Insurance company – Court Ruling (Belgium, 2020)

This decision is an appeal of decision 24/2020, where a customer (the data subject) of an insureance company (the controller) claimed that its health data was used for a purpose to which he did not explicitly agree by the controller. The DPA upheld the complaint and stated that there was a lack of transparancy in the controller's privacy policy as it did not demontrate any legitimate interest. Therefore the controller violated Article 5(1)(a) and (2), Article 6(1), Article 12(1), Article 13(1)(b) and (c) GDPR. The DPA imposed a fine of €50.000. The controller appealed the decision of the DPA at the Court of Appeal of Brussels and raised the following pleas: # The decision was void because of a lack of reasoning regarding the legal basis for #* the processing of personal data with regard to the purposes set out in Article 4.3 of its Privacy Statement, and #* the transfers to third parties set out in Article 6 of its Privacy Statement. # It should have been able to rely on its legitimate interests for the processing of personal data for certain purposes and for transfers to third parties. # When it could not rely on its legitimate interests, it should have been able to rely on legal grounds other than the consent. # The decision violates its freedom of enterprise. # The fine was disproportionate. In response the DPA requested the Court to declare the appeal unfounded, as: # the contested decision was properly reasoned in law and in fact. It was based the information available, in view of the active duty of responsibility of the controller. The balancing of interests provided by te controller did not change this. (regarding the controllers's 1st to 4th plea) # the decision did not unlawfully restrict the controller's ability to stop the violations found. The fact that the GBA, based on the information at its disposal, presumed that it was possible to use consent as a legal basis does not affect the lawfulness of the decision. (regarding the controller's 2th and 3th p