DPA case DOS-2020-00200 – Complaint Upheld (Belgium, 2023)

A college (the controller) dismissed one of its teachers after a student had alleged that they had committed a physical assault against them. Following an internal investigation, the lecturer was dismissed for urgent cause. The college's board informed its staff and the lecturer's students of the dismissal and its reasons in March 2019: This [dismissal] follows physical aggression towards one of the students [...] a thorough investigation has shown that this incident makes any further functioning of [complainant's name] as an employee of [controller] impossible'. In January 20202, the teacher lodged a complaint with the Belgian DPA. The Belgian DPA held that the emails were unlawful and reprimanded the college. To send them, the controller had relied on Article 6(1)(f) GDPR. The Belgian DPA refuted validity of such legal ground. In reaching its conclusion, the Belgian DPA applied the following three-step test to determine legitimate interest, as outlined by the CJEU in Case C-13/16, Rīgas satiksme (§ 28). First, the purpose test. The Belgian DPA confirmed that the mere fact that the lecturer has been dismissed for cause justifies the need for an immediate and legitimate need to communicate this to students and colleagues. Second, the necessity test. Some of the emails had been sent to students who were no longer enrolled. In this respect, the Belgian DPA argued that the communication was not necessary and found a breach of Article 6(1)(f) GDPR. For the emails to current students and colleagues, the Belgian DPA found that there was no need to communicate the reason for dismissal: physical aggression'. The Belgian DPA did acknowledged that there may be situations where it is necessary to state the reason for dismissal. However, in this instance, this was not the case. Third, the balancing test. Finally, the Belgian DPA found that the balancing test was not respected. The Belgian DPA concluded that the college had failed to adequately consider t