APD/GBA - 54/2021
|APD/GBA - 54/2021|
|Relevant Law:||Article 4 GDPR|
Article 5 GDPR
Article 6 GDPR
Article 24 GDPR
|National Case Number/Name:||54/2021|
|European Case Law Identifier:||n/a|
|Original Source:||Autorité de la protection des données (in FR)|
The Belgian DPA reprimanded an entity in charge of paying family allowances to its members for failure to comply with Articles 4, 5, 6 and 24 GDPR, in relation to the processing of a data subject's 'household composition' data.
English Summary[edit | edit source]
Facts[edit | edit source]
In July 2019, an entity (voluntary intervener in the proceedings, hereinafter "the voluntary intervener") in charge of paying family allowances to its affiliates who have children consulted the data of the complainant's son in the National Register, in particular the "household composition" data and its history. This consultation took place in order to manage the family allowance file of the complainant's son, one of its affiliates, and to determine the amount of family allowance that he would be entitled to receive. This consultation was carried out via the TRIVIA application, developed by the BCSS, made available to the family allowance funds. This consultation was done on the basis of the National Register number of the affiliated person, son of the complainant.
It is this consultation of the history of the composition of the complainant's son's household that is the subject of the complaint. During this consultation, the volunteer intervener was given access to the information that the complainant had been part of her son's household at one time in his life. The complainant complains that this consultation of personal data concerning him had no basis of valid legitimacy within the meaning of Article 6 of the GDPR.
On 24 September 2019, the Supervisory Authority of the family allowance funds for the Brussels-Capital Region (IRISCARE/FAMIFED) received a request for information from the complainant via the contact form on its website. With this request for information, the complainant asked the Supervisory Authority about the consultation of his data on 9 and 17 July 2019.
Following several unsuccessful exchanges, and in the absence of a satisfactory response, the dispute was brought before the Belgian Data Protection Authority’s dispute chamber.
In this case, the defendant is the shared service center of the voluntary intervening entity. In this respect, the defendant was responsible for monitoring the personal data protection of all the family allowance funds in the group.
When he submitted his conclusions on 9 June 2020, the complainant underlined that a new consultation of his data, still without any legitimate basis according to him, had taken place on 21 April 2020. When questioned in this respect, the defendant answered to the complainant that this consultation was part of the management of the present case pending before the dispute chamber.
Dispute[edit | edit source]
- Is access to the information that the complainant had been a member of his son's household at one time in his life considered processing of personal data within the meaning of Article 4 GDPR and is it justified on the basis of Article 6 GDPR?
- Can the controller raise the argument that the application used and imposed by a third party does not allow it to comply with provisions of the GDPR ?
Holding[edit | edit source]
The Belgian data protection authority found a violation of the GDPR, and gave the following reasons for its decision:
The notion of processing of personal data within the meaning of Article 4 GDPR[edit | edit source]
Very briefly, the litigation chamber begins by recalling that the fact of having accessed this information constitutes processing of personal data within the meaning of Article 4(2) GDPR irrespective of whether this processing is lawful within the meaning of the Regulation.
Furthermore, the litigation chamber holds that in this case the voluntary intervening entity must be considered as a controller, and the defendant as a processor of the voluntary intervener.
Legal basis of processing under Article 6 of the GDPR[edit | edit source]
The litigation chamber of the Belgian data protection authority points out that the defendant and the voluntary intervener base the processing on Article 6(1)(c) GDPR (processing made necessary by virtue of a legal obligation). Recalling that the concept of 'necessity' is an autonomous concept in EU law, the litigation chamber emphasises that the principle of necessity implies that the authority adopting a measure that infringes a fundamental right of the individual in order to achieve a justified objective must demonstrate that this measure is the least restrictive in order to achieve that objective. Furthermore, recalling the case law of the European Court of Human Rights, the notion of necessity implies that there is a compelling social need.
Furthermore, the Belgian authority relies on Opinion 03/2019 of 23 January 2019 of the European Data Protection Committee (EDPS), which sets out the conditions under which this basis for lawfulness can be applied:
- The obligation must be imposed by legislation;
- The legislation must meet all the conditions required to make the obligation valid and binding;
- The legislation must comply with applicable data protection law, including the principles of necessitý, proportionalitý and purpose limitation ;
- The legal obligation itself must be sufficiently clear about the processing of personal data it requires; and
- The controller should not have an unjustified margin of discretion as to how to comply with the legal obligation.
In the present case, the Belgian DPA notes the following points in this respect:
- Under the provisions of the General Law on Family Allowances of 19 December 1939, the family allowance bodies and the ministerial departments responsible for the implementation of that law are obliged to consult the national register of natural persons in order to obtain the information required by the law, which includes, inter alia, data relating to the composition of the household and its successive changes (the history).
- In addition, the Order of 25 April 2019 of the Brussels-Capital Region and the Order of 4 April 2019 lay down the conditions for the granting of social supplements (these supplements being conditioned by the household income).
The litigation chamber concludes that, in other words, prior to the granting of the family allowance and supplement, it was the responsibility of the family allowance funds (of which the voluntary intervener was one) to identify, in application of the various aforementioned texts, the beneficiaries and their household income. This verification of the household income requirement (and therefore of who was part of it) was, in this case, done by identifying the composition of the complainant's son's household by consulting the National Register.
However, the litigation chamber notes that it is not clear from the legal texts what date the composition of the household was to be taken into consideration. Yet, this precision would have been precious, in accordance with the principle of clarity and predictability of the law, as derived from the jurisprudence of the Court of Justice of the European Union and the European Court of Human Rights.
The litigation chamber considered that, in any event, this history of the complainant's son's "household composition" data could have been consulted back to the date on which entitlement to benefits/social supplements to these benefits began, and that, in any event, the consultation of the complainant's son's entire history without any time limit was disproportionate and unnecessary for the voluntary intervener to comply with its legal obligation. Access to this complete history of the complainant's son was therefore disproportionate and the data consulted were not relevant to the purpose pursued, i.e. to determine the composition of the household at a given point in time, which must be taken into account when granting family allowances and the social supplement.
Consequently, the litigation chamber held that there had been a breach of Article 6 GDPR, in that the processing was not necessary for its legal obligation. In addition, the chamber found a breach of Article 5 GDPR, in that the data collected could not be considered relevant to the purpose.
