APD/GBA (Belgium) - 79/2023
From GDPRhub
| APD/GBA - 79/2023 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 5(1)(d) GDPR Article 12(3) GDPR Article 12(4) GDPR Article 15 GDPR Article 16 GDPR |
| Type: | Complaint |
| Outcome: | Partly Upheld |
| Started: | |
| Decided: | 19.06.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 79/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | French |
| Original Source: | APD/GBA (in FR) |
| Initial Contributor: | n/a |
The Belgian DPA decided that subjective statements made in a meeting and faithfully recorded in the minutes do not fall within the scope of Article 16 GDPR.
English Summary
Facts
The data subject was a psychiatrist. At a meeting of the association of psychiatrists (controller), doubts were expressed as to the legitimacy of the data subject to practise as a psychiatrist and the controller decided to verify the data subject’s diploma. This information was recorded in the minutes of the meeting which were published in May 2018.
The data subject contacted the controller to request access and rectification of his data under Articles 15 and 16 GDPR. He considered that these data were publicly accessible since the publication of the minutes and requested the controller to publish a message to rectify them on the basis of the accuracy principle (Article 5(1)(d) GDPR). The controller didn’t follow up on this request, which led the data subject to lodge a complaint with the Belgian DPA.
Holding
The DPA recalled that the application of Article 16 GDPR requires inaccurate data. In this case, the DPA considered that the subjective statements made in the minutes do not imply the processing of inaccurate data if these statements are consistent with what was said during the meeting. In view of the purpose of the processing, i.e. to provide a written minute of what was said at the meeting, the data is accurate and therefore doesn’t fall within the scope of Article 16 GDPR.
Article 16 GDPR also provides a right to have incomplete data completed. In this case, the DPA considered that in view of the purpose of the processing, the data was complete. The right to have data completed is indeed not intended to enable the data subject to express disagreement with the statements made and faithfully recorded.
In view of the above, the DPA considered that the controller did not violate Article 16 GDPR. However, by not following up on the request of the data subject, the controller violated Article 12(3) and (4) GDPR. The DPA therefore issued a warning for these articles.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/10
Litigation Chamber
Decision 79/2023 of June 19, 2023
File number: DOS-2022-01040
Subject: Complaint relating to the exercise of a right of rectification with regard to the content of a
minutes of meeting
The Litigation Chamber of the Data Protection Authority, made up of Mr Hielke
Hijmans, President, sitting alone;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and
to the free movement of such data, and repealing Directive 95/46/EC (general regulation on the
data protection), hereinafter GDPR;
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter
ACL);
Having regard to the Law of 30 July 2018 relating to the protection of natural persons with regard to
processing of personal data (hereinafter LTD);
Having regard to the Rules of Procedure as approved by the House of Representatives on 20
December 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Made the following decision regarding:
The complainant: Mr. X, hereinafter "the complainant";
The defendant: Y, Hereinafter “the defendant”; Decision 79/2023 - 2/11
I. Facts and procedure
1. The complaint concerns the lack of follow-up given to the exercise of the right to rectification of the
plaintiff with regard to personal data concerning him recorded in a lawsuit
minutes of the defendant's meeting.
2. On January 28, 2022, the complainant filed a complaint with the Authority for the Protection of
data (APD).
3. On April 7, 2022, the APD's Front Line Service (SPL) declared the complaint admissible on
the basis of articles 58 and 60 of the LCA and sends it to the Litigation Chamber
in accordance with Article 62, § 1 of the LCA.
4. The following appears from the complaint and the documents annexed thereto.
5. By letter dated June 3, 2021, the complainant, through his counsel, put the
defendant in default on the basis of the provisions of Article 15 of the GDPR, to provide it
the information that led her to doubt her professional background, her diplomas
and on the basis of his legitimacy to practice as a psychiatrist as well as to rectify
thedataconcerningitinapplicationofarticle16oftheGDPRandtoprovideproof
of this correction.
6. It is indeed apparent from a meeting minutes of the Respondent from 2017, which appears
in a publication of the association, that an item on the agenda related to the "case" of the
complainant. In this regard, the minutes state that the professional qualification of the
complainant was questioned and a member of the defendant was invited to verify
the existence of the complainant's diplomas.
