APD/GBA (Belgium) - 62/2022
|APD/GBA - 62/2022|
|Relevant Law:||Article 12 GDPR|
Article 13 GDPR
Article 30 GDPR
Article 33(1) GDPR
|National Case Number/Name:||62/2022|
|European Case Law Identifier:||n/a|
|Original Source:||Beslissing ten gronde 62/2022 (in NL)|
|Initial Contributor:||Enzo Marquet|
The Belgian DPA held, among others, that a controller is not obliged to report a data breach which results from listing the recipients of an email in CC instead of BCC if the email is only received by a small group (16 people).
English Summary[edit | edit source]
Facts[edit | edit source]
The data subjects are mother and son. The controller is a public institution for youth care with a focus on children with a difficult family background.
On 23 July 2018, the Belgian DPA received a complaint from the mother containing three alleged violations of the controller. First, it was alleged that the controller took photographs of the complainant’s minor son for the purpose of external publication, without the necessary parental consent. Second, it was alleged that the controller sent a group e-mail (16 recipients) and put all of them in CC instead of BCC. This revealed the e-mail addresses of all recipients to one another. Third, it was argued that the controller was sending out a newsletter which, among others, invited the recipients to donate to the controller without having a legal basis for such communications. The controller argued that the newsletter does not qualify as direct marketing but is an essential tool for the controller to keep the parents of the children involved.
In its investigation the Belgian DPA established that the first allegation was not supported by evidence and that the email incident was not communicated to the DPA by the controller. The DPA also found that the newsletter was only received by the parents if they had previously subscribed to it on the controller's website. Moreover, the newsletter also contained an unsubscribe button.
Holding[edit | edit source]
The DPA found that the complaint did not provide sufficient evidence to establish a violation of the controller in relation to the taking of photographs of the son, however it discussed the hypothetical situation that visual material of juveniles would have been made public by the controller. The DPA decided that in such a case prior consent, or at least specific permission of the parents or the legal guardian is indispensable in the absence of a legitimate interest or legal obligation for the publication of pictures. It further noted that the controller can as a public authority not invoke legitimate interest as a legal basis for the processing personal data.
Regarding the use of CC instead of BCC, the DPA concluded that the controller violated Article 6 GDPR because it had no legal basis to disclose the email addresses. It reasoned that Article 6(1)(a) GDPR was not applicable because the recipients of the newsletter did not consent to the disclosure of their email address to other recipients and Article 6(1)(f) GDPR was not applicable because the controller had no legitimate interest in disclosing the email addresses. Furthermore, the DPA concluded that the usage of CC amounted to a data breach but did not pose a risk to the rights and freedoms of the data subjects because the exposure was limited to e-mail addresses and to a small group of recipients (16 people). The DPA therefore found that the controller was not obliged to report the data breach to the DPA according to Article 33(1) GDPR.
Comment[edit | edit source]
Note that in Belgium, the government and its institutions cannot be fined.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/21 Dispute Tribunal Decision on the merits 62/2022 of 29 April 2022 File number : DOS-2018-03944 Subject: Sending a global e-mail with all destinations visible, sending service messages without a legitimate basis and processing images of a minor without parental consent The Dispute Chamber of the Data Protection Authority, composed of Mr Hielke Hijmans, chairman and Mr Yves Poullet and Mr Jelle Stassijns, members; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter AVG; Having regard to the law of 3 December 2017 establishing the Data Protection Authority, hereafter WOG; Having regard to the Rules of Procedure, as approved by the Chamber of Representatives on 20 December 2018 and published in the Moniteur Belge on 15 January 2019; Having regard to the documents in the file; has adopted the following decision on: The complainant: Ms X, hereinafter "the complainant"; The defendant: Y, hereinafter "the defendant" or "the controller Decision on the merits 62/2022 - 2/21 Facts and procedure On July 23, 2018, Ms. X filed a complaint with the Data Protection Authority (hereinafter 'GBA') against Y. The subject matter of the complaint relates to a grouped transmission of data by e-mail which allowed the recipients to identify the e-mail addresses of other data subjects and to the sending of communications (service messages) for which the legal basis was contested by the complainant. In addition, the complainant alleges that the defendant, without informing her in advance, allowed the complainant's minor son to participate in a project intended for external publication, which also involved taking photographs of the son, but without obtaining the complainant's parental consent. On 11 September 2018, the complaint was declared admissible by the First Aid Service on the basis of Articles 58 and 60 of the WOG and was transferred to the Disputes Chamber on the basis of Article 62, § 1 of the WOG. On 3 October 2018, the Dispute Tribunal decided to request an investigation from the Inspectorate on the basis of Articles 63, 2° and 94, 1° of the CPC. On 3 October 2018, pursuant to Article 96, § 1 of the WOG, the request of the Dispute Resolution Chamber to conduct an investigation is transmitted to the Inspectorate, together with the complaint and the inventory of documents. On 23 March 2021, the investigation is completed by the Inspectorate, the report is attached to the file and the file is handed over by the Inspector General to the President of the Dispute Settlement Chamber (Article 91, § 1 and § 2 of the WOG). The report contains findings with regard to the data controller as well as the subject of the complaint, and concludes first of all that the data controller is responsible for "integrated youth care with housing" and is considered to be a Flemish administrative authority as referred to in Article 2, 10° of the eGovernment Decree1 and described on the website of the Flemish Government2 , as the defendant meets the criteria of Article I, 3, 6° of the eGovernment Decree3. The Inspectorate then notes that the complainant distinguishes two processing activities in her complaint: the alleged data breach resulting from the email communication of 7 June 2018, on the one hand, and the unsolicited news email messages of 27 March 2019 and 29 May 2019, on the other. 1 Decree of 18 July 2008 on electronic administrative data exchange, B.S. , 29 October 2008. 