APD/GBA (Belgium) - 79/2023
|APD/GBA - 79/2023|
|Relevant Law:||Article 5(1)(d) GDPR|
Article 12(3) GDPR
Article 12(4) GDPR
Article 15 GDPR
Article 16 GDPR
|National Case Number/Name:||79/2023|
|European Case Law Identifier:||n/a|
|Original Source:||APD/GBA (in FR)|
The Belgian DPA decided that subjective statements made in a meeting and faithfully recorded in the minutes do not fall within the scope of Article 16 GDPR.
English Summary[edit | edit source]
Facts[edit | edit source]
The data subject was a psychiatrist. At a meeting of the association of psychiatrists (controller), doubts were expressed as to the legitimacy of the data subject to practise as a psychiatrist and the controller decided to verify the data subject’s diploma. This information was recorded in the minutes of the meeting which were published in May 2018.
The data subject contacted the controller to request access and rectification of his data under Articles 15 and 16 GDPR. He considered that these data were publicly accessible since the publication of the minutes and requested the controller to publish a message to rectify them on the basis of the accuracy principle (Article 5(1)(d) GDPR). The controller didn’t follow up on this request, which led the data subject to lodge a complaint with the Belgian DPA.
Holding[edit | edit source]
The DPA recalled that the application of Article 16 GDPR requires inaccurate data. In this case, the DPA considered that the subjective statements made in the minutes do not imply the processing of inaccurate data if these statements are consistent with what was said during the meeting. In view of the purpose of the processing, i.e. to provide a written minute of what was said at the meeting, the data is accurate and therefore doesn’t fall within the scope of Article 16 GDPR.
Article 16 GDPR also provides a right to have incomplete data completed. In this case, the DPA considered that in view of the purpose of the processing, the data was complete. The right to have data completed is indeed not intended to enable the data subject to express disagreement with the statements made and faithfully recorded.
In view of the above, the DPA considered that the controller did not violate Article 16 GDPR. However, by not following up on the request of the data subject, the controller violated Article 12(3) and (4) GDPR. The DPA therefore issued a warning for these articles.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/10 Litigation Chamber Decision 79/2023 of June 19, 2023 File number: DOS-2022-01040 Subject: Complaint relating to the exercise of a right of rectification with regard to the content of a minutes of meeting The Litigation Chamber of the Data Protection Authority, made up of Mr Hielke Hijmans, President, sitting alone; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and to the free movement of such data, and repealing Directive 95/46/EC (general regulation on the data protection), hereinafter GDPR; Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter ACL); Having regard to the Law of 30 July 2018 relating to the protection of natural persons with regard to processing of personal data (hereinafter LTD); Having regard to the Rules of Procedure as approved by the House of Representatives on 20 December 2018 and published in the Belgian Official Gazette on January 15, 2019; Considering the documents in the file; Made the following decision regarding: The complainant: Mr. X, hereinafter "the complainant"; The defendant: Y, Hereinafter “the defendant”; Decision 79/2023 - 2/11 I. Facts and procedure 1. The complaint concerns the lack of follow-up given to the exercise of the right to rectification of the plaintiff with regard to personal data concerning him recorded in a lawsuit minutes of the defendant's meeting. 2. On January 28, 2022, the complainant filed a complaint with the Authority for the Protection of data (APD). 3. On April 7, 2022, the APD's Front Line Service (SPL) declared the complaint admissible on the basis of articles 58 and 60 of the LCA and sends it to the Litigation Chamber in accordance with Article 62, § 1 of the LCA. 4. The following appears from the complaint and the documents annexed thereto. 5. By letter dated June 3, 2021, the complainant, through his counsel, put the defendant in default on the basis of the provisions of Article 15 of the GDPR, to provide it the information that led her to doubt her professional background, her diplomas and on the basis of his legitimacy to practice as a psychiatrist as well as to rectify thedataconcerningitinapplicationofarticle16oftheGDPRandtoprovideproof of this correction. 6. It is indeed apparent from a meeting minutes of the Respondent from 2017, which appears in a publication of the association, that an item on the agenda related to the "case" of the complainant. In this regard, the minutes state that the professional qualification of the complainant was questioned and a member of the defendant was invited to verify the existence of the complainant's diplomas. 7. The plaintiff states that the defendant's publication casting doubt on its skills and being publicly accessible since May 2018 to date, it has asked the defendant to dispel this doubt and to correct this information by a message also publicly accessible, on the basis of the principle of accuracy enshrined in the GDPR. In its complaint, the complainant cites Articles 5.1.d) and 16 of the GDPR in support of its approach. 