Belgium's DPA Tightens Rules On Sharing Personal Data At Work

The Belgian Data Protection Authority recently ruled on a complaint after an employer shared a full court judgment with all its staff, revealing the personal data of employees and trade unions involved in the case. Below we outline what happened, the DPA's findings, and the key lessons for employers.

The complaint

In 2014, two trade unions and several employees initiated proceedings against the employer concerning the legality of a part of its remuneration system. The employer won on appeal and shared the full judgment internally with all its employees by e-mail. The majority of the employees were placed in blind-copy (Bcc), making it impossible to see who had received the e-mail. However, the judgment was neither anonymised nor pseudonymised, revealing the names and addresses of the employees involved in the case to all recipients. One of them was an employees' representative (also an employee of the company).

The employee representative served the employer with a notice and demanded compensation for the moral and professional damage she claimed to have suffered as a result of the disclosure of the judgment. According to the employee, colleagues turned against her and there was a risk of physical injury because her home address had been disclosed and because she had previously received threats at work. After the employer disputed any infringement and refused to pay compensation, the employee filed a complaint with the DPA for unlawful processing of her personal data.

The DPA's findings

• No abuse of the right to file a complaint – The fact that the employee waited 18 months to file the complaint was not found to be an abuse of rights (as argued by the employer). The DPA found that she was entitled to take other steps before filing a complaint.
• No processing of special categories of personal data – The employee claimed that there had been unlawful processing of personal data revealing her trade union membership. The processing of personal data revealing trade union membership is in principle prohibited, unless one of the exceptions provided for in the GDPR can be invoked, such as the explicit consent of the person concerned or a legal obligation. In this case, there was no consent, no legal obligation or any other exception that justified sharing the judgment with all employees. Nevertheless, the DPA ruled that there had been no processing of a special category of personal data. The employee had filed the claim in her own name and in the judgment she was not described as an employees' representative, but only as an employee. According to the DPA, the fact that some recipients of the e-mail containing the judgment were aware of her capacity does not alter this.
• Excessive and unlawful processing– The DPA then assessed whether the employer could invoke its legitimate interest in sharing the judgment with all employees. In its analysis, the DPA applied the so-called three-step test. First, on the purpose test, the DPA found that the employer had a legitimate interest in informing its employees about the outcome of the proceedings. These proceedings concerned the remuneration system applicable to some of its employees, could have consequences for the financial health and survival of the company, and had created a tense working atmosphere among the staff. Turning to the necessity test however, the DPA found that it was not necessary for employees to know who had filed the claim in order to achieve the above objective, and the employee's address should not have been mentioned. Since the necessity test was not met, the DPA did not proceed to the balancing test and ruled that the processing was unlawful.
• Use of blind copy is not necessarily improper – The employee claimed that the employer's use of Bcc prevented her from determining who had received her data, which she claimed was a violation of the principle of propriety. The DPA found no unfair conduct but suggested exploring better communication methods, such as providing professional email addresses. It also noted some further breaches of transparency and information obligations

Outcome

The DPA decided to reprimand the employer for the infringements identified and dismissed the complaint insofar as it related to the processing of trade union data and an infringement of the principle of propriety.

Takeaway for employers

Employers are allowed to inform employees about matters that may concern them, including the outcome of legal proceedings. However, if this communication contains personal data relating to other individuals, the employer must carefully assess whether it is necessary to disclose this information. If this is not the case, the employer must take appropriate measures to protect the rights of the individuals concerned. This can be achieved, in the case of circulating a judgment for example, by sharing only a summary of the decision or by anonymising the document.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.