The Belgian supervisory authority (APD) recently decided that the information about teachers’ participation in a strike is not a special category of data, because it does not amount to data about trade union membership.
In the same decision 49/2023, dated 28 April 2023, the APD explained that, when the legal basis for the processing of personal data is the performance of a task carried out in the public interest and such processing has to have a basis laid down by law, the notion of “law” may include, beyond legislative acts adopted by a parliament, other types of acts, such as governmental decrees.
The APD examined a case in which the management of a school in Belgium informed several hundred parents about the names of the teachers who would participate in a strike and for that reason would not attend a scheduled parents’ meeting. The APD decided that the school processed the teachers’ personal data without a legal basis.
The legal basis invoked by the school – processing is necessary for the performance of a task carried out in the public interest (article 6.1(e) of the GDPR) – was not available because the disclosure of information about the teachers’ participation in the strike was not necessary to achieve the purpose of the processing. The purpose was to inform the parents about which teachers would not attend the parents’ meeting so that another time for meeting the absent teachers would have to be agreed. To achieve the purpose of such notification, it sufficed to mention the absence of certain teachers, without specifying the reason for absence.
“Person on strike” is not a special category of data
The teachers claimed in the complaint to the APD that the school, in the said way, disclosed personal data about the teachers’ trade union membership, a special category of data under GDPR Article 9.
The school argued in the proceedings before the APD that Article 9 should be interpreted restrictively. Because a strike can occur without union intervention, the information that an individual is on strike is not the same as stating that the individual is a union member.
The APD did not accept the school’s invitation to interpret Article 9 of the GDPR restrictively. On the contrary, the APD pointed to a recent judgment by the Court of Justice of the EU (“CJEU“) in which the Court stated that the objective of the GDPR supports a broad interpretation of the concept of “special categories of personal data”. A broad interpretation guarantees a high level of protection of the fundamental rights and freedoms of natural persons, in particular their privacy (OT v Vyriausioji tarnybines etikos komisija, Case C-184/20, judgment of 1 August 2022, para. 125).
Even with a broad interpretation of the concept of “special categories of data”, however, it is not possible to consider that the status of a person on strike reveals, even indirectly, trade union membership within the meaning of Article 9.1 of the GDPR. This is different from the situation analysed in the CJEU case OT v Vyriausioji tarnybines etikos komisija, where at issue was the publication online of the information disclosing the names of the individual’s “spouse, cohabitee, or partner”. The name-specific data relating to the spouse, cohabitee, or partner made it possible to infer a conclusion about the sex life or sexual orientation of the individual and their partner.
“Person on strike” is data “of a highly personal nature”
In the continuation of its analysis, the APD concluded that the information about the person’s participation in a strike, while not amounting to a special category of data within the meaning of GDPR Article 9, is “special” in a colloquial sense, i.e. it is a data “of a highly personal nature” as the concept was developed by the European Data Protection Board (“EDPB“).
Processing of personal data of a highly personal nature increases the possible risk to the rights and freedoms of individuals. In the Guidelines on Data Protection Impact Assessment (2017), the EDPB provided three rationales for considering personal data as data of a highly personal nature: the data is linked to household and private activities; the processing of the data impacts the exercise of a fundamental right; or the processing (if unlawful) clearly involves serious impacts in the data subject’s daily life (pp. 9-10). The APD did not specify which of the three potential rationales apply to the classification of participation in a strike as data of a highly personal nature.
“Law” is not restricted to a legislative act adopted by a parliament
In deciding whether the processing by the school was necessary for the performance of a task carried out in the public interest (Article 6.1(e) of the GDPR), the APD had to determine whether there was Belgian law to which the school would be subject and that would lay down a basis for the processing. The APD concluded that the law did exist, in the form of two decrees concerning education in the French-language schools in Belgium.
Inquiry into whether applicable law lays down a basis for the processing is necessary for Article 6.1(e) to be applicable. This is so because Article 6.3 of the GDPR stipulates that the basis for the processing referred to in Article 6.1(e) must be laid down by Union law or Member State law to which the controller is subject.
In this specific case, two decrees governed the exercise of a school’s teaching mission, including communication with the parents of pupils. One decree (from 1997) provided for schools’ “partnership and collaboration with parents of the school’s students”. Another decree (from 2007) provided that the profile of a school director necessarily included a responsibility in terms of communication internally and externally, in particular with parents. The organization of a parents’ meeting, in turn, requires that the parents be informed of where and when they can meet the teachers.
APD’s reliance on governmental decrees, as the “law” within the meaning of Article 6.3 of the GDPR is in line with Recital 41 of the Regulation: “Where this Regulation refers to a legal basis or a legislative measure, this does not necessarily require a legislative act adopted by a parliament, …”.
Comment
APD’s conclusion that “person on strike” is data “of a highly personal nature” but not a “special category of data” is consistent with some earlier pronouncements by European supervisory authorities. However, the reasoning by the Belgian regulator somewhat departs from the reasoning given earlier by the other authorities.
The French supervisory authority, CNIL, ruled at least twice in the past twelve months that geolocation data, while not being a special category of data, are personal data of a highly personal nature. The “highly personal” nature stemmed from the fact that geolocation data may reveal sensitive information such as religion, through locating the place of worship, or sexual orientation, through locating places frequented by the user” (decision against Ubeeqo International, car rental service provider, presented on this blog in August 2022; also, the decision against Cityscoot, electric scooter rental service provider, presented on this blog in April 2023). CNIL simply applied the reasoning and wording by the EDPB, that data controllers who collect location data “may possibly reveal sensitive information such as religion through the place of worship, or sexual orientation through the places visited” (Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications, 9 March 2021, para. 63).
The APD considered the information about the teachers’ participation in a strike as data of a highly personal nature. In contrast to CNIL and EDPB, the Belgian regulator did not suggest that the information may reveal some special category of data (trade union membership, in the instance). On the contrary, the APD emphasized that the information about a “person on strike” does not reveal, even indirectly, trade union membership.
It is not obvious, however, that the fact of an individual parking a scooter in front of a gay bear may reveal that person’s sexual orientation more than the fact of an individual participating in a strike may reveal that person’s trade union membership. The criteria for classifying some information as being of “a highly personal nature” appear to need further brushing up.
APD’s elucidation of the Article 6.3 requirement, that the basis for the processing referred to in Article 6.1(e) must be laid down by law, is helpful as a reminder that the concept of “law” is broader than that of a “statute”. The broad interpretation of “law”, confirmed by the APD, expands the range of potential bases for lawful processing on the part of data controllers. The data controllers operating in Serbia should keep this in mind, because the analogous provision in the Serbian Data Protection Act (Article 14) is worded restrictively, i.e. as if the legal basis for the processing necessary for the performance of a task carried out in the public interest must be law as a legislative act adopted by a parliament. The wording of the relevant provision in the Serbian law is most likely a result of imprecise translation, made in the process of enacting the Serbian Data Protection Act based on the GDPR, rather than a deliberate departure from the substance of the GDPR provision.
“[Note: Serbian Data Protection Act mirrors the provisions of GDPR. The decisions of supervisory authorities and courts in EU and EFTA member states may therefore serve as an instructive guidance for compliance with local regulations.]
