APD/GBA (Belgium) - 137/2021: Difference between revisions

Revision as of 09:17, 16 December 2021

APD/GBA (Belgium) - 137/2021

Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 12(3) GDPR Article 14 GDPR Article 15 GDPR Article 17(1) GDPR Article 21(2) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	08.12.2021
Published:
Fine:	10000 EUR
Parties:	n/a
National Case Number/Name:	137/2021
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Dutch
Original Source:	Beslissing ten gronde 137/2021 van 8 december 2021 (in NL)
Initial Contributor:	Enzo Marquet

The Belgian DPA fined a company €10,000 for having bought and used a database for marketing purposes, without ensuring that this database had been gathered lawfully, and for failing to respect the rights of the data subjects, including the right to information, the right to object, and the right to erasure of personal data.

English Summary

Facts

An individual (the Complainant) received a direct marketing email from a company (the Defendant) in relation to their plans to renovate their property. The Complainant reached out to the Defendant to object to the further processing of their personal data for marketing purposes, to ask how the Defendant had obtained their personal data, and to request the erasure of their personal data.

The Defendant first ignored the requests of the Complainant. The Defendant later explained that it had bought the database from an external company, thinking that these data had been gathered lawfully.

Holding

The Belgian DPA first stated that this case was touching upon to the core of the GDPR. Several violations were found, as further detailed below.

Violation of the right to information (Article 14 GDPR)

In accordance with Article 14 GDPR, when personal data are not received from the data subjects directly, the data subjects must be informed by the controller at the latest within a month of receiving the personal data, or upon initiating contact. The Belgian DPA stressed that the exceptions to this obligation are to be interpreted very narrowly, as transparency is at the core of the GDPR.

In this case, it was found that the Defendant had failed to inform the data subjects about the indirect collection of their personal data and the intended processing.

Violation of the right to access (Article 15 GDPR), the right to object (Article 21 GDPR) and the right to erasure (Article 17 GDPR)

In accordance with Article 15 GDPR, data subjects have the right to request access and receive information about the processing of their personal data from controllers. Under Article 21 GDPR and Article 17 GDPR, data subjects also have the right to object to the processing of their personal data, and to request the erasure of their personal data.

In this case, the Complainant had exercised each of these rights by sending a request to the Defendant. In accordance with Article 12(3) GDPR, the Defendant should have answered the Complainant within one month of receiving such request. Such answer should have included information about how the personal data were indirectly obtained by the Defendant, as well as information on the measures that the Defendant was intending to take in response of the exercise of the right to object ((Article 21(2) GDPR) and the right to erasure (Article 17 GDPR). The Belgian DPA also held that, pursuant to Article 12(4) GDPR, if the Defendant had decided not to take any action in relation to the Complainant's request, the Defendant should have informed the Complainant within 30 days about its decision and the reason why it would not provide the requested information.

In this case, it was found that the Defendant had failed to answer the request of the Complainant, and should not have retained the personal data, given that they had been obtained for marketing purposes. With regard to Article 21 GDPR in particular, the Belgian DPA stressed that the right to object is absolute when a data subject objects to the processing of personal data for marketing purposes; the Defendant could only have retained the personal data if they were processed for a different purpose with a separate legal basis (which was not the case in the situation at hand).

As a result, the Belgian DPA found that the Defendant had violated Article 15, 21 and 17 GDPR, read in combination with Article 12(3) and (4) GDPR.

Violation of the obligation to implement appropriate technical and organisational measures (Article 24 GDPR)

The DPA also held that Article 24 GDPR puts an obligation on the controller to implement adequate technical and organisational measures to ensure its processing is done in compliance with the GDPR. As such, the Defendant should have ensured that the database which it had bought was gathered in a legal and compliant manner. In this case, however, the Belgian DPA found that the Defendant had failed to conduct due diligence before buying and using the database. As a result, the Belgian DPA also found a violation of Article 24 GDPR by the Defendant.

Aggravating and mitigating factors and imposition of a fine

The Belgian DPA took into consideration the fact that the Defendant had ignored twice the Complainant's request, and considered such fact as an aggravating factor. However, the Belgian DPA also took into account the fact that the Defendant had ultimately deleted the personal data of the Complainant and had informed the latter about how it had obtained the personal data (although with some delay) ; this was considered as a mitigating factor.

