Court case 2021/AR/163 – Court Ruling (Belgium, 2021)

A bailiff’s office dealing with debt recovery for parking tickets on behalf of the city requested the driver to fill in a form with personal data. The driver filed a complaint for violation of access right (Article 15), obligation to inform (Article 12), proportionality principle and illegal reuse of their data (Article 5 and 6), and minimisation principle. The Belgian Data Protection Authority considered that the form did not comply with the GDPR, and therefore issued a decision in which it reprimanded the bailiff’s office, ordered it to change its processes to comply with the GDPR and to pay a fine. The bailiff’s office, disagreeing with the decision, appealed it before the Court of Appeal. The Court confirmed its powers in accordance with Article 78 GPDR: the Court can annul and even adopt a new decision in so far as all facts and legal issues were already discussed in front of the APD. The Court can do so in case of a manifest factual or legal error by the APD. The Court confirmed the violations already noted by the Belgian DPA. However, the Court of Appeal annulled the fine (and only the fine) on the grounds that the Litigation Chamber abused its powers when inflicting an administrative fine. According to the Court, the Data Protection Authority should consider the full range of sanctions at its disposal before issuing a fine, and only impose a fine on organisations/people who do not comply with its injunctions. Inflicting an administrative fine as from the first offence was deemed contrary to the proportionality principle, which implies that the sanction must be proportionate to the infringement. In this regard, the Court noted that the DPA confirmed that the violation was not intentional and that the form with the requested personal data at stake was not sent back by the complainant. Therefore, the Court of Appeal annuls the fine, and considers that the DPA should have instead used other corrective powers. The remaining parts of the Belgian DPA 's dec