APD/GBA (Belgium) - 26/2024

APD/GBA - 26/2024
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 12(3) GDPR Article 12(4) GDPR Article 17(1) GDPR
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	07.02.2024
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	26/2024
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Dutch
Original Source:	GBA (in NL)
Initial Contributor:	nzm

The Belgian DPA dismissed a complaint and indicated that in the context of an erasure request, the controller was not expected to search of its own accord for the existence of data subject's email addresses other than the one mentioned by the data subject in the request.

English Summary

Facts

A data subject filed a complaint against a controller concerning the lack of appropriate action regarding his several requests for erasure of his personal data under Article 17(1) GDPR, in particular his e-mail address which was used by the controller to send unsolicited advertising to the data subject. The controller indicated that necessary action would be taken, however, the data subject received unsolicited advertising again. The data subject had 2 accounts with 2 different e-mail addresses and the second e-mail address had not been deleted as (i) it was not the subject of the first request and (ii) the controller only used the e-mail address as a unique identifier to distinguish the different profiles in their database.

The controller notified the Belgian DPA (“APD”) that the data subject’s email address had been deleted, but the data subject still received unsolicited advertising, which led to this complaint.

Holding

The APD considered that the controller was not expected to search of its own accord for a second or even multiple accounts with a similar or different email address(es) that might belong to the data subject without the identity of the data subject.

Furthermore, the APD added that in this case, there were no elements for the controller to doubt the data subject’s identity so there was no reason for the controller to request additional information to confirm its identity under Article 12(6) GDPR.

The APD therefore indicated that the controller made every effort to clarify the situation for the data subject and proceeded to remove the e-mail address as soon as it was established that the second account with another e-mail address belonged to the data subject and thus, there was no breach of Articles 12(3) and 12(4) in conjunction with Article 17(1) GDPR.

Comment

In this case, the judges made an obiter dictum by mentioning Article 12(6) GDPR.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

1/5




                                                                          Dispute Chamber

                                     Decision on the merits 26/2024 of 7 February 2024


File number: DOS-2023-03948


Subject: Exercise of the right to erasure of data regarding e-mail address



The Disputes Chamber of the Data Protection Authority, composed of Mr

Hielke HIJMANS, chairman, and Messrs. DiAN D ERK ELEN and Frank D ESMET, members;


Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

on the protection of natural persons with regard to the processing of

personal data and regarding the free movement of such data and to the revocation of

Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”;

Having regard to the law of 3 December 2017 establishing the Data Protection Authority,

hereinafter “WOG”;


In view of the internal rules of order, as approved by the House of Representatives

Representatives on December 20, 2018 and published in the Belgian Official Gazette on

January 15, 2019;

Considering the documents in the file;



Has made the following decision regarding:



Complainant: Mr.


The defendant: Y, hereinafter “the defendant” Decision on the merits 26/2024 - 2/5


I. Facts and procedure


 1. On 20 September 2023, the complainant lodged a complaint with the Data Protection Authority

       against defendant.

 2. The subject of the complaint concerns the lack of appropriate action by the defendant

       to the complainant's request to erase his personal data, more specifically

       email address […], which is used by the defendant to send unsolicited emails to the complainant

       to send advertisements. The complainant requested data deletion on 9
       November 2022 and again on November 14, 2022. Notwithstanding the second

       request will be received following confirmation from the defendant that the necessary action is being taken

       complainant again on January 16, 2023 unsolicited advertising by email from the defendant. This

       has given rise to Decision 09/2023 of 9 February 2023. Notwithstanding that

       the defendant pursuant to the aforementioned decision to the Disputes Chamber on March 8, 2023

       has reported that the complainant's email address has been deleted, but the complainant is receiving it again
       unsolicited advertising from the defendant, which led to the current complaint.


 3. On October 6, 2023, the complaint will be declared admissible by the First Line Service

       on the basis of Articles 58 and 60 WOG and the complaint is filed on the basis of Article 62, § 1 WOG
       transferred to the Disputes Chamber.


 4. On October 31, 2023, the Disputes Chamber will decide on the basis of Article 95, § 1, 1° and Article 98

       WOG that the file is ready for substantive treatment and will be involved
       parties are notified by registered mail of the provisions as stated in

       Article 95, § 2, as well as that in Article 98 WOG. They are also subject to Article 99

       WOG informed of the deadlines for submitting their defenses.

       The deadline for receipt of the defendant's statement of defense was

       recorded on December 11, 2023, for the complainant's response

       on January 3, 2024 and this for the defendant's response on January 24

       2024.

 5. On November 14, 2023, the Disputes Chamber will receive on behalf of the defendant, within the

       predetermined conclusion period, a detailed explanation explaining the cause

       set out to explain how the complainant can also continue after Decision 09/2023 of February 9, 2023

       have received any unwanted e-mail messages.

 6. Notwithstanding the conclusion period allowed to the complainant, no conclusion of

       response by the complainant is submitted to the Disputes Chamber. Thus, no conclusion is reached

       response thereto submitted by the defendant.