7. The plaintiff states that the defendant's publication casting doubt on its
skills and being publicly accessible since May 2018 to date, it has
asked the defendant to dispel this doubt and to correct this information by a
message also publicly accessible, on the basis of the principle of accuracy
enshrined in the GDPR. In its complaint, the complainant cites Articles 5.1.d) and 16 of the
GDPR in support of its approach.
8. Since the Defendant neither followed up nor granted its request, the Complainant concludes that
the defendant violates the provisions of Article 16 of the GDPR, enshrining the right to
rectification but also the provisions of Article 12 of the GDPR in that the
respondent had one month to follow up on its request or at the very least Decision 79/2023 - 3/11
inform him of his desire not to follow up on this one that the latter has
refrained from doing. Under the terms of the complaint, the complainant no longer invokes Article 15 of the GDPR
which he had mobilized in his initial request to the defendant.
II. Motivation
II.1.1. As to the jurisdiction of the Litigation Chamber
9. The Litigation Chamber is of the opinion that the fact that the meeting of the defendant took place
in 2017, followed according to the complainant by a publication in May 2018, does not call into question his
competence rationae temporis.
10. In fact, the Litigation Division starts from the idea that the disputed minutes drawn up from
typewritten manner is necessarily still preserved today with the
defendant and consists at least of the processing of personal data
relating to the complainant appearing in a file within the meaning of Article 2 of the GDPR, if not in a
automated processing if this storage were to take place electronically.
In this case, this is continuous processing subject to the GDPR since its entry into force.
application on May 25, 2018, the jurisdiction rationae temporis of the Litigation Chamber
is established. Furthermore, since these minutes would actually be publicly
accessible today as the support the plaintiff - and would therefore consist (such as the
conservation mentioned above) also in a continuous processing to which the GDPR
applies even if the minutes drawn up before May 25, 2018, or even distributed before this
date, the Litigation Chamber would also be competent with regard to said processing.
The Litigation Chamber was thus able to observe that at least one of the publications of the
defendant is indeed freely accessible on the Internet. The elements that
above justify that, prima facie, the Litigation Chamber declares itself competent
regard to the facts reported.
11. For all practical purposes, the Litigation Chamber indicates that in this case, the fact that the
complainant resides outside the European Union has no effect on his
jurisdiction. Indeed, the defendant presumed to be responsible for processing is established in
Belgium and article 3.1. of the GDPR applies with regard to the territorial applicability of the GDPR.
The complainant is certainly established outside the European Union but can rely on
Article 77 of the GDPR to lodge a complaint – moreover declared admissible with regard to
the conditions of admissibility laid down in the LCA by the SPL of the APD (point 3) – with
ODA. Article 77 indeed states that “without prejudice to any other administrative remedy
1(….) Decision 79/2023 - 4/11
or jurisdictional, any person concerned has the right to lodge a complaint with
of a supervisory authority, in particular in the Member State in which its
habitual residence, place of work or the place where the violation is alleged to have been committed, if it
considers that the processing of personal data concerning him constitutes a
2
violation of this regulation”.
II.1.2. As to the legality of the disputed publication (Article 6 of the GDPR)
12. Given the uncertainties surrounding the evidence of this (online) publication, the
Litigation Chamber will limit itself to reminding the defendant of its obligations with regard to
of said publication (for everyone, if applicable and not only for members
of the defendant for example) in the form of a warning (see below).
13. Thus, as to the basis of lawfulness of said publication, the Litigation Chamber reminds the
defendant only if the publication should not be able to rely on one of the bases of
lawfulness of Article 6 of the GDPR - all of which contain, with the exception of the
consent of the person concerned, a condition of necessity which joins
Article 5.1 c) of the GDPR - it would contravene Article 6 of the GDPR. Indeed, only the
data necessary for the purpose pursued can be legitimately processed. In his
assessment of the condition of necessity, the Litigation Division invites the defendant
to take into account the publicity thus given to all of a questioning of the diplomas of the
complainant and thereby the legitimacy of the exercise of his profession, i.e.
considerations which can be described as particularly serious for the complainant. Default
basis of valid lawfulness on which to base the possible online publication, the
defendant will have to draw all the consequences with regard to the GDPR, for example in
terms of cessation of processing and possible deletion of data.
II.1.3. Regarding the complainant's right to rectification (Article 16 of the GDPR)
14. The Litigation Chamber recalls that Article 16 of the GDPR – right of rectification – sets out
what follows :
“The data subject has the right to obtain from the controller, within the
as soon as possible, the rectification of the personal data concerning him
which are inaccurate. Taking into account the purposes of the processing, the data subject
has the right to obtain that incomplete personal data be
supplemented, including by providing a supplementary declaration”.