In conclusion, taking into account all the facts of the case, including its mitigating and aggravating factors, the Belgian DPA held that the Defendant had acted in breach of Article 14(1), Article 14(2), Article 14(3), Article 15 GDPR, Article 17(1)(c) and Article 21(2) GDPR, read in combination with Article 12(3) GDPR, and decided to impose a fine of €10,000 on the Defendant. The Belgian DPA further issued an injunction against the Defendant to bring their processing practices in compliance with the GDPR within 30 days of this decision.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

@@ Line 56: / Line 56: @@
 }}
-The Belgian DPA fined a company €10,000 for not ensuring a database it bought and used for direct marketing purposes was gathered in a legal way, for not informing data subjects about data collected indirectly from them, and for not responding to a data subject's access request.
+The Belgian DPA fined a company €10,000 for having bought and used a database for marketing purposes, without ensuring that this database had been gathered lawfully, and for failing to respect the rights of the data subjects, including the right to information, the right to object, and the right to erasure of personal data.
 == English Summary ==
 === Facts ===
-The complainant received a direct marketing letter in their mailbox based on their plans to renovate their property. The complainant reached out to the defendant to object to the further processing of their personal data, to ask for the source of their personal data, and to delete their personal data.
+An individual (the Complainant) received a direct marketing email from a company (the Defendant) in relation to their plans to renovate their property. The Complainant reached out to the Defendant to object to the further processing of their personal data for marketing purposes, to ask how the Defendant had obtained their personal data, and to request the erasure of their personal data.
-The defendant had bought the data from an external company. They opted to ignore the request of the complainant up to two times. The defendant claimed to have acted in good faith when they bought the database, they thought the database was completely legal. As such, they cannot be blamed in this regard.
+The Defendant first ignored the requests of the Complainant. The Defendant later explained that it had bought the database from an external company, thinking that these data had been gathered lawfully.
 === Holding ===
-The DPA held that this case goes to the core of the GDPR. When personal data are not received from the data subjects directly, the data subjects must be informed by the controller of the processing, at the latest within a month of receiving the personal data or upon initiating contact. It is irrelevant how the data were gathered in this aspect. Exceptions to this are to be interpreted very narrowly, as transparency is the core of EU law.
+The Belgian DPA first stated that this case was touching upon to the core of the GDPR. Several violations were found, as further detailed below.
-The controller is thus obliged to provide the data subject with information in accordance with [[Article 12 GDPR#3|Article 12(3)]] within one month of receiving the request, to inform the data subject about the processing of their personal data in [[Article 15 GDPR#]], about the measures taken in response to the request and about the manner of processing, about the processing of their personal data, about the measures taken as a result of the exercise of the right to object in [[Article 21 GDPR#2|Article 21(2)]] and about the exercise of the right to deletion in [[Article 17 GDPR]].
+==== Violation of the right to information (Article 14 GDPR) ====
+In accordance with [[Article 14 GDPR]], when personal data are not received from the data subjects directly, the data subjects must be informed by the controller at the latest within a month of receiving the personal data, or upon initiating contact. The Belgian DPA stressed that the exceptions to this obligation are to be interpreted very narrowly, as transparency is at the core of the GDPR.
-Additionally, the defendant must inform the data subjects on the retention period of their personal data, or the criteria used to determine such period. The personal data may no longer be processed for direct marketing purposes in accordance with [[Article 21 GDPR#3|Article 21(3)]], if the data subject objected to such processing.  Only if the defendant processes the same data for a different purpose and on a separate legitimate basis, can it retain the data.
+In this case, it was found that the Defendant had failed to inform the data subjects about the indirect collection of their personal data and the intended processing.
-Furthermore, the DPA held that [[Article 24 GDPR]] puts an obligation on the controller to implement adequate technical and organisational measures to ensure its processing is done in compliance with the GDPR. As such, the defendant should have ensured that the database it bought was gathered in a legal and compliant manner. The defendant failed to do their due diligence.
