APD/GBA (Belgium) - 140/2022

APD/GBA - Decision 140-2022
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 16 GDPR
Type:	Complaint
Outcome:	Upheld
Started:	24.11.2020
Decided:	29.09.2022
Published:	02.10.2022
Fine:	n/a
Parties:	n/a
National Case Number/Name:	Decision 140-2022
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Dutch
Original Source:	GBA (in NL)
Initial Contributor:	n/a

The DPA held that, pursuant to Article 16 GDPR, a controller had to comply with a rectification request concerning incorrect contact information which prevented the data subject from receiving its daughter's progress reports.

English Summary

Facts

The data subject requested the rectification of certain contact-information about itself and its daughter (Article 16 GDPR). The daughter had problems which were not further specified. The controller had passed on information to another entity to follow up on these problems. A document (Motivatiedocument) was produced to pass on information from the controller to this other entity. However, the data subject claimed that certain contact-information in this document was incorrect, such as address-details and e-mail of the data subject and address details of both the daughter (living with the data subject) and the mother. The data subject stated that it hasn’t received letters or e-mails regarding its daughters progress because of the incorrect contact details.

The data subject stated that the controller didn’t reply to its requests in a sufficient manner. It made 5 requests: In person at 5 February 2020, in writing at 10 February 2020, 20 March 2020 and 6 April 2020 and by phone at 7 April 2020.

The controller stated that it had answered the request already verbally (5 February 2020). This was not the case according to the data subject because the contact information was still incorrect. At 7 April 2020, the data subject received a letter of the controller that the letter of the data subject (6 April 2020) had been well received and that the period of one month had to be extended with two months due to the complexity of the request.

The controller must provide the data subject without delay and, in any case, within at least within one month of receiving the request, information on the follow-up given to the request, or inform the data subject that the period of one month - given the complexity of the request - is extended by two months extended (Article 12(3) GDPR).

Holding

The DPA acknowledged that it had taken almost two years to make a decision, despite multiple requests of the data subject to receive more information about the circumstances of this case. The DPA stated that this was caused by the large workload of the DPA.

The DPA held that the controller didn’t answer the data subject in a sufficient enough manner and that more than two months had passed since the data subject had made its first request. The DPA held that the controller violated Article 16 GDPR and held that the controller had to comply with the request of the data subject. The DPA didn’t sanction the controller.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

                                                                                                   1/6







                                                                                  Dispute room



                                                   Decision 140/2022 of 29 September 2022





File number : DOS-2020-06006



Subject: Complaint for failing to comply with a request for rectification


The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke Hijmans,

single chairperson;


Having regard to Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 on

the protection of natural persons with regard to the processing of personal data and

on the free movement of such data and repealing Directive 95/46/EC (General
Data Protection Regulation), hereinafter GDPR;


Having regard to the law of 3 December 2017 establishing the Data Protection Authority, hereinafter WOG;


Having regard to the internal rules of procedure, as approved by the Chamber of Representatives

on December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;


Having regard to the documents in the file;


has taken the following decision regarding:


The complainant: Mr X, hereinafter: the complainant.



The defendant: Y, hereinafter referred to as “the controller”. Decision 140/2022 - 2/6



I. Facts procedure


    1. On 24 November 2020, the complainant lodged a complaint with the Data Protection Authority against

        the controller.

        Due to a certain problem of the (then minor) daughter of the complainant, the

        daughter followed up by the controller. The controller

        however, has passed this data on to another body for further follow-up. In the

        As part of this further follow-up, an electronic Motivation Document was drawn up. the complainant

        has determined, however, that it contains incorrect personal data of his daughter and himself
        recorded by the controller. More specifically, the following are

        data incorrect: a residence address of the complainant, the surname of the complainant and his daughter, the

        domicile details of the complainant, the e-mail address of the complainant, the domicile details of the

        mother and the domicile details of the daughter who resides with her father. As a result of this

        incorrect information, the complainant has sent certain emails and letters about the progress of his

        daughter not received.

