears from the foregoing that the defendant communicated to the parents

    of students a personal data relating to the complainants which was not necessary for the purpose
    she was chasing. On this basis, the Litigation Chamber concludes that the defendant has

    found guilty of a breach of Article 6.1.e) of the GDPR and more generally of Article 6

    of the GDPR – no other basis of lawfulness can be invoked by the defendant by

    elsewhere – combined with Article 5.1.c) of the GDPR.


56. As to the defendant's allusion to the possible application of Article 9.2.e) of the GDPR, the
    Chambre Litigation emphasizes that even if the status of trade union representative of the complainants

    or one of them was proven, the mention of their or their status as a “striker” does not in Decision on the merits 49/2023 – 17/19


    would not reveal this "trade union membership". In this particular case, it could be

    relevant to the purpose for which such data was processed. The data

    "striker" was not processed for the sensitive information it would contain, either to reveal

    the trade union membership of the complainants. Article 9 would therefore not apply. AT

    even assuming that it is, the status of union representative is certainly made public by the

    person concerned but this circumstance does not authorize that any

    processing of this data can take place. Indeed, Article 9.2. cannot be applied alone
    but must be done in combination with Article 6 of the GDPR. In this case, the condition that the

    processing is necessary for the exercise of the public mission remains. Section 9.2. is limited to

    lift the ban on the processing of sensitive data. However, the Litigation Chamber has

    demonstrated above that this condition of necessity was not fulfilled.





      II.2.2. As for the principle of loyalty (article 5.1.a) of the GDPR)

57. The Litigation Division considers that it does not have sufficient evidence to conclude that

    a proven lack of loyalty on the part of the defendant.


58. Section 5.1. a) of the GDPR does not only enshrine the principle of lawfulness discussed above

    above but also the principle of loyalty that the data controller must respect.

    This principle of loyalty is also enshrined in Article 8.2. of the Bill of Rights

    fundamentals of the European Union (EU) according to which the data “must be
                        10
    processed fairly, for specific purposes and on the basis of the consent of the person
    concerned or under another legitimate basis provided for by law. ". This duty of loyalty

    excludes that the data is obtained or processed using unlawful or unfair means.


59. The Litigation Chamber notes that it is indeed apparent from the writings of the parties that the

    defendant did not explicitly indicate to the teachers that the information they

    would provide according to which they intended to go on strike would be communicated to the parents of students

    (Item 10). Human error or clumsiness invoked by the defendant cannot
    exclude the liability of the controller. The same is true of efforts

    organizational arrangements implemented by the defendant. If the Litigation Chamber welcomes such

    efforts, it recalls that they are only the logical consequence of the legal obligations of

    the defendant and invites it to pay particular attention to the processing of this information

    should such situations arise again. As the complainants indicate, they

    have in confidence communicated this information at the invitation of the defendant for the purpose of

    make it possible to organize the parents' meeting as well as possible, which did not require, as he




10
  It is the Litigation Chamber which underlines. Decision on the merits 49/2023 – 18/19


    demonstrated above, that their status as strikers is known to all parents of students

    from school.


        II.3. Regarding corrective measures and sanctions

60. Under Article 100 of the LCA, the Litigation Chamber has the power to:


        1° dismiss the complaint without follow-up;

        2° order the dismissal;

        3° order a suspension of the pronouncement;

        4° propose a transaction;
        (5) issue warnings or reprimands;

        6° order to comply with the data subject's requests to exercise his or her rights;

        (7) order that the person concerned be informed of the security problem;

        8° order the freezing, limitation or temporary or permanent prohibition of processing;

        9° order the processing to be brought into conformity;

        10° order the rectification, restriction or erasure of the data and the notification of
        these to the recipients of the data;

        11° order the withdrawal of accreditation from certification bodies;

        12° to issue periodic penalty payments;

        13° to impose administrative fines;

        14° order the suspension of cross-border data flows to another State or a

        international body;
        15° forward the file to the public prosecutor's office in Brussels, which informs it of the

        follow-up given to the file;

        16° decide on a case-by-case basis to publish its decisions on the website of the Authority of

        Data protection.



61. The Litigation Division notes that the defendant admitted from the outset that it had committed
    an error in mentioning the status of striker of the plaintiffs during its communication by

    email dated March 29, 2022.


62. The Litigation Division notes above all that the defendant indicated that it had put in place,

    prior to the incident denounced in the terms of the complaints, a series of measures intended to

    implements the obligations arising from the GDPR. It also notes the commitments made to
    terms of its conclusions after the reported incident to prevent such errors from occurring.

    reproduce.


63. It also follows from the finding of the Litigation Chamber that the notion of “striker” does not

    may be further processed by the defendant for other purposes. Decision on the merits 49/2023 – 19/19


64. In light of the foregoing, the Litigation Chamber considers that the reprimand constitutes

    the appropriate sanction in the circumstances.





III. Publication of the decision


65. Given the importance of transparency regarding the decision-making process of the Chamber

    Litigation, this decision is published on the DPA website. Is about

    the identity of the complainants, the Litigation Chamber having considered that it was able to

    process their complaint without disclosing their identity to the defendant, it will not disclose in all

    logical not their identity at the end of its publication. Regarding the identity of the defendant,

    the Litigation Chamber considers that its identification is not necessary for the publication.





     FOR THESE REASONS,


     the Litigation Chamber of the Data Protection Authority decides, after deliberation:


     - Under Article 100.5. of the ACL, to issue a reprimand with regard to the

         defendant with regard to the violation of Articles 5.1.a) (lawfulness) and 6 of the GDPR.





In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged,

within thirty days of its notification, to the Court of Markets (court

d'appel de Bruxelles), with the Data Protection Authority as defendant.


Such an appeal may be introduced by means of an interlocutory request which must contain the

information listed in article 1034ter of the Judicial Code. The interlocutory motion must be

filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 12

via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).






(se). Hielke HIJMANS

President of the Litigation Chamber



1The request contains on penalty of nullity:

 (1) indication of the day, month and year;
 2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
     Business Number;
 3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
 (4) the object and summary statement of the means of the request;
 (5) the indication of the judge who is seized of the application;
 6° the signature of the applicant or his lawyer.
12
  The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.