APD/GBA (Belgium) - 06/2023

APD/GBA - 06/2023
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 15(1)(a) GDPR Article 15(1)(c) GDPR
Type:	Complaint
Outcome:	Partly Upheld
Started:
Decided:	02.02.2023
Published:	06.02.2023
Fine:	n/a
Parties:	n/a
National Case Number/Name:	06/2023
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	French
Original Source:	GBA (in FR)
Initial Contributor:	n/a

The Belgian DPA ordered a controller to comply with an access request pursuant to Article 58(2)(c) GDPR. The DPA determined that the controller was responsible for not receiving the data subject's request due to technical problems with its email inbox.

English Summary

Facts

In an unspecified point in time, the data subject noticed that his 'national register file' had been accessed by a third party on 12 September 2022. On 25 September 2022, he sent an email to the controller, whose nature was also not specified, asking to provide information about such access, its reason as well as the identity of the person or entity who had consulted the data. The data subject received an automatic reply from the controller informing him that the recipient's e-mail box was full and that no new messages could be received. The data subject continued sending messages with his inquiries, which all resulted in the same outcome. On 21 October 2022, he filed a complaint at the Belgian DPA.

Holding

The DPA confirmed that the data subject was exercising his right of access in order to get information regarding the purpose of the consultation of his national register (Article 15(1)(a) GDPR) and the identity of the person(s) who consulted the register (Article 15(1)(c) GDPR). The DPA stated that it looked like that the controller never received the e-mail and did therefore not comply with the one-month deadline of Article 12(3) GDPR to provide an answer to the request.

The DPA concluded that the controller may have violated Article 15 GDPR by not providing an answer to the access request and ordered the controller to comply with the access request of the data subject. The DPA especially noted that the e-mail address provided by the controller was not functional to let data subjects exercise their rights, which is a requirement pursuant to Article 12(2) GDPR.

The DPA ordered the controller to comply with the access request pursuant to Article 58(2)(c) GDPR and Article 95(1)(5) LCA (Law establishing the data protection authority).

Comment

This is a preliminary decision pursuant to Article 95 LCA, prior to the decision on the merits.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/5





                                                                          Litigation Chamber


                                                           Decision 06/2023 of February 2, 2023





File number: DOS-2022-04347


Subject: consultation of the national register and lack of response to the exercise of the right

access




The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke
Hijmans, chairman;


Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and

to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the
data protection), hereinafter “GDPR”;


Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, hereinafter

“ACL”;

Having regard to the internal regulations as approved by the House of Representatives on 20

December 2018 and published in the Belgian Official Gazette on January 15, 2019;


Considering the documents in the file;


Made the following decision regarding:



The plaintiff: X, hereinafter “the plaintiff”; .

                                                                                                          .
                                                                                                          .
The defendant: Y, hereinafter: “the defendant”. Decision 06/2023 – 2/5



I. Facts and procedure


 1. The subject of the complaint concerns the consultation of the national register of the complainant by Y and

       failure to respond to the access request.

       The complainant noted that his national registry file had been consulted by Y on 12

       September 2022. On September 25, 2022, he wrote to the address […] requesting

       information on this consultation and in particular the reason for the consultation and the identity of

       the person who viewed it. He receives the same day an automated response in Dutch

       indicating that the mailbox is full and no new messages can be received. THE

       complainant seems to have made new sending attempts in the following days, which

       all led to the same result.


 2. On October 21, 2022, the complainant lodged a complaint with the Data Protection Authority
       given against the defendant.


 3. On October 28, 2022, the complaint was declared admissible by the Front Line Service on

       the basis of Articles 58 and 60 of the LCA and the complaint is forwarded to the Litigation Chamber

       pursuant to Article 62, § 1 of the LCA.


 4. Pursuant to article 95 § 2, 3° of the LCA as well as article 47 of the rules of order
       inside the DPA, a copy of the file may be requested by the parties. If one of

       parties wishes to make use of the possibility of consulting the file, the latter is required to

       contact the secretariat of the Litigation Chamber, preferably via the address

       litigationchamber@apd-gba.be.



II. Motivation


 5. Article 15.1.a) of the GDPR provides that the data subject can contact the controller

       processing in order to achieve the purpose of the processing. Article 15.1.c) provides that it may

       also ask “the recipients or categories of recipients to whom the

       personal data have been or will be communicated”.


 6. Under Article 12.3 of the GDPR, the controller has a maximum period

       one month from the request for access to provide a response. This period may, under

       conditions, be extended for an additional month.

 7. In addition, article 12.2 of the GDPR provides that the controller facilitates the exercise

       of the rights granted to the data subject.



1
 Pursuant to article 61 LCA, the Litigation Chamber informs the parties by this decision, of the fact that the complaint has been
declared admissible.
2 Pursuant to Article 95, § 2 LCA, by this decision, the Litigation Division informs the parties of the fact that following
of this complaint, the file was forwarded to him. Decision 06/2023 – 3/5


 8. In this case, it appears from the email that the complainant sent to the Y, that the latter was exercising his right

       of access concerning the purpose of the consultation of its national register (article 15.1a) of the

       GDPR) and the identity of the persons having consulted the register (article 15.1.c) of the GDPR).


