APD/GBA (Belgium) - 99/2023

From GDPRhub
APD/GBA - 99/2023
Authority: APD/GBA (Belgium)
Jurisdiction: Belgium
Relevant Law: Article 5(1)(c) GDPR
Article 6(1) GDPR
Article 6(1)(c) GDPR
Article 17(1)(d) GDPR
Article 17(3) GDPR
Type: Complaint
Outcome: Upheld
Started: 25.05.2023
Decided: 13.07.2023
Fine: n/a
Parties: n/a
National Case Number/Name: 99/2023
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): French
Original Source: Autorité de protection des données (in FR)
Initial Contributor: Enzo Marquet

The Belgian DPA considered that collecting names and dates of birth of tourists was not necessary to establish the amount of a tax calculated on the basis of the number of occupants.

English Summary[edit | edit source]

Facts[edit | edit source]

The data subject owned properties he was renting out to tourists. He received a tourist tax form from the municipality (controller) where he was required to fill in personal information about himself and the date of birth, stay duration and full names of the renters.

Considering that this processing breached the data minimization principle of Article 5(1)(c) GDPR and lacked a legal basis under Article 6 GDPR, the data subject filed a complaint with the Belgian DPA.

Holding[edit | edit source]

The Belgian DPA distinguished between the collection of the data subject's data and the collection of renters' data. It held that the municipality could only rely on legal obligation under Article 6(1)(c) GDPR for the collection that concerned renters. The controller could however not rely on any legal obligation to collect data about the owner of the properties. Thus, the DPA issued a warning to the controller for lack of legal basis.

Furthermore, the DPA deemed the collection of all data not strictly necessary for tourist tax purposes, excessive and contrary to the principle of data minimization under Article 5(1)(c) GDPR. The tourist tax is calculated based on the number of occupants. As such, any other information (such as data of birth, stay duration and name) is unnecessary. The DPA therefore issued a warning to the controller for breach of data minimization.

The DPA added that the controller must assess whether it can retain the unlawfully processed data under Article 17(3) GDPR. If it considers that the processing does not fall under this article, it must delete the unlawfully processed data according to Article 17(1)(d) GDPR.

Comment[edit | edit source]

This is a prima facie decision, not a decision on the merits.

Further Resources[edit | edit source]

Share blogs or news articles here!

English Machine Translation of the Decision[edit | edit source]

The decision below is a machine translation of the French original. Please refer to the French original for more details.


                                                                        Litigation Chamber

                                                         Decision 99/2023 of July 13, 2023

File number: DOS-2023-02312

Subject: Complaint relating to unlawful collection of personal data in the

context of the collection of a municipal tourist tax

The Litigation Chamber of the Data Protection Authority, made up of Mr Hielke

Hijmans, President, sitting alone;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and

to the free movement of such data, and repealing Directive 95/46/EC (general regulation on the

data protection), hereinafter GDPR;

Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter

Having regard to the Law of 30 July 2018 relating to the protection of natural persons with regard to

processing of personal data (hereinafter LTD);

Having regard to the Rules of Procedure as approved by the House of Representatives on 20

December 2018 and published in the Belgian Official Gazette on January 15, 2019;

Considering the documents in the file;

Made the following decision regarding:

The plaintiff: Mr. X, hereinafter “the plaintiff”;

The defendant: City Y, represented by its Communal College of Mayors and

                       Aldermen, hereinafter “the defendant”. Decision 99/2023 - 2/11

I. Facts and procedure

 1. The complaint concerns the collection of personal data by the defendant in the context of

       the collection of a municipal tourist tax via a form which, according to the complainant,

       requests the communication of excessive data in contradiction with the principles of
       lawfulness (article 6.1. of the GDPR) and minimization (article 5.1.c) of the GDPR) enshrined in the


 2. On May 25, 2023, the complainant filed a complaint with the Data Protection Authority
       (APD) against the defendant.

 3. The content of the complaint can be summarized as follows:

 4. The plaintiff is the owner of a dwelling in City Y (the defendant).

       he receives annually a form to be completed in order to collect the tourist tax

       established by the City.