2 https://overheid.vlaanderen.be/digitale-overheid/is-uw-organisatie-een-vlaamse-bestuursinstantie/. 3 Executive Decree of 7 December 2018, B.S. , 19 December 2018.http://www.jjgoldman.net/index/ Decision on the merits 62/2022 - 3/21 According to the Inspectorate, the first processing activity falls within the operation and core mission of the defendant. The Inspectorate also considers it sufficiently proven, on the basis of the documents submitted and the defendant's reply, that the principle of transparency has been complied with. Data subjects are adequately informed about the processing of their personal data in the context of the sending of newsletters and service communications, thanks to the information contained in the privacy statement, which can be easily found on the website of the controller. Moreover, the Inspectorate notes that, since April 2018, the defendant has indicated that it no longer automatically enrols the parents of young people staying at Y, but invites them to enrol via the website (opt-in system). The Inspectorate notes that data subjects are invited to subscribe to the newsletter by entering their e-mail address on the website independently, and that this subscription does not have a blocking effect on further visits to the website. Thus, the Inspectorate concludes that the consent of data subjects is sufficiently informed, specific, free and unambiguous. Moreover, although the complainant makes no reference to the opt-out possibility for service communications in her complaint, the Inspectorate notes that data subjects still have the possibility to withdraw their consent at any time by writing to the data protection officer of the defendant. Therefore, the Inspectorate considers the first processing operation to be in compliance with Articles 5, 6 and 4.11 in conjunction with Article 7.2 AVG, as well as with Articles 12.1 and 13 and 14 AVG. Furthermore, the Inspectorate notes that, although the recipients of the email message were able to learn the identity and email address of the other recipients, the content of the June 2018 communication does not contain any personal data. As regards the use of CC instead of BCC, which according to the complainant should be regarded as a data breach, the Inspectorate first confirms that the defendant failed to report the incident to the GBA within 72 hours. However, according to the Inspectorate, this breach of Article 33 AVG must be qualified somewhat, in the sense that the controller may have been able to rely on the likelihood that the data breach posed a low risk to the rights and freedoms of natural persons, in accordance with Article 33.1 AVG, in order to decide not to notify the GBA. Decision on the merits 62/2022 - 4/21 The Inspectorate stresses in particular that the data breach was limited both in the number of recipients (16 parents or guardians) and in the personal data exposed (the e- mail address from which the identity of the recipients could possibly be established), with the result that the e-mail in question may have caused only very limited damage to the complainant. The inspection report also refers to the fact that the complaint and infringement rather referred to a non-intentional, one-off and mainly human error, in view of the defendant's ICT Code of Conduct which states that staff should use BCC when necessary. Furthermore, according to the Inspectorate, the data leakage could be avoided in the future because the defendant learned from the situation and already has a procedure and form that can be used to report a data leakage. Finally, the Inspectorate refers to the internal awareness raising and training on the existing ICT Code of Conduct and Security Incident Procedure as well as the relevant reporting form, which the defendant has provided since the incident to the staff of the department where the incident occurred. In view of the above elements, the Inspectorate considers that the violation of Article 33.1 of the AVG could be closed. Notwithstanding this, the Inspectorate notes a series of concerns in relation to the defendant's internal procedure. More specifically, the Inspectorate notes that a notification to the GBA is not provided for in the security breach procedure, and that the aforementioned procedure could therefore be supplemented with specific instructions to always provide for a record of incidents in the defendant's own data breach register, to apologise to those concerned, and to send an e-mail to the recipients of e-mails sent in error, asking for the immediate deletion of the preceding e-mail. With regard to the second processing activity, namely the two e-mail communications of 27 March and 29 May 2019, the Inspectorate notes that it relates to the sending of news messages inter alia to the parents of adolescents staying in the controller's unit. The Inspectorate notes that these newsletters contain an unsubscribe option at the bottom of the email messages, and that data subjects are also offered the possibility to withdraw their consent by writing to the data protection officer of the defendant. Decision on the merits 62/2022 - 5/21 On the basis of these specific elements available in the file, the Inspectorate finds that the consent provided by the controller is free and unambiguous, and therefore meets the conditions provided for in Article 4.11 in conjunction with Article 7.3 AVG. The Inspectorate shall establish this processing activity on the basis of Article 6.1.a) AVG and notes that this processing activity can be considered as being in compliance with Article 5.1.a) AVG. As to whether the complainant was adequately informed of the processing of her personal data for the purpose of sending newsletters, the Inspectorate notes that data subjects are adequately informed by means of the privacy statement on the website of the controller. Therefore, the Inspectorate concludes that the sending of the disputed newsletters does not constitute a violation of Articles 12.1, 13 and 14 of the AVG. The report shall also contain findings which go beyond the subject matter of the complaint. In particular, the Inspectorate finds that the submitted register of processing activities is incomplete and unclear, and that the defendant has therefore infringed Article 30.1 of the AVG. On 23 September 2021, the Dispute Tribunal decides, on the basis of Article 95, § 1, 1° and Article 98 of the CPC, that the case is ready for examination on the merits. On 23 February 2022, the parties concerned shall be notified of the provisions referred to in Article 95 § 2 and those referred to in Article 98 of the CPC. They are also notified of the time limits for lodging their defences pursuant to Article 99 of the CPC. In view of the fact that the complainant was resident in the Dutch-speaking area at the time she lodged the complaint, and that according to the inspection report the defendant is considered to be a Flemish administrative authority4 , the Dispute Chamber also decided to conduct the proceedings in Dutch, in accordance with its language policy5. However, both parties are given 14 days to object. On 6 October 2021, the complainant objects to the use of Dutch as the language of the proceedings. Bearing in mind that, at the time when she lodged her complaint, the complainant, in French, was resident in the homogeneous Dutch-speaking area; that the defendant must be regarded as a Flemish administrative authority; and that, moreover, the complainant used Dutch on several occasions in the context of her exchanges with the defendant and with, inter alia, the services 4 Inspection report of 23 March 2021, p. 3. 