APD/GBA (Belgium) - 49/2023
From GDPRhub
| APD/GBA - 49/2023 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 6(1)(e) GDPR Article 9(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 28.04.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 49/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | French |
| Original Source: | APD/GBA (in FR) |
| Initial Contributor: | n/a |
The DPA considered that a school informing the pupils' parents that some professors were on strike did not reveal trade union membership and was therefore not a sensitive data under Article 9 GDPR. However, this processing was not necessary to carry out a public task (i.e. the school's education mission) and therefore lacked legal basis.
English Summary
Facts
In March 2022, a school (controller) organised a parents' meeting and informed the parents that some teachers would not be able to attend because they were on strike. In practice, the school sent out a list of teachers and marked them as 'on strike'. Other teachers were absent for other reasons and the school simply added the word "absent" without additional information.
A few days after the strike, the union delegation contacted the school management to say that this was inappropriate. The school did not respond to this. Five striking teachers therefore lodged a complaint with the DPA, claiming that the controller had violated Article 9(1) GDPR by disclosing their trade union membership without a legal basis. Alternatively, they considered that the controller had violated Articles 5(1) and 6(1) GDPR.
In its defence, the controller explained that the meeting of parents is part of its public interest mission (education) which is a legal basis under Article 6(1)(e) GDPR. It added that calling a teacher a striker did not reveal a trade union membership and that the situation therefore did not fall within the scope of Article 9 GDPR. However, the controller acknowledged that the use of the term striker should have been avoided. It added that this was a human error and that it was taking steps to avoid similar errors in the future.
Holding
The DPA joined the complaints and began by examining whether or not the term "striker" fell within the scope of Article 9(1) GDPR. To be covered by this article, the reference must reveal trade union membership. The DPA referred to the English and Dutch versions of the GDPR and considered that being a striker does not reveal trade union membership within the meaning of Article 9(1) GDPR.
On the other hand, the DPA considered that the qualification of "striker" could constitute "highly personal" data within the meaning of the EDPB guidelines on DPIA. This implies that they are sensitive in the common sense of the term which may increase the possible risk to rights and freedoms. The DPA also added that sensitive data must be interpreted broadly, but that even a broad interpretation does not allow the striker to be considered as falling within the scope of Article 9(1) GDPR.
Since Article 9 GDPR was not applicable, the DPA examined the lawfulness of the processing under Article 6(1)(e) GDPR which was put forward by the controller. It considered that the education mission of the controller includes an aspect of communication with the parents of the pupils. However, the communication of the status of striker was not necessary for this task. The DPA explained that simple information that absent teachers could be contacted at another time would have been sufficient.
In conclusion, the DPA considered that the controller had no legal basis for his processing. In view of the measures already taken by the controller, the DPA issued a reprimand.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/19
Litigation Chamber
Decision on the merits 49/2023 of 28 April 2023
File numbers: DOS-2022-02905 – DOS-2022-02908 – DOS-2022-02910 –
DOS-2022-02912– DOS-2022-02915
Subject: Complaint relating to the communication of the status of striking teacher by a
school when organizing a parent-teacher meeting –
procedure on the merits guaranteeing the confidentiality of the identity of the complainants
against the defendant
The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke
Hijmans, chairman, and Messrs. Romain Robert and Christophe Boeraeve, members;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and
to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the
data protection), hereinafter "GDPR";
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter
ACL);
Having regard to the internal regulations as approved by the House of Representatives on 20
December 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Made the following decision regarding:
The Complainants:
1. Mr. X1, hereinafter “Complainant No. 1” (DOS-2022-02905);
2. Mr. X2, hereinafter “Complainant No. 2” (DOS-2022-02908);
3. Mr. X3, hereinafter “Complainant No. 3” (DOS-2022-02910); Decision on the merits 49/2023 – 2/19
4. Ms. X4, hereinafter "Complainant No. 4" (DOS-2022-02912);
5. Mr. X5, hereinafter "Complainant No. 5" (DOS-2022-02915);
All 5 represented by their counsel, Maître Laurence RASE, lawyer, whose firm is
established at 4000 Liège, Quai de Rome, 2.
Hereinafter referred to together as “the (striking) teachers” or “the plaintiffs”.
The defendant: Secondary school Y, hereinafter “the defendant”.
I. Facts and procedure
1. During the months of May and June 2022, the complainants each lodged a complaint with
of the Data Protection Authority (APD) against the defendant. 1
2. The subject of their complaint concerns the communication by the defendant of their status
striking teacher when sending by e-mail to all the parents of pupils of the list of
teachers who can be met during the meeting of parents of pupils of
the establishment of March 29, 2022. The facts are more fully detailed in the points which
follow.
3. On July 7, 2022, the 5 complaints were declared admissible by the Front Line Service (SPL)
DPA ON THE BASIS OF ARTICLES 58 AND 60 OF THE ACL AND COMPLAINTS ARE FORWARDED TO THE Chamber
Litigation under Article 62, § 1 of the LCA.
4. Under the terms of his complaint, each complainant requests, ticking the box provided for this purpose in
the complaint form, whether its data is masked, or whether it is not
communicated to the defendant.