However, the complainant raised a second consultation in the course of the proceedings, dated 21/04/2020. In this respect, the DPA notes that the defendant and the voluntary intervener rely on their legitimate interest (article 6(1)(f) GDPR), the consultation being justified, according to them, by the needs of the present proceedings. In this respect, the DPA recalls that it has already considered that legal defence is a legitimate interest that can be validly invoked by data controllers, provided that the cumulative conditions of necessity of the processing operation for the achievement of the legitimate interest pursued and of proportionality (i.e. that the fundamental rights and freedoms of the data subjects do not prevail over the interest pursued) are met. But as it is not the case in fact, the Chamber rejected this argument and considered that the processing was not justified.
Accountability within the meaning of Article 24 GDPR[edit | edit source]
The Belgian data protection authority also concludes that the voluntary intervener failed to comply with Articles 24 and 5.2 of the GDPR when it was not able to put in place the technical measures intended to implement the GDPR. Indeed, the controller cannot therefore raise the argument that the application used - even if its use is imposed by a third party - does not allow it to comply with the GDPR.
Consequently, in application of its obligation of accountability and documentation, the voluntary intervener should at least have alerted the relevant authorities to the situation in which the forced use of the TRIVIA application placed it in relation to its obligations under the GDPR.
Sanctions[edit | edit source]
In view of these failings, the litigation chamber reprimanded the voluntary intervener and ordered the publication of the decision on the Belgian data protection authority's website with the deletion of the parties' direct identification data.
In addition, the litigation chamber stresses that it is important that an appropriate response be found quickly to the problem raised by the complaint, in order to allow limited consultation, in compliance with the GDPR, of the history of the "household composition" data (as well as the history of other data in the National Register, if applicable).
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the French original. Please refer to the French original for more details.
Decision on the merits 54 / 2021-1 / 23 Litigation Chamber Decision on the merits 54/2021 of 22 April 2021 File No .: DOS-2019-06237 Subject: Complaint relating to an illicit consultation of the National Register in the context of the allocation of family allowances The Contentious Chamber of the Data Protection Authority, made up of Mr. Hielke Hijmans, chairman, and of Messrs. Y. Poullet and C. Boeraeve, members, taking up the case in this composition; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the protection of individuals with regard to the processing of personal data and the free movement of such data, and repealing Directive 95/46 / EC (general regulation on the protection data), hereinafter GDPR; Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter LCA); Having regard to the Rules of Procedure as approved by the Chamber of Representatives on December 20 2018 and published in the Belgian Official Gazette on January 15, 2019; Having regard to the documents in the file; Took the following decision regarding: The complainant: Mr X1, (hereinafter "the complainant"); The defendant: Y1, (hereinafter “the defendant”); In the presence of: Y2 ASBL, (hereinafter "the voluntary worker"); Decision on the merits 54 / 2021-2 / 23 Both advising Maître Paul Van den Bulck and Maître Andrine Like, lawyers at the Bar of Brussels, whose office is established at Rue des Colonies 56 box 3 in 1000 Brussels. 1. Feedback from the procedure In view of the mediation request filed on December 8, 2019 by the complainant with the Autorité de data protection (DPA); Given the failure of the mediation attempt communicated to the complainant on February 20, 2020 by the First Line (SPL) of ODA; Considering the agreement given by the complainant on February 20, 2020 for his request to be transformed into a complaint in application of Article 62.2. LCA; Considering the decision of March 9, 2020 of the SPL declaring the complaint admissible and the transmission of it to the Litigation Chamber; Having regard to the letter of April 8, 2020 from the Litigation Chamber informing the parties of its decision to consider the case to be ready for treatment on the merits on the basis of Article 98 LCA and their providing a timetable for the exchange of conclusions. In this letter, the Litigation Chamber in particular specified the following to the parties: Without prejudice to any arguments you may wish to develop, you will ensure that you shed light on the Litigation Chamber on the data processing involved, on the role of the various possible stakeholders and their quality with regard to the regulations for the protection of data as well as on the precise legal basis of the disputed consultation of the data of the complainant. You will also ensure that you explain the measures put in place to guarantee access only to data justified by the processing of files and the traceability of such access. You will also inform the Litigation Chamber of what is concretely understood by the terms "induced and involuntary consultation" used in the attachments to the complaint in the light of the specific facts. Having regard to the main conclusions filed on May 22, 2020 by the defendant as well as by Y2 (the voluntary intervenor) who intervenes voluntarily to the cause by this means (see below point 30 and following); Having regard to the arguments of the complainant of June 9, 2020; Decision on the merits 54 / 2021-3 / 23 Having regard to the additional and summary conclusions of the defendant and the voluntary intervener of 3 July 2020; Having regard to the invitation to the hearing sent by the Litigation Chamber to the parties on December 10, 2020; Having regard to the hearing during the session of the Litigation Chamber of January 19, 2021 in the presence of the complainant and Mr. A. Like, representing both the Respondent and the Volunteer Intervenor; Having regard to the letter sent by counsel for the defendant and the voluntary worker on January 26 2021; Having regard to the minutes of the hearing and the observations made thereon by the parties who have been attached to these minutes. 2. The facts and the subject of the request 2.1. Preliminary remarks 1. For a good understanding of its decision and of all the actors to whom the parts procedure and the files of the parties refer, the Litigation Chamber specifies the following: - FAMIFED is the federal agency for family allowances. FAMIFED was to insure until December 31, 2019 the management of family allowances, including in the Region of Brussels-Capital. th - IRISCARE has, under the 6 state reform, become, in place of FAMIFED, the supervisory authority for family allowance funds for the Brussels-Capital Region. IRISCARE is responsible for setting up and managing the family allowances system of the Brussels-Capital Region. - During a period of transition, the two structures coexisted so that the relay of the mission legal process can switch from FAMIFED to the new regional authorities, including, as mentioned, for the Brussels-Capital Region, IRISCARE. In the context of this decision, IRISCARE and FAMIFED are referred to as the "Supervisory Authority". - The complainant includes the Crossroads Bank for Social Security (BCSS) among the “stakeholders” revolving around the disputed data processing indicating that it was the BCSS which, at the time facts, develops the TRIVIA application. The TRIVIA application allows benefit funds Decision on the merits 54 / 2021-4 / 23 family to consult the available files of integrated actors, to integrate themselves actors and create files and obtain, through the intervention of the BCSS, access to the various sources of the social security network. 2. The defendant is the shared service center of group Y. It provides administrative services to the various entities of Group Y. In this regard, it notably monitors the protection personal data of all family allowance funds in the group. It has a Data Protection Officer (DPO) as well as a "Corporate Compliance 1 Officer ”and“ Information Security Officer ”. 3. Y2, here a voluntary intervening party, aims in particular to pay family allowances to its affiliates who have children. 