5 Language policy note used by the Dispute Resolution Chamber, available on the GBA website: https://www.gegevensbeschermingsautoriteit.be/publications/nota-talenbeleid-gehanteerd-door-de-geschillenkamer.pdf Decision on the merits 62/2022 - 6/21 of the Youth Welfare Agency, the Dispute Tribunal decides to propose to the parties by registered letter on 14 October 2021 the following agreement. a. The official language of the proceedings shall remain Dutch, it being understood that, in the proceedings before the Dispute Tribunal, the parties may express themselves in French or Dutch, both in writing in their submissions and orally at any hearing. b. The Dispute Tribunal undertakes to conduct its correspondence with the parties concerned in both French and Dutch at all times in future, in accordance with Article 41 § 1 and § 2 of the Laws of 18 July 1966 on the use of languages in administrative matters (hereinafter, 'SWT')6. The previously communicated deadlines will be replaced by new deadlines. The Dispute Tribunal will also provide the complainant with a French translation of the Dutch inspection report, without this French version replacing the inspection report. c. The Dispute Chamber will not translate the procedural documents submitted by a party for the benefit of the other party, nor will it cover the costs incurred by them in connection with the translation of these documents. The parties are also not required to provide translations of their procedural documents. d. The Dispute Resolution Chamber undertakes to take its final decision in Dutch, and simultaneously to communicate a French version to the complainant; both versions will be made available on the GBA website. In the absence of an objection within 7 days of the communication of the previous proposal, the Dispute Tribunal will send a new invitation to the parties to submit their defence. The deadline for receipt of the Respondent's Statement of Defence was set at 6 December 2021, that for the Complainant's Statement of Defence at 3 January 2022 and that for the Respondent's Statement of Defence at 24 January 2022. Pursuant to Articles 95 § 2, 98 and 99 WOG, the parties are notified both by e-mail and by registered mail that the scope of this case concerns the following alleged infringements by the defendant: 1) alleged breach of Articles 6 and 7 AVG, concerning the lack of parental consent for the alleged processing of image material of the 6 Laws of 18 July 1966 on the use of languages in administrative matters, B.S. , 2 August 1966. Decision on the merits 62/2022 - 7/21 complainant's minor son for the purpose of external publication, without her knowledge; 2) Alleged breach of Articles 5, 6 and 4(11) in conjunction with Article 7 AVG, concerning the email communication of 7 June 2018 between the defendant's "[...]" department and the parents; 3) Alleged violation of Article 12.1 and Articles 13 and 14 AVG, regarding the newsletter information in the defendant's privacy statement; 4) alleged breach of Article 30 of the AVG, due to an incomplete and unclear register of processing activities; 5) alleged violation of Article 33.1 of the AVG, due to insufficient internal procedures on security breaches, which provide that incidents are always recorded in a separate data breach register of the controller, and that incidents must be reported to the GBA, if applicable. On 25 October 2021, the defendant's data protection officer acknowledged receipt of the Dispute Tribunal's letter and its annexes by e-mail. On 3 December 2021, the Dispute Tribunal received the Respondent's Statement of Defence as regards the findings relating to the subject-matter of the complaint. This conclusion also contains the defendant's response concerning the findings made by the Inspectorate outside the scope of the complaint. With regard to infringement 1, the defendant points to the lack of any finding in that regard by the Inspectorate, as a result of which the defendant does not consider it possible to submit a defence in that regard. For the rest, the defendant states that its staff ask the competent minor, or the parents if the minor is deemed not to be competent (guide age 12), for permission to take and distribute photographs. This is also included in the defendant's reception brochure which has already been provided in the context of the inspection investigation. As regards infringements 2 and 3, the defendant refers to the Inspectorate's finding that the infringements were properly monitored and rectified by the controller. The defendant also states that no similar incident has occurred in the past and that it is therefore a one- off, human "beginner's mistake", given the recent entry into force of the AVG at the time of the incident. The defendant also stresses that it provides regular internal training and awareness-raising. Decision on the merits 62/2022 - 8/21 II. Motivation With regard to infringement 4, the defendant states that the recommendations made in the inspection report to complete the register of processing activities have now been incorporated in the abovementioned register. In particular, a tab on version control was added, as well as a tab on the organisation and the data protection officer. In addition, a tab explaining the technical and organisational measures was added, as well as a tab with the retention periods applied. Finally, the defendant states that the complaint dates from 6 months after the entry into force of the AVG, when the defendant focused on training its staff on the use of procedures. As regards infringement 5, where the Inspectorate notes that the internal procedure for reporting security incidents provides for the defendant to report data breaches to the Flemish Supervisory Commission (VTC), the defendant considers that it can rely on the information available on the Flemish Government's website7. Furthermore, the defendant states that data subjects are free to lodge a complaint with the GBA following data leaks, and that it is prepared to report its incidents to the GBA anyway. Finally, the defendant confirms that e-mails sent in error are now added to the incident register, and that employees should request the "wrong recipients" to delete the message immediately. The Dispute Tribunal did not receive a statement of reply from the complainant. II.1. Competence of the Data Protection Authority in relation to a Flemish administrative authority First of all, by analogy with its decision 15/2020 of 15 April 20208 and following on from the statement in the Inspectorate's report, the Dispute Tribunal clarifies that the GBA is competent to act in the present case. The AVG is a regulation which is directly applicable in the Union and cannot be transposed by Member States into national law. Nor may provisions of the AVG be specified in national legislation, except where the AVG expressly allows this. Data protection has thus become, in principle, a matter of European law9. 