DPA case 64/2025 – Dismissed (Belgium, 2025)

The data subject worked at a hospital. On 2 March 2020, their manager consulted the data subject’s medical file, outside working hours, to check their capacity to receive the news of their termination. The hospital acted as the data controller for the medical files. On 3 March 2020, the data subject was been dismissed. On 16 April 2020, the employer informed the data subject that their file has been consulted by their manager on the 2 March 2020. On 22 April 2020, the data subject lodged a complaint to the DPA regarding the dismissal decision. From the 4 June 2020 to the 11 February 2025, the DPA carried out the proceedings and heard the participants. The DPA dismissed the complaint due to the following reasons. Identification of the controller The DPA recalls that the controller is defined as the entity who determines the purpose and means of the data processing (Article 4.7 GDPR). The DPA clarifies that when an organization’s employee processes data, the processing is typically considered as directed under the organization’s authority. But in this case, the manager unlawfully exceeding the powers given to them by defining the purpose of the processing on his own. For this reason, the DPA considered the manager as the sole only controller. Notification of the violation to the DPA The DPA reminds that the controller must notify the authority of any violation, except if the violation is not likely to create a risk for rights and freedom of the data subject (Article 33.1 GDPR). The DPA underlines that even in case of doubt, or if the controller can’t be sure of the absence of such a risk, the controller must notify the authority. Also, the DPA recalls that a risk can be found in the circumstances of a loss of confidentiality, especially when the data were protected by professional secrecy and reveal the health status of the data subject Recital 75 GDPR. After recalling these legal provisions, the DPA points out that even if the employer is not the controller