APD/GBA (Belgium) - 62/2023

From GDPRhub
Revision as of 07:49, 8 June 2023 by FeestHoed (talk | contribs) (Created page with "{{DPAdecisionBOX |Jurisdiction=Belgium |DPA-BG-Color= |DPAlogo=LogoBE.png |DPA_Abbrevation=APD/GBA |DPA_With_Country=APD/GBA (Belgium) |Case_Number_Name=62/2023 |ECLI= |Original_Source_Name_1=Autorité de Protection des données |Original_Source_Link_1=https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-62-2023.pdf |Original_Source_Language_1=French |Original_Source_Language__Code_1=FR |Original_Source_Name_2= |Original_Source_Link_2= |Origina...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
APD/GBA - 62/2023
LogoBE.png
Authority: APD/GBA (Belgium)
Jurisdiction: Belgium
Relevant Law: Article 6(1)(a) GDPR
Article 95 §1 3° Loi portant création de l'Autorité de protection des données
Type: Complaint
Outcome: Other Outcome
Started: 11.03.2023
Decided: 01.06.2023
Published:
Fine: n/a
Parties: n/a
National Case Number/Name: 62/2023
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): French
Original Source: Autorité de Protection des données (in FR)
Initial Contributor: Enzo Marquet

The Belgian DPA dismissed a complaint based on article 95, §1, 3 LCA because the data subject did not adequately prove a breach of the GDPR. The Belgian DPA stated that it would require a disproportionate amount of resources, compared to the limited impact, to resolve the issue.

English Summary

Facts

There were four parties in this case: the data subject who applied for a new job, his ex-employer who fired him, the new employer where the data subject applied for a job and a recruitment agency tasked with the recruitment for the new employer.

When the data subject applied for a new job, the recruitment agency contacted the ex-employer to ask for references. The ex-employer provided negative references. This resulted in the new employer not wanting to hire the data subject and the recruitment agency ceasing all contact with him.

The data subject was informed about this negative reference and also reached out to the new employer and recruitment agency to resolve the matter amicably. He did not receive a response and thus went to the DPA to complain about his personal data being processed without the required legal basis, his consent.

Holding

The Belgian DPA clarified that it possesses the competence to dismiss a complaint under article 95, §1, 3° Law creating the Data Protection Authority. For this case, the DPA motivated its dismissal based on two reasons:

First, the DPA found that the data subject did sufficiently prove a breach of the GDPR or any data protection legislation. There was no concrete proof of the allegations such as supporting documents. A presented screenshot of a text message did not suffice to prove the authenticity of the allegations, nor did it provide compelling evidence.

Second, the DPA dismissed the case based on opportunity reasons. The complaint did not meet the threshold of general or elevated personal impact. The DPA clarified that the resources required to conduct additional research for evidence purposes would be disproportionately large and not an efficient usage of the limited resources available.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/6






                                                                         Litigation Chamber


                                                           Decision 62/2023 of June 1, 2023





File number: DOS-2023-01173


Subject: Complaint relating to the collection of personal data belonging to a

candidate by the potential employer with his former employer as part of a

recruitment procedure and conversely to the communication of said data by

the ex-employer to the potential employer



The Litigation Chamber of the Data Protection Authority, made up of Mr Hielke

Hijmans, President, sitting alone;


Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and

to the free movement of such data, and repealing Directive 95/46/EC (general regulation on the

data protection), hereinafter “GDPR”;


Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter
“ACL”);


Having regard to the Law of 30 July 2018 relating to the protection of natural persons with regard to

processing of personal data (hereinafter “LTD”);

Having regard to the Rules of Procedure as approved by the House of Representatives on 20

December 2018 and published in the Belgian Official Gazette on January 15, 2019;


Considering the documents in the file;


Made the following decision regarding:



The plaintiff: X, hereinafter “the plaintiff”;


Defendant: Y1, hereinafter “Defendant 1”;


                       Y2, hereinafter “Defendant 2”;


                       Y3, hereinafter “Defendant 3”. Decision 62/2023 - 2/6



I. Facts and procedure


 1. On March 11, 2023, the complainant lodged a complaint with the Data Protection Authority

       data (hereafter "DPA") against the defendants.

 2. The subject of the complaint concerns the collection of personal data belonging to a

       candidate by the potential future employer with his former employer as part of a

       recruitment procedure and conversely to the communication of said data by the former

       employer to potential future employer

 3. On March 11, 2023, the Complainant requested the SPL from the DPA through the application form

       of information. The complainant, a job seeker, discovered that a potential employer,

       Mr. Y1 (hereinafter “Defendant 1”), took references without his consent
       from a former director of company Z, Mr. Y2 (hereinafter “defendant 2”). THE

       complainant asks the SPL to confirm the data breach and indicate the procedure

       which must be followed in order to obtain compensation.