7 https://overheid.vlaanderen.be/digitale-overheid/is-uw-organisatie-een-vlaamse-bestuursinstantie. 8 Decision on the merits 15/2020 of 15 April 2020 of the Disputes Chamber of the GBA, para. 69-70 and 77 et seq. See also decision 23/2022 of 11 February 2022, para. 6, and decision 31/2022 of 4 March 2022, paras. 33-43, available on the GBA website: https://www.gegevensbeschermingsautoriteit.be/burger/publicaties/beslissingen. 9 See e.g. in C. KUNER, L.A. BYGRAVE and C. DOCKSEY (eds.),The EU General Data Protection Regulation: A Commentary, Oxford University Press, 2020, pp. 54-56. Decision on the merits 62/2022 - 9/21 The issuing of any regulatory provisions on personal data by the federal or state government must therefore be done within the framework established by the AVG. In this respect, the Court refers to Article 22 of the Constitution10 and the settled case law of the Constitutional Court, which states that the right to respect for private life, as guaranteed in Article 22 of the Constitution (as well as in treaties), has a broad scope and includes, inter alia, the protection of personal data and personal information11. The Constitutional Court and the Legislation Division of the Council of State have already ruled that the introduction of general restrictions on the rights guaranteed by a constitutional provision is a matter reserved to the federal legislator12. Consequently, the state authorities retain the possibility of providing, within their powers, for specific restrictions, only to the extent and on the condition that they respect the general federal legislation in this respect13. In short, the Court of Arbitration finds that the federal and regional authorities are empowered to issue general and specific rules respectively on the protection of private and family life, and only to the extent permitted by the AVG and within the rules of the AVG which are directly applicable in the Belgian legal order14. In its Opinion No 61.267/2/AV of 27 June 2017, issued in response to the preliminary draft that led to the WOG, the Legislation Section of the Council of State addressed in detail the competence-sharing rules on data protection supervision15. In the aforementioned opinion, the Council of State stated that the federal government may establish a supervisory authority with "a general competence [...] over all processing of personal data, including those carried out in matters for which the Communities and Regions are competent "16. "Such a regime does not affect the competence of the Communities and 10 "Everyone has the right to respect for his private and family life, except in the cases and under the conditions provided for by law. The law, the decree or the rule referred to in Article 134 shall guarantee the protection of that right." 11 See e.g. GwH, No 29/2018, 15 March 2018, B.11; No 104/2018, 19 July 2018, B.21; No 153/2018, 8 November 2018, B.9.1. See also A. ALEN and K. MUYLLE, Handboek van het Belgisch Staatsrecht, Mechelen, Kluwer 2011, pp. 917 ff. 12 A. ALEN and K. MUYLLE, Handboek van het Belgisch Staatsrecht, Mechelen, Kluwer, 2011, 918; K. REYBROUCK and S. SOTTIAUX, De federale bevoegdheden, Antwerpen, Intersentia, 2019, 122; J. VANDE LANOTTE, G. GOEDERTIER , Y. HAECK , J. GOOSSENS and T. DE PELSMAEKER, Belgisch Publiekrecht, Bruges, die Keure, 2015, p. 449. 13 Court of Arbitration, No 50/2003, 30 April 2003, B.8.10; No 51/2003, 30 April 2003, B.4.12; No 162/2004, 20 October 2004 and 16/2005, 19 January 2005; GwH, 20 October 2004, 14 February 2008; Adv. RvS nr. 37.288/3 of 15 July 2004, Parl. St. Vl. Parl. 2005-2006, no. 531/1: "[...] the Communities and the Regions [are] only competent [...] to authorise and regulate specific restrictions to the right to respect for private life in so far as, in so doing, they adapt or supplement the federally determined basic standards, but [...] they [are] not competent [...] to affect those federal basic standards". 14 J. VAN PRAET, De latente staatshervorming, Bruges, die Keure, 2011, pp. 249-250. 15 Adv.RvS no. 61.267/2 of 27 June 2017 on the preliminary draft law 'reforming the Commission for the Protection of Privacy', pp. 28-45. 16 Ibid, p. 12, para. 5. Decision on the merits 62/2022 - 10/21 Consequently, according to the Council of State, the federal supervisory authorities can only be empowered to monitor the specific rules they have issued for data processing in the context of activities falling within their competence, and this of course only to the extent that the AVG still allows Member States to adopt specific provisions and that the provisions of the WOG are not prejudiced. In short, the GBA, as the federal supervisory authority, is the competent authority to monitor the general rules, including the mandatory provisions of the AVG which do not require further national implementation, in accordance with Article 4 of the WOG18. This is also the case if the data processing relates to a matter falling within the competence of the Communities or Regions (federal authorities) and/or if the controller is a public body falling within the competence of the Communities or Regions, even if the federal authority itself has established a supervisory authority within the meaning of the DPA. In view of the above, the Court concludes that, in order for a federal supervisory authority to be competent, it is by no means sufficient that the data processing relates to a federal matter. Moreover, the federal State in question must also, within the scope left to the Member States by the AVG, have adopted specific rules for the processing of personal data in the context of that matter. It is only the monitoring of compliance with those specific federal rules that can be entrusted to the federal supervisory authority. The Court stresses that the notion of 'specific rules' should not be interpreted too broadly. It appears from the cited opinion of the Council of State that the notion of 'specific rules' refers to specific limitations or special safeguards, which derogate from or go beyond the general provisions, safeguards and limitations contained in, or deriving from, the AVG or federal legislation. In other words, the mere fact that the Länder implement or confirm (by decree or order) a general rule does not mean that this rule acquires the character of a 'specific rule'. A specific rule only exists when the federal states, using the scope left by the AVG, establish additional safeguards or restrictions. In addition, any limitations of powers of a data protection authority under the AVG would only be possible if, at the level 17 Ibid, p. 12, para. 6. 