2Emphasis added by the Litigation Chamber. Decision 79/2023 - 5/11
15. Article 16 of the GDPR is closely linked to the principle of correctness enshrined in Article 5.1.d)
of the GDPR according to which the personal data processed must be "accurate and,
if necessary, kept up to date; all reasonable steps must be taken to ensure that
personal data that is inaccurate, having regard to the purposes for which
they are processed, erased or rectified without delay (accuracy)”.
16. The application of this right therefore presupposes in its first part (first sentence of
16 of the GDPR) that the personal data of the data subject which
are processed are inaccurate in relation to the purpose for which they are processed.
17. In general, personal data may consist of information
objectives such as a surname, first name, date of birth which, if they are not
correctly spelled or mention a day, a month, incorrectly for example must
certainly be corrected.
18. Personal data may also consist of subjective assessments,
opinions, questions or evaluations from third parties. In these
case, when these data are disputed by the data subject, it is not
necessarily a question of inaccuracy of the data. Their challenge may simply
translate a disagreement between the person concerned on the one hand and the author of the said
subjective assessment, opinion, questioning or evaluation on the other hand.
19. In the same way, the remarks related in a report do not entail any
processing, where appropriate, of inaccurate personal data if these statements are
consistent with what was presented at the meeting in question. The data thus reported
therefore do not fall within the scope of Article 16 of the GDPR and should not
not be corrected by the controller. In view of the purpose pursued by
the processing of data, i.e. the recording in writing of remarks made in meetings, the
data is correct. In other words, the right of rectification enshrined in the right to
data protection cannot in this case be diverted from its objective to deliver
in question what would have been accurately reported in the written minutes of the meeting, or what
that would have been issued as an assessment in one or the other report, were it the person
concerned in disagreement with what would be said about him during this one or with the said
evaluation. The Litigation Chamber has already clarified this in the past during a complaint
addressed by a parent of a student about what was reported in the minutes of a meeting
school about her daughter's learning difficulties. The right of rectification is not
3See. for example decision 42/2023 of the Litigation Chamber. Decision 79/2023 - 6/11
not there to rewrite what would have been said in a meeting and then recorded in his account-
rendered.
20. Article 16 of the GDPR also provides (in its second part) the right for the person
concerned to obtain that incomplete personal data relating to him
be supplemented by a declaration. The Litigation Chamber is of the opinion that this
additional information is not intended to allow the data subject
to express his disagreement with the remarks made (and faithfully recorded) which relate
data concerning him taking into account, here again, the purpose of said processing of
data.
21. The Litigation Chamber is of the opinion that in this case, the data relating to the complainant
as recorded in the publication in dispute by the defendant can neither be
qualified as inaccurate or incomplete within the meaning of Article 16 of the GDPR. Those data
question his professional title and his authorization to practice his profession and
request that a member of the defendant carry out the necessary checks. Also
disagreeable may it be so expressed, recorded and disseminated (see above) such
doubts, it is not questioned by the complainant that such would not have been the comments
held with regard to him or that the data concerning him mentioned during the said meeting are not
would not find mentioned in the minutes. The Litigation Chamber insists on this
regard to the fact that it is clear from the manner in which the minutes are drafted that
the processing of the complainant's data reflects the opinion of certain members of the
defendant. The Litigation Chamber subscribes in this respect to the point of view of the doctrine
which states that “it is also complex if the data in question records an opinion. Opinions are,
by their very nature, subjective, and it can be difficult to conclude that the record of an
opinion is inaccurate. As long as the record shows clearly that the information is an opinion
and, where appropriate, whose opinionitis, it may be difficult to say thatitis inaccurate and
needs to be rectified”.4
4https://gdprhub.eu/Article_16_GDPR#Right_to_Complete_Incomplete_Data
"The situation is also complex if the data in question reflect an opinion. Opinions are, by their nature,
subjective and it may be difficult to conclude that reflecting an opinion is inaccurate. As long as it is clear that the information
reported is an opinion and, if applicable, the opinion of the person concerned, it may be difficult to say that the data revealed by
These statements are inaccurate and must be corrected”. Decision 79/2023 - 7/11
22. In conclusion, the Litigation Chamber decides that no breach based on a
possible violation of Article 16 of the GDPR cannot be blamed on the defendant.