        The complainant argues in his complaint that he submitted to the controller on 5 February 2020

        in person and then on February 10, 2020 and April 6, 2020 in writing and on April 7, 2020

        has telephoned the controller to provide this incorrect data
        to fit. However, the complainant has not been allowed a sufficient substantive answer to these requests

        receive.


    2. On January 21, 2021, the complaint will be declared admissible by the Frontline Service on the basis of
        Articles 58 and 60 of the WOG and the complaint pursuant to Article 62, §1 of the WOG will be forwarded to

        the Disputes Chamber.



II. Justification


    3. The Disputes Chamber is aware that it took almost two years to resolve this complaint

        despite the complainant's repeated requests for more information on the status
        of cases on file. This is the result of the large workload at the Disputes Chamber

        as a result of which files have a (too) long processing time. In view of the above

        the complainant's repeated requests to the Disputes Chamber show that the object of the

        complaint has not yet been resolved in the meantime, as a result of which the Disputes Chamber proceeds to the

        handling the complaint. Decision 140/2022 - 3/6



 II.1. Correction of data


 4. The Disputes Chamber is of the opinion that the requests of the complainant, both personally dated. February 5

     2020, if in writing dated. February 10, 2020, March 10, 2020, April 6, 2020, if by phone on April 7

     2020 constitute an exercise of his right to rectification, as referred to in Article 16 of the GDPR.

 5. Pursuant to Article 12.3 GDPR, the controller must inform the data subject without undue delay and in

     in any case within one month of receipt of the request, provide information regarding

     the follow-up given to the request, or must inform the data subject that the

     term of one month – given the complexity of the request – is extended by two months

     extended.

 6. The controller replied on March 10, 2020 that the complainant already

     would have received answers to his questions during a personal meeting on February 5, 2020,

     which, according to the complainant, is incorrect because the data is still incorrect. On April 7th

     2020, the complainant received a letter from the controller informing them
     that the letter from the complainant dated 6 April 2020 was well received and delivered to the concerned

     employee within the controller.


 7. It does not appear from the file that the controller adequately

     responded to these requests on the date of the complaint, i.e. more than two months after
     the complainant had sent his first request.


 8. The Disputes Chamber is of the opinion that on the basis of the above analysis,

     concluded that the controller has violated the provisions of the GDPR.

 9. More specifically, the violation concerns the failure to respond to the requests of the

     complainant to exercise his right to rectification (Article 16 of the GDPR) and this in particular

     considering:

     - the extracts of the electronic Motivation Document from which the incorrect personal data

        to turn out; and


     - the written requests dated. February 10, 2020, March 10, 2020 and April 6, 2020 until rectification
        of the personal data of himself and his daughter.


 10. This justifies that in the present case a decision must be taken to

     in accordance with Article 95, § 1, 5°, of the WOG, compliance with the complainant's request to
     order.


11. The present decision is a prima facie decision taken by the Disputes Chamber

    in accordance with article 95 WOG on the basis of the complaint submitted by the complainant, in the context of

    the “procedure prior to the decision on the merits and not a decision on the merits of the”
    Dispute Chamber within the meaning of Article 100WOG. The Dispute Chamber has thus decided on the grounds

    of Articles 58.2.c) and 95, §1, 5° of the Law of 3 December 2017, Decree 140/2022 - 4/6




         order the controller to comply with the data subject's requests

         to exercise its rights, in particular the right to rectification as defined in article 16 of the GDPR.


    12. The purpose of this decision is to inform the defendant that it is a

         has committed a breach of the provisions of the GDPR and to give them the opportunity to

         to still conform with the aforementioned provisions.


    13. However, if the defendant does not agree with the contents of this prima facie

         decision and is of the opinion that it can assert factual and/or legal arguments that lead to

         could lead to a different decision, this can be done via the e-mail address litigationchamber@apd-

         gba.be submit a request for treatment on the merits of the case to the Disputes Chamber and this

         within 30 days of notification of this decision.


