DPA case 14/2023 – Complaint Upheld (Belgium, 2023)

The controller, a public authority, was the former employer of the data subject. The controller announced on his intranet that the data subject's contract was terminated by the controller, and with immediate effect. This intranet was accessible to 428 people. The data subject therefore lodged a complaint with the Belgian DPA. The DPA noted that a distinction should be made between (i) announcing the contract termination to the rest of the staff and (ii) clarifying the reasons of such termination. The DPA examined whether each of the elements relied on a legal basis (Article 5(1)(a) and 6(1) GDPR) and whether the minimisation principle was respected (Article 5(1)(c)). Regarding the first part of the assessment, (i), the DPA considered that, under Article 6(1)(b), it is appropriate to inform employees of changes in the staff. Making information about employees available to staff facilitates exchanges between colleagues. The DPA therefore considered that the publication of staff changes on the intranet was legitimate under Article 6(1)(b). The Belgian DPA, however, also analysed the second part of the message sent by the controller, (ii), in which the latter clarified or at least hinted at the reasons that had led to the dismissal. In particular, the controller had not only announced that the data subject was no longer an employee, but had also specified that the dismissal had taken place with 'immediate effect' and at the 'initiative of the controller'. This message carries an implied, underlying and sensitive meaning, which is a probable serious misconduct by the former employee. The DPA therefore assessed whether this additional information (i.e. processing) was necessary. The authority started its analysis by taking into account Article 6(1)(e), under which the processing carried out in the public interest must be necessary for the performance of that task. The DPA concluded that the second part of the message was not necessary to fulfil a public interest, th