Therefore, the Litigation Chamber will close this aspect of the complaint without further action (see below).
II.1.4. As for the lack of response to the complainant (article 12 of the GDPR)
23. Under Article 12.3. of the GDPR, the controller provides the data subject
concerned information on the measures taken following a request made in
application of Articles 15 to 22 (therefore including Article 16 of the GDPR invoked in
case), as soon as possible and in any case within one month from
from receipt of the request. If necessary, this period may be extended by two
months, given the complexity and number of requests. The person in charge of
processing informs the data subject of this extension and the reasons for the postponement
within one month of receipt of the request. When the person
concerned submits its request in electronic form, the information is
provided electronically where possible, unless the person concerned
don't ask for it to be otherwise.
24. It is also provided for in Article 12.4. of the GDPR only "if the controller does not
does not respond to the request made by the person concerned, he informs the latter without
delay and at the latest within one month of receipt of the request from the
reasons for its inaction and the possibility of filing a complaint with an authority
control and to lodge a judicial appeal”.
25. In other words, regardless of the defendant's intention with regard to the request
of rectification which was sent to it on June 3, 2021 (point 5), it had to react to the
complaining what she seems to have refrained from doing. Therefore, the Litigation Chamber
will also issue a warning in this regard (see.infra).
III. Corrective measures and sanctions
26. Based on the facts described in the complaint file as summarized above, and on the
basis of the powers attributed to it by the legislator under Article 95,
§ 1 of the LCA, the Litigation Chamber decides on the follow-up to be given to the file.
27. In this case, the Litigation Chamber decides:
– on the one hand, on the basis of Article 58.2.a) of the GDPR and Article 95, § 1, 4° of the LCA,
to issue a warning to the defendant with regard to the grievance based on a possible Decision 79/2023 - 8/11
breach of article 6 of the GDPR as well as article 12.3-4 of the GDPR, for
reasons set out above ( Title II.1.2, points 12-13 and Title II.1.4, points 23-25).
- on the other hand, in accordance with article 95, § 1, 3° of the LCA, to proceed with the classification
without action on the grievance alleging a possible breach by the defendant of Article 16 of the
GDPR for the reasons set out above (Title II.1.3 – points 14-22).
III.1.1. As for the warning
28. The Litigation Chamber wishes to specify that this warning decision is a
prima facie decision taken by the Litigation Chamber in accordance with Article 95 of the
LCA on the basis of the sole complaint filed by the plaintiff and the exhibits he filed with
the support of this, within the framework of the "procedure prior to the substantive decision".
therefore not a decision on the merits within the meaning of Article 100 LCA.
29. The purpose of this warning decision is to inform the defendant and to inform him
enables compliance where applicable (Title II.1.2) and in the future (Title II.1.4).
30. Therefore, if the defendant does not agree with the content of this decision
prima facie and believes that it can make factual and/or legal arguments that
could lead to a different decision on the point on which this warning relates, it
may submit to the Litigation Chamber a request for processing on the merits of
the case via the e-mail address litigationchamber@apd-gba.be, within 30 days
after notification of this decision.
31. In the event of further processing of the complaint on the merits pursuant to Articles 98, 2° and 3°
juncto article 99 of the LCA, the Litigation Chamber will invite the parties, either the
plaintiff than the defendant, to introduce their arguments in the form of conclusions
and to attach to the file all the documents that he and she deem useful.
32. The Litigation Chamber informs in this regard both the plaintiff and the defendant that the
procedural file relating to the complaint leading to this warning decision
may, pursuant to Article 95.2, 3° of the LCA, be requested by sending
preferably an e-mail to the registry of the Litigation Chamber (litigationchamber@apd-
gba.be). Decision 79/2023 - 9/11
33. Finally, for the sake of completeness and transparency, the Litigation Chamber emphasizes
that an examination of the case on the merits may lead to the imposition of the measures mentioned
in Section 100 of the ACL 5.
III.1.2. As for the classification without continuation
34. In matters of dismissal, the Litigation Chamber is required to justify its
step-by-step decision and:
- to pronounce a classification without technical continuation if the file does not contain or not
sufficient elements likely to lead to a sanction or if it includes a
technical obstacle preventing him from rendering a decision;
- or pronounce a classification without further opportunity, if despite the presence of elements
likely to lead to a sanction, the continuation of the examination of the file does not seem to him
not appropriate taking into account the priorities of the Data Protection Authority such
as specified and illustrated in the Chamber's Dismissal Policy
7
Litigation.
