APD/GBA (Belgium) - 99/2024
From GDPRhub
| APD/GBA - 99/2024 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 12 GDPR Article 15 GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 24.07.2024 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 99/2024 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | French |
| Original Source: | APD/GBA (Belgium) (in FR) |
| Initial Contributor: | p |
The DPA dismissed a complaint on the grounds of expediency. A data subject filed the complaint prior to one-month period under Article 12 GDPR to react to the data subject’ access request.
English Summary
Facts
A data subject was an employee of a company (the controller). Due to a conflict between the data subject and their manager disciplinary proceedings against the data subject were initiated. The data subject was asked not to work onsite; their laptop was confiscated and the mailbox blocked.
The data subject received a document concerning the disciplinary proceedings from the controller to review and comment within 10 days. The document was sent via mail and e-mail. The controller provided the instruction on the remote access to the data subject’s mailbox.
The data subject was unable to access their mailbox and asked the controller for help. The controller forwarded the request to its IT department. Also, the controller informed the data subject they were entitled to use a computer within the company premises to access the mailbox.
After few days, the data subject found out their e-mail account password was changed without their consent or notification. Then, the data subject requested access from the controller to their mailbox’s logs and explanation of the situation at stake. The controller didn’t answer the access request.
The data subject filed a complaint with the Belgian DPA (ADP/GBA). The data subject claimed the controller failed to answer the access request and suspended their mailbox access.
Holding
The DPA dismissed the case on the grounds of expediency.
According to the DPA, the subject matter of the case referred to the failure to answer the data subject's access request. The DPA explained the data subject lodged the complaint too early, i.e. three days after the access request was made. Hence, the controller was unable to react within the time frame under Article 12 GDPR. Thus, the violation of the GDPR didn’t occur yet. Moreover, for the DPA the complaint covered a broader dispute, related to the disciplinary proceedings. Because of that, potential investigation of the DPA was inappropriate.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/7 Litigation Chamber Decision 99/2024 of July 24, 2024 File number: DOS-2023-03447 Subject: Complaint regarding access to the professional mailbox, including the suspension of this access and the modification of its access codes without consent; as well as the absence of a response to a request for access to the mailbox logs for a determined period The Litigation Chamber of the Data Protection Authority, consisting of Mr. Hielke Hijmans, President, sitting alone; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter "GDPR"; Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, hereinafter "LCA"; Having regard to the Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, hereinafter "LTD"; Having regard to the Rules of Procedure as approved by the Chamber of Representatives on 20 December 2018 and published in the Belgian Official Gazette on 15 January 2019; Having regard to the documents in the file; Has taken the following decision concerning: The complainant: X, hereinafter “the complainant”; The defendant: Y, hereinafter “the defendant”. Decision 99/2024 - 2/7 I. Facts and procedure 1. On 13 August 2023, the complainant, employed at Y, filed a complaint with the Data Protection Authority (hereinafter “DPA”) against the defendant, Y. 2. This complaint concerns access to the complainant’s professional mailbox, including the suspension of this access and the modification of his access codes without his consent; as well as the failure to respond to his request for access to his mailbox logs for a specified period. 3. On 3 August 2023, following the hearing of 31/07/2023, the minutes are sent to the complainant by post and email, with a period of 10 days for any comments. After this deadline, the disciplinary file will be forwarded to the Y Management Committee. In response to the question concerning access to the complainant's professional email, instructions for accessing it remotely are provided by the defendant. 4. On 7 August 2023, the complainant confirms that he will send the signed hearing minutes with his comments by registered mail before the end of the week. He then expressed his concern regarding access to his professional email account, which contained personal documents and emails related to work. Despite the instructions provided for accessing it, the complainant encountered difficulties and requested explanations and a resolution of the problem. On the same date, the respondent indicated that his request had been forwarded to the IT department. An undated electronic correspondence informed the complainant that if the connection problems persisted, he could check his email account from a PC available at the workplace, with a room provided for him to save or transfer documents. 5. On 10 August 2023, the complainant contacted the respondent to report that his password to access his professional email account had been changed without his consent or prior notification, which he considered to be a serious violation of his privacy and fundamental rights. Under the GDPR, he demanded the immediate provision of access logs to his email account for a given period (from Thursday 29 June 4:00 p.m. to Tuesday 8 August), as well as explanations for this change. The complainant also demanded the immediate cessation of any interference with his electronic correspondence and the protection of his right to confidentiality of communications under penalty of legal proceedings. 