4. Mr. X2 is the son of the complainant, affiliated with Y2, voluntarily intervened in the cause (see below. points 30 et seq.). 2.2. The facts at the origin of the dispute 5. In July 2019, the voluntary worker consulted the data of the complainant's son in the Register national, in particular the "household composition" data and its history. This consultation took place in order to manage the family allowances file for the complainant's son, one of his affiliates, and determine the amount of family allowances - including any supplement - that it would be entitled to receive from January 1, 2020. This consultation was done via the TRIVIA application, developed by the BCSS, made available to family allowance funds, including the worker voluntary, by the supervisory authority. This consultation was made on the basis of the register number affiliate's national, Mr. X2. 6. It is this consultation of the history of the household composition of Mr. X2 that is the subject of of the complainant's complaint. Indeed, during this consultation, the volunteer worker had access to the information that the complainant had been part of his son's household at some time his life. The complainant complains that this consultation of personal data concerning was not based on any valid basis of legitimacy within the meaning of Article 6 of the GDPR (see. title 2.3; point 23 et seq.). 1 Deliberation 18/008 of 9 January 2018 on the communication of personal data by the Agency federal for family allowances (Famifed) and various other social security institutions to the Ministry of the German-speaking Community, in the context of the transfer of powers to follow up on the sixth reform status - use of the TRIVIA application. Decision on the merits 54 / 2021-5 / 23 7. This research of the history of the composition of the household is called by the supervisory authority "search P028". It is carried out via the TRIVIA application already mentioned. During this research, the history of the household composition of Mr. X2 showed the complainant as having been part of his household in the past and this, as head of household. 8. On September 24, 2019, the Supervisory Authority received a request for information from the complainant via the contact form on its website. By this request for information, the complainant asked the Supervisory Authority about the consultation of its data on July 9 and 17, 2019. 9. There followed an exchange of e-mails between the complainant and the Supervisory Authority. The latter informed the complainant of the nature of the research P028 which had led to access to certain data on concerning and invited him, if necessary, to approach the family allowance fund (either the voluntary worker), in order to inquire more about the reason for the access to his data as they appeared in her son's household composition history. 10. On 7 October 2019, the complainant sent his request for information to the data of the volunteer worker via the address "[...]". 11. On 10 October 2019, the defendant, which ensures, as mentioned above in point 2, the follow-up on the protection of personal data of all family allowance funds group, acknowledged receipt and responded a first time to the request for information from complainant. 12. On October 14, 2019, the defendant replied to the complainant a second time. This answer was following a request for acknowledgment of receipt from the complainant regarding his request for information, which acknowledgment of receipt had been sent by the defendant on 10 October 2019 (see point 11 below above). 13. On November 6, 2019, the Complainant wrote again to the Respondent. On the same day, the defendant replied a third time to the complainant and confirmed having responded promptly to the October 10 and 14, 2019 at his request of October 7, 2019. 14. On November 7, 2019, the complainant, still addressing the respondent, developed his fears and raised the following question: "That one checks his tax flow [read the tax flow of Mr. X2] does not ask me personally no problem and that seems normal to me since his household is beneficiary / beneficiary Family Allowances. Decision on the merits 54 / 2021-6 / 23 BUT, what are the legal bases that allow you to consult my own private data and tax flow? " 15. On November 7, 2019, the defendant replied a fourth time to the complainant and confirmed that the the tax flow of the complainant had not been examined and that only the identification data of the complainant had appeared while viewing her son's household history. 16. On 12 November 2019, the complainant confirmed receipt of the registered letter from the defendant by which the latter provided proof of the sending of her emails of the 10th and 14th October 2019. 17. On 20 November 2019, the Respondent informed the Complainant that a request for clarification had still requested from the Supervisory Authority regarding the consultation of its data. The Defendant's DPO returned the same day (i.e. a fifth time) with said clarification of the supervisory authority. In the response that the defendant sent to the complainant, the Supervisory Authority confirms that it appeared that there had been access to the complainant's identification data, this one being mentioned as having been part of the household of his son and that it was necessary to understand that this consultation was "induced and not voluntary" (in other words, that it was a incidental access via the history of the household composition of the complainant's son). 18. The same day, after receiving this response (see point 17 above), the complainant filed defendant in default to justify the legal grounds for the consultation of its data. 19. On November 27, 2019, the defendant returned to the complainant for a sixth time, specifying that the provisions of the General Law on Family Allowances (hereinafter "LGAF") justified the consultation of the history of the household composition of Mr. X2 (complainant's son) with of the National Register (i.e. Articles 51 and 54 LGAF). Literally, she indicated, for the good understanding of the complainant, that the mission of the family allowance funds included verification of entitlement to allowances including verification of "the history of the family composition for which the funds have the right to query the National Register ”. 20. On December 8, 2019, the complainant lodged an application with the APD in the following terms: "I noticed that (Y2- Brussels) [read the volunteer worker] had consulted my data personal without any valid reason in my eyes since I am a pensioner, without responsible for more than 10 years and that I live in Wallonia. After questions from those in charge, I received an answer that does not satisfy me in any way. given that the family composition history of one of my sons' household - including Decision on the merits 54 / 2021-7 / 23 household apparently benefits from family allowances in Wallonia - does not have to lead to an induced and involuntary manner regardless because the legal references, unless I am mistaken part, do not allude to it) on queries of my private data which are not at all concerned. In my view, this is not a normal procedure but a malfunction (or a pirate query) which I cannot accept. " 21. On February 3, 2020, the defendant replied to the SPL's questions in connection with the attempt mediation conducted by this service of the ODA. In essence, the defendant responded to the DPA which had already been answered to the complainant by the Supervisory Authority, i.e. a P028 search had been carried out and that the consultation was non-voluntary but resulted from the consultation - necessary in the exercise of its legal missions - consultation of the history of the household composition of the complainant's son. 22. When communicating his conclusions on 9 June 2020, the complainant complained that a new consultation of his data, still without a legitimate basis according to him, had taken place on April 21 2020. Interested on June 3 in this regard, the defendant on June 15, 2020, indicated to the complainant that this consultation was part of the management of this case pending before the DPA. The Litigation Chamber specifies from the outset that it will also rule on this second consultation, the legality of which is called into question by the complainant in terms of its conclusions as soon as when it is closely linked to the facts denounced by the complainant under the terms of his form complaint.2 2.3. The subject of the complaint 23. In these same conclusions of June 9, 2020, the complainant specifies the subject of his complaint and expresses which his son, Mr. X2, has not resided with him since 2006. Consultation of the history the household composition of the latter - even necessary for the granting of allowances - must according to be subject to a time limit taking into account (1) either the day on which the person whose "history of household composition" data is consulted is potentially beneficiary / beneficiary of allowances / supplement, (2) either from the day of the birth of the child beneficiary. Access to the history of "household composition" since the birth of the one whose history is consulted - as happened in this case - is irrelevant and disproportionate in relation to the purpose pursued (the granting of family allowances). 