Court of Appeal of Brussels - 2022/AR/560 & 2022/AR/564
| APD/GBA - 2022/AR/560 & 2022/AR/564 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 26 GDPR Article 58(2) GDPR Article 83 GDPR |
| Type: | Other |
| Outcome: | n/a |
| Started: | |
| Decided: | 07.01.2023 |
| Published: | |
| Fine: | 50,000 EUR |
| Parties: | Brussels Airport Company Gegevensbeschermingsautoriteit Ambuce Rescue Team |
| National Case Number/Name: | 2022/AR/560 & 2022/AR/564 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | APD/GBA (in NL) |
| Initial Contributor: | elsjegold |
The Belgian Market Court held that the DPA did not sufficiently motivate its statement that the parties were joint controllers, and lowered the fine imposed on one of the controllers to €50,000 due to mitigating circumstances.
English Summary
Facts
On 4 April 2022, the Belgian DPA issued a decision in relation to the use of thermal cameras and temperature checks for COVID-19 detection purposes by Brussels Airport. The DPA imposed a fine of €200,000, as well as a fine of €20,000 for the Ambuce Rescue Team which carried out a second test for passengers at Brussels Airport with a temperature of 38°C or higher.
The DPA held they lacked a lawful ground for processing these special personal data. For more information on this decision, see the original decision and the GDPRhub summary.
Ambuce and the Airport both appealed the DPA's decision with the Market Court, where they were jointly decided.
Both parties questioned the impartiality of the DPA, because one of its members is also the ‘program director’ at a non-profit focused on digital data protection (noyb). This was supposedly incompatible with his mandate as a member of the Dispute Chamber of the DPA and violated Article 52(1) and (2) GDPR and Article 44(1) WOG. They also questioned the qualification of them as joint controllers as far as the second-line control was concerned. Last, they argued that the fines imposed on them were not adequately justified.
Brussels Airport further argued that the DPA misused its power. According to BAC, the purpose of the contested decision was not to impose an effective, proportionate and dissuasive sanction but rather to set an example and denounce the DPA's lack of consultation in any legislative initiative. In addition, the DPA alleged breached the principles of reasoning and due care.
Further, Ambuce stated that the publication of the press release of 17 June 2020 infringed Article 54(2) AVG and Article 48(1) and Article 64(3) WOG. In addition, it held that Ambuce's rights of defence and article 92(3) WOG were not respected by the DPA. A number of GDPR violations were found in the contested decision on the part of Ambuce, whereas the Inspection Service Report held only Brussels Airport responsible for the GDPR violations committed in the context of the second-line inspection. The DPA upheld infringements on Ambuce’s behalf without any rebuttal, violating Ambuce's right of defence. It would also make the contested decision incompatible with Article 92(3) WOG, as that provision would imply that the DPA may not find infringements other than those that in the Inspection Report.
Holding
On the impartiality of the DPA, the Market Court held that it was only for the Dispute Chamber to remove one of its member from office. The Court had no jurisdiction to do so. It further noted that none of the parties complained to the Chairperson of the Dispute Chamber before the start of the hearing about this alleged incompatibility, which made the argument appear less convincing.
Regarding the press release, the Court again stated that it had no jurisdiction to rule on the legitimacy of the publication of the latter. It was only competent to rule on the decisions of the DPA. Insofar that the parties invoked Article 54(2) GDPR, the Court stated that this merely stipulates that members and staff of national supervisory authorities are bound by professional secrecy. However, this provision was not to be interpreted so broadly that it would prevent the DPA as such from communicating to the general public about (possible) breaches.
Regarding the alleged abuse of power, the Court reminded that this is only present when a public authority uses the power vested in it to for the purpose of public interest for another, purpose. The unauthorised purpose must moreover be the sole purpose of the contested act. Since both parties didn’t demonstrate that the DPA pursued an objective other than the enforcement of the right to data protection, the plea is unfounded.
