DPA case 15/2023 – Complaint Upheld (Belgium, 2023)

The controller was a public authority and the data subject was its employee. The data subject used a company car which the controller was tracking with a GPS. At some point in the past, the data subject received a fraud report from the employer. The report showed that the car (and therefore the employee) stopped at certain addresses during working hours such as the employee's mother, a bar and some random streets. On 31 March 2021, the data subject submitted a complaint explaining that he was not informed about the GPS tracking before receiving the report, nor was it included in the privacy policy. Following the complaint, the DPA investigated and the Investigation Service issued a report which concluded that the controller breached the GDPR in several ways. The controller did not refute this and in the meantime, implemented new compliance measures. Regarding the legal basis for the processing, the DPA firstly stipulated that the controller relied on legitimate interest under Article 6(1)(f) GDPR, which could not be relied upon by a public authority in the performance of its tasks according to Article 6(1). The DPA secondly assessed if the processing was necessary for the performance of a legal obligation under Article 6(1)(c) GDPR. The DPA held that under national law, public authorities only possess competences formally assigned to them by law. This implies that a public authority may only process personal data if this is necessary for a task it is legally obliged to fulfill. Article 6(1)(c) could therefore not be considered as a legal basis. Thirdly (and finally), the DPA analysed if the controller could rely on Article 6(1)(e) GDPR as a legal basis. For it to be possible, the GPS tracking had to be necessary and directly related to the performance of a task in the public interest. The DPA considered that this should be interpreted in a broad way. It held that the efficient use of scarce government resources by checking the time tables of employees and t