2 See. in this sense, points 18 and s. of Decision 38/2021 of the Contentious Chamber: https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-38-2021.pdf Decision on the merits 54 / 2021-8 / 23 According to the complainant, this access constitutes an all the more unacceptable security breach: - that it emanates from public bodies; - that it potentially affects millions of people (beyond himself, his wife and all the people with whom her son has, at some point in his life, lived under the same roof); - that the useful data (i.e. the date / dates opening (s) the right to benefits family and from which the consultation of the history of management composition could be relevant) is / are available in the Cadastre family allowances; - that the research system "P028" replaced an earlier system which allowed relevant and targeted research. The complainant quotes in this regard the passage following extract from the “Specific functional description of message P028” sheet: 22.214.171.124. P028 Historical consultation of household composition Principle The P028 message is used to request data relating to the history of the household composition in the National Register on the basis of a register number national. This flow can be subsequently extended with data from the registry of the BCSS. This consultation flow combines the old consultation messages P036 and P038 in a single message. Unlike consultation message P036, this flow displays the complete history, whether or not the person sought is the head of the household. It is not therefore it is no longer necessary to carry out several consultations for this purpose. (…) 24. Finally, still in his conclusions of 9 June 2020, the complainant makes a series of requests to the Litigation Chamber, namely (page 11 of its conclusions): - To jointly and indivisibly condemn the defendant, the voluntary intervener, the Supervisory Authority, the FPS Interior (National Register), the Crossroads Security Bank social (BCSS), or even any dishonest perpetrators responsible for access and processing of its data, in accordance with articles 221 to 230 of the Law of 30 July 2018 on the protection of individuals with regard to the processing of personal data staff ; - Inform the King's Prosecutor of any breaches noted and inform the complainant of this Steps ; Decision on the merits 54 / 2021-9 / 23 - To ensure that the necessary corrections have been made to remedy the shortcomings denounced and this under penalty of penalty; - Obtain proof that their tax data has not been processed within the framework of the consultation denounced; - Obtain the necessary explanations regarding the consultations of July 9, 2019 and April 21, 2020 by FAMIFED in the National Register; - Obtain the identification and full contact details of all persons who have had access to his personal data and failing that condemn the defendant, the voluntary intervener and other contributors to periodic penalty payments; - To invite those responsible in the broad sense of the illegal processing, or even the possible perpetrators indelicate, to compensate him for the material and moral damage suffered. 2.4. Position of the defendant and the voluntary worker 25. The defendant and the voluntary intervener request, in support of their conclusions, that the Litigation Chamber declare the complainant's complaint, if admissible, unfounded, the consultation of the household composition of Mr X2, son of the complainant, being from their point of perfectly legal and legitimate view. They therefore request that the complaint of the Complainant without follow-up. The defendant and the voluntary intervener add that if by impossible, the ODA had to consider that in the circumstances of the case, access to the history of the composition is illegal, it should be the cause of both the National Register and the Authority supervision insofar as they are the ones who determine the data accessible during a search P028 (page 11 of the additional and summary conclusions of the defendant and the volunteer worker). 3. The hearing of January 19, 2021 26. During the hearing on January 19, 2021 - of which the minutes were drawn up - the parties stated the arguments they had developed by their respective conclusions. 27. The following elements were particularly highlighted by the parties: - the status of data controller of the voluntary worker; - the deliberate choice, according to the complainant, to set up research which won the consultation of potentially irrelevant data and the seriousness of the problem at with regard to the number of people who may be affected by this structural failure; Decision on the merits 54 / 2021-10 / 23 - the absence of any legal impact of the "induced" and "non-voluntary" nature of the access irrelevant data on the qualification of processing within the meaning of Article 4.2. of the GDPR; - the demonstration by the defendant and the voluntary intervener of the obligation to resort to the TRIVIA application and the impossibility for them to modify the parameters to consult the only historical data relating to a targeted period of time. PLACE As a preliminary ✓ As for the quality of the parties 28. Both in terms of her conclusions and of the hearing (see section 3 above), the intervener volunteer declares himself responsible for processing within the meaning of Article 4.7. of the GDPR with regard to disputed consultation, consultation which she furthermore qualifies as an incident. The defendant is for its part qualified as a subcontractor of the voluntary worker (page 10 of the conclusions and page 11 additional and summary conclusions of the defendant and the voluntary intervener). 29. The Contentious Chamber takes note of this and does not see, in the context of its own analysis with regard to to the factual elements submitted to it and having regard to the applicable legal elements, no reason for not recognizing these respective qualities in the voluntary intervenor and the defendant. With regard to the voluntary worker more particularly, she defines in fact, at the start of her own mission, the purposes and means of the data processing it operates within the meaning of Article 4.7 of the GDPR which defines the data controller. ✓ As for voluntary intervention 30. The Contentious Chamber takes note of Y2's voluntary intervention in this procedure. This intervention is the result of the decision of Y2 who, voluntarily, and for the needs of the cause, intervened in the proceedings by way of pleadings (see title 1). 31. The Litigation Chamber specifies that neither the LCA nor the Internal Rules of the APD explicitly provide for the mechanism of (voluntary) intervention by a party that has not been challenged by the complainant. 32. Nevertheless, in the exercise of its competences, it is incumbent on the ODA, and therefore on the Litigation Chamber in the exercise of the powers devolved to it, to facilitate the exercise of the rights recognized to persons concerned by the GDPR, including the right to complaint (Article 77 of the GDPR - also recognized in Article 8.3. of the Charter of Rights Decision on the merits 54 / 2021-11 / 23 fundamental as part of the essence of the right to data protection). In this perspective, filing a complaint should remain an easy process for people data subjects whose personal data are processed and with regard to the processing of which they believe that there has been a breach of data protection rules. 