6. In the complaint form, the complainant explains that a disagreement with his hierarchical superior led to an order from the general management of the establishments (…) to no longer go to his workplace and the initiation of disciplinary proceedings against him. In the context of these events, the management of the establishment where the complainant worked (hereinafter "the establishment") confiscated his work laptop and blocked his access to work messaging. Decision 99/2024 - 3/7 7. On 25 August 2023, the SPL declared the complaint admissible on the basis of Articles 58 and 60 of the LCA, and forwarded it to the Litigation Chamber in accordance with Article 62, § 1 of the LCA. II. Motivation 8. Pursuant to Article 4, § 1 of the LCA, the DPA is responsible for monitoring the data protection principles contained in the GDPR and other laws containing provisions relating to the protection of the processing of personal data. 9. Pursuant to Article 33, § 1 of the LCA, the Litigation Chamber is the administrative litigation body of the DPA. It is seized of complaints that the SPL transmits to it pursuant to Article 62, § 1 of the LCA, i.e. admissible complaints. In accordance with Article 60, paragraph 2 of the LCA, complaints are admissible if they are written in one of the national languages, contain a statement of the facts and the information necessary to identify the processing of personal data to which they relate and which fall within the competence of the DPA. 10. On the basis of the facts described in the complaint file as summarised above, and on the basis of the powers conferred on it by the legislator under Article 95, § 1 of the LCA, the Litigation Chamber decides on the follow-up to be given to the file; in this case, the Litigation Chamber decides to proceed with the dismissal of the complaint, in accordance with Article 95, § 1, 3° of the LCA, for the reasons set out below. 11. In matters of dismissal of the complaint, the Litigation Chamber is required to justify its 1 decision by stage and to: - pronounce a technical dismissal if the file does not contain or does not contain sufficient evidence likely to lead to a sanction or if it contains a technical obstacle preventing it from rendering a decision; - or to pronounce a classification without further action as a matter of opportunity, if, despite the presence of elements likely to result in a sanction, the continuation of the examination of the file does not seem appropriate to him given the priorities of the Data Protection Authority as specified and illustrated in the Classification without further action policy of the Contentious Chamber.2 1Court of Markets (Brussels Court of Appeal), 2 September 2020, judgment 2020/AR/329, p. 18. 2 APD, “Policy of classification without further action of the Contentious Chamber”, 18 June 2021, available at https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre- contentieuse.pdf. Decision 99/2024 - 4/7 12. In the event of a dismissal based on several grounds for dismissal, the latter (respectively, dismissal on technical grounds and dismissal on grounds of expediency) must be treated in order of importance. 13. In this case, the Litigation Chamber decides to dismiss the complaint on grounds of expediency. The decision of the Litigation Chamber is based more specifically on three reasons (criteria B1; B2; B3) for which it considers that it is inappropriate to continue monitoring the case, and consequently decides not to proceed, among other things, with an examination of the case on the merits. 14. The Litigation Chamber notes that the main grievance raised by the complainant lies in the defendant's failure to respond to his request made on 10 August 2023. This request includes the provision of access logs, explanations concerning the incident in question, as well as the requirement for an immediate cessation of any interference in his electronic correspondence. 15. While it is technically possible to examine your complaint, the Litigation Chamber begins by verifying whether the general criteria of high societal or personal impact, as defined by the APD in its note on the policy of dismissal of 18 June 2021, are applicable in this case. In the event that these high societal or personal impact criteria are not applicable, the Litigation Chamber then weighs the personal impact of the circumstances of the complaint on the fundamental rights and freedoms of the person concerned, and the efficiency of the Litigation Chamber’s intervention. 16. After examining the high societal or personal impact criteria, the Litigation Chamber concludes that none of these criteria are applicable to the present case. Consequently, the Litigation Chamber assesses the personal impact of the circumstances of the complaint on the fundamental rights and freedoms of the complainant against the efficiency of his or her intervention in order to decide whether to deal with the complaint in depth. 