The Belgian Data Protection Authority (BDPA) has published a decision of 21 February 2020 of the BDPA's litigation chamber showing the way in which data protection has become an additional argument in disputes.
The core of the dispute may sound familiar to many organisations: employee X is dismissed by company Alpha, goes to work for company Beta, and a few months in company Beta dismisses X. Both have disputes with X, and at some point along the way, Alpha and Beta have oral discussions about X.
Things get a little more complicated then. Beta reveals orally to Alpha that a court has ordered X to pay damages to Beta for the use of false arguments and for breach of Beta's company policies. Afterwards, Alpha mentions this court decision (revealed by Beta) in an e-mail to X's trade union, which has threatened wholly separate proceedings against Alpha on X's behalf. [Are you still following?]
X becomes aware of this and goes on to complain before the BDPA that both companies are in breach of their obligations under the General Data Protection Regulation (GDPR) – Beta for sharing information on the court decision with Alpha, and Alpha for sharing that information with X's trade union.
1. Reasoning & decision of the litigation chamber
The BDPA's litigation chamber makes a few comments in reaching its final decision.
First, the litigation chamber stresses that its role is not to serve as a replacement for labour courts. Employment law is not within its remit, only verification of compliance with data protection law. The litigation chamber does not explain why it felt the need to say so, but the reasoning applies to all areas of law. In practice, this may serve as a reminder for individuals and organisations seeing data protection arguments as another string to their bow – no matter what, the litigation chamber will not be able to award damages.
Next, the litigation chamber states that oral disclosures are not automated processing of personal data in any way, such that the GDPR does not apply to the disclosure by Beta to Alpha of personal data regarding employee X. In other words, because Beta's disclosure of information regarding the court proceedings was only made orally, the complaint against Beta is dismissed.
In relation to Alpha's disclosure by e-mail to X's trade union, however, the GDPR applies, and the litigation chamber examined the question of lawfulness of the processing. In this respect, it made the following observations:
-Information on "administrative sanctions or civil judgments" do not fall within the scope of Article 10 of the GDPR, which relates only to "processing of personal data relating to criminal convictions and offences". However, according to the litigation chamber, such information "is sensitive to a certain degree".
-Alpha claimed that the processing was justified on the basis of its legitimate interest in defending itself in its own dispute against X (given the trade union's threat of proceedings against Alpha). The litigation chamber confirmed that this interest was valid and existed at the time of processing.
-However, the litigation chamber considered that this interest did not prevail over X's rights and freedoms and that the processing of information on the judgment in Beta's case against X was not "necessary" or "proportionate" in this particular case. One relevant consideration was that X's dispute with Alpha was based on his dismissal by Alpha, and that any subsequent information regarding Beta and its case against X was irrelevant to X's dismissal by Alpha. The litigation chamber also mentioned that because the information was not obtained from X himself but from a third party (Beta), this also weighed against Alpha's reliance on legitimate interests.
The litigation chamber concluded that based on the circumstances, a reprimand was an appropriate "effective, proportionate and dissuasive" sanction – not a fine.
2. Additional observations and lessons for others
The decision contains a few interesting elements for organisations irrespective of how they process personal data – and whether they process employee personal data or personal data on other categories of data subjects.
First, the decision is interesting from a linguistic perspective. In Belgium, a country with three official languages, proceedings are normally carried out in only one language. In fact, in the judiciary, a specific Act regulates the use of languages in proceedings. The BDPA's litigation chamber is not subject to those rules, though, as it is not part of the judiciary. In this particular case, the litigation chamber appears to have tolerated the use of multiple languages, as one party's submissions were in Dutch, while the remainder of the submissions and the decision itself are in French. One may wonder whether this example might lead to a multiplication of multi-language proceedings before the BDPA.
Second, the litigation chamber adopted a clear and logical position by stating that oral disclosures fall outside of the scope of the GDPR. One nevertheless has to wonder whether regulators and legislators across the EU will one day view this as a loophole.
Third, the reasoning of the litigation chamber in relation to legitimate interests as a legal ground – and in particular the legitimate interest in defending oneself in the context of present or possible litigation – may serve as a useful benchmark for many organisations working on (improving) data retention policies or processes regarding the collection and preservation of dispute-relevant information. While it only relates to a specific case, this reasoning provides insights into how the litigation chamber might view such processes and policies.
Finally, this is the first decision to be published by the BDPA since a decision of 19 February 2020 of the Belgian Market Court, in which a decision of the litigation chamber was quashed notably for failing to justify the amount of the fine it had then imposed. According to the Market Court, "in the absence of a clear qualification and quantification of the potential sanctions in a publicly available document [made public by the BDPA] before any specific complaint" (emphasis ours), the BDPA had to provide clear justifications as to why (in this particular case) a sanction other than a fine of the relevant amount would have been insufficient to stop the infringement. In this decision of 21 February 2020 (two days after the decision of the Market Court), no fine was imposed but only a reprimand. While the timing may be purely coincidence, the Market Court's decision suggests that we will see many more reprimands in the future, and possibly fewer fines initially.
If you wish to read the decision in full, you can find it at the following link (only available in French at this time, translation likely forthcoming).