5. At the end of August 2022, the Litigation Chamber asked each plaintiff whether he
whether or not he agreed to his identity being communicated to the other complainants, the
confidentiality remains preserved with regard to the defendant.
6. Each complainant, in response, indicated his agreement to the communication of his identity to the
other complainants.
1 Complaints 1, 2 and 5 are dated May 10, 2022 (complaint 2 was received on July 4, 2022). Complaint 3 is dated May 30, 2022 and
4 is dated June 6, 2022. Decision on the merits 49/2023 – 3/19
7. The plaintiffs are all members of the teaching staff of the defendant and employees
of it within the Y secondary school.
8. On March 29, 2022, a strike was organized at the initiative of the trade unions
representatives of staff in the education sector.
9. On the same March 29, 2022, a parents' meeting was organized within the defendant in order to
to allow the parents of the pupils of the school to meet the teachers individually.
10. The parties report that by an email dated March 25, 2022, the management of the defendant
appealed to all of its teachers in these terms:
"As you know, the parents' meeting will take place on March 28, 2022 (read March 29
2022). However, the strike will take place this Tuesday as well. I ask those who intend to do
strike to report it to me for this Monday at 9am at the latest so that I report your absence to the
educators and parents.
On the other hand, if you are absent, you will have to ensure the parents' permanence this Thursday at
from 3:30 p.m. instead of this Tuesday, unless you still participate in
parent's meeting.
11. The complainants point out that several members of the teaching staff – including
union representatives – in response, informed the school management that they would participate in
strike action.
12. On March 29, 2022, the management of the defendant informed the parents of the students of the terms
organizing the parent meeting on the same day. A letter is sent to the parents
of students by email. The complainants specify that they are several hundred parents. THE
complainants report that this mail was also distributed, by hand, on the spot
at school on the day of the parents' meeting by the management present at the entrance of the establishment.
13. This letter states this:
“As announced in the media, some teachers have decided to follow the
strike action organized today. On the back you will find the list of
striking teachers as well as sick teachers who will not be present at the
parent meeting. However, the striking teachers were asked to take
contact with the parents concerned in order to fix an appointment this Thursday afternoon for
meet you ".
14. The list of school teachers is attached to the letter. It lists the premises where the
teachers will be present. Considering the names of the teachers who announced to the management
their participation in the strike (point 10 above), the mention "striker" is affixed. This was Decision on the merits 49/2023 – 4/19
in particular the case with regard to the name of the complainants. For other teachers absent during
of the parents' meeting, it is indicated "abs", without specifying the reason for their absence.
15. The complainants add that a few days after March 29, 2022, a trade union delegation
challenged Y's management team orally about this way of proceeding. She has him
reports the inappropriate nature of such a communication which mentions data to be
"sensitive" personal character according to her to third parties, communication querien justified. THE
complainants further add that the management of Y did not intend to follow up on this
questioning and that the trade union representatives concerned were dismissed.
16. Following these events, five members of the striking teaching staff were, as he
has been set out in point 1, lodges a complaint with the DPA, in order to denounce a violation of the
GDPR. They insist on the deleterious climate within the establishment and the contempt opposed to the
right to strike more generally.
17. On October 6, 2022, the Litigation Chamber informs the parties by registered mail of the
provisions as set out in article 95, § 2 as well as in article 98 of the LCA. In this
mail, the Litigation Chamber, taking into account the request for confidentiality of the
plaintiffs against the defendant:
To. Decides to join the complaints which it considers to be so closely related that there is
interest in instructing them and making a decision about them at the same time in order to
guarantee the consistency of its decisions;
b. Takes note that the Complainants request confidential treatment of their
identity with respect to the defendant. The Litigation Chamber considers in this
respect that it is able to pursue the examination of complaints without disclosing
the identity of the plaintiffs to the defendant;
vs. Takes note that the complainants have each given their agreement that their
identity is shared with other complainants;
d. Summarizes the facts reported by the complainants under each of their complaints
and specifies that at the request of the defendant, the anonymized file relating to
each complaint will be communicated to him;
e. Invites the parties to submit their respective arguments to it in the form of
conclusions. The Litigation Chamber more particularly invites the
defendant to specify the methods of the communication of the letter of March 29
2022 as well as to put forward its arguments with regard to potential breaches
revealed by the facts, in particular with regard to the basis of lawfulness on which it
believes that he can justify the processing (internal registration, communication
to the parents) of the “striking” data attached to each of the complainants. The Chamber Decision on the merits 49/2023 – 5/19
Litigation cannot exclude at this stage of the procedure the application of the article
9 of the GDPR, it invites the defendant to defend itself both with regard to articles
5.1.a) and 6 of the GDPR only with regard to Article 9 combined with Article 6 of the GDPR;
f. Defines that the defendant must file its submissions in response no later than
on November 17, 2022 and its submissions in reply no later than January 2, 2023.
