Court of Appeal of Brussels - 2022/AR/560 & 2022/AR/564
| APD/GBA - 2022/AR/560 & 2022/AR/564 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 26 GDPR Article 58(2) GDPR Article 83 GDPR |
| Type: | Other |
| Outcome: | n/a |
| Started: | |
| Decided: | 07.01.2023 |
| Published: | |
| Fine: | 50,000 EUR |
| Parties: | Brussels Airport Company Gegevensbeschermingsautoriteit Ambuce Rescue Team |
| National Case Number/Name: | 2022/AR/560 & 2022/AR/564 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | APD/GBA (in NL) |
| Initial Contributor: | elsjegold |
The Belgian Court of appeal of Brussels upheld a decision by the Belgian DPA to fine Brussels airport for using temperature scanners at the airport to detect potential COVID-19 infections without a legal basis. However, the Court reduced the original fine.
English Summary
Facts
On 4 April 2022, the Belgian DPA issued decision 48/2022, in which it fined Brussels Airport €200,000 for the use of thermal cameras and temperature checks for COVID-19 detection purposes. It also fined the Ambuce Rescue Team €20,000 for carrying out a second test (second-line control) for passengers at Brussels Airport with a temperature of 38°C or higher. The DPA held these controllers lacked a lawful ground for processing these special personal data. For more information on this decision, see the GDPRhub summary.
Ambuce and the Airport both appealed this decision with the Market Court, where they were jointly decided. Both parties questioned the impartiality of the DPA, because one of its members was also the ‘program director’ at a non-profit focused on digital data protection (NOYB). This was supposedly incompatible with his mandate as a member of the Dispute Chamber of the DPA and in violation with Articles 52(1) and 52(2) GDPR and Article 44(1) WOG.
Ambuce and the Airport also questioned their qualification as joint controllers as far as the second-line control was concerned.
Lastly, they argued that the fines imposed on them were not adequately justified.
Brussels Airport further argued that the DPA misused its power. According to the Airport, the purpose of the contested decision was to set an example and to denounce the practice of not consulting the DPA in any legislative initiative. In addition, the DPA allegedly breached the principles of reasoning and due care.
The controllers stated that the publication of the press release of 17 June 2020 infringed Article 54(2) GDPR and Article 48(1) and Article 64(3) WOG. This press release described that the DPA was 'worried' about the installation of these thermal camera's.
In addition, Ambuce held that it's rights of defence and article 92(3) WOG were not respected by the DPA. A number of GDPR violations were found in the contested decision on the part of Ambuce, whereas the Inspection Service Report only held Brussels Airport responsible for the GDPR violations committed in the context of the second-line inspection. The DPA upheld infringements on Ambuce’s behalf without any rebuttal, violating Ambuce's right of defence. It would also make the contested decision incompatible with Article 92(3) WOG, as that provision would imply that the DPA may not find infringements other than those that in the Inspection Report.
Holding
On the impartiality of the litigation chamber, the Market Court held that it was only for the Parliament to remove one of its members from office. The Court had no jurisdiction to do so. It further noted that the decision is collegial, and no element proved that the member was irregularly appointed or biased in a way that could lead to the annulment of the decision.
Regarding the press release, the Court again stated that it had no jurisdiction to rule on the legitimacy of the publication of the press release. It was only competent to rule on the decisions of the DPA. Insofar that the parties invoked Article 54(2) GDPR, the Court stated that this merely stipulated that members and staff of national supervisory authorities were bound by professional secrecy. However, this provision was not to be interpreted so broadly that it would prevent the DPA from communicating (possible) breaches of the GDPR to the general public.
Regarding the alleged abuse of power, the Court reminded that this can only be the case when a public authority used its power, meant to serve the public interest, for another purpose. The unauthorised purpose must moreover be the sole purpose of the contested act. Since both parties didn’t demonstrate that the DPA pursued an objective other than the enforcement of the right to data protection, this plea was unfounded.
