The Litigation Chamber of the Data Protection Authority (DPA) ruled in decision No 35/2020 that an unspecified Belgian disciplinary and judicial authority (“Sports Court”) was entitled to forward a profile photo of Facebook to sports commissioners in order to have a so-called “ban on presence”, meaning that one is not allowed to attend a sporting event, enforced. A brief explanation.
The complainant had lodged a complaint against the Sports Court (first defendant) and the clerk of the Sports Court (second defendant). According to the complainant, the clerk had infringed the GDPR by sendinghis Facebook profile photo by e-mail to the sports commissioners of a forthcoming event and to the organising institution. According to the complainant, this profile photo would not be freely accessible as he applied the strictest privacy settings.
However, the complainant had previously been given a ban on presence for a period of one year by the Sports Court.
The complainant lodged his complaint against the clerk of the Sports Court, whereas according to the Sports Court the clerk acted on behalf of the Sports Court. The clerk must be considered an employee of the Sports Court. Therefore, according to the Litigation Chamber, it is the Sports Court that acts as the controller, not the clerk.
The Litigation Chamber then checks whether this is a processing of personal data. The Sports Court stated that it was not a processing activity, because it was not a so-called structured processing. However, this exclusion of the GDPR only applies to manual processing. In this case, however, it was an automated processing via e-mail and the GDPR therefore continued to apply
Subsequently, the question arises as to which legal basis from the GDPR the Sports Court was allowed to process (i.e. the forwarding to third parties) these personal data (i.e. the profile photo).
First and foremost, the Sports Court had had a bailiff establish that the profile photo was publicly accessible on the complainant's Facebook profile. The complainant, too, now confirmed that “everyone knows that a profile picture is freely accessible” [free translation].
A distinction must then be made between (1) consulting and (2) re-using this public profile photo. After all, the fact that a profile photo can be consulted publicly does not necessarily mean that this profile photo can also be re-used for another purpose.
For the re-use of the profile photo, the Sports Court relies on its legitimate interest. In order to ascertain whether that is possible, the Litigation Chamber follows the cumulative three-step test developed by the Court of Justice of the European Union (CJEU) in the Rigas case .
In view of the above and that each test of the three-step test has been completed, the Litigation Chamber decided that the Sports Court was right to invoke its legitimate interest in the re-use of the profile photo of Facebook in question. The complaint was therefore dismissed.
 ECJ, 4 May 2017, C-13/16, Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde v Rīgas pašvaldības SIA "Rīgas satiksme", recital 28. See also ECJ, 11 December 2019, C-708/18, TK t/ Asociaţia de Proprietari bloc M5A-ScaraA, recital 40.