8. Since the Defendant neither followed up nor granted its request, the Complainant concludes that the defendant violates the provisions of Article 16 of the GDPR, enshrining the right to rectification but also the provisions of Article 12 of the GDPR in that the respondent had one month to follow up on its request or at the very least Decision 79/2023 - 3/11 inform him of his desire not to follow up on this one that the latter has refrained from doing. Under the terms of the complaint, the complainant no longer invokes Article 15 of the GDPR which he had mobilized in his initial request to the defendant. II. Motivation II.1.1. As to the jurisdiction of the Litigation Chamber 9. The Litigation Chamber is of the opinion that the fact that the meeting of the defendant took place in 2017, followed according to the complainant by a publication in May 2018, does not call into question his competence rationae temporis. 10. In fact, the Litigation Division starts from the idea that the disputed minutes drawn up from typewritten manner is necessarily still preserved today with the defendant and consists at least of the processing of personal data relating to the complainant appearing in a file within the meaning of Article 2 of the GDPR, if not in a automated processing if this storage were to take place electronically. In this case, this is continuous processing subject to the GDPR since its entry into force. application on May 25, 2018, the jurisdiction rationae temporis of the Litigation Chamber is established. Furthermore, since these minutes would actually be publicly accessible today as the support the plaintiff - and would therefore consist (such as the conservation mentioned above) also in a continuous processing to which the GDPR applies even if the minutes drawn up before May 25, 2018, or even distributed before this date, the Litigation Chamber would also be competent with regard to said processing. The Litigation Chamber was thus able to observe that at least one of the publications of the defendant is indeed freely accessible on the Internet. The elements that above justify that, prima facie, the Litigation Chamber declares itself competent regard to the facts reported. 11. For all practical purposes, the Litigation Chamber indicates that in this case, the fact that the complainant resides outside the European Union has no effect on his jurisdiction. Indeed, the defendant presumed to be responsible for processing is established in Belgium and article 3.1. of the GDPR applies with regard to the territorial applicability of the GDPR. The complainant is certainly established outside the European Union but can rely on Article 77 of the GDPR to lodge a complaint – moreover declared admissible with regard to the conditions of admissibility laid down in the LCA by the SPL of the APD (point 3) – with ODA. Article 77 indeed states that “without prejudice to any other administrative remedy 1(….) Decision 79/2023 - 4/11 or jurisdictional, any person concerned has the right to lodge a complaint with of a supervisory authority, in particular in the Member State in which its habitual residence, place of work or the place where the violation is alleged to have been committed, if it considers that the processing of personal data concerning him constitutes a 2 violation of this regulation”. II.1.2. As to the legality of the disputed publication (Article 6 of the GDPR) 12. Given the uncertainties surrounding the evidence of this (online) publication, the Litigation Chamber will limit itself to reminding the defendant of its obligations with regard to of said publication (for everyone, if applicable and not only for members of the defendant for example) in the form of a warning (see below). 13. Thus, as to the basis of lawfulness of said publication, the Litigation Chamber reminds the defendant only if the publication should not be able to rely on one of the bases of lawfulness of Article 6 of the GDPR - all of which contain, with the exception of the consent of the person concerned, a condition of necessity which joins Article 5.1 c) of the GDPR - it would contravene Article 6 of the GDPR. Indeed, only the data necessary for the purpose pursued can be legitimately processed. In his assessment of the condition of necessity, the Litigation Division invites the defendant to take into account the publicity thus given to all of a questioning of the diplomas of the complainant and thereby the legitimacy of the exercise of his profession, i.e. considerations which can be described as particularly serious for the complainant. Default basis of valid lawfulness on which to base the possible online publication, the defendant will have to draw all the consequences with regard to the GDPR, for example in terms of cessation of processing and possible deletion of data. II.1.3. Regarding the complainant's right to rectification (Article 16 of the GDPR) 14. The Litigation Chamber recalls that Article 16 of the GDPR – right of rectification – sets out what follows : “The data subject has the right to obtain from the controller, within the as soon as possible, the rectification of the personal data concerning him which are inaccurate. Taking into account the purposes of the processing, the data subject has the right to obtain that incomplete personal data be supplemented, including by providing a supplementary declaration”. 