 5. The complainant was thus sent a paper letter at the beginning of 2023 inviting him to complete the

       form entitled “Declaration form to be completed by the taxpayer relating to: Tax

       residence permit – Financial year 2022”. The complainant produced this letter in the file.

 6. The complainant points out that the impugned form asks him to provide data

       for all the occupants of his property, whether they are domiciled there or not. However, the regulation

       council which institutes the said tourist tax for the financial years […] including the financial year 2022

       provides that the chargeable event for the tax is precisely the absence of domicile in the

       GOOD. The collection of data relating to people domiciled in its property (and more
       generally in the goods concerned by the tax) therefore appears to him to be unlawful with regard to the article

       6.1 of the GDPR (lack of basis of lawfulness).

 7. The complainant also denounces that this form asks him to mention, for each
       occupant to whom he makes his property available or to whom he rents it out, the information

       following: a) last name and first name of this occupant, b) date of birth of the occupant as well as

       (c) the date of entry and exit of the property by this occupant.

 8. The complainant points out in this regard that under the terms of the aforementioned municipal regulation, the

       tax is levied according to the number of occupants per year (the tax is in fact annual and

       lump sum per occupant with regard to the type of accommodation in which the complainant is

       owner). The collection of the aforementioned data relating to each occupant seems to him as soon as

       then superfluous. According to the plaintiff, the defendant collects personal data

       relating to the occupants of his property in violation of the principle of minimization (article 5.1.c) of the
       GDPR). Decision 99/2023 - 3/11

9. The complainant indicated that, despite his doubts as to the compliance with the GDPR of the

      communication of the data requested, completed the form sent to him in his

      status of taxpayer by the defendant.

10. The complainant reports having contacted the Data Protection Officer (DPO) of the

      defendant at the same time.

11. The complainant produced the exchange of e-mails that took place with the DPO between the months of March and
      May 2023. The latter told the complainant that it had issued recommendations to

      the attention of the Municipal Council similar to the concerns it raised but that the

      form having already been sent to some of the owners for 2022, the modifications

      said form decided by the Municipal Council following its opinion should intervene

      for the next annual enrollment (2023).

12. In an email dated April 19, 2023, the Respondent's DPO writes precisely the following:

              "I have myself analyzed the data processing that you mention in
              your mail of March 29, 2023 and delivered a report as well as recommendations

              at the Communal College in November 2022. The administrative processes for their

              implementation are however quite long, in particular because they require the

              consultation between all parties (administrative services, College and Council


              The College finally took the decision, in December 2022, to apply at least

              the recommendations formulated by revising the form allowing the declaration

              of the tax in order to suppress the collection of personal data of the tenants and

              to stick to the taxable base of the tax, namely the number of occupants


              However, it was not possible to apply this decision as soon as the

              declaration forms relating to the 2022 financial year since forms

              "old version" had already been sent to certain taxpayers. For concern
              equality between citizens, the use of this new form has therefore been

              postponed and will come into effect for the sending of declaration forms

              relating to the 2023 financial year. (…)”.

13. The complainant also states that he questioned the DPO as to the fate that would be reserved for
      excessive data collected. The complainant points out that the DPO, relying moreover

      of his capacity as archivist alongside that of DPO, confirmed to him by email of May 24

      2023 that the data would be archived for the legal duration of 5 years and that a

      periodical deletion once the deadlines had expired was organized under his supervision. Decision 99/2023 - 4/11

 14. On June 30, 2023, the APD's Front Line Service (SPL) declared the complaint admissible on

       the basis of articles 58 and 60 of the LCA and sends it to the Litigation Chamber

       in accordance with Article 62, § 1 of the LCA.

II. Motivation

          II.1. Regarding the jurisdiction of the DPA and the Litigation Chamber

 15. The DPA is the Belgian authority responsible in particular for monitoring compliance with the GDPR by

       application of Article 8 of the Charter of Fundamental Rights of the European Union (EU),

       of article 16 of the Treaty on the Functioning of the European Union (TFEU) and of article

       51 GDPR.

 16. It follows in this respect from Article 4 of the LCA and its explanatory memorandum that DPA is

       "competent to carry out the missions and mandates to monitor compliance with the principles

       fundamentals of protection of personal data as established in the
       Regulation 2016/679. (…)”.

