DPA case 41/2023 – Dismissed (Belgium, 2023)

The former employer of complainant received an e-mail concerning an invoice to be paid for the complainant for a supplementary pension. Since the employment contract had already ended, the former employer asked the defendant to contact the pension insurance company complementary to understand the reason for issuing the invoice. The insurance company indicates that she was not informed of the end of the contract of work between the complainant and his former employer, and that she therefore issued a new invoice. In this context, the complainant considers that his personal data should not have been sent, as the defendant is not an insurance broker or policyholder. At first instance, the complainant made a request for mediation to the DPA. However, he was not satisfied with the outcome and thus filed a complaint afterwards. In accordance with article 6.1.f GDPR and the case law of the CJEU (arrest '[https://curia.europa.eu/juris/document/document.jsf;jsessionid=2A575E90D7094F88881B7521A78C1936?text=&docid=190322&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=1876300 Rigas]', three cumulative conditions must be fulfilled in order to process personal data based on legitimate interests: a) Purpose criterion: the pursuit of a legitimate interest; b) Necessity criterion: demonstrating the necessity of the processing to achieve the purpose; c) Weighing of interests: the rights and freedoms of the data subject must not override the legitimate interest pursued by the controller Each criterion is briefly discussed below: a) Purpose criterium: the DPA states that the personal data of the complainant were passed on to the insurance company in the context of an assignment entrusted to the defendant by the former employer of the complainant. The first condition is therefore fulfilled. b) Necessity criterion: In order to satisfy the second condition, it must be shown that the same result cannot be achieved by other less intrusive means of processing of personal data The