Editing APD/GBA (Belgium) - 57/2021 (section)
== English Summary == === Facts === This decision is a reconsideration of the decision 24/2020 and executes the appeal of the Market Court of 18 November 2020 (2020/AR/813), it gives the defendant the possibility to defend itself against all infractions on the GDPR for which the initial sanction was based on. To summarise, the complainant claimed that its health data was used by an insurance company for a purpose for which he did not explicitly agree. The defendant now claims to use legitimate interest as legal basis. === Holding === Legal basis of legitimate interest The defendant states that non-sensitive personal data can be processed based on legitimate interest for different purposes: - conducting computer tests; - monitoring the quality of service; - training of personnel; - monitoring and reporting; - storing recordings of video surveillance for the statutory period; and - compiling statistics from coded data, including big data. For each of these purposes, a balancing test was done. The DPA recites the requirements for relying on [[Article 6 GDPR#1f|Article 6(1)(f)]], namely purpose test, necessity of the processing and a balancing test. As regards the first condition (the so-called "purpose test"), the DPA considers that the processing purpose as described by the Respondent must be considered as carried out in view of a legitimate interest. The interest pursued by the Respondent as the data controller can in itself be regarded as legitimate, in accordance with recital 47 of the GDPR. In order to satisfy the second condition, it must be demonstrated that the processing is necessary for the achievement of the purposes pursued. More specifically, this means asking the question whether the same result can be achieved by other means without processing personal data or without an unnecessarily intrusive processing for the data subjects. In order to verify whether the third condition of [[Article 6 GDPR#1f|Article 6(1)(f)]] - the so-called "balancing test" between the interests of the controller, on the one hand, and the fundamental freedoms and fundamental rights of the data subject, on the other hand - can be met, the reasonable expectations of the data subject must be taken into account in accordance with recital 47 GDPR. More specifically, it should be evaluated whether "the data subject may reasonably expect, at the time and in the context of the collection of the personal data, that processing may take place for that purpose." <u>Conducting computer tests</u> The DPA holds that this satisfies the first, second and third criteria. It does state that the data subject could be more informed about the tests. <u>Monitoring the quality of service and compiling statistics from coded data, including big data</u> This topic has three parts: "statistics and quality tests", "satisfaction questionnaires" and "quality tests operations", each legitimate interest basis was assessed by the DPA: '''Statistics and quality tests''' All criteria have been fulfilled. '''Satisfaction questionnaires''' All criteria have been fulfilled. '''Quality tests operations''' All criteria have been fulfilled. <u>Training of personnel</u> The first criteria has been fulfilled. The necessity test has not been fulfilled, as it is not necessary to use client data in order to provide training cases for personnel, this is a breach of data minimisation of [[Article 5 GDPR#1c|Article 5(1)(c)]]. The balancing test is also not fulfilled as it is not within the reasonable expectations of a person taking an insurance for their information to be used as an example. <u>Monitoring and reporting</u> The first criteria has been fulfilled.The second criteria has been fulfilled as a minimum of data is necessary to fulfill legal obligations. Said legal obligations however, did not foresee in an explicit legal basis for the processing.The third criteria has also been fulfilled as it is a reasonable expectation of a data subject that the insurance company must fulfill its legal obligations. <u>Storing recordings of video surveillance for the statutory period</u> The first and second criteria have been fulfilled. The third criteria has not been fulfilled as a data subject signing an insurance contract cannot reasonably expect that their data will be used for video surveillance. This falls under the Camera law of 21 March 2007, including the obligation to put up pictograms to inform the data subjects. <u>Model of balancing test</u> The defendant states that all these balancing tests scored less than 30 on the model that they used, which means legitimate interest can be used as a legal basis. The DPA holds that this is purely instrumental and no legal value can be given to a model. <u>Legal basis for transfer to third parties</u> The defendant claims that transfers to third parties is not a processing purpose, but a form of processing within the meaning of [[Article 4 GDPR#2|Article 4(2)]]. The DPA states according to [[Article 5 GDPR#1a|Article 5(1)(a)]], personal data must be processed processed for a specific purpose and the processing must be legitimate within the meaning of [[Article 6 GDPR#1|Article 6(1)]]. It is possible to do multiple processing for the same purpose, but this must be done in compliance with the above. As the defendant is not able to state a specific and separate purpose for the transfer to a third party, and in light of the transparency principle within the meaning of [[Article 13 GDPR#1c|Article 13(1)(c)]], there is a breach of the GDPR. <u>Transparency principle</u> Notwithstanding [[Article 13 GDPR#1d|Article 13(1)(d)]] regarding transparency of its legitimate interests, the defendant claims that they fulfilled the requirements by merely stating in the privacy notice that the personal data will be processed based on its legitimate interest without indicating what those interests are. Those legitimate interest are not public as they contain company sensitive information and the documents are very 'heavy', not suited for a privacy notice. As the defendant is not able to state a specific and separate purpose for the transfer to a third party, and in light of the transparency principle within the meaning of [[Article 13 GDPR#1d|Article 13(1)(d)]], there is a breach of the GDPR. And even if the defendant does not want to share sensitive information, they must at least provide more information to its data subjects in a clear and transparent way. Sharing company sensitive or 'heavy' documents on their own is not required for this. Based on the above, the first decision, and the appeal, the fine for the insurance company is reduced to €30.000 (from €50.000)
How does GDPR call the entity who controls the means of processing personal data?
Retrieved from "https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_57/2021"