 17. Under Article 77 of the GDPR, it is provided that “without prejudice to any other remedy

       administrative or judicial, any person concerned has the right to introduce a

       complaint to a supervisory authority, in particular in the Member State in which

       is his habitual residence, his place of work or the place where the violation is alleged to have been

       committed, if it considers that the processing of personal data concerning

       constitutes a violation of this regulation”.

 18. Before examining the merits of the complaint, the Litigation Chamber would like to

       specify the following with regard to its competence.

 19. The Litigation Chamber notes that it appears from the complaint lodged that the complainant

       communicated a certain number of data concerning the rental of his property, which
       constitute personal data concerning him (see point 21 below). These

       same data are also data concerning the occupants of his property, such as

       example their identity and date of birth. The complainant reports having had doubts

       as to the compliance with the GDPR of such communication of data to which it was bound

       – data from third parties in addition (see point 9).

1Explanatory memorandum to the Law of 3 December 2017 creating the Data Protection Authority (APD), Chambre
representatives, DOC 54 2648/001, page 13 under article 4. Decision 99/2023 - 5/11

 20. In its note relating to the Complainant's Position, the Litigation Chamber states that not

       only data subjects 3 within the meaning of the GDPR, but also other

       people have the possibility to lodge a complaint provided that the conditions of

       admissibility of the complaint are satisfied and provided that these persons justify a

       sufficient interest. The mere fact of pursuing a public interest is not sufficient in this regard. A

       complainant who is not a data subject within the meaning of the GDPR must be able to demonstrate to

       what regard he may personally have a connection with the data processing of which he is


 21. In this case, the Litigation Chamber is of the opinion that the complainant is a person

       concerned in the sense that the data that he must provide relating to the occupants of his property

       are also data relating to his property and therefore indirectly, data the

       re. Unquestionably, the identity of the occupants is linked to their property, as are the

       entry and exit dates of each occupant. Regarding the date of birth of

       occupants which, at first glance, may appear to relate exclusively to the occupant and not to the

       plaintiff, the Litigation Chamber considers from the start of the broad interpretation that it

       should give to the notion of "personal data" and to the support of the position

       adopted by Group 29 on this concept that the date of birth of the occupant must
       also be considered to relate to the complainant.

 22. In any event, the plaintiff has a sufficient "interest in acting" to lodge a complaint

       in relation to the processing (i.e. the communication to the defendant) of the data

       personal information relating to the occupants of his property. Indeed, if the defendant were to

       request the communication of data in contradiction with the GDPR, it would associate the

       complainant to this violation.

 23. Insofar as necessary, the Litigation Chamber also considers that the collection

       reported data, even organized by sending and returning paper forms

       completed (non-automated processing) as appears to be the case in this case, consists

       in a processing of personal data called to appear in a file, of

       moreover probably partially automated once the data is sent back to


3Complainants who meet the qualification of the GDPR are potentially affected in their subjective rights, being
given that their action concerns by definition a processing of their own personal data. They witness
therefore of interest.

4In its note relating to the position of the plaintiff, the Litigation Chamber cites Decisions no. 30/2020 (points 4 e.s.) and no.
80/2020 (points 47 e.s.).

 See. in this respect Article 29 Group, Opinion 04/2007 on the concept of personal data, WP 136 of 20 June
2007, pages 10 et seq. relating to the interpretation of “concerning” in the definition of personal data as
than provided for in Directive 95/46/EC. This interpretation may continue to apply to the definition of character data
personnel provided for in Article 4.1. of the GDPR, the concepts not differing from one text to another. Decision 99/2023 - 6/11

       the administration of the defendant. It is therefore in any case a treatment of

       personal data subject to the GDPR in execution of article 2.1. of the GDPR.

