DPA case 62/2023 – Order (Belgium, 2023)

There were four parties in this case: the data subject who applied for a new job, his ex-employer who fired him, the new employer where the data subject applied for a job and a recruitment agency tasked with the recruitment for the new employer. When the data subject applied for a new job, the recruitment agency contacted the ex-employer to ask for references. The ex-employer provided negative references. This resulted in the new employer not wanting to hire the data subject and the recruitment agency ceasing all contact with him. The data subject was informed about this negative reference and also reached out to the new employer and recruitment agency to resolve the matter amicably. He did not receive a response and thus went to the DPA to complain about his personal data being processed without the required legal basis, his consent. The Belgian DPA clarified that it possesses the competence to dismiss a complaint under article 95, §1, 3° Law creating the Data Protection Authority. For this case, the DPA motivated its dismissal based on two reasons: First, the DPA found that the data subject did sufficiently prove a breach of the GDPR or any data protection legislation. There was no concrete proof of the allegations such as supporting documents. A presented screenshot of a text message did not suffice to prove the authenticity of the allegations, nor did it provide compelling evidence. Second, the DPA dismissed the case based on opportunity reasons. The complaint did not meet the threshold of general or elevated personal impact. The DPA clarified that the resources required to conduct additional research for evidence purposes would be disproportionately large and not an efficient usage of the limited resources available.