33. As it has already had the opportunity to develop in its Decision 17/2020, the authorities of data protection must therefore play an active role through the missions and powers which are assigned to them under Articles 57 and 58 of the GDPR. 34. In the same way that the complainant cannot be expected to identify straight away, from the terms 4 of his complaint, all the legal grievances relevant to the facts denounced, the same so he cannot be expected to identify with certainty the controller concerned. To assert the contrary would be to seriously jeopardize the right of complaint of the complainant. Indeed, the identification of the controller, even in support of the definition provided for in Article 4.7. GDPR, is a process that can be particularly complex. Certainly detailed guidelines have already been published several times by the European Committee of Data Protection (EDPS) and its predecessor the Article 29 Group, on it. 5 Nevertheless, it is clear that this identification often remains thorny. It requires sometimes even recourse to the Inspection Service in the most difficult cases. 35. In support of the foregoing considerations, in order to give effective effect to the right to lodge a complaint, and through it, to contribute to the effective application of the GDPR, the Litigation Chamber therefore naturally accepts this voluntary intervention. She specifies that, of course, the debate contradictory has developed with the latter as well. In these circumstances, the House Litigation is able to impose sanctions on the voluntary intervenor, if necessary. ✓ As to the competence of the APD and the Litigation Chamber 36. The Contentious Chamber specifies here at the outset, with regard to the measures requested by the complainant (see point 24), that it is in any case not competent to grant a any compensation even in the event of shortcomings noted. Indeed, this 3Decision 17/2020: https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-17- 2020.pdf See. also Decision 80/2020 of the Contentious Chamber: https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-80-2020.pdf 4 Decision 38/2021 of the Contentious Chamber: https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-38-2021.pdf 5 See EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR, on edpb.europa.eu. Decision on the merits 54 / 2021-12 / 23 jurisdiction is not listed among the corrective measures and sanctions that it may decide on application of Articles 58.2. of the GDPR and 95 and 100 LCA. 4. As for breaches of the GDPR 37. The Litigation Chamber notes that it emerges from the above statement of facts that the complainant criticizes the voluntary intervener for having accessed personal data on concerning and this, in its terms, without valid legal basis. 38. The Contentious Chamber notes that the parties do not dispute that during the consultation of the history of the household composition (National Register) of Mr. X2 in July 2019, the voluntary worker did have access to the information that the complainant had, at a time, is part of his son's household as head of household. 39. Having access to this information constitutes processing of personal data within the meaning of Article 4.2 of the GDPR regardless of whether the person responsible for treatment that accessed it - in this case the voluntary worker - intended to seek this information or if there was access incidentally, fortuitously, during the search for data relating to a separate person, in this case the complainant's son. that the voluntary worker had the intention or not to process this personal data, whether or not she then used it to make her decision, all of these are irrelevant on the qualification of "treatment" within the meaning of Article 4.2. of the GDPR. 40. The Litigation Chamber recalls that any processing of personal data must rely on one of the bases of lawfulness provided for in Article 6 of the GDPR. 41. Article 3, paragraph 1, 9 ° of the Law of 8 August 1983 organizing a National Register of Persons physical (hereinafter the RN Law) provides that for each person registered in the National Register, the "household composition" data is recorded and kept as well as the modifications successive dates provided to this information as well as their effective date; this is the history (article 3 paragraph 2 of the RN Law). The royal decree of January 8, 2006 determining the types of information associated with the information referred to in Article 3, paragraph 1, of the law of August 8, 1983 organizing a national register of natural persons precise as to 6 See. article 4.2 of the GDPR: "processing", any operation or any set of operations carried out or not using automated processes applied to data or sets of personal data, such as that the collection, recording, organization, structuring, conservation, adaptation or modification, the extraction, consultation, use, communication by transmission, dissemination or any other form of provision, reconciliation or interconnection, limitation, erasure or destruction. Decision on the merits 54 / 2021-13 / 23 him in Article 1, 9 ° that the information "household composition" is associated with the data following: "household reference person" on the one hand and "household member" on the other go. 42. Consequently, consultation of the “household composition” data from the National Register of son of the complainant may, de facto, take cognizance of personal data other people than the son himself, such as members of his household. Personal data that appear in the household composition and its history are both data of a personal data relating to the person whose National Register is consulted AND personal data personnel relating to persons who are included in the composition and history of its housework. There will therefore be processing of personal data of third parties. (separate from the one for which the "household composition" data is consulted, in this case the son of the complainant) when they are or have been part of the household of the person for whom the "household composition" data is consulted (as here the complainant). The result is however, not necessarily an absence of a basis of lawfulness for the processing of personal data. these third parties such as the complainant in this case. 43. Provided it is validly invoked, the legal basis for consulting the data "Household composition" (and its history) of the person concerned (in this case the son of complainant) includes the consultation of the data included under this information, including therefore members of his household, including the complainant. In this case, the basis of lawfulness in support of which consultation of the history of the household composition of the complainant's son is legitimate potentially also access - even induced as described by the defendant and the voluntary worker - to the data relating to the complainant according to which he was part of the household of his son. 44. The Litigation Chamber recalls that in addition to the required legal basis (Article 6 of the GDPR), personal data must, in accordance with the principle of minimization expressed in Article 5.1.c) of the GDPR, be adequate, relevant and limited to what is necessary with regard to the purposes for which they are processed (principle of minimization). 45. Finally, pursuant to Article 24 of the GDPR, it is the responsibility of the controller to implement implement the appropriate technical and organizational measures to ensure and be able to to demonstrate (as required by Article 5.2. of the GDPR) that the processing he carries out complies to the GDPR. 46. It follows from the foregoing that it is for the Contentious Chamber to verify whether the consultation (whose legality is contested by the complainant) - by the voluntary intervener in her capacity as Decision on the merits 54 / 2021-14 / 23 data controller - the "household composition" data of the complainant's son, in this including the complete history thereof, met in this case the conditions of treatment imposed by the GDPR. 4.1. As to the basis of legality and respect for the principle of minimization 47. The Contentious Chamber notes that the defendant and the voluntary intervener rely on Article 6.1.c) of the GDPR to legitimize the contested data processing. Article 6.1.c) authorizes the data processing necessary for compliance with a legal obligation to which the person responsible for 7 treatment is submitted. 48. The Contentious Chamber recalls as it did in its recent decisions 37/2021 and 38/2021 that in its Huber judgment, the Court of Justice of the European Union (CJEU) has, in view of of this condition of necessity, specified that it was an autonomous notion of the right Community which must be interpreted in a way that fully meets the purpose of the 8 Directive 95/46 / EC applicable at the time of this judgment. 