The plaintiffs are invited to file their joint conclusions on
if applicable – 9 December 2022 at the latest (article 99 LCA);
g. Indicates that in view of the complainants' request for confidentiality, it
will itself communicate the conclusions to the other party for
guarantee the adversarial nature of the procedure while preserving this
request for confidentiality. The Litigation Chamber adds that these conclusions
will be communicated as is to the other party and that it is therefore the responsibility of the
complainants to draft them in such a way as to preserve the confidentiality of their
identity with respect to the defendant.
h. Indicates that if the parties wish to file exhibits in support of their
conclusions, they are invited to do so at the same time as submitting these
latest. The procedures for preserving the confidentiality of the identity of the
plaintiffs with regard to the defendant will be identical to those provided for in point
g).
i. Finally, specifies that taking into account the complainants' request for confidentiality, a
hearing cannot be granted to them. Indeed, as soon as a party requests
hearing, all parties are invited to attend. The anonymity of the parties e
can therefore be guaranteed during the hearing, the parties being heard together and
not separately (Article 53 of the RoI).
18. On November 16, 2022, the Litigation Chamber receives the submissions in response from the
defendant. The summary of the defendant's position is set out in point 20 above
including his reply.
19. On December 8, 2022, the Litigation Chamber receives from the complainants their conclusions in
common replicas.
To. The plaintiffs mainly denounce a violation of Article 9 of the GDPR. They
indeed consider that by communicating their status as striker, the defendant treated
sensitive data concerning them – more particularly their membership
trade union – without having any basis of lawfulness to do so.
b. Union membership, according to the complainants, includes any expression of an activity
union, which must be understood in a broad sense. It is not synonymous Decision on the merits 49/2023 – 6/19
of union affiliation. Participation in a strike organized at the initiative
of trade union organizations representing workers constitutes an activity
union, regardless of whether or not the participants are
affiliated with a union. This is the exercise of the fundamental rights of freedom
of expression (Article 10 of the European Convention on Human Rights - ECHR) and
freedom of assembly and association (article 11 of the same ECHR).
vs. Reveal to third parties - in this case to parents of pupils - the status of "striker" of a
group of teachers therefore constitutes data processing referred to in Article 9 of the
GDPR. The term "striker" reveals the participation of teachers in an activity
union and, consequently, their union membership. It is undisputed that the
complainants have not consented (article 9.2.a) of the GDPR) and the complainants believe
that no other basis of lawfulness provided for in Article 9.2 of the GDPR applies.
d. In the alternative, failing the Litigation Chamber to find a violation
of Article 9 of the GDPR, the plaintiffs believe that the defendants have at least
found guilty of a breach of Articles 5.1 and 6.1 of the GDPR.
i. The plaintiffs exclude the bases of lawfulness listed in Article 6.1 of the GDPR, that
it is their consent, the legal obligation to which the defendant would be
held, or even the mission of public interest with which the latter would be invested.
ii. The plaintiffs point out that the defendant does not dispute the character
inadequate communication but Islam minimizes it. An alternative should have
complainants be put in place which would simply indicate that some
members of the teaching staff unavailable on March 29, 2022 would ensure
a permanence on March 31, 2022 or later.
iii. The plaintiffs also believe that the defendant cannot be followed
when it claims that the communication would have been made in a fair and
transparent to the staff members concerned. They point out that
in its letter of March 25, 2022 (point 10), the management of Y told them that
this information was requested from them in order to be able to warn the parents of their
absence, and not the reasons for this absence. The data communicated
have therefore not been treated fairly or adequately,
relevant and limited to what was necessary for that purpose. THE
sections 5.1. a) and c) of the GDPR have thus been violated as well as article 6.1. of
GDPR.
e. The plaintiffs asking the Litigation Chamber to pronounce a sanction
exemplary (an administrative fine or at the very least a reprimand) with regard to
the defendant who takes into account a) the sensitive nature of the data communicated
which is indicative of the complainants' union conviction and is the subject of a Decision on the merits 49/2023 – 7/19
special protection under Article 9 of the GDPR in the form of a prohibition
of principle with exceptions as well as b) the distribution by e-mail of this
information to several hundred parents of students.
f. On the basis of article 100.1, 9° of the LCA, the plaintiffs also postulate that it is
ordered the defendant to formally remind its management of its obligations in
regarding the protection of personal data and to prohibit any
subsequent disclosure of data without first obtaining consent
expressly from the staff members concerned as to this disclosure and the purposes
for which it is authorized.
20. On December 29, 2022, the Litigation Chamber receives the conclusions in reply of the
defendant. The defendant's argument – as developed both in its
conclusions in reply than in those in reply – can be summarized as follows:
To. The date of March 29 scheduled for the parents' meeting had been set in
consultation with staff representatives at the end of the school year
former.
b. This parent meeting is an important deadline for parents of students –
especially for those who encounter difficulties – which allows them to
receive information and educational advice aimed at the success of their
child at the end of the school year.
vs. This meeting fits in a very essential way within the framework of
the execution of its mission as provided for by the Decree defining the missions
priorities for basic education and secondary education in the 24
2
July 1997. It contributes to the necessary cooperation between parents and
teachers, who are also part of all the schools' educational projects. She
results from the exercise of its public interest mission within the meaning of Article 6.1.e) of the
GDPR.
