DPA case 147/2022 – Complaint Upheld (Belgium, 2022)

The controller was the owner of a ‘vacation park’. The data subject owned one of the apartments in this park. The controller provided a special membership card for the owners of an apartment which included a discount for access to the swimming pool. Family members, limited to a certain degree of kinship, were also allowed to use this card. Several details had to be provided to use the card, such as the name of the card owner, a photo of every user family member using it, and their degree of kinship to the owner. It became clear from the proceedings that fraudulent use of the card had occurred in the past by loaned it to unauthorized third parties to profit from the discount. The controller used two legal grounds for the processing: Article 6(1)(b) GDPR and Article 6(1)(f) GDPR. Article 6(1)(f) GDPR, however, was only recently added as a legal ground. The data subject filed a complaint at the DPA, stating that he wanted to access the pool with a discount without providing the photos of the users of the card and their degree of kinship. The DPA held that the controller could rely on Article 6(1)(b) GDPR to regulate access to its swimming pool. The DPA stated that according to Article 13(1)(c) GDPR, the controller should mention the legal basis and the purpose of the processing to the data subject before it starts processing personal data. The controller had mentioned in the contract with the data subject that it would have the possibility to regulate access to the pool. Therefore, the controller could rely on Article 6(1)(b) GDPR. The DPA did however state that the controller could not rely on Article 6(1)(f) GDPR because this legal ground was added to the privacy policy after the processing had already started. Nevertheless, this finding did not affect the decision since the DPA held that one legal ground was enough for the controller to process personal data. The DPA did however determine that the controller violated Article 5(1)(c) GDPR, stating that personal d