18 See also e.g. Adv.RvS, no. 66.033/1/AV of 3 June 2019 on a draft decree of the Flemish Government of 10 December 2010 'implementing the decree on private employment agencies, as regards the introduction of a registration obligation for sports agents', p. 5, para. 5.3; Adv.RvS., no. 66.277/1 of 2 July 2019 on a draft decree of the Flemish Government 'containing the detailed rules for the processing, preservation and evidentiary value of the electronic data concerning the allowances in the framework of the family policy', p. 7, para. 5.3. Decision on the merits 62/2022 - 11/21 of a Land would have established a supervisory authority which meets all the requirements imposed on supervisory authorities by the European Treaties and which has also been given all the functions and powers of a supervisory authority. In this context, reference is made in particular to Articles 51 to 59 of the DPA. This is not the case for the Flemish Supervisory Commission. It follows from the above that the Flemish authorities are subject to the directly applicable provisions of the AVG and that the GBA is competent to act in n the present case. This competence also means that incidents relating to personal data, as defined in Article 4.12) AVG, must be reported to the competent supervisory authority, in this case the GBA, pursuant to Article 33.1 AVG. II.2. Lack of parental consent for taking and distributing photographs of a minors The Dispute Tribunal takes note of the fact that Mrs. X complains that the defendant had photographs taken of her minor son for external publication without her prior information and consent. However, the Dispute Tribunal notes that the complainant responded negatively to the Inspectorate's request to provide some evidence of this alleged processing. More specifically, the complainant notes that the defendant refused to provide her with more information about the project. Moreover, a member of the defendant's ombudsman service is alleged to have stated that participation in the project was proposed directly to the young people, that participation could also be anonymous and that for this reason the defendant "did not really [ask for] permission". The Dispute Chamber notes that the defendant does not dispute that the processing in question took place, but refers to its reception brochure in which a statement of consent provides for the possibility for educators or competent young people to give their consent to the taking and use of atmospheric photographs19. First of all, the Court stresses that the protection of personal data, which is covered by the AVG, must be dissociated from the "right to image", which is a personal right provided for in Article XI.174 of the Code of Economic Law. Therefore, the fact that a person agrees to be photographed or filmed does not necessarily mean that he or she consents to the publication or dissemination of 19 Welcome brochure of the non-profit organisation Sporen, p. 13. Decision on the merits 62/2022 - 12/21 these images. These two consents are separate and must therefore be requested separately20. The Dispute Chamber understands from the documents submitted that the complainant's son was 15 years old at the time of the facts. However, neither the AVG nor the Belgian Data Protection Act provide any clarification as to the age at which minors may themselves have access to their personal data, except in the specific context of a direct offer of information society services to a child21. Although all natural persons are holders of the right to representation, the exercise of that right is closely linked to the holder's capacity or incapacity to act.22 Legal doctrine therefore provides for a distinction between minors with capacity and minors without capacity, and it should also be stated that "current case law assesses the concept of capacity according to the concrete, factual circumstances of the case and not on the basis of a specific age".23 The right to representation is not limited to minors, but also includes the right to be represented by a legal person. In other words, in the absence of a conclusive answer as to whether the complainant still had parental authority over her son at the time of the judgment of the juvenile court and as to whether or not the latter had the capacity to distinguish, it is impossible for the Dispute Tribunal to ascertain whether the complainant's consent to the disputed processing in the present case was necessary. As a result, the provisions of ordinary law relating to the capacity of minors24 to exercise their right to image apply in principle, and the Dispute Chamber takes the prima facie view that parental consent - as well as the consent of the persons concerned if they have the capacity to distinguish - is necessary for the processing of image material of minors under the age of 18. However, the Dispute Tribunal finds that the complaint is not sufficiently substantiated with evidence of the existence of a breach of the AVG or of data protection laws, and it is clearly not possible to obtain such evidence25. Nor is the 20 https://www.gegevensbeschermingsautoriteit.be/burger/thema-s/recht-op-afbeelding/principes. 21 Article 8 of the AVG ; Article 7 of the Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, B.S. , 5 September 2018. 22 E. GULDIX, The rights of personality, privacy and private life in their interrelationship, Doctoral thesis Faculty of Law, Brussels, 1986, pp. 246-247. 23 Kh. Brussels, 24 February 1995, Ing.-Cons. 1995, p. 333, note L. MULLER; Rb. Brussels, 17 May 2002, AM, 2003, p. 138. See also L. DIERICKX, The right to image, Intersentia, Antwerp-Oxford, 2005, pp. 39-42. 24 Articles 388, 488 and 1123 to 1125 of the Civil Code. Unauthorised minors are absolutely, generally and completely incapable of acting and are therefore represented. See also FR. SWENNEN, The law of persons and family law, Intersentia, Antwerp-Cambridge, 2012, para. 265 ff. 25 In this respect, the Dispute Tribunal refers to section 3.1, A.1 of its dismissal policy, as set out on the GBA website: https://www.gegevensbeschermingsautoriteit.be/publications/sepotbeleid-van-de-geschillenkamer.pdf. Decision on the merits 62/2022 - 13/21 Dispute Tribunal able to establish that prior parental consent was required in the present case. Thus, on the basis of the facts and the legal complaints raised in the complaint, the Dispute Resolution Chamber cannot conclude that there has been a breach of data protection rules. In short, on the basis of the above elements, the Dispute Resolution Chamber considers that no breach of the AVG can be established; this complaint is therefore declared as manifestly unfounded26. However, on the assumption that in the present case there was in fact a publication of images of minors, the Dispute Chamber questions to what extent such a publication with photographs of minors on social media or communication