d. The information that some teachers are on strike has been collected
in a fair and transparent manner following communication by the management of the
email of March 25, 2022 cited in point 10 above.
e. Contrary to what the plaintiffs state, the term "striker" does not reveal
not union membership. The reasoning of the defendant is in this
regard to the following:
2M.B., September 23, 1997. Decision on the merits 49/2023 – 8/19
i. The right to strike is recognized for all workers whether they belong or
no to a union and any worker, unionized or not, can choose to
participate in such and such a strike;
ii. A strike can occur without union intervention. She is not
conditioned by a union initiative;
iii. As a result, assimilating the fact of participating in a strike (and therefore of being
“striker”) to that of belonging to a union organization is based on
erroneous premises;
iv. Trade union membership consists of affiliation to a trade union. There
English GDPR terminology “trade -union membership” is in this regard
enlightening. It is also this status that is likely to lead to
discrimination at the very least differential treatment, which Article 9
of the RGP D seeks to avoid. Participation in a strike may, on the other hand,
be a one-off act like any exercise of other rights related to the right of the
work.
v. The notion of union membership is strictly interpreted. Account
given that Article 9 of the GDPR consists of an exception to Article 6 of the
GDPR, the interpretation of the ban on data processing
“revealing trade union membership” must be interpreted restrictively. A
excerpt from recital 51 of the GDPR is invoked by analogy in this respect. 3
vi. Finally, the defendant wonders whether the fact of
infer that a person, by virtue of his participation in a strike, belongs
necessarily to a union would not constitute an inference to the contrary
the principle of data accuracy set out in Article 5.1.c) of the GDPR.
f. The qualifier "striker" should have been avoided and the defendant expresses its
sorry about the use of this terminology. The terms “absent (for
sick teachers) and “contactable” (for strikers absent on March 29
but that the parents could contact) would have been preferable according to her.
g. The defendant adds that it has endeavored to implement all of the
obligations arising from the GDPR and that it has, for this purpose, engaged a delegate for the
external data protection (DPO) in 2021 which has done a substantial job
and helped to train and sensitize staff members on issues of
Data protection. In terms of achievements, the defendant cites:
3Recital 51: (…) The processing of photographs should not systematically be considered as constituting
processing of special categories of personal data, given that these do not fall under the
definition of biometric data only when they are processed according to a specific technical method allowing
unique identification or authentication of a natural person. (…) Decision on the merits 49/2023 – 9/19
the establishment of the various registers (of processing activities, breaches
data, access), mandatory training for staff members,
the publication of a document containing the essential points of the GDPR to be respected
or the implementation of information security measures.
h. This is a one-time incident resulting from human clumsiness on the part of a
school collaborator when sending a single communication in a
emergency context. This is not a decision of the defendant in the sense of a
decision that would have been taken by the organizing authority. The defendant indicates
that it would like to point out in this respect that it does not have a database in
which this quality would be listed and which it in no way intends
categorize its staff members on this basis in its processes
administrative.
i. The defendant further observes that if the plaintiffs were to be
union representatives, it cannot be excluded that Article 9.2. e) GDPR
applies. Under this article, the prohibition of data processing
sensitive (including those revealing trade union membership) is lifted when “the
processing relates to personal data which are manifestly
made public by the data subject”. Confirmation of applicability
of this article could result in the lifting of the “anonymity” of the complainants.
d. To prevent this error from recurring in the future, the defendant indicates
that she will take the following additional actions suggested to her are
DPO:
i. Implementation of an obligation to monitor the training provided in 2021
within 3 months of taking office, with particular attention to
school administrative staff;
ii. Organization of a question-and-answer session with the DPO during
pedagogical daysforexampleificeladewouldrespondtoarequest
Staff ;
iii. Putting on the agenda of a meeting with the local authorities of
competent consultation (Works Council and Committee for the
prevention and protection at work - CPPT) with a view to determining
together the procedures and terms to be used when communicating
different types of school absences.
k. Finally, the defendant regrets not having been questioned directly by the
complainants following the distribution of the list, which would have allowed a dialogue. She
furthermore denies any denial of the right to strike within it underlining by Decision on the merits 49/2023 – 10/19
elsewhere the lack of competence of the Litigation Chamber to hear
this type of grievance.
21. The filing of these submissions in reply closes the exchange of arguments between the parties. None
of them not having requested a hearing and the Litigation Chamber not having convened a hearing
on its own initiative, the Litigation Chamber decides as set out below.
II. Motivation
II.1. As to the jurisdiction of the Litigation Chamber
22. Pursuant to Article 4 § 1 of the LCA, the DPA is responsible for monitoring the principles of
data protection contained in the GDPR and other laws containing provisions
relating to the protection of the processing of personal data. In application of
Article 33 § 1 of the LCA, the Litigation Chamber is the administrative litigation body
of ODA. It receives complaints that the SPL transmits to it pursuant to Article 62 § 1.
LCA, or admissible complaints.
