DPA case 28/2024 – Dismissed (Belgium, 2024)

The data subject was an employee of a school and was absent for long periods of time in 2021-2022 for medical reasons. The data subject returned to work since April 2022. On 12 May 2023, the data subject filed a complaint with the Belgian DPA (“APD”) regarding two people: the complaint concerned, on the one hand, the theft of the data subject’s personnel file with the intention of copying and disseminating such data, and on the other hand, suspicions of failure to safeguard the confidentiality and integrity of the complainant’s personnel file. Regarding the alleged theft of personal data, it relied on the fact that a colleague of the data subject stated in writing that one of the defendants told the colleague that she was going to take the data subject’s file to go through it again and take any copies. Regarding the failure to safeguard the confidentiality and integrity of the personnel file, it relied on the fact that in October 2022, the data subject asked for access to her file in general terms, without specifying what she was looking for. In November 2022, she clarified that she was looking for “personal reports made by her directors over the years, medical info…”. She then added that she was also looking for “medical reports as well as correspondence regarding employment” from 2020-2022. In March 2023, the data subject clarified that medical information regarding her medical absence, documentation and communication regarding her return to work and evaluation reports from 2020 were missing from the personnel file. Concerning the failure to safeguard the confidentiality and integrity of the data subject’s file, firstly, the APD proceeded with a policy dismissal as they found that the data subject did not provide evidence which allowed the DPA to decide whether or not there has been a breach of the GDPR under Article 32 GDPR. Secondly, the APD held that regarding each document, the data subject did not provide evidence that the controller was in possession of