+==== Violation of the right to access (Article 15 GDPR), the right to object  (Article 21 GDPR) and the right to erasure (Article 17 GDPR) ====
+In accordance with [[Article 15 GDPR]], data subjects have the right to request access and receive information about the processing of their personal data from controllers. Under [[Article 21 GDPR]] and [[Article 17 GDPR]], data subjects also have the right to object to the processing of their personal data, and to request the erasure of their personal data.
-The DPA also held that following [[Article 12 GDPR#4|Article 12(4)]], the defendant was obliged to inform the complainant within 30 days about its decision and the reason why it would not provide the requested information.
+In this case, the Complainant had exercised each of these rights by sending a request to the Defendant. In accordance with [[Article 12 GDPR#3|Article 12(3) GDPR]], the Defendant should have answered the Complainant within one month of receiving such request. Such answer should have included information about how the personal data were indirectly obtained by the Defendant, as well as information on the measures that the Defendant was intending to take in response of the exercise of the right to object (([[Article 21 GDPR#2|Article 21(2) GDPR]]) and the right to erasure ([[Article 17 GDPR]]). The Belgian DPA also held that, pursuant to [[Article 12 GDPR#4|Article 12(4) GDPR]], if the Defendant had decided not to take any action in relation to the Complainant's request, the Defendant should have informed the Complainant within 30 days about its decision and the reason why it would not provide the requested information.
-Based on the above, the DPA states that ignoring a data subject request twice is an aggravating factor. However, the defendant has deleted the personal data of the complainant and has informed the complainant, even though late. This can be seen as a mitigating factor.
+In this case, it was found that the Defendant had failed to answer the request of the Complainant, and should not have retained the personal data, given that they had been obtained for marketing purposes. With regard to Article 21 GDPR in particular, the Belgian DPA stressed that the right to object is absolute when a data subject objects to the processing of personal data for marketing purposes; the Defendant could only have retained the personal data if they were processed for a different purpose with a separate legal basis (which was not the case in the situation at hand).
-The DPA holds that the defendant has acted in breach of [[Article 14 GDPR#1|Article 14(1)]], [[Article 14 GDPR#2|Article 14(2)]], [[Article 14 GDPR#3|Article 14(3)]], [[Article 15 GDPR]], [[Article 17 GDPR#1c|Article 17(1)(c)]] and [[Article 21 GDPR#2|Article 21(2)]] in combination with [[Article 12 GDPR#3|Article 12(3)]] and imposes a fine of €10,000 on them, as well as ordering them to ensure their practises are compliant with the above articles within 30 days of this decision.
+As a result, the Belgian DPA found that the Defendant had violated Article 15, 21 and 17 GDPR, read in combination with Article 12(3) and (4) GDPR.
+==== Violation of the obligation to implement appropriate technical and organisational measures (Article 24 GDPR) ====
+The DPA also held that [[Article 24 GDPR]] puts an obligation on the controller to implement adequate technical and organisational measures to ensure its processing is done in compliance with the GDPR. As such, the Defendant should have ensured that the database which it had bought was gathered in a legal and compliant manner. In this case, however, the Belgian DPA found that the Defendant had failed to conduct due diligence before buying and using the database. As a result, the Belgian DPA also found a violation of Article 24 GDPR by the Defendant.
+==== Aggravating and mitigating factors and imposition of a fine ====
+The Belgian DPA took into consideration the fact that the Defendant had ignored twice the Complainant's request, and considered such fact as an aggravating factor. However, the Belgian DPA also took into account the fact that the Defendant had ultimately deleted the personal data of the Complainant and had informed the latter about how it had obtained the personal data (although with some delay) ; this was considered as a mitigating factor.
+In conclusion, taking into account all the facts of the case, including its mitigating and aggravating factors, the Belgian DPA held that the Defendant had acted in breach of [[Article 14 GDPR#1|Article 14(1)]], [[Article 14 GDPR#2|Article 14(2)]], [[Article 14 GDPR#3|Article 14(3)]], [[Article 15 GDPR]], [[Article 17 GDPR#1c|Article 17(1)(c)]] and [[Article 21 GDPR#2|Article 21(2) GDPR]], read in combination with [[Article 12 GDPR#3|Article 12(3) GDPR]], and decided to impose a fine of €10,000 on the Defendant. The Belgian DPA further issued an injunction against the Defendant to bring their processing practices in compliance with the GDPR within 30 days of this decision.
 == Comment ==