23. As the Litigation Chamber has already had occasion to state, data processing
data are operated in multiple sectors of activity, in particular within the framework
professional as in the present case. The fact remains that the competence of
the APD in general, and of the Litigation Chamber in particular, is limited to the control of the
compliance with the regulations applicable to data processing, regardless of the sector
of activity in which this data processing takes place. Its role is not to
substitute for the courts of the judiciary in the exercise of the powers which are the
their labor rights and the right to strike, for example
II.2. Regarding the alleged violations of the GDPR
II.2.1. Regarding the principles of lawfulness and minimization (Article 5.1.a) and 5.1.c) of the GDPR
as well as Articles 6 and 9 of the GDPR)
24. Any processing of personal data must, in application of the principle of lawfulness
devoted to Article 5.1. a) of the GDPR, rely on one of the bases of lawfulness of Article 6.1. of
GDPR. When the data controller processes data that comes out of the "categories
specific data”, he must also comply with the conditions of article 9 of the GDPR read in
combination with Article 6 GDPR.
25. Article 6 of the GDPR thus provides that personal data may be processed
if their processing can validly be based on one of the 6 bases that it lists, namely: the
consent of the data subject (Article 6.1.a)), the performance of the contract or measures Decision on the substance 49/2023 – 11/19
pre-contractual obligations taken at the request of the data subject (Article 6.1.b)), the execution
a legal obligation (Article 6.1.c)), the vital interest of the data subject (Article 6.1.d)),
the execution of the public authority or the public interest mission with which the
controller (article 6.1. e)) or legitimate interest (article 6.1.f)). In all
cases, the data processing must be necessary.
26. Article 9 of the GDPR (special categories of data) provides for its part n its § 1 , a
ban on the processing of so-called “sensitive” data in these terms: “the processing of
personal data that reveals racial or ethnic origin, political opinions,
religious or philosophical beliefs or trade union membership, as well as the
processing of genetic data, biometric data for the purpose of identifying a
natural person in a unique way, data concerning health or data
concerning the sex life or sexual orientation of a natural person are prohibited”.
27. Recital 51, which explains Article 9 of the GDPR, specifies in particular that "in addition to the requirements
applicable to this processing [read the processing of these special categories of
data], the general principles and other rules of this Regulation should
apply, in particular with regard to the conditions of lawfulness of the processing”. In
in other words the application of article 9.2. of the GDPR which authorizes the processing of said
data in some cases should be read in conjunction with Section 6.1. of the GDPR which requires
that any processing is based on one of the 6 bases of lawfulness that it sets out.
28. Consequently, it is essential before being able to consider whether or not a basis of lawfulness
failure, as denounced by the complainants, to qualify the data processed to determine whether the
compliance with Article 6 GDPR alone must be verified or whether, in the presence of data falling within the
article 9.1. of the GDPR (i.e. data qualified as “sensitive”), this is compliance with article 9.2
read in conjunction with Article 6 of the GDPR which should be checked.
29. In the present case, it is not disputed that the mention “striker” attached to the identity of the complainants
and other staff consists of personal data relating to
the latter within the meaning of Article 4.1. of the GDPR. In fact, this is information relating
to directly identified natural persons since the statement is affixed opposite
of their first and last name.
30. Nor is it contested that the communication made by the defendant via her e-mail
of March 29, 2022 sent to parents of students is processing within the meaning of Article 4.2. of
RGD. It is indeed a communication made in this case using methods
automated.
31. The views of the parties differ on the other hand on the question of whether the qualifier
“striker” falls under Article 9.1 or not. of the GDPR, more particularly if it reveals, within the meaning of Decision on the merits 49/2023 – 12/19
this provision, the trade union membership of the complainants. The summaries of the conclusions of the
parties set out in points 19 and 20 state their respective arguments in this regard.
32. The Litigation Chamber notes that in order to be covered by Article 9 of the GDPR, the information
status as a striker must reveal union membership. The Litigation Chamber is
of the opinion that the fact of being a striker does not reveal this membership. Union membership
indeed consists of trade union membership, which the English version of the GDPR translates better
as well as the French term "affiliation". The English version retains the terms of
"trade-union membership" which translates the idea that the person concerned is a member
“member”) of a trade union. The Dutch version also clearly mentions being
affiliated to a trade union using the term "lidmaatschap" either which is "lid" or which is
“member”. However, the right to strike is open to all workers whether or not they are affiliated to
a syndicate. A strike does not necessarily have to be organized at the initiative of a
union. In other words, a participant in a strike is not necessarily a member of a
union. He may be, but if necessary, his participation in the strike will not be revealed. In other
In other words, being a striker does not reveal union membership. The Litigation Chamber
considers, moreover, that the fact of deducing that a person, because of his participation in a
strike, would necessarily belong to a trade union would constitute an inference contrary to the
principle of data accuracy enshrined in Article 5.1.c) of the GDPR.
33. The Litigation Chamber concludes that the mention of the quality of striker of the complainants
does not consist of processing data revealing trade union membership within the meaning of Article
9.1 GDPR. The Litigation Chamber, on the other hand, is of the opinion that the qualification of
"striker" can be considered as "highly personal" data in the
meaning that the European Data Protection Board (EDPB) has given to this concept in
its Data Protection Impact Assessment (DPIA) Guidelines . 4
The EDPS stresses that, beyond the provisions of the GDPR, certain categories of data
may be considered to increase the possible risk to the rights and freedoms of
people. They are “sensitive” in the common sense of the term and require attention
particular when they are processed, the philosophy of the GDPR being characterized by a
approach on the risk and on the taking of measures intended to take them into account and
minimize.
