DPA case 149/2022 – Complaint Upheld (Belgium, 2022)

Two data subjects submitted complaints at the Belgian DPA, stating that their personal data was unlawfully processed by a social housing organisation. The controller was responsible for verifying the eligibility criteria for social housing and was suspecting that the data subjects did not qualify for social housing, after they failed to provide clarity regarding their assets in Turkey. The controller initiated an investigation into these assets. It hired a processor, a private investigation firm, to check personal data of the data subjects. This processor also used a processor of its own, which was located in Turkey. Following the investigation, the controller determined that the data subjects did not qualify for social housing in Belgium, because they owned sufficient assets in Turkey. After the data subjects submitted their complaint, the DPA also initiated an investigation. The investigation unit of the DPA (investigation unit) determined that the controller breached several GDPR Articles. The data subjects stated that they were not the owners of the assets in question. They also contested the value of evidence in the reports and stated that the evidence was received illegitimately. The district court of Lier already delivered a judgement in a case between the controller and the data subjects, which was about the termination of the rental contract. In this ruling, the district Court held amongst other things that the controller could use Article 6(1)(e) GDPR for conducting the investigation into the foreign assets. It also determined that the controller had send letters to the data subjects which remained unanswered. Violations of Article 5(1)(a) GDPR and Article 6(1) GDPR The DPA held that the controller did not violate Article 5(1)(a) GDPR and Article 6(1) GDPR. The DPA stated that in order to lawfully process personal data (Article 5(1)(a) GDPR), the controller needed a legal basis for processing (Article 6(1) GDPR). The investigation unit determined t