2Emphasis added by the Litigation Chamber. Decision 79/2023 - 5/11 15. Article 16 of the GDPR is closely linked to the principle of correctness enshrined in Article 5.1.d) of the GDPR according to which the personal data processed must be "accurate and, if necessary, kept up to date; all reasonable steps must be taken to ensure that personal data that is inaccurate, having regard to the purposes for which they are processed, erased or rectified without delay (accuracy)”. 16. The application of this right therefore presupposes in its first part (first sentence of 16 of the GDPR) that the personal data of the data subject which are processed are inaccurate in relation to the purpose for which they are processed. 17. In general, personal data may consist of information objectives such as a surname, first name, date of birth which, if they are not correctly spelled or mention a day, a month, incorrectly for example must certainly be corrected. 18. Personal data may also consist of subjective assessments, opinions, questions or evaluations from third parties. In these case, when these data are disputed by the data subject, it is not necessarily a question of inaccuracy of the data. Their challenge may simply translate a disagreement between the person concerned on the one hand and the author of the said subjective assessment, opinion, questioning or evaluation on the other hand. 19. In the same way, the remarks related in a report do not entail any processing, where appropriate, of inaccurate personal data if these statements are consistent with what was presented at the meeting in question. The data thus reported therefore do not fall within the scope of Article 16 of the GDPR and should not not be corrected by the controller. In view of the purpose pursued by the processing of data, i.e. the recording in writing of remarks made in meetings, the data is correct. In other words, the right of rectification enshrined in the right to data protection cannot in this case be diverted from its objective to deliver in question what would have been accurately reported in the written minutes of the meeting, or what that would have been issued as an assessment in one or the other report, were it the person concerned in disagreement with what would be said about him during this one or with the said evaluation. The Litigation Chamber has already clarified this in the past during a complaint addressed by a parent of a student about what was reported in the minutes of a meeting school about her daughter's learning difficulties. The right of rectification is not 3See. for example decision 42/2023 of the Litigation Chamber. Decision 79/2023 - 6/11 not there to rewrite what would have been said in a meeting and then recorded in his account- rendered. 20. Article 16 of the GDPR also provides (in its second part) the right for the person concerned to obtain that incomplete personal data relating to him be supplemented by a declaration. The Litigation Chamber is of the opinion that this additional information is not intended to allow the data subject to express his disagreement with the remarks made (and faithfully recorded) which relate data concerning him taking into account, here again, the purpose of said processing of data. 21. The Litigation Chamber is of the opinion that in this case, the data relating to the complainant as recorded in the publication in dispute by the defendant can neither be qualified as inaccurate or incomplete within the meaning of Article 16 of the GDPR. Those data question his professional title and his authorization to practice his profession and request that a member of the defendant carry out the necessary checks. Also disagreeable may it be so expressed, recorded and disseminated (see above) such doubts, it is not questioned by the complainant that such would not have been the comments held with regard to him or that the data concerning him mentioned during the said meeting are not would not find mentioned in the minutes. The Litigation Chamber insists on this regard to the fact that it is clear from the manner in which the minutes are drafted that the processing of the complainant's data reflects the opinion of certain members of the defendant. The Litigation Chamber subscribes in this respect to the point of view of the doctrine which states that “it is also complex if the data in question records an opinion. Opinions are, by their very nature, subjective, and it can be difficult to conclude that the record of an opinion is inaccurate. As long as the record shows clearly that the information is an opinion and, where appropriate, whose opinionitis, it may be difficult to say thatitis inaccurate and needs to be rectified”.4 4https://gdprhub.eu/Article_16_GDPR#Right_to_Complete_Incomplete_Data "The situation is also complex if the data in question reflect an opinion. Opinions are, by their nature, subjective and it may be difficult to conclude that reflecting an opinion is inaccurate. As long as it is clear that the information reported is an opinion and, if applicable, the opinion of the person concerned, it may be difficult to say that the data revealed by These statements are inaccurate and must be