34. The Litigation Chamber adds abundantly that it does not, however, share the point
Defendant's view that Article 9.1. of the GDPR should, in principle, be
er
interpreted restrictively, In a judgment of August 1, 2022, the Court of Justice of the European Union
(CJEU) has clearly specified that “(…) a broad interpretation of the notions
4Article 29 Group, Guidelines on Data Protection Impact Assessment (DPIA) and Data Protection
how to determine whether the processing is “likely to create a high risk” for the purposes of Regulation (EU) 2016/679,
WP 248 of October 4, 2017: https://www.cnil.fr/sites/default/files/atoms/files/wp248_rev.01_fr.pdf. These guidelines
were endorsed by the European Data Protection Board at its inaugural meeting on 25 May
2018: https://edpb.europa.eu/sites/default/files/files/news/endorsement_of_wp29_documents_en_0.pdf Decision on substance 49/2023 – 13/19
of “special categories of personal data” and of “sensitive data” is
supported by the objective of Directive 95/46 and the GDPR, recalled in paragraph 61 of this judgment,
which is to guarantee a high level of protection of the fundamental rights and freedoms of
natural persons, in particular their privacy, with regard to the processing of personal data.
personal character concerning them (see, to this effect, judgment of 6 November 2003, Lindqvist,
5
C-101/01, EU:C:2003:596, point 50)’.
The Court adds that "the contrary interpretation would, moreover, run counter to the purpose of
Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR,
consisting in ensuring increased protection against processing which, because of the
particular sensitivity of the data which is the subject of it, are likely to constitute, as well as
that it appears from recital 33 of Directive 95/46 and recital 51 of the GDPR, a
particularly serious interference with the fundamental rights to respect for private life and to
the protection of personal data, guaranteed by Articles 7 and 8 of the Charter
[see, incense, judgment of September 24, 2019, GCe.a. (Dereferencing of sensitive data),
C-136/17, EU:C:2019:773, point 44] » .6
35. In this case, the Litigation Division considers that this interpretation, even broad (and not
not restrictive as the defendant postulates) does not allow to consider that the quality
striker reveals, even indirectly, trade union membership and should therefore be
considered as sensitive data within the meaning of article 9.1. of the GDPR. as well as the room
Litigation she explained, this qualification would be based on the erroneous premise that any
striker is unionized and would otherwise violate the principle of data accuracy
as also already mentioned.
36. Since the defendant was not processing sensitive data, Article 9 of the GDPR is not applicable.
application. The Litigation Chamber's assessment of the legality of the processing of the
"striker" data will therefore be made from article 6.1 alone. of the GDPR and the principles
general terms set out in Article 5 of the GDPR and not at the start of Article 9.2. read in combination with
GDPR Article 6.
37. As a basis of lawfulness, the defendant indicates that the disputed communication was part of
within the framework of the execution of its mission of public interest of teaching and that it was from
therefore founded on the basis of Article 6.1.e) of the GDPR which authorizes the processing of data
when "the processing is necessary for the performance of a task in the public interest or falling
the exercise of official authority vested in the controller”. She returns
5CJEU, judgment of August 1, 2022, OTagainst Vyriausioji tarnybinės etikos komisija, C-184/20, ECLI:EU:C:2022:601, point
125). It is the Litigation Chamber which underlines.
6Point 126 of the aforementioned judgment. It is the Litigation Chamber which underlines. Decision on the merits 49/2023 – 14/19
to the "Missions" decree already cited without further clarification as well as to the educational regulations of the
schools (item 20).
38. The mobilization of article 6.1.e) of the GDPR presupposes the meeting of the conditions below that
the Litigation Chamber will endeavor to verify:
- The data controller must, in accordance with Article 6.3.b) of the GDPR read in the light
of recitals 41 and 45, be entrusted with the performance of a task in the public interest or
relating to the exercise of official authority by virtue of a legal basis, whether in law
of the European Union or under the law of the Member State;
- The purposes of the processing must be necessary for the performance of the mission of interest
public or the exercise of public authority.
39. Recital 41 clarifies the quality of this legal basis. : :" When
this Regulation refers to a legal basis or a legislative measure, this does not
does not necessarily mean that the adoption of a legislative act by a parliament is required, without
prejudice to the obligations provided for under the constitutional order of the Member State
concerned. However, this legal basis or legislative measure should be clear and
precise and its application should be foreseeable for litigants, in accordance with the
case law of the Court of Justice of the European Union (CJEU) and of the European Court of
human rights (Eur. Court D.H.)”.
40. In other words, according to recital 41, this legal basis or measure
legislation should be clear and precise and its application should be predictable for
litigants, in accordance with the case law of the CJEU and the Eur. D.H.
41. This requirement of foreseeability implies that certain constituent elements of the processing be
registered in the legal basis, including in particular the purpose of the processing.