 7. On February 1, 2024, the complainant informs the Disputes Chamber that the complaint is still pending

       is always up to date. Decision on the merits 26/2024 - 3/5


II. Justification


8. The factual elements that formed the basis of Decision 09/2023 of February 9, 2023

    concern the receipt of unwanted advertising messages at the email address [...] In the present

    the present complaint that gives rise to the current decision was made by the complainant merely
    referred to the aforementioned Decision 09/2023 which was stated not to be

    carried out by the defendant and leaving the complainant undesirable

    would receive advertising messages. This conduct of the defendant may have had consequences

    result in an infringement of Articles 12.3 and 12.4 GDPR in conjunction with Article 17.1 GDPR.

9. However, the defendant explains that the right to erasure of the complainant's data dated 9 November

    2022 the email address […] concerned and that the effectiveness of this right was confirmed to

    the Disputes Chamber in accordance with Decision 09/2023 and thus the

    personal data of the complainant linked to the relevant email address in the database

    were removed. The defendant adds that the complainant apparently has another
    account with a different email address. After a new request from the complainant by the

    defendant was received informing him that the complainant had again received a prospecting

    had received the email, the defendant was able to link the email address [...] to the email address based on this

    first and last name of the complainant. This second account had a different email address and was lost

    that reason was not removed as it was not the subject of the initial request. The
    Defendant hereby points out that the unique identification code used to identify the

    different profiles in the database can only be distinguished by the e-mail address. Any request

    sent via an email address will therefore only be sent to the same email address

    processed to avoid confusion in case of homonyms. This explains why

    unwanted advertising messages were sent by email to […].

10. The defendant declares that the complainant's account and the associated account are indeed valid

    e-mail address […] as stated in the complaint and in the documents submitted by the complainant, which

    gave rise to Decision 09/2023, was deleted, as confirmed to the
    Disputes Chamber by letter dated March 8, 2023. In the meantime, in response to the current

    complaintsafter it became clear that the complainant still had a second account with hot-

    email address […] this was also removed.


11. The explanation provided by the defendant convinces the Disputes Chamber, since the
    documents that the complainant provided to substantiate the exercise of his right to

    erasure of data to which the defendant did not comply, which gives rise to

    until Decision 09/2023, only related to the e-mail address

    [...] The defendant could not deduce from any factual element of the file that the complainant

    had a second account with a somewhat similar or different email address.
    Nor can the defendant be expected to search for it on his own initiative

    a second or even more accounts with a similar email address(es) that may


    belong to the same data subject without the identity of the data subject being known with certainty

    data subject to whom the account belongs has been established. This also follows from Article 17.1 GDPR in which

    it is stated that the data subject has the right to erasure of data concerning him or her

    personal data, and therefore does not imply an obligation for the defendant to transfer
    to delete personal data that it is not established that it belongs to the data subject

    to belong. This also explains that Article 12.6 GDPR states that when the

    controller has reasons to doubt the identity of the

    natural person who submits the request referred to in Articles 15 to 21, om

    may request additional information necessary to confirm the identity of the

    person involved. However, the Disputes Chamber is of the opinion that in this case there is no
    elements were available to doubt the identity of the complainant and the actions taken by him

    exercised the right to erasure of data with regard to [...] on the basis of the information provided by him

    supporting documents that only related to that e-mail address, which means that

    There was therefore no reason for the defendant to collect additional information

    questions to confirm his identity in relation to […].

12. It follows from the above that the Disputes Chamber is of the opinion that the defendant has done everything

    has made every effort to clarify the situation for the benefit of the complainant

    proceeded to delete the email address [...] as soon as it was established that there was a

    second account with this email address belonged to the complainant; and previously the e-

    email address […] was deleted in compliance with the data erasure order as imposed
    in Decision 09/2023. This leads the Disputes Chamber to the conclusion that the current complaint is not

    gives rise to the finding of a new infringement of Articles 12.3 and 12.4 GDPR in conjunction

    Article 17.1 GDPR. Decision on the merits 26/2024 - 5/5



III. Publication of the decision


 14. Considering the importance of transparency with regard to decision-making

       Dispute Chamber, this decision will be published on the website of the

       Data Protection Authority. However, it is not necessary that the

       identification details of the parties are disclosed directly.



    FOR THESE REASONS   ,

    the Disputes Chamber of the Data Protection Authority, after deliberation, decides to

    on the basis of Article 100, § 1, 1° WOG, to dismiss this complaint in view of the fact that

    no infringement of the GDPR can be established in this regard.




Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the

notice, an appeal against this decision will be filed with the Market Court (court of

appeal Brussels), with the Data Protection Authority as defendant.

Such an appeal can be lodged by means of an inter partes petition

must contain statements listed in Article 1034ter of the Judicial Code. It

an objection petition must be submitted to the registry of the Market Court

in accordance with Article 1034quinquies of the Dutch Civil Code. , or via the e-Deposit

IT system of Justice (Article 32ter of the Judicial Code).








(get). Hielke IJMANS

Chairman of the Disputes Chamber












1The petition states, under penalty of nullity:
 1° the day, month and year;

 2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
    company number;
 3° the surname, first name, place of residence and, where applicable, the capacity of the person to be
    summoned;
 4° the subject matter and brief summary of the grounds of the claim;
 5° the judge before whom the claim is brought;
 6° the signature of the applicant or his lawyer.
2The petition with its attachment, in as many copies as there are parties involved, will be sent by registered letter
deposited with the clerk of the court or at the registry.