APD/GBA (Belgium) - 66/2021
|APD/GBA (Belgium) - 66/2021|
|Relevant Law:||Article 4(3) GDPR|
Article 14 GDPR
Article 15 GDPR
Article 16 GDPR
Article 18 GDPR
|Parties:||Federal Governmental Agency: Financial|
|National Case Number/Name:||66/2021|
|European Case Law Identifier:||n/a|
|Original Source:||Beslissing ten gronde 66/2021 van 04 juni 2021 (in NL)|
|Initial Contributor:||Enzo Marquet|
The Litigation Chamber of the Belgian DPA ordered the Belgian Special Tax Inspectorate to comply with a complainant's requests to exercise their rights under Articles 14, 15, 16, and 18 GDPR. The Chamber held that subjective information can constitute personal data under the GDPR, and that restrictions to data subject rights in a Belgian income tax law are formulated too broadly and are therefore not applicable.
English Summary[edit | edit source]
Facts[edit | edit source]
The complainant is an accountant in Luxembourg. On 18 July 2019 and 9 August 2019, the complainant issued a request for information, access, rectification, and restriction of the processing of their personal data to the Belgian Special Tax Inspectorate ("Directie Algemene Administratie van de Bijzondere Belastinginspectie"), following the mention of their name in various files concerning investigations into tax payers. According to the complainant, the Tax Inspectorate had wrongly referred to them as a 'straw man' ("stroman") for a company alleged to have committed tax evasion.
When the Tax Inspectorate rejected the complainant's requests in a letter dated 28 October 2019, the complainant filed a complaint with the Belgian DPA.
Among other things, in its submissions, the Tax Inspectorate argued that the words 'straw man' and 'suspected straw man' do not constitute personal data as defined by the GDPR, since they concern an opinion or viewpoint of the Tax Inspectorate regarding the relation of the complainant to the relevant company. The complainant is therefore not entitled to request rectification of this data, or restriction of its processing.
Further, the Tax Inspectorate argued that, in accordance with Article 322 §1 of the Income Tax Law 1992 ('wetboek van de inkombelastingen', or 'WIB92') it is entitled to take a position on relevant tax issues to ensure the correct collection of tax. Specifically, this means that it is entitled to state that the complainant is suspected of acting as a 'straw man'. It argued a different reading of Article 322 §1 WIB92 would be contrary to Article 322 §1 WIB92 itself, as well as to a civil servant's freedom of expression within the meaning of Article 10 ECHR.
The Tax Inspectorate also argued that it had indeed satisfied the complainant's right to information under Article 14. This is because Law of 3 August 2012 containing provisions on the processing of personal data by the Tax Inspectorate in connection with its tasks, specifies a derogation which provides that the right of information may be restricted in order to safeguard the public interest objectives of monetary, budgetary, and fiscal matters. Specifically, it refers to the processing of personal data that has at its purpose the aim of preparing, organising, and monitoring activities which may result in an administrative fine or penalty. The restriction applies during the period of which the relevant individual is subject to investigation.
Holding[edit | edit source]
Firstly, the Litigation Chamber of the Belgian DPA held that the Tax Inspectorate had not executed the complainant's request for information, access, rectification, and restriction of processing, within good time - that is, within one month of the request - thereby infringing Article 12(3) of the GDPR, as well as 11 §3, 11/1 §3, 11/2 §3 and 11/3 §3 of the Act of 3 August 2012.
With regard to the complainant's right to rectification, the Litigation Chamber emphasised that, contrary to the Tax Inspectorate's assertion, the description of the complainant as a 'straw man' qualifies as personal data, which, in line with Article 4(1) and Recital 26 GDPR, as well as Opinion 4/2007 of the WP29 and the case law of the CJEU, must be interpreted broadly to include elements characterising the physical, physiological, genetic, mental, economic, cultural, or social identity of the individual. Importantly, personal data includes subjective information, such as the term 'straw man' irrespective of whether or not this information is correct. The litigation Chamber highlighted that in its opinion 04/2017, the WP29 pointed out that data protection rules take into account the possibility that such subjective information is inaccurate, and give the data subject the right of rectification, which is possible. In this regard, the Litigation Chamber noted that since it is not in a position to check the accuracy of the contested information ('straw man'), and cannot take the place of the Tax Inspectorate in this, it recommends the Tax Inspectorate rectify the personal data by allowing the complainant to add a statement to the file to the contrary.
The Litigation Chamber further held that the Tax Inspectorate cannot rely on the derogations provided for in the Act of 3 August 2012 and is therefore obliged to facilitate the complainant's data subject rights.
This is because these derogations must satisfy certain conditions, based on Article 52 of the Charter of Fundamental Rights of the EU, read in line with Article 8 of the same law, as well as CJEU case law. The Litigation Chamber notes that these conditions are not satisfied, in particular because the derogations are very broadly formulated, and go beyond what is provided for in Article 23 GDPR on restrictions to the GDPR. That Act not only allows the rights of data subjects to be restricted, but also makes it possible to exclude them altogether and deprive the data subject of any right. By incorrectly relying on these derogations, and failing to inform the complainant of the lack of applicability of the derogations, the Tax Inspectorate violated Article 12(2) GDPR, in conjunction with Articles 14, 15, 16, and 18 GDPR.
The Litigation Chamber ordered the Tax Inspectorate to comply with the complainant's requests to exercise their rights, in particular their right to information and access under Articles 14 and 15 GDPR and Articles 11 and 11/1 of the Act of 3 August 2012.
In line with Articles 16 and 19 GDPR, the Litigation Chamber also ordered the Tax Inspectorate to inform any recipient to whom the personal data concern were disclosed of this rectification. It emphasised the Tax Inspectorates obligation under Article 5(1)(d) GDPR to ensure personal data processed are accurate and up to date, and take steps to ensure all inaccurate data are rectified without delay.
It also issued a reprimand in accordance with Article 58(2)(b) GDPR and Article Article 100, §1, 5° WOG in addition to these corrective measures. It takes into account that the Tax Inspectorate is a public authority which has an exemplary function in terms of compliance with legislation on the protection of personal data, and which, as a tax authority, also processes a large amount of personal data. In accordance with the principle of 'lead by example' it must therefore ensure that it acts in conformity with the GDPR at all times and in particular with the provisions regarding the rights of data subjects.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.