         II.2. Regarding compliance with Article 6 of the GDPR (lawfulness)

 24. Pursuant to Article 6 of the GDPR, any processing of personal data must

       rely on one of the bases of lawfulness that it provides. In this regard, the defendant bases the

       collection of the data requested via the form sent to the complainant on the rules

       aforementioned municipality. The Litigation Chamber notes that the chargeable event for the tax of
       stay for the collection of which the data concerned is requested is

       worded as follows:

                “Article 2 – Generating event

                This applies to the stay of unregistered persons, for the accommodation where they are staying,

                in the population register or in the register of foreigners”.

 25. In other words, the fact giving rise to the tourist tax is the absence of domicile of the

       people in the good. It is clear from the municipal regulations that the objective of the tax
       is to correct the imbalance created between the part of the population residing in the territory

       of the defendant and contributing to the finances of the latter on the one hand and the part of the

       non-domiciled population who do not contribute to it on the other hand. Regulationpointeencesens

       the need to make up for the shortfall (additional cents) relating to buildings

       allocated to the use of housing for the benefit of persons not domiciled in its territory and

       not for the use of accommodation for the benefit of persons domiciled in the territory of the


 26. It follows that for the application of the aforementioned municipal regulations and the collection of the tax

       established, the concept of “occupants” must be understood as not including

       persons domiciled in the property concerned.

 27. However, as the complainant denounces, the letter from the beginning of 2023 which was sent to him with the
       form to be completed indicates unequivocally that "Any property put up for rent or

       available on the territory of City Y must be filled in on the form, as well as

       any occupant, domiciled or not in the property”. The Litigation Chamber reproduces here the

       terms of said letter including bold highlighting and underlining of the terms "all

       occupant, domiciled or not in the property”.

 28. By asking the owners concerned, such as the complainant, to provide him with

       personal data concerning occupants domiciled with it, the defendant

       prima facie collection of personal data without having a basis of lawfulness which

6Registration in the population register is based on domicile. Decision 99/2023 - 7/11

       justifies. Indeed, only the data necessary for the satisfaction of the legal obligation which is

       his own can be dealt with by the defendant (article 6.1.c)). The Litigation Chamber

       therefore decides to issue a warning to the defendant regarding this (see below). In doing so,

       the defendant also places its taxpayers such as the plaintiff in a position

       delicate, non-compliant with the GDPR, requesting that in execution of their own obligation, they

       communicate excessive personal data of third parties.

 29. For all practical purposes, the Litigation Chamber recalls here that to provide for an obligation to

       processing of personal data within the meaning of Article 6.1.c of the GDPR, it is necessary,

       as pointed out by the Article 29 Working Party, the legal predecessor of the Committee
       European Data Protection Officer (EDPS), that the legal provision establishing it

       meets “all the conditions required to render the obligation valid and

       binding". Its wording must therefore be clear and precise in such a way that the person responsible

       processing subject to this obligation does not have a margin of appreciation in the

       determination of the essential elements of the processing of personal data

       necessary to comply with its legal obligation.

         II.3. Regarding compliance with Article 5.1.c) of the GDPR (minimization)

 30. The Litigation Chamber also recalls that pursuant to Article 5.1.c) of the GDPR,

       personal data must be adequate, relevant and limited to what

       is necessary with regard to the purposes for which they are processed (minimization of


 31. In support of the complaint and the documents produced by the complainant, in particular the

       request for communication of the data of the occupants of the property and the regulations

       already mentioned, the Litigation Chamber concludes that the collection of data relating

       to the occupants seems, prima facie, excessive and contrary to the principle of minimization

       devoted to Article 5.1. c) GDPR.

 32. Indeed, only the collection by the defendant (and therefore the communication by the plaintiff)
       data necessary for the achievement of the purpose pursued – either in this case

       the registration of the tourist tax – is authorized in execution of this article 5.1.c) of the GDPR.

 33. As this tourist tax is calculated annually and on the basis of a flat rate per occupant, the

       Chambre Litigation understands that the number of annual occupants must be declared

       by the owner. On the other hand, the Litigation Chamber does not perceive, primafacie, how

7 “Article 29” Working Party, Opinion 06/2014 on the notion of legitimate interest pursued by the data controller
data within the meaning of article 7 of directive 95/46/EC, p. 21.