corrected”. Decision 79/2023 - 7/11 22. In conclusion, the Litigation Chamber decides that no breach based on a possible violation of Article 16 of the GDPR cannot be blamed on the defendant. Therefore, the Litigation Chamber will close this aspect of the complaint without further action (see below). II.1.4. As for the lack of response to the complainant (article 12 of the GDPR) 23. Under Article 12.3. of the GDPR, the controller provides the data subject concerned information on the measures taken following a request made in application of Articles 15 to 22 (therefore including Article 16 of the GDPR invoked in case), as soon as possible and in any case within one month from from receipt of the request. If necessary, this period may be extended by two months, given the complexity and number of requests. The person in charge of processing informs the data subject of this extension and the reasons for the postponement within one month of receipt of the request. When the person concerned submits its request in electronic form, the information is provided electronically where possible, unless the person concerned don't ask for it to be otherwise. 24. It is also provided for in Article 12.4. of the GDPR only "if the controller does not does not respond to the request made by the person concerned, he informs the latter without delay and at the latest within one month of receipt of the request from the reasons for its inaction and the possibility of filing a complaint with an authority control and to lodge a judicial appeal”. 25. In other words, regardless of the defendant's intention with regard to the request of rectification which was sent to it on June 3, 2021 (point 5), it had to react to the complaining what she seems to have refrained from doing. Therefore, the Litigation Chamber will also issue a warning in this regard (see.infra). III. Corrective measures and sanctions 26. Based on the facts described in the complaint file as summarized above, and on the basis of the powers attributed to it by the legislator under Article 95, § 1 of the LCA, the Litigation Chamber decides on the follow-up to be given to the file. 27. In this case, the Litigation Chamber decides: – on the one hand, on the basis of Article 58.2.a) of the GDPR and Article 95, § 1, 4° of the LCA, to issue a warning to the defendant with regard to the grievance based on a possible Decision 79/2023 - 8/11 breach of article 6 of the GDPR as well as article 12.3-4 of the GDPR, for reasons set out above ( Title II.1.2, points 12-13 and Title II.1.4, points 23-25). - on the other hand, in accordance with article 95, § 1, 3° of the LCA, to proceed with the classification without action on the grievance alleging a possible breach by the defendant of Article 16 of the GDPR for the reasons set out above (Title II.1.3 – points 14-22). III.1.1. As for the warning 28. The Litigation Chamber wishes to specify that this warning decision is a prima facie decision taken by the Litigation Chamber in accordance with Article 95 of the LCA on the basis of the sole complaint filed by the plaintiff and the exhibits he filed with the support of this, within the framework of the "procedure prior to the substantive decision". therefore not a decision on the merits within the meaning of Article 100 LCA. 29. The purpose of this warning decision is to inform the defendant and to inform him enables compliance where applicable (Title II.1.2) and in the future (Title II.1.4). 30. Therefore, if the defendant does not agree with the content of this decision prima facie and believes that it can make factual and/or legal arguments that could lead to a different decision on the point on which this warning relates, it may submit to the Litigation Chamber a request for processing on the merits of the case via the e-mail address email@example.com, within 30 days after notification of this decision. 31. In the event of further processing of the complaint on the merits pursuant to Articles 98, 2° and 3° juncto article 99 of the LCA, the Litigation Chamber will invite the parties, either the plaintiff than the defendant, to introduce their arguments in the form of conclusions and to attach to the file all the documents that he and she deem useful. 32. The Litigation Chamber informs in this regard both the plaintiff and the defendant that the procedural file relating to the complaint leading to this warning decision may, pursuant to Article 95.2, 3° of the LCA, be requested by sending preferably an e-mail to the registry of the Litigation Chamber (litigationchamber@apd- gba.be). Decision 79/2023 - 9/11 33. Finally, for the sake of completeness and transparency, the Litigation Chamber emphasizes that an examination of the case on the merits may lead to the imposition of the measures mentioned in Section 100 of the ACL 5. III.1.2. As for the classification without continuation 34. In matters of dismissal, the Litigation Chamber is required to justify its step-by-step decision and: - to pronounce a classification without technical continuation if the file does not contain or not sufficient elements likely to lead to a sanction or if it includes a technical obstacle preventing him from rendering a decision; - or pronounce a classification without further opportunity, if despite the presence of elements likely to lead to a sanction, the continuation of the examination of the file does not seem to him not appropriate taking into account the priorities of the Data Protection Authority such as specified and illustrated in the Chamber's Dismissal Policy 7 Litigation. 