Regarding Ambuce’s right of defence, the Court found that Ambuce was made aware of all the issues that could cause a debate before the litigation chamber. Furthermore, Ambuce was sufficiently heard during the hearing based on the official report. There was therefore no violation of its right to defence. Regarding the violation of Article 92(3) WOG, the Court held that the DPA cannot be bound by what was stated in the Inspection Report for the establishment of potential violations and sanctions.
On the qualification by the DPA of the parties as joint controllers, the Court noted that this qualification was not in line with the inspection report and the conclusions of Ambuce and Brussels Airport. The Court stated that the DPA could have, for example, invited the Inspection Service to the hearing and/or ask it to conduct an additional investigation, which the DPA did not do. Therefore, the contested decision was not carefully prepared on this point and the reasoning of the DPA was inadequate. Thus, no sanction could in any event be imposed on Ambuce since the alleged infringement was not established with due care and was not adequately reasoned.
The Court reduced the amount of the fine on the Airport. In particular, the court stated that the DPA should have paid more attention to the following factors: (Article 83 GDPR)
- The Airport had fully cooperated with the DPAs during the procedure
- The controller had not profited economically from these temperature checks.
- The sole purpose of the temperature checks was to support public health.
Therefore, it reduced the fine given to Brussels Airport to €50,000.
Comment
Similar temperature checks were performed at Brussels Charleroi Airport. This was the subject of a separate (French) decision of the DPA (47/2022), also issued on 4 April 2022 and appealed at the Market Court (2022/AR/556). Both the decision of the DPA and the decision of the Market Court are summarised on the GDPRhub.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
-
Court of Appeal BrussMarktenhof 2022/AR/560 & 2022/AR/564 p. 2
IN CASE OF:
B RUSSELSAIRPORT COMPANV NV (BAC}, with registered office at 1030 Schaarbeek,
Auguste Reyerslaan 80, and with KBO number 0890.082.292;
applicant,
Assisted and represented by Mr. Peter VAN DYCK and Mr. Lore VAN ESPEN, lawyers,
with office in [...];
IN RETURN FOR:
The DATA PROTECTION AUTHORITY (DPA), independent public body
(supervisory authority) with legal personality, with registered office at 1000
Brussels, Drukpersstraat 35, with KBO number 0694.679.950;
Respondent,
Assisted and represented by Mr. Any CLOOTS, Mr. Joos ROETS and Mr. Timothy ROES,
lawyers, with office in[...]
And from:
AMBUCE RESCUE TEAM nv (B-Art), with registered office at 2110 Wijnegem,
Bijkhoevelaan 8, box B, and with KBO number 0878.991.927;
applicant,
Assisted and represented by Mr. Gerrit VANDENDRIESCHE and Mr. Pierre ANTOINE,
lawyers, with office in [...]
1 PAGE 01- □□□□ 3026656-00 □2- □□ 36-□1- □1-
L-
Hof van berpBrussels -arkenhof 2022/AR/560 & 2022/AR/564 p. 3
IN RETURN FOR:
The DATA PROTECTION AUTHORITY (DPA), independent public body
(supervisory authority) with legal personality, with registered office at 1000
Brussels, Drukpersstraat 35, with KSO number 0694.679.950;
Respondent,
Assisted and represented by Mr. ElkeClOOTS, Mr. Joos ROETS and Mr. Timothy ROES,
lawyers, with office in [...]
In presence of:
Mr Romain ROBERT, [...]
voluntary intervening party,
Assisted and represented by Mr. Catherine FORGET, lawyer, with office in [...]
Having regard to the procedural documents:
• the petition of 3 May 2022, by which BrusselsAirport Company nv (hereinafter: 'BAC') appealed
appeals against decision no. 48/2022 of the Litigation Chamber of 4 April 2022, in the
file with file number DOS-2020-02823 (hereinafter: 'the contested decision'), as
notified by email and registered mail dated April 4, 2022 to BAC;
• In view of the first conclusion of the GBA of 20 July 2022;
• Having regard to the conclusion of voluntary intervention by Mr Robert of 20 July 2022;
• Having regard to the synthesis conclusion of BAC of 20 September 2022;
• the bundles of documents submitted by the parties involved.
And
1 PAGE 01- □□□□ 3026656- □□□ 3-0036- □1-□ 1-;-J
L