8 “Article 29” Working Party, Opinion 06/2014 on the notion of legitimate interest pursued by the data controller
data within the meaning of article 7 of directive 95/46/EC, p. 22. Decision 99/2023 - 8/11

       the communication of the requested data relating to the occupants is necessary for this

       finality. The Litigation Chamber recalls in this respect that the condition of necessity must

       assess themselves strictly. For example, it does not see, prima facie, how the

       date of birth of the occupant is necessary to establish the number of occupants

       in the property unless the age of the occupant should be taken into account in the collection

       of the said tax. The same applies to the first and last names of the occupants as well as the dates

       of entry and exit. The Litigation Chamber then decides to issue a warning
       to the defendant as to this (see below).

         II.4. Regarding data retention

 34. The Litigation Chamber also recalls that pursuant to Article 17.1 of the GDPR, the

       person concerned has the right to obtain the erasure, within the

       as soon as possible, of personal data concerning him and that the person responsible for the

       processing has the obligation to erase this personal data as soon as possible

       deadlines, when one of the reasons listed in Article 17.1 of the GDPR applies, including, "when the

       personal data have been unlawfully processed" (Article 17.1.d) of the


 35. Only if the data controller should be able to invoke one of the exceptions

       provided for in Article 17.3. of the GDPR only data processed in contradiction with the GDPR

       could be kept. In the light of the conclusions, admittedly prima facie (see below) of the

       Litigation Chamber in points 28 and 33 above, it is incumbent on the defendant

       assess compliance with its obligations in this regard (accountability) and, where applicable,
       erase said data.

 36. Finally, the Litigation Chamber also recalls that a protection delegate

       (DPO) may carry out other missions and tasks insofar as these

       do not lead to a conflict of interest with his function as DPO, in particular with regard to

       the independence with which he/she must exercise it (Article 38.6 of the GDPR). The DPO cannot
       furthermore, receive no instructions concerning the performance of his duties (Article

       38.3 GDPR).

 37. With regard to the question of the existence of conflicts of interest, the Court of Justice of the European Union
       (CJEU) in a judgment of February 9, 2023 recalled - referring to the articles cited

       above - that the GDPR provided that the DPO could perform other missions and tasks,
       provided that the latter do not lead to a conflict of interest, in order to preserve

9 CJEU, judgment X-FAB Dresden GmbH & Co. KG c. FC, C-453/21.
cid=270323&pageIndex=0&doclang=FR&mode=lst&dir=&occ=first&part=1&cid=224750 Decision 99/2023 - 9/11

       his independence. She pointed out in particular that the DPO could not see himself

       entrust missions that would lead him to determine the purposes and means of the

       processing of personal data with the controller or

       its subcontractor, the latter having to be able to carry out a control of these purposes and of these

       means independently.

 38. The Litigation Chamber is of the opinion that this means in practice that when a DPO is

       associated with other missions, it cannot be called upon to determine the purposes or the means

       of certain treatments, since he could not at the same time objectively control these

       last .0

 39. It appears from the documents produced by the complainant in support of his complaint that the DPO of the

       defendant also acts as an archivist. This accumulation of functions emerges from the

       signature of the emails from the DPO and of the comments it made, dated May 24, 2023,

       in response to the complainant, relying on this double role (point 13).

 40. Being a prima facie decision, and in the absence of any evidence that in the

       case in point, there would be on the part of the Data Protection Officer (DPO)

       the defendant, a conflict of interest with her function as archivist, the Litigation Chamber

       is limited to the aforementioned reminder.

 41. It specifies in this respect that this reminder - like that formulated in points 34 and 35 - does not

       constitutes neither a remedy nor a sanction within the meaning of Article 95 of the LCA.

          II.5. As for the warning

 42. The Litigation Division would like to point out that this warning decision is a

       prima facie decision taken by the Litigation Chamber in accordance with Article 95 of the

       LCA - based on the sole complaint filed by the plaintiff and the exhibits he produced

       in support of it - in the context of the "procedure prior to the substantive decision". He ... not

       It is therefore not a decision on the merits within the meaning of Article 100 LCA.