platforms is necessary for the performance of a task in the public interest entrusted to the defendant or falls within a legal obligation incumbent on the defendant. The fact that the case in question concerns young people with a difficult family situation or background should, in the view of the Dispute Resolution Chamber, at least call for caution, and should even be a reason not to publish images in which those young people are identifiable, except where parental consent is obtained in advance for specific processing purposes. Since the defendant is to be regarded as a Flemish public authority27 , it cannot, in accordance with Article 6.1 in fine AVG, rely on the legitimate interest as a basis for processing personal data.28 In the absence of a legitimate interest or legal obligation for the publication of images depicting young people in a recognisable manner, the Dispute Chamber concludes that prior consent, or at least specific consent, from the parents or the legal guardian is indispensable. II.3.Lawfulness of the processing of the complainant's personal data in the context of the service notification dated 7 June 2018 It is established that the defendant has the contact details of the parents and guardians in order to communicate with them concerning information relevant to the defendant's relationship with the parents of the young people. The Dispute Chamber assumes that there is a legal basis for obtaining this data, as referred to in Article 6.1 of the AVG, more specifically the need for processing in order to comply with a legal obligation (Article 6.1.c) 26 Ibidem, section 3.1, A.2. 27 Inspectorate Investigation Report, p. 3. See also para. 7 in this decision. 28 Article 6.1.f) AVG : "Processing is lawful only if and insofar as at least one of the following conditions is met : [...] f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their duties." See also para. 67 in this decision. Decision on the merits 62/2022 - 14/21 AVG). For this reason, consent as a legal basis in accordance with the conditions of Articles 4.7 and 7 AVG is not conceivable for obtaining the data. After all, parents of young people do not have the free choice of whether or not to provide their contact details to the defendant. The Dispute Tribunal shall examine the extent to which the defendant may share the complainant's contact details with third parties, in this case the parents of other young people. Pursuant to Article 5(1)(b) of the AVG, the processing of personal data for purposes other than those for which the personal data were originally collected may be authorised only if the processing is compatible with the purposes for which the personal data were originally collected. Taking into account the criteria set out in Article 6.4 AVG and Recital 50 AVG29 , it should thus be assessed whether the purpose of the further processing, in this case the communication by e-mail of the complainant's contact details to the parents of other young people, is compatible or not with the purpose of the initial processing consisting in the collection of the complainant's contact details within the context of direct contact between the parents of young people and the respondent. The Dispute Resolution Chamber concludes that the complainant provided her contact details within the context of her relationship with the defendant and could not reasonably expect the defendant to share those same details with third parties who, although they have a personal relationship with the defendant, since they are parents of other young people, are outside the relationship between the complainant and the defendant. This leads to the conclusion that there is no compatible further processing, so that a separate legal basis is required for the communication of the complainant's contact details to the parents of other young people to be lawful. Processing of personal data, including incompatible further processing as in the present case, is only lawful if there is a legal basis for it. For incompatible further processing, reference should be made to Article 6(1) AVG and Recital 50 AVG. Recital 50 AVG30 states that a separate legal basis is required for the processing of personal data for other purposes which are incompatible with the 29 Recital 50 GDPR: [...] In order to assess whether a purpose of further processing is compatible with the purpose for which the personal data were originally collected, the controller should, after having complied with all the requirements of lawfulness of the original processing, take into account, inter alia: any link between those purposes and the purposes of the intended further processing; the context in which the data were collected; in particular, the data subjects' reasonable expectations based on their relationship with the controller regarding their further use; the nature of the personal data; the impact of the intended further processing on the data subjects; and appropriate safeguards in both the initial and the intended further processing. 30 Recital 50 AVG: The processing of personal data for purposes other than those for which the personal data were originally collected should only be allowed if the processing is compatible with the purposes for which the personal data were originally collected. In that case, no separate legal basis other than the one on the basis of which the collection of personal data was authorised is required. [...] Decision on the merits 62/2022 - 15/21 purposes for which the personal data were originally collected. Those separate legal grounds on the basis of which a processing operation, including thus incompatible further processing operations, can be considered lawful are set out in Article 6(1) AVG. To that end, the Dispute Chamber shall examine the extent to which the legal grounds provided for in Article 6.1 of the AVG may be invoked by the defendant in order to justify the further processing of the personal data relating to the complainant. The defendant itself does not mention any legal basis which would allow it to carry out the processing of data which is the subject of the complaint, namely the communication of the complainant's e-mail address to the parents of other young people. Moreover, the defendant expressly admits that that communication was an error. The defendant does not therefore argue that the communication was authorised and does not therefore seek to justify it by expressly invoking any legal basis. On the basis of the factual elements available in the file, the Dispute Resolution Chamber examines, of its own motion, whether there is any legal basis which could allow the defendant to send the e-mail containing the complainant's e-mail address visible to all addressees, taking into account that there is a simple technical means of reaching the intended addressees of the e-mail in a single movement without everyone's e-mail addresses being visible, namely sending it in BCC instead of CC. Given the capacity of the defendant31 , it cannot, in principle, rely on its