17. According to efficiency criterion B.1, it is imperative to have previously filed a complaint with the entity responsible for processing personal data and to have waited a reasonable period of time to obtain a response. This requirement aims to promote efficient use of the resources of the Litigation Chamber, by reserving its intervention for cases where a prior complaint has not been satisfactorily resolved. In this case, the complainant reports that the defendant has not responded to his request for access made on August 10, 2023. It is important to note that the defendant is required to comply with a 3 APD, “Policy for filing without further action of the Litigation Chamber: 3. –In which cases is my complaint likely to be filed without further action by the Litigation Chamber? ", 18 June 2021, available at https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre- contentieuse.pdf. 4APD, "Policy for classification without follow-up of the Contentious Chamber: 3. - In which cases is my complaint likely to be classified without follow-up by the Contentious Chamber?", 18 June 2021, available at https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre- contentieuse.pdf. Decision 99/2024 - 5/7 period of one month, which may be extended to two months, to respond to a request to exercise rights, in accordance with the provisions of the GDPR. Although the complainant exercised his rights through the electronic communication of 10 August 2023, the Litigation Chamber notes that the complaint was filed on 13 August 2023, three days after the exercise of his right of access, which has the effect of depriving the defendant of the reasonable period provided for by the GDPR to provide a response. In such a context, the Litigation Chamber cannot rule on the existence of a breach of the GDPR or personal data protection laws. 18. According to the opportunity criteria B.2 and B.3 set out in the said policy, the Litigation Chamber may decide not to process a complaint in cases where a judicial or administrative decision has already been rendered on the grievances of the complaint; when such decisions are pending, or if the complaint is considered incidental to a broader dispute. Furthermore, the Disputes Chamber notes, as indicated in the complaint form, that a disagreement with a hierarchical superior allegedly led the general management of the establishments (…) to suspend the complainant, thus preventing him from going to his workplace and triggering disciplinary proceedings. In addition, the management of the establishment allegedly confiscated his work laptop and blocked his access to electronic mail. Contradictorily, undated electronic correspondence also indicates to the complainant that he can consult his mailbox from a PC available at the workplace if the connection problems persist, with a room made available to him to save or transfer documents, which seems to contradict the allegation that the password to access the professional mailbox has been changed. Based on the aforementioned facts, the Disputes Chamber notes that the complaint is incidental to a broader dispute with ongoing disciplinary proceedings. Consequently, the Litigation Chamber considers that it is not appropriate to launch an investigation through the Inspection Service to corroborate the complainant’s allegations, and consequently decides not to proceed, among other things, with an examination of the case on the merits. 19. In conclusion, to the extent that it is clear from the documents in the file that the efficiency of the Litigation Chamber’s intervention has not been demonstrated in this case and that the means to be implemented to support the complaint are potentially excessive, the Litigation Chamber cannot uphold the complainant’s complaint and decides to dismiss the complaint without further action on grounds of expediency. 5 APD, “Policy for the classification without follow-up of the Litigation Chamber: 3.2.2 – Efficiency criteria - B.1 You have not filed a prior complaint with the organisation that processes your data and/or have not given it a reasonable period of time to respond” and “3.2.2 – Efficiency criteria - B.5 Your complaint is not sufficiently detailed or is not supported by evidence that would allow the Litigation Chamber to decide on the existence or not of a violation of the GDPR AND your complaint does not have a high societal and/or personal impact”, 18 June 2021, available at https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre- contentieuse.pdf. 6A dismissal of the case on grounds of expediency does not mean that the Litigation Chamber legally finds that no violation has occurred, but that the resources required to support the complaint are potentially excessive. ; APD, “Policy on dismissal of the Litigation Chamber”, 18 June 2021, available on Decision 99/2024 - 7/7 filed with the registry of the Court of Markets in accordance with Article 1034quinquies of the Judicial Code, or 11 via the e-Deposit information system of the Ministry of Justice (Article 32ter of the Judicial Code). To enable it to consider any other possible course of action, the Litigation Chamber refers the complainant to the explanations provided in its dismissal policy. 12 The Litigation Chamber stresses that the classifications without follow-up that have occurred are likely to be taken into account by the Data Protection Authority in order to set its future priorities and/or could inspire future own-initiative investigations by the Inspection Service of the Data Protection Authority. (sé). Hielke HIJMANS President of the Litigation Chamber 2° the name, first name, address of the applicant, as well as, where applicable, his/her qualities and his/her national register number or company number; 3° the name, first name, address and, where applicable, the quality of the person to be summoned; 4° the subject and summary statement of the grounds of the application; 5° the indication of the judge who is seized of the application; 116° the signature of the applicant or his/her lawyer. The application, accompanied by its annex, is sent, in as many copies as there are parties involved, by registered letter to the clerk of the court or filed with the registry. 12APD, “Policy for filing without further action of the Contentious Chamber: 4. – What can I do if my complaint is filed without further action?”, 18 June 2021, available at https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans- suite-de-la-chambre-contentieuse.pdf.
