DPA case 79/2023 – Complaint Upheld (Belgium, 2023)

The data subject was a psychiatrist. At a meeting of the association of psychiatrists (controller), doubts were expressed as to the legitimacy of the data subject to practise as a psychiatrist and the controller decided to verify the data subject’s diploma. This information was recorded in the minutes of the meeting which were published in May 2018. The data subject contacted the controller to request access and rectification of his data under Articles 15 and 16 GDPR. He considered that these data were publicly accessible since the publication of the minutes and requested the controller to publish a message to rectify them on the basis of the accuracy principle (Article 5(1)(d) GDPR). The controller didn’t follow up on this request, which led the data subject to lodge a complaint with the Belgian DPA. The DPA recalled that the application of Article 16 GDPR requires inaccurate data. In this case, the DPA considered that the subjective statements made in the minutes do not imply the processing of inaccurate data if these statements are consistent with what was said during the meeting. In view of the purpose of the processing, i.e. to provide a written minute of what was said at the meeting, the data is accurate and therefore doesn’t fall within the scope of Article 16 GDPR. Article 16 GDPR also provides a right to have incomplete data completed. In this case, the DPA considered that in view of the purpose of the processing, the data was complete. The right to have data completed is indeed not intended to enable the data subject to express disagreement with the statements made and faithfully recorded. In view of the above, the DPA considered that the controller did not violate Article 16 GDPR. However, by not following up on the request of the data subject, the controller violated Article 12(3) and (4) GDPR. The DPA therefore issued a warning for these articles.