DPA case 69/2024 – Dismissed (Belgium, 2024)

A bank’s employee, an ex-girlfriend of data subject, allegedly consulted data subject's personal data for one and a half of a year. The data subject contacted the bank (controller) twice, claiming that the controller’s employee (his ex-girlfriend) breached the confidentiality of the data, as she consulted the data outside controller's instructions, namely to stalk the data subject. Also, the data subject asked about the measures taken by the controller against the employee. Later on, the data subject decided to file a complaint with the police against his ex-girlfriend on charge of stalking. In response, the controller explained that the employee processed the data subject's data outside of her professional capacity and without controller's instruction. Additionally, the controller, implemented necessary and proportionate measures, as well as reported the breach with the Belgian DPA (APD/GBA). The data subject did not share the views of the controller and, consequently, filed a complaint with the DPA and [https://www.nationaleombudsman.nl/ the National Ombudsman] (Nationale ombudsman), claiming a breach of confidentiality by the controller. The DPA dismissed the data subject's complaint. Firstly, the actions taken by the controller after data subject’s notification were sufficient in the situation at hand. The controller implemented measures which adequately dealt with the breach of confidentiality. As a result, the DPA found no evidence that the measures were ineffective, especially they did not stop the employee from further unlawful conduct. At the same time, the controller acted proactively, preventing similar breaches to occur in the future. Therefore, the subject matter of the case was obsolete. Secondly, the DPA stated the complaint brought by the data subject also covered the criminal offence of stalking. However, the DPA had no jurisdiction over criminal cases of that kind, which made this part of compliant inadmissible.