legitimate interest (Article 6(1)(f) AVG) or that of a third party for the communication of the complainant's e-mail address to other parents. The other legal grounds contained in Article 6.1.a) to 6.1.e) AVG are not applicable in the present case either, since ▪ the subject-matter of the complaint and the documents in the case file do not in any way show that the complainant gave her consent (Article 6(1)(a) AVG) to the processing in question, nor that the defendant intends to rely on consent; ▪ the Dispute Chamber does not find it plausible that the disclosure of the complainant's contact details to other parents is necessary for the performance of an agreement between the complainant and the respondent 31 See para. 60 in fine in this decision. Decision on the merits 62/2022 - 16/21 (Article 6(1)(b) AVG), nor that such disclosure would result from a legal obligation incumbent on the defendant (Article 6(1)(c) AVG); ▪ there can be no doubt that the communication of the complainant's e-mail address was not necessary in order to protect the vital interests of the parents concerned or of another natural person (Article 6(1)(d) AVG), and that the communication of the parents' contact details is necessary for the performance of a task carried out in the public interest which has been assigned to the respondent (Article 6(1)(e) AVG). The Dispute Tribunal considers that the foregoing elements sufficiently demonstrate that the defendant cannot rely on any legal basis showing the lawfulness of the data processing operation as initiated by it. Moreover, the defendant does not contest the facts and states itself that in the e-mail in question which is the subject of the complaint, the complainant's e-mail address was placed in the field 'CC', together with those of other parents, instead of 'BCC', contrary to what is provided for in the ICT Code of Conduct for staff. As a result, the defendant claims that the employee who sent out the communication committed a breach in relation to the complainant's personal data. Despite the fact that the documents produced by the defendant show that general guidelines have been drawn up within its organisation whereby global e-mails are to include destinations in BCC, the complainant shows that those guidelines were not applied in practice. In the service note dated 7 June 2018 attached by the complainant and to which the complaint relates, those guidelines are not complied with. The defendant does not deny this, but states that the incident occurred as a result of human error and was of a one- off and incidental nature. Notwithstanding the improvements made since then, according to the Respondent, the Dispute Chamber concludes, on the basis of the above elements, that the infringement of Articles 5, 6 and 4.11 in conjunction with Article 7 AVG has been proven with respect to the service notice of 7 June 2018, in which the contact details of all recipients remained visible. In line with the statement in the Inspectorate's report, the Dispute Chamber finds that, on the other hand, no breach of Article 33.1 AVG can be established, since it is not established that the data leak resulting from the service communication of 7 June 2018 posed a risk to the complainant's rights and freedoms, and the defendant was therefore not obliged to report the breach to the GBA. Decision on the merits 62/2022 - 17/21 II.4. Lawfulness of the processing of the complainant's personal data in the context of the sending of newsletters to parents and educators In its reply to the Inspectorate, the defendant states that it does not regard the newsletters as direct marketing, but as an essential means of keeping the parents of the young people staying in the living groups involved, of providing parents with food for thought in communicating with their children, and of keeping parents informed of activities such as parent contacts. The complainant notes, on the other hand, that the electronic newsletters also call on recipients to support, either by volunteering or financially, Y's initiatives and operations, as well as promoting external service providers such as travel organisations. The Dispute Chamber finds, on the basis of the submitted newsletters dated 27 March 2019 and 29 May 2019, that the recipients concerned are being invited to make voluntary deposits for the benefit of the Y, which does not fall within the Respondent's core mission as an Organisation for Special Youth Care. Therefore, the Dispute Resolution Chamber finds that the newsletters in this case do not fall exclusively within the scope of the decree on integrated youth care, but must also be considered in part as direct marketing communications. To this end, the Disputes Chamber examines which legal basis as provided for in Article 6.1 AVG is invoked by the controller. From the defendant's reply to the Inspectorate's questions32 , the Dispute Settlement Body understands that data subjects can subscribe to the electronic newsletter on its website via an opt-in. The defendant also states that consents given are kept in MailChimp, and recipients can unsubscribe via a "reply to newsletter" or via the "unsubscribe" button at the bottom of each newsletter. In the course of that investigation, the Respondent was further able to establish that MailChimp did not record any attempt by the Complainant to unsubscribe via the button provided for that purpose, nor did any email from the Complainant arrive via the "reply" functionality. The Dispute Tribunal finds that data subjects are informed in an appropriate manner of the processing of their personal data for the purpose of sending newsletters and that the defendant is justified in relying on their consent as the basis for that processing. The Court also finds that the defendant has taken appropriate measures to enable data subjects to withdraw their consent easily if they wish to unsubscribe. Notwithstanding the above, the Court notes that the lack of a clear distinction between service notices and electronic newsletters may, however, lead to confusion for data subjects as to the precise lawfulness ground. 