9 49. According to the conclusions he filed in this case, the Advocate General explains to this considering that "the concept of necessity has a long history in Community law and it is established as part of the proportionality test. It means that the authority which adopts a measure which infringes a fundamental right in order to achieve a justified objective must demonstrate that this measure is the least restrictive allowing this objective to be achieved. Otherwise, whether the processing of personal data may be likely to infringe the fundamental right to respect for private life, Article 8 of the European Convention for the Protection of man and fundamental freedoms (ECHR) which guarantees respect for private and family life, also becomes relevant. As the Court stated in the Österreichischer Rundfunk and others judgment, if a national measure is incompatible with Article 8 of the ECHR, this measure cannot meet the requirement of Article 7 (e) of the Directive. Article 8, paragraph 2, of the ECHR provides that an interference with privacy may be justified if it pursues one of the objectives therein listed and "in a democratic society, is necessary" for any of these purposes. The courtyard 7 See. decisions 37/2021 and 38/2021 of the Contentious Chamber which explain what is meant by necessary for compliance with a legal obligation: https://www.autoriteprotectiondonnees.be/publications/decision- quant-au-fond-n-37-2021.pdf https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n- 38-2021.pdf 8 CJEU, December 16, 2008, Heinz Huber v. Bundesrepublik Deutschland, C-524/06, ECLI: EU: C: 2008: 724, para. 52. 9 Opinion of Advocate General Poiares Maduro delivered on 3 April 2008 in the proceedings before the CJU resulting in the judgment cited in footnote 15 above (C-524/06). Decision on the merits 54 / 2021-15 / 23 European Human Rights Council has ruled that the notion of "necessity" implies that a "need imperative social "is in question". 50. This case-law, formulated admittedly in the light of Article 7 (e) of Directive 95/46 / EC, applies to all the bases of lawfulness which retain this condition of necessity. She remains today relevant even though Directive 95/46 was repealed since this condition of necessity is maintained under Article 6.1 b) to f) of the GDPR and therefore in Article 6.1.c) invoked in the species. Article 6.1 of the GDPR in fact reproduces the terms of Article 7 of Directive 95/46 / EC 10 of which it is the equivalent. 51. The Article 29 Group also referred to the case law of the European Court of human rights (Eur. D.H. Court) to define the requirement of necessity 11 and concludes that the adjective "Necessary" therefore does not have the flexibility of terms such as "admissible", "normal", "useful", "Reasonable" or "expedient". 12 52. More precisely with regard to the basis of legitimacy which rests on the legal obligation to which would be held by the controller, the European Data Protection Board (EDPB - 13 EDPS) has set out the conditions under which this basis of lawfulness can be applied: - the obligation must be imposed by law; - the legislation must meet all the conditions required to make the obligation valid and binding; - the legislation must comply with the applicable data protection law, in particular the principles of necessity, proportionality and limitation of purpose; - the legal obligation itself must be sufficiently clear about the data processing of a personal nature that it requires; - and the controller should not have an unjustified margin of appreciation as to how to comply with the legal obligation. 10 Note that the only differences to be noted are the addition to Article 6.1.d) of the GDPR of the vital interest of another natural person as the data subject as well as the deletion in Article 6.1.e) of the GDPR of the "third party to which the data is communicated ", the mission of public interest or falling within the exercise of public authority before be that of the sole controller. In addition, a slight wording difference exists between the article 7.1. f) e Directive 95/46 / EC and Article 6.1. f) of the GDPR without modifying the scope of this provision. All these modifications do not affect the condition of necessity. 11 Article 29 Group, Opinion 06/2014 of April 9, 2014 on the notion of legitimate interest pursued by the person responsible data processing within the meaning of Article 7 of Directive 95/46 / EC, WP 217. 12Court eur. D.H., March 25, 1983, Silver and others v. United Kingdom, para 97. 13European Data Protection Board (EDPS), Opinion 03/2019 concerning questions and answers on the interaction between the regulation on clinical trials and the general data protection regulation (GDPR) [article 70, paragraph 1, point b)] of 23 January 2019 (point 11): https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_opinionctrq_a_final_fr.pdf Decision on the merits 54 / 2021-16 / 23 53. In the present case, the defendant and the voluntary intervener put forward several provisions which, from their point of view, required them to proceed with the disputed treatment. 54. The Contentious Chamber notes in this regard the following: - The granting of the social supplement in addition to the ordinary allowances is governed by the General Law relating to family allowances (LGAF) of 19 December 1939, in particular Articles 51, 54 and 173quater. Article 173 quater explicitly provides that family allowance organizations and the ministerial services, responsible for the execution of this law, are required to contact the Register national of natural persons to obtain the information referred to in Article 3, paragraphs 1 and 2, of the Law of August 8, 1983 organizing a national register of natural persons. Among these data show the household composition and its successive modifications (ie history). The recourse to another source is only permitted insofar as the necessary information is not cannot be obtained from the National Register. - Jurisdiction over the granting of family allowances and social supplement is regionalized and the complainant's son was listed as residing in the Brussels-Capital Region at the time 14 of the consultation of the denounced National Register. In this regard, the Litigation Chamber notes that Article 9 of the Ordinance of 25 April 2019 of the Brussels-Capital Region regulating the granting 15 family benefits specifies that the basic family allowance is increased by a supplement social under certain conditions, especially when the annual household income does not reach not a certain threshold. In other words, the granting of the supplement is conditioned by the income of the housework. - Regarding the granting of this social supplement, Article 10 of the Ordinance of April 4, 2019 provides that "the assembled College sets the conditions under which the payment of social supplements is carried out provisionally, pending tax data establishing the annual income of the cleaning allowing a final decision to be taken ”. As a result, the assembled College of the Commission Community Commune has set the conditions for granting social supplements and certain supplements provided for in the General Law on Family Allowances in a Decree of 24 October 2019. 14 The complainant states in this regard that his son has been living in Wallonia since a date much earlier than that of this consultation (i.e. since July 2018). The voluntary worker and the defendant indicate that this change of domicile had not been notified to them on the date of the P028 consultation and that now the voluntary worker no longer manages the family allowances file of the complainant's son. The Litigation Chamber takes note of this. 15M.B., May 8, 2019. https://bruxelles.famifed.be/sites/default/files/uploads/20190509_ordranteiegezinsbijslag_NLFR.pdf: Decision on the merits 54 / 2021-17 / 23 - In accordance with the aforementioned Decree of October 24, 2019, the preparatory measures that the funds family allowances were to be taken from 2019 in order to be able to establish, for each household Brussels resident, the correct amount of family allowances to which he would be entitled from the 1st January 2020, as well as the procedure to be followed for the granting of social supplements from 2020, were decreed in the CO PF2 Circular of July 5, 2019 relating to the granting procedure provisional social supplements in the Brussels-Capital Region from January 1, 2020 ,. - The defendant and the voluntary intervener rely on this Circular of July 5, 2019 relating to the procedure for provisionally granting social supplements in the Brussels-Capital Region to from 1 January 2020, in particular on its articles 2.2 and 7 to legitimize their consultation of the