 4. On March 14, 2023, the SPL reminded the complainant of the concept of processing personal data
       staff and urges the complainant to verify certain information. On the same day, the complainant

       files a complaint: he claims in the body of his email that defendant 1 informed by

       e-mail Mrs. V in charge of recruitment at W (hereinafter "the

       defendant 3") that he did not want to work with him because of comments that were not

       commendation from its former director, defendant 2. In support of his remarks, the
       complainant attached to his complaint a screenshot of a message (SMS) he received from the

       defendant 3: “Monday Mr. Y1 gave an email response. He decided not to

       work with you. He received not very complimentary comments about you from

       the former director of Z.”. The plaintiff adds that defendant 3 ceased, since this

       incident, any form of collaboration in the management of his file and that defendant 2 has
       already damaged his reputation by spreading false rumours. He thinks the

       documents which could, we quote, “emerge from this complaint [him] would allow

       to be able to sue [respondent 2] for slander and defamation”.


 5. In addition to the abovementioned information, the complainant affirms, in the complaint form,
       having been dismissed after 13 years of service for reorganization by the defendant 2 , and considers

       that his personal data has been unlawfully processed by his former employer and the

       potential employer. The complainant indicates that he tried to contact the people involved,

       both by phone and by e-mail, to solve this problem amicably,

       but without success.

 6. The complainant sends an email to the SPL providing information

       supplementary information on the law on labor relations and the collection of candidate data

       with their former employers and clients. The complainant also provided a link, link Decision 62/2023 - 3/6



       which refers to the site of the Data Protection Authority (hereinafter "DPA")

       https://www.autoriteprotectiondonnees.be/professionnel/themes/vie-privee-sur-le-lieu-

       of-work/recruitment-of-candidates.


 7. On March 21, 2023, the SPL informed the complainant that his complaint was inadmissible for defects of
       forms. The same day, the complainant returns the complaint form duly completed.


 8. On May 2, 2023, the SPL declared the complaint admissible on the basis of Articles 58 and 60 of the ACL,

       and sends it to the Litigation Division in accordance with Article 62, § 1 of the LCA.



II. Motivation


 9. Pursuant to Article 4, § 1 of the LCA, the DPA is responsible for monitoring the principles
       of data protection contained in the GDPR and other laws containing

       provisions relating to the protection of the processing of personal data.


 10. Pursuant to Article 33, §1 of the LCA, the Litigation Chamber is the body for

       ODA administrative litigation. It receives complaints that the SPL forwards to it in

       application of Article 62, § 1 of the LCA, i.e. admissible complaints. In accordance with
       Article 60 paragraph 2 of the LCA, complaints are admissible if they are written in one of the

       national languages, contain a statement of the facts and the information necessary to

       identify the processing of personal data to which they relate and which

       fall within the competence of the ODA.


 11. On the basis of the facts described in the complaint file as summarized above, and on the

       powers attributed to it by the legislator under Article 95, § 1 of the
       the LCA, the Litigation Chamber decides on the follow-up to be given to the file; in this case, the

       Litigation Chamber decides to proceed with the dismissal of the complaint,

       in accordance with Article 95, § 1, 3° of the LCA, for the reasons set out below.


 12. In matters of dismissal, the Litigation Chamber is required to justify its
                          1
       step-by-step decision and:

            - to pronounce a classification without technical continuation if the file does not contain or not

                sufficient element likely to lead to a sanction or if it includes a

                technical obstacle preventing him from rendering a decision;

            - or pronounce a classification without further opportunity, if despite the presence

                elements likely to lead to a sanction, the continuation of the examination of the

                file does not seem to him to be appropriate given the priorities of the Autorité de






1Cour des marchés (Brussels Court of Appeal), September 2, 2020, judgment 2020/AR/329, p. 18. Decision 62/2023 - 4/6



                data protection as specified and illustrated in the Privacy Policy
                                                                      2
                dismissal of the Litigation Chamber.

 13. In the event of dismissal based on several reasons for dismissal, these

       last (respectively, classification without technical continuation and classification without continuation

       opportunity) should be addressed in order of importance . 3


 14. In this case, the Litigation Chamber decides to proceed with a classification without further

       the complaint on these two grounds. The decision of the Litigation Chamber is based more

       specifically on two reasons why it considers it inappropriate to

       continue to monitor the case, and therefore decides not to proceed, among other things, with

       a review of the case on the merits.


 15. First, the Litigation Division finds that the complaint is not sufficiently
       supported by evidence of a breach of GDPR or privacy laws

       personal data, and decides to dismiss the complaint for technical reasons.


 16. Although the complainant alleges the collection and communication of personal data

       personal by the defendants, he did not provide any hard evidence to support these

       allegations. The complaint does not contain supporting documents, correspondence or

       other specific pieces of evidence that would allow the Litigation Chamber

       to clearly identify the alleged violation. The Litigation Chamber adds that the capture

       screenshot of the SMS message provided by the complainant, although presented as evidence,

       does not allow the authenticity of the information to be verified and does not constitute proof

       conclusive. In the absence of sufficient evidence, the Litigation Chamber cannot conclude

       whether there is a breach of GDPR and/or data protection laws. By

       Consequently, the grievance raised by the complainant is dismissed.