32 Piece 12, pp. 1-2. Decision on the merits 62/2022 - 18/21 Indeed, the consent of data subjects does not constitute an appropriate basis for communications which must be considered necessary for the provision of services, such as communications on parental contacts, or communications which have their origin in a legal obligation incumbent on the controller, such as in this case the involvement of parents and guardians in the provision of youth care33. Nevertheless, it is not for the Dispute Tribunal to determine which specific legal obligation the defendant may or may not invoke as a basis for its service communications to parents and carers, in the context of its core tasks. Following the above findings, the Dispute Resolution Chamber concludes that the defendant in the present case did not sufficiently inform the parties concerned about the distinction between service announcements and communications directly related to its core mission, on the one hand, and communications to be qualified as direct marketing, on the other hand. In this respect, the Court stresses in particular the importance of an appropriate legal basis for both necessary service communications and electronic newsletters which voluntarily inform parents or guardians of the day-to-day functioning of the organisation. In the absence of clear information on the different categories of electronic communications to parents and carers, both in the online privacy notice and in the welcome brochure, the Dispute Chamber finds that the defendant has violated Articles 12 and 13 AVG. 33 The Dispute Tribunal refers in particular to the joint commitment envisaged by Article 8 of the Decree of 12 July 2013 on integrated youth care, B.S. , 13 September 2013, applicable to the defendant: "Integrated youth care" refers to cooperation and coordination in youth care with the aim of making a joint commitment on behalf of minors, their parents and, where appropriate, their carers and the persons involved in their environment and for th at purpose : 1° to work towards the socialisation of youth care; 2° to organise timely access to youth care; 3° to ensure the flexibility and continuity of youth care services, including the seamless transition to other forms of care; 4° to deal appropriately with situations of concern in youth care; 5° to provide a subsidiary offer of crisis youth care; 6° to enable them to participate as much as possible in youth care; 7° to achieve an integrated approach in the organisation and provision of youth care services." Decision on the merits 62/2022 - 19/21 II.5. Obligation to document security incidents and to notify the Data Protection Authority The Inspectorate notes in the course of its investigation that the defendant's internal procedure for dealing with security incidents does not explicitly provide for the systematic inclusion of erroneously sent e-mails as incidents in its own data leakage register, and that the form used for following up security incidents does not provide for mandatory reporting to the GBA. The Court recalls that a controller must document all breaches as interpreted in Article 33.5 of the AVG, regardless of whether the breach must be notified to the supervisory authority: "The controller shall document all personal data breaches, including the facts of the personal data breach, its consequences and the remedial measures taken. Such documentation shall enable the supervisory authority to monitor compliance with this Article. " In the absence of a determination by the Inspectorate regarding the inclusion of the data breach following the service notification dated 7 June 2018 in an internal incident register of the Respondent, the Dispute Chamber is unable to conclude that there has been a breach of the AVG and of data protection regulations. As a result, the Dispute Chamber decides to order the dismissal of the prosecution as regards this point. However, the Dispute Resolution Chamber takes note of the defendant's intention to have incident reports submitted via the Intranet in the future, which will be followed by an automatic email to the employee concerned with follow-up steps, a reference to the modified incident procedure and some examples of data breaches. As regards the additions to the internal procedure proposed by the Inspectorate, in particular the obligation to notify the GBA of personal data breaches, the Court refers to the explanation given above concerning the GBA's general competence for compliance with the AVG34. II.6. Register of processing operations The Dispute Settlement Body agrees with the Inspectorate's finding that the register of processing operations is incomplete and unclear. Article 30 of the AVG explicitly provides that the register shall contain, inter alia, the name and contact details of the controller and any joint processing 34 See para. 40-50 in this decision. Decision on the merits 62/2022 - 20/21 III. Publication. controller and, where applicable, of the representative of the controller and of the Data Protection Officer. In addition, the controller should describe the envisaged time limits within which the different categories of data are to be erased, taking into account that vague time limits such as "retention period unknown" or "lawful retention period" do not provide sufficient clarity. Finally, the description of the organisational and technical measures taken should allow for an understanding of the precise effect of the measures in order to assess the extent to which they adequately protect the personal data concerned. Given the absence of the aforementioned information in the register of processing activities of the defendant at the time of the investigation, the Dispute Chamber considers that the infringement of Article 30 AVG has been sufficiently proven. of the decision In view of the importance of transparency with regard to the decision-making of the Dispute Resolution Chamber, this decision is published on the GBA website. However, it is not necessary for the parties' identifying data to be published directly for this purpose. Decision on the merits 62/2022 - 21/21 FOR THESE REASONS, the Dispute Chamber of the Data Protection Authority shall, after deliberation, decide to: - pursuant to Article 100 § 1, 1° WOG, dismiss the complaint as regards the taking and publication of the image of the complainant's underage son, without her prior consent; - pursuant to Article 100, § 1, 2° WOG, to order the removal from the register of the data leak of 7 June 2018 in the internal incident register; - on the basis of Article 100 § 1, 5° WOG, issue a warning to the defendant with regard to the notification of personal data breaches to the Data Protection Authority, in accordance with Article 33 AVG; - on the basis of Article 100, § 1, 5° WOG, issue a reprimand against the defendant for the infringement of Articles 5, 6 and 4.11 in conjunction with Article 7 AVG in the context of the service announcement of 7 June 2018, in which the contact details of all addressees remained visible; - on the basis of Article 100 § 1, 5° WOG, issue a reprimand against the defendant for the infringement of Articles 12 and 13 AVG for the lack of transparency in the defendant's privacy statement regarding the processing grounds for the service communications to parents and educators, on the one hand, and the newsletters to be considered as direct marketing, on the other hand; - order the defendant, pursuant to Article 100 § 1, 9° WOG, to bring its privacy statement into compliance with Articles 12 and 13 AVG; - order the defendant, pursuant to Article 100 § 1, 9° WOG, to bring the register of processing activities into line with Article 30 AVG; Pursuant to Article 108, § 1 of the WOG, an appeal against this decision may be lodged with the Marktenhof, with the Data Protection Authority as defendant, within a period of thirty days from the notification. (Get). Hielke HIJMANS President of the Dispute Chamber