Sanction on a public centre for social welfare (PCSW) for unlawfully collecting a disproportionate amount of personal data

Background information

• Date of final decision: 27 July 2022
• Cross-border case or national case: National case    
• Controller: Public Centre for Social Welfare    
• Legal Reference: Lawfulness (Article 6), Purpose limitation (Article 5.1.b), Data Minimisation (Article 5.1.c)
• Decision:  Infringement of the GDPR; Reprimand; Order to bring the processing operations into compliance with the GDPR
• Key words: Lawfulness; Purpose limitation; Data Minimisation; Excessive collection of personal data  

Summary of the Decision

Origin of the case

Litigation Chamber of the Belgian Supervisory Authority (SA) was appointed as administrator of Mrs. X in October 2020. In the context of her admission to a residential care centre, Mrs. X was found by the administration to be lacking sufficient financial resources and therefore, in accordance with the internal rules between the residential care centre and the PCSW Y, required to obtain a financial guarantee from the latter.
Despite repeated claims by the administrator that Mrs. X had enough financial incomes to be admitted without obtaining a financial guarantee, the PCSW Y argued on the contrary that it had a legal obligation to subject Mrs. Y to an extensive social and financial investigation prior to granting any guarantee.
The administrator L.C. nonetheless challenged the necessity to conduct such an investigation, finding that the legal obligation did not apply, and eventually filed a complaint with the Belgian SA for the unlawful collection of a disproportionate amount of personal data.

Key Findings

In its written submissions before the Litigation Chamber of the Belgian SA, the defendant invoked its prerogative to carry out a thorough social and financial investigation regarding individuals who request a financial guarantee, as foreseen by Article 60 of the PCSW Act of 1976.
Moreover, the defendant argued that the administrator of the plaintiff reached out to the PCSW on its own volition to ask for a financial guarantee, irrespective of any agreement between the defendant and the residential care centre, and that the defendant was legally obligated to carry the investigation as a result of the administrator’s request.
More specifically, the defendant claimed that it was neither responsible nor competent for assessing whether a request for a financial guarantee was justified or legitimate, and contested that it retained any margin of appreciation with regard to the actual necessity of the social and financial investigation, once it had been seized by such a request.

Decision

The Litigation Chamber of the Belgian SA ruled that the PCSW Y had failed to evaluate the need for such an investigation prior to the mandatory data collection, and had therefore breached the principles of lawfulness, purpose limitation and data minimisation.
While it took note of the fact that the controller could legitimately invoke article 60 of the PCSW Act as legal ground for collecting and processing personal data related to the social and financial situation of the plaintiff, the Litigation Chamber nevertheless considered that the controller had failed to assess the actual necessity of the aforementioned data collection in light of the concrete circumstances of the case, before conducting the investigation.
The Litigation Chamber of the of the Belgian SA issued a reprimand and imposed on the controller to bring the processing operation into compliance with the GDPR by no longer requiring the conduct of a social and financial investigations without duly considering and establishing the necessity thereof beforehand.

For further information: national decision (NL)