history of the household composition of the complainant's son. - This circular provides that the establishment of the right to a supplement in the Brussels-Capital Region will be done in two phases, namely: Phase 1: A decision on the provisional payment of the supplement is taken in "time real ": in other words, it is automatically granted on a provisional basis if the conditions are met. Also, the supplement can be granted on a provisional basis following a request from the household accompanied by supporting documents relating to the current gross income of the household. Phase 2: Two years later, the taxable income of all households is verified using of the tax flow and the definitive establishment of the right to the social supplement is carried out on the basis tax data made available by the authentic source. - As for the concept of household retained, the circular specifies that "this identification is made according to the notion of household as described in article 2 of the decree of October 24, 2019. This decree provides in Article 1 that it is to be understood by: "1 ° member of the cohabiting household: any person who is neither a relative nor an ally up to the third degree inclusive, with which the recipient cohabits and forms a de facto household; 2 ° household members: the beneficiary and, where applicable, the spouse with whom he cohabits and / or any other member of the cohabiting household ” 55. The Litigation Chamber concludes that in other words, prior to the granting of the supplement adequate social security from 1 January 2020, it went to the family allowance funds (including the voluntary worker), to identify, in application of the various aforementioned texts, from July 2019, beneficiaries and their income, more particularly that of their household as this concept is defined in article 2 of the decree of 24 October 2019. Decision on the merits 54 / 2021-18 / 23 56. This verification of the income condition of the household (and therefore of who was part of it) is, in the occurrence, through an identification of the household composition of the complainant's son via the consultation of the National Register. It is also not disputed that the allowance funds family, including the volunteer worker, were duly authorized to consult the National Register. 57. The Litigation Chamber notes that it is not clear from the legal texts invoked which are the income that should be taken into account and hence, depending on the phase in which the consultation took place, what was the date of the household composition to be taken into consideration (current calendar year, backtracking by 2 years by analogy with the final calculation which will take place two years later as mentioned by the defendants and the intervener voluntary during the hearing (see Articles 2.1. and 2.2. of the circular of 5 July 2019)?). This precision would have been invaluable, it is also required by the principle of clarity and predictability of the "law", a principle long required by the case law of the European Court of Human Rights 16 man, as well as the CJEU. 58. The Litigation Chamber considers that at most, this history of the “composition” data household "of the complainant's son could have been consulted by going back to the opening date right to allowances / social supplement to these allowances and that in any event, the consultation the entire history of the complainant's son without a time limit was disproportionate and not necessary for the voluntary worker to comply with her legal obligation. 59. However, as the complainant denounces, the “P028 search” which was carried out prevails systematically consulting the history of household composition in its entirety, or since the birth of the person whose National Register is consulted. Access to this history of the complainant's son was therefore disproportionate and the data consulted was not relevant with regard to the objective pursued, namely the determination of the composition of household at a time T which must be taken into account in the granting of family allowances and the social supplement. 60. Accordingly, the Contentious Chamber concludes that, even if it invokes that the TRIVIA application which it had to use did not allow consultation of a time-limited history (see point 63), the voluntary worker did not carry out the processing necessary for her obligation legal and therefore cannot invoke Article 6.1.c) as a basis of lawfulness. The Litigation Chamber therefore finds a breach of Article 6 of the GDPR on its part, in the absence of any other basis valid lawfulness and without prejudice to the obligation of the controller to identify a basis 16Court eur. D.H., May 4, 2000, Rotaru v. Romania; CJEU, Joined cases C-511/18, C-512/18 and C-520/18, La Quadrature du Net and others, ECLI: EU: C: 2020: 791, para 121. Decision on the merits 54 / 2021-19 / 23 17 legality and not several depending on the circumstances. The Litigation Chamber also concludes also for a breach of Article 5.1.c) of the GDPR, the data of which the intervener has acquainted with it on the occasion of its illegal consultation (in the absence of a legal basis to legitimize it) therefore also irrelevant with regard to the aim pursued. 61. As for the consultation held on April 21, 2020, the Litigation Chamber notes that the the defendant and the voluntary intervener are based on their legitimate interest (article 6.1.f) of the GDPR), the consultation being justified according to them by the needs of the present procedure. Bedroom Litigation recalls in this regard that it has, in the past already, considered that the defense in court 18 is a legitimate interest that can validly be invoked by data controllers to as much as the cumulative conditions of necessity of the treatment for the realization of the interest lawful pursuit and proportionality (i.e. that the fundamental rights and freedoms of concerned do not prevail over the interest pursued) are met. 62. Without calling into question the fact that legal defense may indeed constitute an interest legitimate within the meaning of Article 6.1.f) of the GDPR, the Litigation Chamber concludes no less, for the same reasons as those underlying its conclusion regarding the initial consultation (see. points 57-60), that this consultation during the proceedings pending before the DPA was also illegal. 4.2. As for the principle of accountability 63. The Litigation Chamber takes note of what the voluntary intervener declares on the one hand that it is required to use the TRIVIA application and on the other hand that it is impossible for him to target in time his request to consult the history of the "household composition" data in the Register national. The Litigation Chamber is not insensitive to this and refers on this point to the measures corrective measures that it decides to take as detailed in points 69 et seq. (title 5). 64. Notwithstanding this last point, the fact remains that in his capacity as responsible processing, the voluntary worker could not rely on Article 6.1.c) of the GDPR and did not have as was concluded in points 60 and 62 above from no valid basis of lawfulness to access the complainant's data via the consultation of the complete history of household composition of his son. 17 See. Decision 38/2021 of the Contentious Chamber: https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-38-2021.pdf 18 See. the Decision 03/2020 of the Contentious Chamber: https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-03-2020.pdf Decision on the merits 54 / 2021-20 / 23 65. The Contentious Chamber also finds a breach of Articles 24 and 5.2. of GDPR on the part of the voluntary worker when she has not been able to put put in place the technical measures intended to implement the GDPR. Here again, the House Litigation is not unaware of the lack of control of the application by the voluntary worker. This circumstance is not, however, such as to eliminate any breach on his part given his capacity as data controller. 