42. As to the requirement of necessity (the processing is lawful only if and insofar as it is
necessary for the execution of the mission of public interest to take only one of the hypotheses
covered by Article 6.1 of the GDPR), the Litigation Chamber has already pointed out that the legislation does not
often contains no specific provision for the necessary data processing. THE
data controllers who wish to invoke Article 6.1.e) of the GDPR under such
legal basis must then themselves carry out a weighting between the need for the
processing for the task of public interest and the interests of data subjects.
43. As mentioned in point 39, the Litigation Division will endeavor to verify whether the
conditions for recourse to Article 6.1. e) of the GDPR were met in this case. Decision on the merits 49/2023 – 15/19
As for the mission of public interest and the quality of the legal basis which consecrates it
44. The defendant invokes in this respect its teaching mission as it is in particular
7
regulated by the “Missions” decree of the French community in Belgium. Bedroom
Litigation considers that a school such as that of the defendant is
certainly vested with a mission of public interest within the meaning of Article 6.1. e) GDPR.
45. The “Missions” decree already cited provides for several provisions under which parents
secondary school students are informed and/or involved in decision-making
about their child. Thus, for example, the class council is designated as being
responsible for student guidance. “To this end, it associates the psycho-
medico-social and parents. To this end, he guides each student in the construction of a project
school and professional life according to the methods described in article 67” (article 22).
46. Article 67.1 of the "Missions" decree provides for the mandatory adoption by the establishment
of a school project which must be drawn up taking into account "(…): 2° the
aspirations of students and their parents in terms of career plans and
continuation of studies » .8
47. Article 67.2 of the decree provides that “the management plan, whose model and
termsaredecidedbytheGovernment,includesinparticularthefollowingpoints:(…)g)
the partnership and collaboration strategy with the parents of the school's students,
in consultation with the participation council”.
48. Finally, numerous provisions of the “Missions” decree mention contact with the
parents in the provisions relating to a change of establishment, the evaluation of
specific needs, in cases of absenteeism and exclusion decisions in particular.
9
49. The decree of February 2, 2007 establishing the status of principals and directors in education,
provides for its part that the profile of a director necessarily includes a responsibility in
terms of internal and external communication, particularly with regard to parents.
50. In conclusion, it emerges from the aforementioned texts that the public mission of teaching a
school such as the defendant includes communication with parents about
their child's experience in the school.
51. In line with point 47, the defendant's business plan provides for contacts
regularly with parents. .
7
Decree defining the priority missions of basic education and secondary education and organizing
structures to achieve them, French Community, July 24, 1997, M.B., September 23, 1997.
8It is the Litigation Chamber that underlines.
9
Decree of the French Community of February 2, 2007 establishing the status of directors in education,
M.B., 15 May 2007. Decision on the merits 49/2023 – 16/19
52. The Litigation Chamber considers that the organization of parents' meetings in a school
secondary requires that parents be informed of where they can meet the
present teachers of their children, these teachers being different according to the subjects
dispensed.
53. In conclusion on this point, the Litigation Division is of the opinion that the organization of the meeting
of parents of March 29 and the communication of the presence or absence of one or
the other teacher that the parents would like to meet participates in the execution of the
defendant's public teaching mission. This communication pursues a
legitimate and necessary purpose for the performance of this mission which is based on
various legal texts governing the exercise by a school of its mission
teaching, including communication with the parents of students regarding schooling
of their child.
As for the need to process “striking” data
54. On the other hand, with regard to the communication of the complainants' status as strikers, the
Litigation Chamber considers that it was not necessary for the achievement of the purpose of the
treatment which consisted in indicating to the parents which teachers would be present that they
could meet during the parents' meeting of March 29, 2022. In this respect, only the
mention of the absence of certain teachers, for any reason whatsoever, having been
sufficient. The distinction that the defendant actually intended to make between teachers
strikers who would have been “contactable” two days later and the others who would not have been
not been due to their absence, for example for illness, does not convince the Chamber
Litigation. Indeed, a teacher who is ill or absent for any other reason on the day of the
parents' meeting could, a priori, if necessary, be contacted at short notice also by the
parents too. The Litigation Chamber is in this respect of the opinion that it was sufficient for the
defendant to put in place general information according to which, as far as
concerned absent teachers, another time to be agreed could be fixed.
Conclusion
55. In conclusion, it appears from the foregoing that the defendant communicated to the parents
of students a personal data relating to the complainants which was not necessary for the purpose
she was chasing. On this basis, the Litigation Chamber concludes that the defendant has
found guilty of a breach of Article 6.1.e) of the GDPR and more generally of Article 6
of the GDPR – no other basis of lawfulness can be invoked by the defendant by
elsewhere – combined with Article 5.1.c) of the GDPR.