 9. Y provides data subjects with an email address entitled […] so that data subjects can

       data subjects can exercise their rights. It appears that due to a problem

       full mailbox, Y never received this email and therefore did not respond to it within
       the period of one month.


 10. The Litigation Chamber considers that on the basis of the aforementioned facts, there is reason to

       conclude that the defendant may have breached the provisions of the GDPR, which

       which justifies that in this case, it is making a decision in accordance with Article
               er
       95, § 1, 5° of the LCA, more specifically, to order compliance with the request of the

       complainant of the complainant to exercise his right of access (article 15.1 of the GDPR) and this in
       particular seen:



        - The evidence provided by the complainant demonstrating that there was indeed consultation with

            its national registry file by the defendant;



        - Copies of emails sent by the complainant and automatic responses received,

            which demonstrate that he has attempted, through an official email address, to exercise his

            right of access provided for in Articles 15.1.a) and 15.b) of the GDPR;



        - That the email address provided by the defendant so that the persons concerned

            can exercise the rights granted to them by the GDPR is not functional,
            which would indicate that the defendant did not facilitate the exercise of rights conferred on the

            data subject as required by article 12.2 of the GDPR.



 11. This decision is a prima facie decision taken by the Litigation Chamber

       pursuant to Article 95 of the LCA on the basis of the complaint lodged by the complainant/the

       complainant, in the context of the "procedure prior to the substantive decision" and not a

       decision on the merits of the Litigation Chamber within the meaning of Article 100 of the LCA.

 12. The purpose of this decision is to inform the defendant, allegedly responsible for the

       processing, because it may have violated the provisions of the GDPR,

       in order to enable it to still comply with the aforementioned provisions.


 13. If, however, the defendant does not agree with the content of this decision

       prima facie and believes that it can make factual and/or legal arguments that



3Section 3, Subsection 2 of the ACL (articles 94 to 97 inclusive). Decision 06/2023 – 4/5


        could lead to another decision, it may send the Litigation Chamber a

        request for treatment on the merits of the case via the e-mail address litigationchamber@apd-

        gba.be, within 30 days of notification of this decision. The case

        applicable, the execution of this decision is suspended for the period

        aforementioned.


 14. In the event of further processing of the case on the merits, pursuant to Articles 98, 2° and 3°

        juncto article 99 of the LCA, the Litigation Chamber will invite the parties to introduce their

        conclusions and attach to the file all the documents they deem useful. If applicable, the

        this decision is permanently suspended.


 15. With a view to transparency, the Litigation Division finally emphasizes that a

        dealing with the case on the merits may lead to the imposition of the measures mentioned in

        section 100 of the ACL. 4






III. Publication of the decision



 16. Given the importance of transparency regarding the decision-making process of the Chamber

        Litigation, this decision is published on the website of the Protection Authority

        Datas. However, it is not necessary for this purpose that the identification data

        of the parties are communicated directly.


















4Art. 100. § 1. The litigation chamber has the power to
 1° dismiss the complaint without follow-up;
 2° order the dismissal;
 3° pronouncing the suspension of the pronouncement;
 4° to propose a transaction;
 5° issue warnings and reprimands;

 6° order to comply with requests from the data subject to exercise his or her rights;
 7° order that the person concerned be informed of the security problem;
 8° order the freezing, limitation or temporary or permanent prohibition of processing;
 9° order compliance of the processing;
 10° order the rectification, restriction or erasure of the data and the notification thereof to the recipients of the
     data ;
 11° order the withdrawal of accreditation from certification bodies;
 12° to issue periodic penalty payments;
 13° to issue administrative fines;

 14° order the suspension of cross-border data flows to another State or an international body;
 15° forward the file to the public prosecutor's office in Brussels, who informs it of the follow-up given to the file;
 16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. Decision 06/2023 – 5/5






    FOR THESE REASONS,


    the Litigation Chamber of the Data Protection Authority decides, subject to

    the introduction of a request by the defendant for treatment on the merits in accordance with

    to articles 98 e.s. of the ACL:


        - pursuant to Article 58.2.c) of the GDPR and Article 95, §1, 5° of the LCA, to order

            the defendant to comply with the request of the person concerned to exercise

            his right of access (article 15.1 of the GDPR) regarding the consultation of his register

            national level, and to send the information to the complainant within the time limit

            30 days from the notification of this decision;

        - to order the defendant to inform by e-mail the Data Protection Authority

            data (Litigation Chamber) of the follow-up given to this decision, in the

            same deadline, via the e-mail address litigationchamber@apd-gba.be; And


        - if the defendant does not comply in good time with what is requested of it

            above, to deal ex officio with the case on the merits, in accordance with articles 98 e.s. of

            the ACL.





In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged,

within thirty days of its notification, to the Court of Markets (court

d'appel de Bruxelles), with the Data Protection Authority as defendant.

Such an appeal may be introduced by means of an interlocutory request which must contain the

information listed in article 1034ter of the Judicial Code. The interlocutory motion must be

filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 6

via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).






   (se). Hielke H IJMANS


   President of the Litigation Chamber


5
 The request contains on pain of nullity:
 (1) indication of the day, month and year;
 2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
     Business Number;
 3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
 (4) the object and summary statement of the means of the request;
 (5) the indication of the judge who is seized of the application;
 6° the signature of the applicant or his lawyer.

6The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.