Regarding Ambuce’s right of defense, the Court found that Ambuce was made aware of all the issues that could cause a debate before the litigation chamber. Furthermore, Ambuce was sufficiently heard during the hearing based on the official report. There was therefore no violation of its right to defense. Regarding the violation of Article 92(3) WOG the Court held that the DPA cannot be bound by what was stated in the Inspection Report for the establishment of potential violations and sanctions.
On the qualification of the parties as joint controllers, the Court noted that his statement was contrary to the the inspection report and the conclusions of Ambuce and Brussels Airport. In addition the contested decision does not explain what joint-controllership entails and the implications for liability and responsibilities under the GDPR. The Court stated that the DPA could have, for example, invited the Inspection Service to the hearing, asked the latter for an additional investigation. Hover, the DPA did not. Therefore, the contested decision was not carefully prepared on this point and the reasoning was inadequate. Thus, no sanction could in any event be imposed on Ambuce since the alleged infringement with which it is charged was not established with due care and not adequately reasoned.
Last, regarding the amount of the fine, the Court held that the DPA did not pay sufficient attention to the mitigating circumstances laid down in Article 83 GDPR. Therefore, it reduced the fine given to Brussels Airport to €50,000.
Comment
Similar temperature checks were performed at Brussels South Charleroi Airport. This was the subject of a separate (French) decision of the DPA (47/2022), also issued on 4 April 2022 and appealed at the Market Court (2022/AR/556). Both the decision of the DPA and the decision of the Market Court are summarised on the GDPRhub.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
-
Court of Appeal BrussMarktenhof 2022/AR/560 & 2022/AR/564 p. 2
IN CASE OF:
B RUSSELSAIRPORT COMPANV NV (BAC}, with registered office at 1030 Schaarbeek,
Auguste Reyerslaan 80, and with KBO number 0890.082.292;
applicant,
Assisted and represented by Mr. Peter VAN DYCK and Mr. Lore VAN ESPEN, lawyers,
with office in [...];
IN RETURN FOR:
The DATA PROTECTION AUTHORITY (DPA), independent public body
(supervisory authority) with legal personality, with registered office at 1000
Brussels, Drukpersstraat 35, with KBO number 0694.679.950;
Respondent,
Assisted and represented by Mr. Any CLOOTS, Mr. Joos ROETS and Mr. Timothy ROES,
lawyers, with office in[...]
And from:
AMBUCE RESCUE TEAM nv (B-Art), with registered office at 2110 Wijnegem,
Bijkhoevelaan 8, box B, and with KBO number 0878.991.927;
applicant,
Assisted and represented by Mr. Gerrit VANDENDRIESCHE and Mr. Pierre ANTOINE,
lawyers, with office in [...]
1 PAGE 01- □□□□ 3026656-00 □2- □□ 36-□1- □1-
L-
Hof van berpBrussels -arkenhof 2022/AR/560 & 2022/AR/564 p. 3
IN RETURN FOR:
The DATA PROTECTION AUTHORITY (DPA), independent public body
(supervisory authority) with legal personality, with registered office at 1000
Brussels, Drukpersstraat 35, with KSO number 0694.679.950;
Respondent,
Assisted and represented by Mr. ElkeClOOTS, Mr. Joos ROETS and Mr. Timothy ROES,
lawyers, with office in [...]
In presence of:
Mr Romain ROBERT, [...]
voluntary intervening party,
Assisted and represented by Mr. Catherine FORGET, lawyer, with office in [...]
Having regard to the procedural documents:
• the petition of 3 May 2022, by which BrusselsAirport Company nv (hereinafter: 'BAC') appealed
appeals against decision no. 48/2022 of the Litigation Chamber of 4 April 2022, in the
file with file number DOS-2020-02823 (hereinafter: 'the contested decision'), as
notified by email and registered mail dated April 4, 2022 to BAC;
• In view of the first conclusion of the GBA of 20 July 2022;
• Having regard to the conclusion of voluntary intervention by Mr Robert of 20 July 2022;
• Having regard to the synthesis conclusion of BAC of 20 September 2022;
• the bundles of documents submitted by the parties involved.
And
1 PAGE 01- □□□□ 3026656- □□□ 3-0036- □1-□ 1-;-J
L