56. As to the defendant's allusion to the possible application of Article 9.2.e) of the GDPR, the
Chambre Litigation emphasizes that even if the status of trade union representative of the complainants
or one of them was proven, the mention of their or their status as a “striker” does not in Decision on the merits 49/2023 – 17/19
would not reveal this "trade union membership". In this particular case, it could be
relevant to the purpose for which such data was processed. The data
"striker" was not processed for the sensitive information it would contain, either to reveal
the trade union membership of the complainants. Article 9 would therefore not apply. AT
even assuming that it is, the status of union representative is certainly made public by the
person concerned but this circumstance does not authorize that any
processing of this data can take place. Indeed, Article 9.2. cannot be applied alone
but must be done in combination with Article 6 of the GDPR. In this case, the condition that the
processing is necessary for the exercise of the public mission remains. Section 9.2. is limited to
lift the ban on the processing of sensitive data. However, the Litigation Chamber has
demonstrated above that this condition of necessity was not fulfilled.
II.2.2. As for the principle of loyalty (article 5.1.a) of the GDPR)
57. The Litigation Division considers that it does not have sufficient evidence to conclude that
a proven lack of loyalty on the part of the defendant.
58. Section 5.1. a) of the GDPR does not only enshrine the principle of lawfulness discussed above
above but also the principle of loyalty that the data controller must respect.
This principle of loyalty is also enshrined in Article 8.2. of the Bill of Rights
fundamentals of the European Union (EU) according to which the data “must be
10
processed fairly, for specific purposes and on the basis of the consent of the person
concerned or under another legitimate basis provided for by law. ". This duty of loyalty
excludes that the data is obtained or processed using unlawful or unfair means.
59. The Litigation Chamber notes that it is indeed apparent from the writings of the parties that the
defendant did not explicitly indicate to the teachers that the information they
would provide according to which they intended to go on strike would be communicated to the parents of students
(Item 10). Human error or clumsiness invoked by the defendant cannot
exclude the liability of the controller. The same is true of efforts
organizational arrangements implemented by the defendant. If the Litigation Chamber welcomes such
efforts, it recalls that they are only the logical consequence of the legal obligations of
the defendant and invites it to pay particular attention to the processing of this information
should such situations arise again. As the complainants indicate, they
have in confidence communicated this information at the invitation of the defendant for the purpose of
make it possible to organize the parents' meeting as well as possible, which did not require, as he
10
It is the Litigation Chamber which underlines. Decision on the merits 49/2023 – 18/19
demonstrated above, that their status as strikers is known to all parents of students
from school.
II.3. Regarding corrective measures and sanctions
60. Under Article 100 of the LCA, the Litigation Chamber has the power to:
1° dismiss the complaint without follow-up;
2° order the dismissal;
3° order a suspension of the pronouncement;
4° propose a transaction;
(5) issue warnings or reprimands;
6° order to comply with the data subject's requests to exercise his or her rights;
(7) order that the person concerned be informed of the security problem;
8° order the freezing, limitation or temporary or permanent prohibition of processing;
9° order the processing to be brought into conformity;
10° order the rectification, restriction or erasure of the data and the notification of
these to the recipients of the data;
11° order the withdrawal of accreditation from certification bodies;
12° to issue periodic penalty payments;
13° to impose administrative fines;
14° order the suspension of cross-border data flows to another State or a
international body;
15° forward the file to the public prosecutor's office in Brussels, which informs it of the
follow-up given to the file;
16° decide on a case-by-case basis to publish its decisions on the website of the Authority of
Data protection.
61. The Litigation Division notes that the defendant admitted from the outset that it had committed
an error in mentioning the status of striker of the plaintiffs during its communication by
email dated March 29, 2022.
62. The Litigation Division notes above all that the defendant indicated that it had put in place,
prior to the incident denounced in the terms of the complaints, a series of measures intended to
implements the obligations arising from the GDPR. It also notes the commitments made to
terms of its conclusions after the reported incident to prevent such errors from occurring.
reproduce.
63. It also follows from the finding of the Litigation Chamber that the notion of “striker” does not
may be further processed by the defendant for other purposes. Decision on the merits 49/2023 – 19/19
64. In light of the foregoing, the Litigation Chamber considers that the reprimand constitutes
the appropriate sanction in the circumstances.
III. Publication of the decision
65. Given the importance of transparency regarding the decision-making process of the Chamber
Litigation, this decision is published on the DPA website. Is about
the identity of the complainants, the Litigation Chamber having considered that it was able to
process their complaint without disclosing their identity to the defendant, it will not disclose in all
logical not their identity at the end of its publication. Regarding the identity of the defendant,
the Litigation Chamber considers that its identification is not necessary for the publication.
FOR THESE REASONS,
the Litigation Chamber of the Data Protection Authority decides, after deliberation:
- Under Article 100.5. of the ACL, to issue a reprimand with regard to the
defendant with regard to the violation of Articles 5.1.a) (lawfulness) and 6 of the GDPR.
In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged,
within thirty days of its notification, to the Court of Markets (court
d'appel de Bruxelles), with the Data Protection Authority as defendant.
Such an appeal may be introduced by means of an interlocutory request which must contain the
information listed in article 1034ter of the Judicial Code. The interlocutory motion must be
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 12
via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).
(se). Hielke HIJMANS
President of the Litigation Chamber
1The request contains on penalty of nullity:
(1) indication of the day, month and year;
2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
Business Number;
3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
(4) the object and summary statement of the means of the request;
(5) the indication of the judge who is seized of the application;
6° the signature of the applicant or his lawyer.
12
The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.
