DPA case 110/2023 – Dismissed (Belgium, 2023)

On 15 June 2018, a complaint was brought jointly by two data subjects, employed at a municipal school as teachers, against the municipal authority which acted as the governing body of the school. The complaint concerned two alleged infringements of the GDPR: # The publication of a series of Board reports on the school's online platform on 23 November 2017. The reports contained incriminating statements made against the first data subject. # The publication of the results of a student survey concerning the second data subject. This survey was published on the school's platform on 22 January 2018. Both the reports and the survey were removed from the online platform before the data subject's had filed the complaint. The reports were taken down on 9 May 2018, and the survey was removed on the same day as its publication (22 January 2018). On 4 July 2018, the complaint was declared admissible by the Belgian DPA and a formal investigation of the matter was commenced on 11 October 2019. The DPA issued a dismissal of the orginial complaint as the processing (the publishing and removing of the reports and survey) took place prior to the GDPR's entry into force on 25 May 2018. However, the DPA found several violations outside of the scope of the complaint. Firstly, prior to assessing the violations, the DPA clarified the data processing roles of the school and the municipality. In particulary, the Belgian DPA found that the municipal body was the controller for the purposes of Article 4(7) GDPR, as the management of the school was under the administrative authority of the municipality. The DPA acknowledged that the school held high levels of autonomous decision-making powers regarding educational decisions, but adopted the EDPB's reading of Article 4(7) GDPR. The EDPB on this matter, notes that "an organisation can still be the controller even if it does not make all the decisions about the ends and the means." Secondly, the DPA found a breach of Article 37 GDPR. As a