51° close the complaint without action; 2° order the dismissal; 3° pronouncing the suspension of the pronouncement; 4° to propose a transaction; 5° issue warnings and reprimands; 6° order to comply with requests from the data subject to exercise his or her rights; 7° order that the person concerned be informed of the security problem; 8° order the freezing, limitation or temporary or permanent prohibition of processing; 9° order compliance of the processing; 10° order the rectification, restriction or erasure of the data and the notification thereof to the data recipients; 11° order the withdrawal of accreditation from certification bodies; 12° to issue periodic penalty payments; 13° to issue administrative fines; 14° order the suspension of cross-border data flows to another State or an international body; 15° forward the file to the public prosecutor's office in Brussels, which informs it of the follow-up given to the case ; 16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. 6 Market Court (Brussels Court of Appeal), September 2, 2020, judgment 2020/AR/329, p. 18. 7In this respect, the Litigation Chamber refers to its policy of dismissal as developed and published on the website of the Data Protection Authority: https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre- litigation.pdf. Decision 79/2023 - 10/11 35. In the event of dismissal based on several reasons for dismissal, these last (respectively, classification without technical continuation and classification without continuation timeliness) should be addressed in order of importance .8 35. In this case, the Litigation Chamber decides to proceed with the dismissal of the technical complaint. The decision of the Litigation Chamber is based more precisely on the fact that no violation of Article 16 of the GDPR can be established in the head of the defendant (points 14-22). This grievance is therefore unfounded in this case, the criterion A.2. of the Discontinued Discontinuance Policy of the Litigation Chamber finds at 9 apply (unfounded complaint). The Litigation Chamber therefore considers that it is inadvisable to continue the follow-up of the file, and decides accordingly not to proceed, inter alia, an examination of the case on the merits. IV. Publication and communication of the decision 36. Given the importance of transparency with regard to the decision-making process and the decisions of the Litigation Chamber, this decision will be published on the website of ODA. However, it is not necessary for this purpose that the identification data of the parties are directly mentioned. 8Cf.Title 3–In which cases is my complaint likely to be dismissed without further action by the Litigation Chamber? of the dismissal policy of the Litigation Chamber. 9 Criterion A.2. : The Litigation Chamber will have to proceed to a classification without follow-up if it emerges in a way evidence of your complaint that the Litigation Chamber cannot conclude that there is any violation GDPR and personal data protection rules, based on the facts and legal grievances invoked in your complaint. The complaint will then be considered manifestly unfounded within the meaning of Article 57.4. of the GDPR. https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la- litigation-chamber.pdf. Decision 79/2023 - 11/11 FOR THESE REASONS, the Litigation Chamber of the Data Protection Authority decides, after deliberation, - subject to the introduction of a request by the defendant for treatment on the merits in accordance with articles 98 e.s. of the ACL via the e-mail address firstname.lastname@example.org, within 30 days of notification of the present decision, to issue a warning against the defendant in pursuant to Article 58.2.a) of the GDPR and Article 95.1, 4° of the LCA with regard to complaints based on possible breaches of Articles 6 and 12.3-4 of the GDPR. - to close the present complaint without follow-up pursuant to article 95, § 1, 3° of the LCA for the surplus. Pursuant to Article 108, § 1 of the LCA, this decision may be appealed to the Court of Markets (Brussels Court of Appeal) within 30 days of its notification, with the Data Protection Authority (DPA) as defendant. Such an appeal may be introduced by means of an interlocutory request which must contain the 10 information listed in article 1034ter of the Judicial Code. The interlocutory motion must be filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. 11 jud. , or via the e-Deposit information system of the Ministry of Justice (article 32ter of C. jud.). (se). Hielke HIJMANS President of the Litigation Chamber 10The request contains on pain of nullity: (1) indication of the day, month and year; 2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or Business Number; 3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned; (4) the object and summary of the grounds of the application; (5) the indication of the judge who is seized of the application; the signature of the applicant or his lawyer. 11 The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter recommended to the court clerk or filed with the court office.