FOD Financiën – Dismissed (Belgium, 2022)

The controller is the Belgian tax authority (Algemene Administratie van de Bijzondere Belastinginspectie). The complainant provides tax advice services. The data subjects are (1) the complainant (hereinafter: Tax Advisor) and its (2) customers (hereinafter: Customers). The Tax Advisor was involved in a criminal investigation into tax fraud, forgery of documents, and the use of false documents. The investigation was still pending when the DPA issued the decision. The controller used the Tax Advisor’s criminal records for an investigation into tax evasion of his Customers. These documents only contained personal data of the Customers. The controller’s notice to the Customers of the investigation contained the Tax Advisor’s personal data (full name; address; data of birth). The Tax Advisor issued a complaint with the DPA for unlawful processing of personal data. He stated that it damaged his reputation and breached his clients' confidentiality, which cost him customers. Regarding the data from his criminal records, the Tax Advisor stated that it did relate to him because (1) he processed it in the context of his independent professional activity and (2) it was obtained from his criminal records. He further argued that customer data is covered by professional secrecy and thus cannot be processed for tax purposes. The controller stated that the notice to the Customers, on its own, did not fall under the definition of 'filing system' under Article 4(6). Therefore the GDPR was not applicable. The DPA noted that a complaint by someone other than the data subject can be admissible if they have a sufficient interest (Article 58 WOG). Sufficient interest is present if the complainant's interest in some way relates to the interest of the data subjects (mere commercial interest is not enough). The DPA found that the Tax Advisor's interest was purely commercial and thus, not sufficient. The DPA also disregarded the Tax Adviser's argument that the data obtained from hi