 17. Secondly, and without prejudice to the foregoing, the Litigation Division proceeds to a

       dismissal for reasons of opportunity. The Litigation Chamber notes that the grievance

       raised by the complainant does not meet the general or personal impact criteria

       high, as defined by the APD in its note on the policy of classification without follow-up of the

       June 18, 2021. The Litigation Chamber therefore weighs the personal impact

       the circumstances of the complaint for the fundamental rights and freedoms of the complainant, and

       the efficiency of its intervention, to decide whether it considers it appropriate to deal with the complaint of

       thorough manner.





2In this respect, the Litigation Chamber refers to its policy of dismissal as developed and published on
the website of the Data Protection Authority: https://www.autoriteprotectiondonnees.be/publications/politique-de-
classification-without-continuation-of-the-litigation-chamber.pdf.
3Data Protection Authority, “Policy of classification without follow-up of the Litigation Chamber: 3.–In which cases
Is my complaint likely to be dismissed by the Litigation Chamber? », June 18, 2021, available on
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
litigation.pdf. Decision 62/2023 - 5/6




 18. In this case, although the Complainant mentioned alleged consequences on his

        reputation and his relationship with the defendant 3, the Litigation Chamber finds that the

        screenshot of an SMS message provided by the complainant does not constitute a source

        sufficiently reliable and verifiable to support claims of a breach of the GDPR and/or

        data protection laws. In addition, the Litigation Chamber recalls that it

        evaluates the efficiency of its intervention and the means necessary to deal with the complaint


        thorough manner. In this case, a thorough investigation would require means

        considerable resources to gather additional evidence, question the parties involved

        and assess the circumstances surrounding the allegations. Given the lack of evidence

        strong and the significant resources that this would entail, the Litigation Chamber

        considers that it is not appropriate to pursue the examination of the complaint. Therefore, the

        Complaint is also dismissed for reasons of expediency. 4


 19. In conclusion, the Litigation Chamber decides to proceed with the dismissal of the

        plaintiff's complaint, both for technical and expediency reasons.




III. Publication and communication of the decision


 20. Given the importance of transparency with regard to the process

        decision-making and the decisions of the Litigation Chamber, this decision will be published on the

        website of the Data Protection Authority. However, it is not necessary for this


        so that the identification data of the parties are directly communicated.

 21. In accordance with its policy of dismissal, the Litigation Chamber

                                                       5
        communicate the decision to the defendants. Indeed, the Litigation Chamber decided to

        communicate dismissal decisions to default defendants. There

        However, the Litigation Chamber refrains from such communication when the complainant

        has requested anonymity vis-à-vis the defendant(s) and when the communication of the

        decision to the defendant(s), even pseudonymized, nevertheless risks allowing its re-

        identification . This is not the case in the present case, the plaintiff having not requested


        anonymity.










4
 A dismissal for reasons of expediency does not mean, however, that the Litigation Chamber legally finds that no
violation has taken place, but the resources needed to substantiate the claim are potentially excessive. ; Authority for the protection of
data, “Dismissal policy of the Litigation Chamber”, June 18, 2021, available on
5ttps://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-contentieuse.pdf
 Data Protection Authority, “Policy of classification without follow-up of the Litigation Chamber: 5. -Classification
without follow-up will it be published? Will the opposing party be informed? », June 18, 2021, available on
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
litigation.pdf.
6Ibidem. Decision 62/2023 - 6/6







   FOR THESE REASONS,


   The Litigation Chamber of the Data Protection Authority decides, after deliberation,


   to close this complaint without further action pursuant to Article 95, § 1, 3° of the LCA.





In accordance with article 108, § 1 of the LCA, an appeal against this decision may be lodged,

within thirty days of its notification, to the Court of Markets (court

d'appel de Bruxelles), with the Data Protection Authority as defendant.


Such an appeal may be introduced by means of an interlocutory request which must contain the

information listed in article 1034ter of the Judicial Code. The interlocutory motion must be

filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 8

via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).


To allow him to consider any other possible course of action, the Litigation Chamber sends

the complainant to the explanations provided in its dismissal policy. 9


The Litigation Chamber underlines that the classifications without action taken are likely

to be taken into account by the Data Protection Authority in order to set its future priorities


and/or could inspire future investigations of the Inspection Authority's own initiative.

Data protection.








(se). Hielke HIJMANS


President of the Litigation Chamber










7The request contains on penalty of nullity:

 (1) indication of the day, month and year;
 2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
     Business Number;
 3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
 (4) the object and summary of the grounds of the application;
 (5) the indication of the judge who is seized of the application;
 6° the signature of the applicant or his lawyer.
8
  The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.
9Data Protection Authority, “Discontinued filing policy of the Litigation Chamber: 4. – What can I
should I do if my complaint is dismissed? », June 18, 2021, available on
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
litigation.pdf.