X (the data subject) – Complaint Upheld (Belgium, 2022)

A service provider (controller) published an invoice on its Facebook page which contained the data subject's first, last name, and address. Although it was not clearly specified in this preliminary decision, it seemed like there was a dispute between the data subject and the controller regarding payment(s), where the controller published the invoice to illustrate the tariffs it applied. The data subject filed, among the others, a complaint with the local police office claiming GDPR violations. Following this, the controller only removed the postal address on the invoice, but did not delete the last name and first name. The controller also blocked the data subject from accessing the Facebook page of the controller. On 19 July 2022, the data subject filed a complaint with the Belgian DPA to raise the refusal of the controller to comply with her erasure request. The DPA stated that an invoice obliges the controller to collect certain basic information about the data subject. The invoice has to include first names, surnames, e-mail, billing address, delivery address as well as the content of the purchases and/or the service (Article 4(1) GDPR). It also stated that the controller was a service provider and had to comply with requests made by data subjects under Articles 15 to 22 GDPR. The DPA also determined that even after the data subject previous complaint, one at the police and one at the Conseil Régional Francophone, the first name and last name of the data subject were still visible on the Facebook page on 3 October 2022. The invoice itself was still published on the controller’s Facebook page. The name of the data subject also still appeared in some of controller’s commentary included with this Facebook post. The DPA considered that for the processing in question (the publication of the invoice with the name of the data subject) the controller did not meet any of the conditions for lawfulness of processing (Article 6 GDPR). For the sake of completeness, the DPA examined whether the processing could have been based on ‘Legitimate interest (Article 6(1)(f) GDPR), The controller needed to meet 3 cumulative conditions to use this legal basis: the pursuit of a legitimate interest by the controller or by the third party or parties to whom the data are disclosed, the necessity of the processing of personal data for the fulfilment of the legitimate interest pursued and the condition that the fundamental rights and freedoms of the data subject do not prevail (balancing test). Firstly, the DPA determined that the publication of a price list of the controller’s services (in the form of an invoice) could be considered a legitimate interest for reasons of price-transparency and a way to gain customers' trust. Secondly, the processing (publication) was not considered necessary to reach the purpose. The DPA stated that for this necessity test, it had to be analysed whether the same result could be achieved by other means, without processing personal data at all or without unnecessary substantial processing. In this case, the processing only helped in labelling the data subject as someone who did not fulfil her financial obligations, which was also an attack on her person and dignity in the event of a dispute. It did not offer any added value for the purpose of price transparency. This purpose could also have been achieved without publishing an invoice with personal data. Instead, a brochure or a leaflet could have been published. Thirdly, the DPA held that for the balancing test, the reasonable expectations of the data subject should have been taken into account regarding the processing of personal data for a particular purpose. (Recital 47 GDPR) The DPA stated that the data subject could not have foreseen the controller posting her invoice with her personal information on Facebook. The controller also did not ask for consent to publish the invoice on Facebook (Article 6(1)(a) GDPR). The controller therefore failed the balancing test. The DPA held that the controller could not rely on legitimate interest (Article 6(1)(f) GDPR) and stated that the controller did not seem to comply with Article 6 GDPR. The controller was obliged to the delete the personal data of the data subject as soon as possible (Article 17(1) GDPR). The DPA also determined that the controller seemed to fail to comply with Article 24 GDPR, because it had published the invoice to illustrate the tariffs it applied and/or to settle a dispute. This did not seem to ensure that processing was carried out in compliance with the GDPR and other data protection laws. Thus, the DPA held that the controller seemed to fail to comply with Articles 12(3) and 12(4) and 17(1) GDPR and ordered the controller to comply with the data subject’s request to data erasure (Article 95(1)(5) LCA). The DPA also issued a warning (pursuant to Article 95(1)(4) LCA and Article 58(2)(a) GDPR) for the controller because it seemed to fail to comply with Articles 6 and 24 GDPR. The DPA warned the controller to respect data subject requests in the future. The DPA also emphasised that this was a prima facie decision and part of the procedure prior to the decision on the merits.