DPA case 124/2021 – Dismissed (Belgium, 2021)

Complainants X1 and X2 filed a complaint against a controller (the Defendant) regarding the disclosure to third parties of personal data concerning tenants of social housing in the context of an asset investigation. According to the Complainants, the Defendant did not have any valid legal basis to disclose such data (i.e. breach of Article 6 GDPR), and had failed to properly inform the Complainants about the processing activity (i.e. breach of Article 13 GDPR). After these complaints were declared admissible, the Belgian DPA conducted an investigation at the premises of the Defendant. During the investigation, five additional breaches against data protection principles were discovered. The Defendant stated that the processing it carried out formed part of the legal framework for social housing and that the legal basis for the processing, namely the consent of the Complainants, was expressly included in the Flemish regulations governing the social housing system. = The processing operations in casu all took place before the GDPR became applicable, except for the period that was granted to the Complainants to leave the house. This period expired on 31 October 2021. In previous decisions, the Belgian DPA had already stated that it can only be competent for data processing operations which, although having started before 25 May 2018, still continued after that date, but not for one-off or multiple processing operations which exclusively took place before 25 May 2018. On the basis of these considerations, the Belgian DPA considers itself incompetent ratione temporis to review the merits of the complaints, given that the contested processing operations had been carried out before the GDPR had become applicable. Therefore, the Belgian DPA decided to dismiss the complaints in accordance with the terms of the its dismissal policy. = Despite the complaints being dismissed, the Belgian DPA provided guidance on the legal basis of the processing operations. The Belgian DPA s