51° close the complaint without action;
2° order the dismissal;
3° pronouncing the suspension of the pronouncement;
4° to propose a transaction;
5° issue warnings and reprimands;
6° order to comply with requests from the data subject to exercise his or her rights;
7° order that the person concerned be informed of the security problem;
8° order the freezing, limitation or temporary or permanent prohibition of processing;
9° order compliance of the processing;
10° order the rectification, restriction or erasure of the data and the notification thereof to the
data recipients;
11° order the withdrawal of accreditation from certification bodies;
12° to issue periodic penalty payments;
13° to issue administrative fines;
14° order the suspension of cross-border data flows to another State or an international body;
15° forward the file to the public prosecutor's office in Brussels, which informs it of the follow-up given to the
case ;
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority.
6
Market Court (Brussels Court of Appeal), September 2, 2020, judgment 2020/AR/329, p. 18.
7In this respect, the Litigation Chamber refers to its policy of dismissal as developed and
published on the website of the Data Protection Authority:
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
litigation.pdf. Decision 79/2023 - 10/11
35. In the event of dismissal based on several reasons for dismissal, these
last (respectively, classification without technical continuation and classification without continuation
timeliness) should be addressed in order of importance .8
35. In this case, the Litigation Chamber decides to proceed with the dismissal of the
technical complaint. The decision of the Litigation Chamber is based more
precisely on the fact that no violation of Article 16 of the GDPR can be established in
the head of the defendant (points 14-22). This grievance is therefore unfounded in this case, the criterion
A.2. of the Discontinued Discontinuance Policy of the Litigation Chamber finds at
9
apply (unfounded complaint). The Litigation Chamber therefore considers that it is
inadvisable to continue the follow-up of the file, and decides accordingly not to proceed,
inter alia, an examination of the case on the merits.
IV. Publication and communication of the decision
36. Given the importance of transparency with regard to the decision-making process and the
decisions of the Litigation Chamber, this decision will be published on the website of
ODA. However, it is not necessary for this purpose that the identification data of the
parties are directly mentioned.
8Cf.Title 3–In which cases is my complaint likely to be dismissed without further action by the Litigation Chamber?
of the dismissal policy of the Litigation Chamber.
9
Criterion A.2. : The Litigation Chamber will have to proceed to a classification without follow-up if it emerges in a way
evidence of your complaint that the Litigation Chamber cannot conclude that there is any violation
GDPR and personal data protection rules, based on the facts and legal grievances invoked
in your complaint. The complaint will then be considered manifestly unfounded within the meaning of Article 57.4.
of the GDPR. https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-
litigation-chamber.pdf. Decision 79/2023 - 11/11
FOR THESE REASONS,
the Litigation Chamber of the Data Protection Authority decides, after deliberation,
- subject to the introduction of a request by the defendant for treatment on the
merits in accordance with articles 98 e.s. of the ACL via the e-mail address
litigationchamber@apd-gba.be, within 30 days of notification of the
present decision, to issue a warning against the defendant in
pursuant to Article 58.2.a) of the GDPR and Article 95.1, 4° of the LCA with regard to complaints
based on possible breaches of Articles 6 and 12.3-4 of the GDPR.
- to close the present complaint without follow-up pursuant to article 95, § 1, 3° of the LCA
for the surplus.
Pursuant to Article 108, § 1 of the LCA, this decision may be appealed to the
Court of Markets (Brussels Court of Appeal) within 30 days of its
notification, with the Data Protection Authority (DPA) as defendant.
Such an appeal may be introduced by means of an interlocutory request which must contain the
10
information listed in article 1034ter of the Judicial Code. The interlocutory motion must
be filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C.
11
jud. , or via the e-Deposit information system of the Ministry of Justice (article 32ter of C.
jud.).
(se). Hielke HIJMANS
President of the Litigation Chamber
10The request contains on pain of nullity:
(1) indication of the day, month and year;
2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
Business Number;
3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
(4) the object and summary of the grounds of the application;
(5) the indication of the judge who is seized of the application;
the signature of the applicant or his lawyer.
11 The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.
