DPA case 49/2023 – Complaint Upheld (Belgium, 2023)

In March 2022, a school (controller) organised a parents' meeting and informed the parents that some teachers would not be able to attend because they were on strike. In practice, the school sent out a list of teachers and marked them as 'on strike'. Other teachers were absent for other reasons and the school simply added the word "absent" without additional information. A few days after the strike, the union delegation contacted the school management to say that this was inappropriate. The school did not respond to this. Five striking teachers therefore lodged a complaint with the DPA, claiming that the controller had violated Article 9(1) GDPR by disclosing their trade union membership without a legal basis. Alternatively, they considered that the controller had violated Articles 5(1) and 6(1) GDPR. In its defence, the controller explained that the meeting of parents is part of its public interest mission (education) which is a legal basis under Article 6(1)(e) GDPR. It added that calling a teacher a striker did not reveal a trade union membership and that the situation therefore did not fall within the scope of Article 9 GDPR. However, the controller acknowledged that the use of the term striker should have been avoided. It added that this was a human error and that it was taking steps to avoid similar errors in the future. The DPA joined the complaints and began by examining whether or not the term "striker" fell within the scope of Article 9(1) GDPR. To be covered by this article, the reference must reveal trade union membership. The DPA referred to the English and Dutch versions of the GDPR and considered that being a striker does not reveal trade union membership within the meaning of Article 9(1) GDPR. On the other hand, the DPA considered that the qualification of "striker" could constitute "highly personal" data within the meaning of the [https://www.documentcloud.org/documents/4109562-20171013-wp248-rev01-Enpdf-Final-Guidelines-DPIA EDPB guidelines