DPA case DOS-2024-01344 – Complaint Upheld (Belgium, 2025)

On January 19, 2023, the controller’s security officer requested the Belgian National Security Authority (NSA) to extend the security clearance of one of their employees (the data subject), which was rejected by means of a reasoned decision on July 7, 2023 and communicated back to the controller’s security officer. The data subject and the governing body of the controller received the reasoned decision, which was then forwarded to the data subject’s hierarchical superior by the governing body of the controller. This triggered disciplinary investigations of the data subject in connection to allegations of indecent assault on a minor. On March 5, 2024, the data subject filed a complaint with the Belgian Data Protection Authority (APD/GBA) concerning the unlawful processing of their personal data by their employer, the controller. On March 27, 2024, the DPA declared the complaint admissible, leading to the DPA delivering a decision on the substance of the case. The Contentious Chamber found multiple GDPR violations by the controller. Article 5(1)(a) GDPR was breached by processing the NSA's reasoned decision without a valid legal basis, Article 5(1)(b) GDPR by sharing it with unauthorised parties contrary to its originally intended purpose, and Article 5(1)(f) GDPR by failing to ensure confidentiality of the personal data. Since the processing of personal data related to criminal offences, the controller additionally violated Article 10 GDPR. The lack of necessity for processing under both a legal obligation to which the controller is subject and public interest grounds breached Articles 6(1)(c) and 6(1)(e) GDPR. Furthermore, the controller violated Articles 12(1), (3), and (4) GDPR by failing to inform the data subject, delaying access requests, and improperly invoking judicial secrecy, along with Article 15 GDPR for denying a legitimate access request by the data subject. Finally, breaches of Articles 24(1), 25(1), and 32 GDPR were found due to the controlle