66. Indeed, the objective of the principle of accountability, or "principle of responsibility" in its translation French (Article 5.2. of the GDPR), is to make data controllers accountable - whether it is private companies or public authorities or bodies -, and allow the authorities to data protection monitoring such as ODA to verify the effectiveness of the measures taken applying it. Risks must be identified by setting up action plans and control procedures and these organizations must be able to prove without difficulty that they have carried out an identification, an assessment and a framework of the risks in terms of protection of personal data with regard to the processing they carry out. This principle would be broadly undermined, or even emptied of all substance if it was enough for a data controller to invoke, once faced with a complaint lodged with the supervisory authority, the fact that the application computer used - even its use imposed by a third party - does not allow it to comply to the GDPR. 67. In accordance with its obligation of accountability and documentation, the voluntary worker therefore, at a minimum, should have alerted the relevant authorities to the overhang situation in which the constrained use of the TRIVIA application placed it in relation to its obligations arising from the GDPR. 68. The Litigation Chamber is also aware of the care taken by the defendant to respond to questions from the complainant and making contact with the supervisory authority to be able to explain to the the situation better at the latter. But here again, these circumstances are not such as to allow the Litigation Chamber to conclude that there was no breach. Bedroom Litigation also noted that the intervener now undertook to contact the Supervisory Authority. 5. Regarding corrective measures and sanctions 69. Under article 100 LCA, the Litigation Chamber has the power to: 1 ° dismiss the complaint; 2 ° order the dismissal; 3 ° pronounce a suspension of the pronouncement; Decision on the merits 54 / 2021-21 / 23 4 ° propose a transaction; 5 ° issue warnings or reprimands; 6 ° order compliance with the requests of the person concerned to exercise these rights; 7 ° order that the person concerned be informed of the security problem; 8 ° order the freezing, limitation or temporary or definitive prohibition of processing; 9 ° order that the processing be brought into conformity; 10 ° order the rectification, restriction or erasure of the data and the notification thereof data recipients; 11 ° order the withdrawal of accreditation of certification bodies; 12 ° give periodic penalty payments; 19 20 13 ° issue administrative fines; 14 ° order the suspension of transborder data flows to another State or an organization international; 15 ° send the file to the public prosecutor's office in Brussels, who informs them of the consequences data on file; 16 ° decide on a case-by-case basis to publish its decisions on the website of the data. 70. It is important to contextualize the shortcomings noted by the Litigation Chamber with a view to to identify the most appropriate corrective measures and sanctions. 71. In this context, the Litigation Chamber will take into account all the circumstances of the case and explanations provided by the parties. In this regard, the Litigation Chamber wishes to specify that it belongs to it sovereignly as an independent administrative authority - in compliance with the relevant articles of the GDPR and the LCA - to determine the measure (s) corrective (s) and appropriate sanction (s). 21 72. Thus, it is not for the complainant to ask the Litigation Chamber to order such or such corrective measure or sanction. If, notwithstanding the above, the complainant should nevertheless ask the Litigation Chamber to pronounce one or the other measure and / or 19 https://www.autoriteprotectiondonnees.be/publications/politique-en-matiere-d-astreinte.pdf 20 The Contentious Chamber does not comment on the advisability of a possible administrative fine to against the defendant. Given the latter's "public authority" status within the meaning of Article 5 of the Law of 30 July 2018 on the protection of individuals with regard to processing of personal data, read in conjunction with Articles 83.7. of the GDPR and 221 § 2 of the law of July 30, 2018 cited above, the Litigation Chamber is in fact not authorized to impose such a fine on him. 21 Litigation Chamber, Decision on the merits 81/2020: https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-81-2020.pdf Decision on the merits 54 / 2021-22 / 23 sanction, it is not up to the latter to justify why it would not retain one or the other request made by the complainant. These considerations leave intact the obligation for the Litigation Chamber to justify the choice of corrective measure (s) and / or sanction (s) which it judges, (among the list of measures and sanctions made available to it by the articles 58 of the GDPR and 95.1 and 100.1 of the LCA recalled above) appropriate to condemn the party in question. The Contentious Chamber recalls here, as it mentioned in point 36 above, that it is not competent to grant any compensation. 73. The Litigation Chamber found a breach of Articles 6, 5.1.c) as well as of Articles 24 and 5.2. of the GDPR on behalf of the voluntary worker (points 60, 62 and 65). 74. In view of these shortcomings, the Litigation Chamber sends the voluntary intervener 22 a reprimand on the basis of Article 100.1, 5 ° LCA which constitutes, in view of the facts and breaches noted, the effective, proportionate and dissuasive sanction as required by the applicable article 83 of the GDPR. In this regard, the Litigation Chamber wishes to stress that it is not in a position to issue a warning to the voluntary worker as soon as this measure cannot be applied when a breach is found. Disclaimer applies only when the planned processing operations are likely to violate the provisions of the GDPR. 75. The Litigation Chamber is of the opinion that beyond the reprimand addressed to the intervener voluntary, it is important that an adequate response be quickly found to the problem raised by the complaint and this, in order to allow a limited consultation, respectful of the GDPR, of the history of the "household composition" data (as well as the history of other data from the National Register if applicable). The Contentious Chamber refers in this regard to the deliberations of the Sectoral Committee of the National Register (CSRN) of the former Commission for the Protection of Life private (OPC) under which the NISA grants access to limited historical data over time in accordance with Article 4 § 1, 3 ° of the Privacy Law which then set out the principle proportionality (now principle of minimization worded in Article 5.1, c) of the GDPR). 23 The Litigation Chamber is also challenged by the document entitled "File - Description specific function of the P028 message ”(in particular point 126.96.36.199.) highlighted by the complainant, according to which it would have been waived to use an application more respectful of the principle of minimization (see point 23). 22 See. Article 58. 2 b) of the GDPR which provides for sending a call to order to the controller when "The processing operations have resulted in a violation of the provisions of this Regulation". 23 See. taking for example the deliberation of the sectoral committee of the National Register RN No. 20 of March 25, 2009. Decision on the merits 54 / 2021-23 / 23 76. For all these reasons, the Litigation Chamber will draw the attention of the APD Steering Committee on this issue. Where appropriate, the ODA bodies could, in accordance with their respective competences assigned to them by the LCA, decide to enter into a dialogue with the whole of the bodies concerned and / or conduct an in-depth investigation of the issue which arose during the complaint leading to this decision. 77. The Contentious Chamber also decides to send a copy of this decision to services of the National Registry as well as to Famifed, Iriscare and the Crossroads Security Bank social security (BCSS) mentioned by the complainant in the terms of his complaint. 6. Transparency 78. In view of the importance of transparency with regard to the decision-making process and decisions of the Litigation Chamber, this decision will be published on the website of the APD by deleting the direct identification data of the parties (either the defendant, the voluntary worker and the complainant) and the natural persons mentioned. On the other hand, the Chamber Litigation believes that it has no other possibility, for the proper understanding of this decision, only to mention Famifed, Iriscare, the Banque-Carrefour de la sécurité social (BCSS) and National Registry services. FOR THESE REASONS, THE LITIGATION CHAMBER Decided - To issue a reprimand against the voluntary intervener on the basis of the article 100.1, 5 ° LCA. Under Article 108.1 LCA, this decision can be appealed to the Court of contracts (Brussels Court of Appeal) within 30 days of notification, with the Data Protection Authority as respondent. (Sé) Hielke Hijmans President of the Litigation Chamber