 43. The purpose of this warning decision is to inform the defendant and to inform him

       enables compliance in the future (2023 tax enrollment form)

       with regard to Articles 6 and 5.1. c) GDPR (points 27 and 32). The choice of this sanction depends

       into account the commitments that the defendant seems to have made, which were reported

       by the DPO with which the defendant is not confused (and vice versa).

       The warning nevertheless constitutes a precedent which will be taken into account in the event of

       any new complaint having the same subject.

10Voy. also the G29 Guidelines, endorsed by the European Data Protection Board
(EDPS) concerning Data Protection Officers (DPO), WP 243 of 5 April 2017:
https://ec.europa.eu/newsroom/article29/items/612048 Decision 99/2023 - 10/11

 44. Therefore, if the defendant does not agree with the content of this prima facie decision

        facie and believes that it can make factual and/or legal arguments that

        could lead to another decision on the points on which this warning relates,

        it can submit a request for substantive processing to the Litigation Division via

        the e-mail address litigationchamber@apd-gba.be, within 30 days of the

        notification of this decision.

 45. In the event of further processing of the complaint on the merits pursuant to Articles 98, 2° and 3°

        juncto article 99 of the LCA, the Litigation Chamber will invite the parties, either the

        plaintiff than the defendant, to introduce their arguments in the form of conclusions and

        to attach to the file all the documents that he and she deem useful.

 46. The Litigation Division informs in this respect both the plaintiff and the defendant that the

        procedural file relating to the complaint leading to this warning decision

        may, in application of article 95.2, 3° of the ACL, be requested by preferably addressing

        an e-mail to the registry of the Litigation Chamber (litigationchamber@apd-gba.be).

 47. Finally, for the sake of completeness and transparency, the Litigation Chamber emphasizes

        that an examination of the case on the merits may lead to the imposition of the measures mentioned

        at section 100 of the ACL .1

  1° dismiss the complaint without follow-up;
 2° order the dismissal;
 3° pronouncing the suspension of the pronouncement;
 4° to propose a transaction;
 5° issue warnings and reprimands;
 6° order to comply with requests from the data subject to exercise his or her rights;
 7° order that the person concerned be informed of the security problem;
 8° order the freezing, limitation or temporary or permanent prohibition of processing;
 9° order compliance of the processing;
 10° order the rectification, restriction or erasure of the data and the notification thereof to the recipients of the
data ;
 11° order the withdrawal of accreditation from certification bodies;

 12° to issue periodic penalty payments;
 13° to issue administrative fines;
 14° order the suspension of cross-border data flows to another State or an international body;
 15° forward the file to the public prosecutor's office in Brussels, who informs it of the follow-up given to the file;
 16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. Decision 99/2023 - 11/11

III. Publication and communication of the decision

 48. Given the importance of transparency with regard to the process

       decision-making and the decisions of the Litigation Chamber, this decision will be published on the

       ODA website. However, for this purpose it is not necessary that the data

       identification of the parties are directly mentioned.


    the Litigation Chamber of the Data Protection Authority decides, after deliberation,

    subject to the introduction of a request by the defendant for treatment on the

    merits in accordance with articles 98 e.s. of the ACL via the e-mail address

    litigationchamber@apd-gba.be, within 30 days of notification of the

    this decision, to issue a warning against the defendant pursuant to

    of Article 58.2.a) of the GDPR and Article 95.1, 4° of the LCA with regard to the grievances

    any breaches of Articles 6 and 5.1. c) GDPR (points 28 and 33).

In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged,

within thirty days of its notification, to the Court of Markets (court

d'appel de Bruxelles), with the Data Protection Authority as defendant.

Such an appeal may be introduced by means of an interlocutory request which must contain the
information listed in article 1034ter of the Judicial Code. The interlocutory motion must be

filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 13

via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).

(Sr.) Hielke HIJMANS

President of the Litigation Chamber

12The request contains on pain of nullity:
 (1) indication of the day, month and year;
 2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
    Business Number;
 3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;

 (4) the object and summary statement of the means of the request;
 (5) the indication of the judge who is seized of the application;
 6° the signature of the applicant or his lawyer.
13The request, accompanied by its annex, shall be sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.