     14. In the event of a continuation of the handling of the case on the merits, the Disputes Chamber will

          the parties on the basis of Articles 98, 2° and 3° in conjunction with Article 99 WOG invite their

          to submit defenses and to attach to the file any documents they deem useful. The

          If necessary, this decision will be definitively suspended.


     15. For the sake of completeness, the Disputes Chamber points out that a hearing of the merits of the case can be

          lead to the imposition of the measures referred to in Article 100 WOG. 1


     16. Finally, the Disputes Chamber points out the following:


          If one of the parties wishes to make use of the possibility to consult and

          copyingthefile(article95,§2,3°WOG),shouldreturntothesecretariat

          of the Disputes Chamber, preferably via litigationchamber@apd-gba.be, in order to make an appointment


          If a copy of the file is requested, the documents will be
                                                                     2
          delivered electronically or otherwise by regular mail.






11° to dismiss a complaint;
 2° order the suspension of prosecution;
 3° order the suspension of the judgment;
 4° propose a settlement;
 5° to formulate warnings and reprimands;

 6° order compliance with the data subject's requests to exercise his or her rights;
 7° to order that the data subject is informed of the security problem;
 8° order that the processing be temporarily or permanently frozen, restricted or prohibited;
 9° to order that the processing is brought into conformity;
 10° the rectification, restriction or deletion of data and notification thereof to the recipients of the data
to command;
 11° order the withdrawal of the recognition of certification bodies;
 12° to impose periodic penalty payments;
 13° impose administrative fines;

 14° order the suspension of cross-border data flows to another State or an international institution;
 15° to transfer the file to the public prosecutor's office of the Public Prosecutor in Brussels, who will inform it of the consequence that
the file is given;
 16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority.
2Due to the extraordinary circumstances due to COVID-19, the possibility of collection at the secretariat of

the Disputes Chamber is NOT provided. Moreover, in principle all communication takes place electronically. Decision 140/2022 - 5/6




III. Publication of the decision


    17. Given the importance of transparency in the decision-making of the

        Litigation Chamber, this decision is published on the website of the

        Data Protection Authority. However, it is not necessary that the identification data
        of the parties be published directly.







FOR THESE REASONS,

the Disputes Chamber of the Data Protection Authority also decides, subject to the

submission of a request by the controller for processing on the merits

in accordance with Article 98 et seq. WOG, to:

- on the basis of Article 58.2.c) GDPR and Article 95, §1, 5° WOG to the controller

    order that the complainant's request to exercise his rights is complied with, in particular the

    right to rectification (Article 16 GDPR) within the period of 30 days from the date

    notification of this decision;



- to order the controller to the Data Protection Authority (Dispute Chamber)

    by e-mail within the same period of the result of this decision via the
    e-mail address litigationchamber@apd-gba.be; and



- in the absence of timely implementation of the above by the controller, the

    to handle the case on the merits ex officio in accordance with Articles 98 et seq. WOG.



The Disputes Chamber will send a copy of the present decision to the controller

To deliver.




Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the notification
appeal against this decision to the Marktenhof (Brussels Court of Appeal), with the

Data Protection Authority as Defendant.


Such an appeal may be lodged by means of an adversarial petition that the
                                                                                  3
1034terof the Judicial Code, the statements listed should contain .The application to



3The petition states, on pain of nullity:
 1° the day, month and year;
 2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
    company number;
 3° the surname, first name, place of residence and, where appropriate, the capacity of the person to be summoned;
 4° the subject matter and the brief summary of the grounds of the claim; Decision 140/2022 - 6/6




contradiction must be submitted to the registry of the Market Court in accordance with Article

1034quinquiesof the Ger.W. , or via the Justice Deposit Information System (Article 32ter of


the Ger.W.).






(get). Hielke H IJMANS


Chairman of the Disputes Chamber






























































 5° the court before whom the claim is brought;
 6° the signature of the applicant or of his lawyer.

4The application with its annex is sent by registered letter, in as many copies as there are parties involved, to
the clerk of the court or at the registry.