APD/GBA (Belgium) - 47/2024

APD/GBA - 47/2024
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 57(4) GDPR
Type:	Complaint
Outcome:	Rejected
Started:	23.11.2023
Decided:	19.03.2024
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	47/2024
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	French
Original Source:	APD (in FR)
Initial Contributor:	nzm

The DPA closed a case considering, among other things, that the complaint was manifestly excessive as it was filed almost 2 years and 9 months after the events took place.

English Summary

Facts

The controller, a bank (“controller 1”), decided to block the data subject’s bank account for an overdraft of €1,400. The data subject made an access request, asked the controller to justify its action, asked for the erasure of their personal data and explained that the debt had been transferred to a debt collecting agency (“controller 2”) and had been repaid shortly after their account had been blocked.

The data subject received no response to their telephone calls nor emails and the controller even blocked their email address. The data subject also contacted controller 2 to ask for the erasure of their personal data. Controller 2 indicated that it was able to retain the data subject’s personal data for a period of 10 years. The data subject questioned the legality of such a practice and therefore lodged a complaint with the Belgian DPA (“APD”) against controller 1 for not responding to the data subject access request and the erasure request and against controller 2 for not taking into account their deletion request.

Holding

Firstly, the APD considered that the complaint did not present the necessary details to assess whether there was a breach of the GDPR.

Regarding the complaint against controller 1, the APD found that the data subject submitted a copy of a single email, which does not authenticate the information provided, nor does it constitute conclusive evidence.

Regarding the complaint against controller 2, the APD held that the data subject did not provide any evidence of exchanges with the defendant concerning his erasure request.

Secondly, the APD pointed out the events took place between December 2020 and February 2021. However, the data subject lodged a complaint with the DPA in November 2023 which represents a delay of more than 2 years and 9 months since the last exchanges with the controllers. The APD also pointed out that no valid justification had been provided to explain this significant lapse of time. Therefore, the APD held that the complaint was manifestly excessive pursuant to Article 57(4) GDPR.

Thus, the APD closed the case with no further action.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/7




                                                                        Litigation Chamber


                                                          Decision 47/2024 of March 19, 2024


File number: DOS-2023-04810


Subject: Complaint relating to the lack of response from a bank to the exercise of the right of access

and a request for erasure; as well as the refusal by a collection office of

comply with an erasure request



The Litigation Chamber of the Data Protection Authority, made up of Mr.

Hielke HIJMANS, president, sitting alone;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the

protection of natural persons with regard to the processing of personal data and

to the free movement of these data, and repealing Directive 95/46/EC (general regulation on the

data protection), hereinafter “GDPR”;

Having regard to the Law of December 3, 2017 establishing the Data Protection Authority, hereinafter

“ACL”;


Having regard to the Law of July 30, 2018 relating to the protection of individuals with regard to

processing of personal data, hereinafter “LTD”;

Having regard to the Internal Regulations as approved by the House of Representatives on

December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;


Considering the documents in the file;


Has taken the following decision regarding:



The complainant: X, hereinafter “the complainant”;


Defendant 1: Y1, hereinafter “defendant 1”;


Defendant2: Y2, hereinafter “defendant 2”. Decision 47/2024 — 2/7



I. Facts and procedure


    1. On November 22, 2023, the complainant filed a complaint with the Protection Authority

        data (hereinafter “the DPA”) against defendant 1, (hereinafter “the

        defendant 1”) and defendant 2, (hereinafter “defendant 2”).


    2. The subject of the complaint concerns the lack of response by defendant 1 to the exercise of the

        right of access and request for erasure; as well as the refusal by defendant 2 to

        comply with an erasure request.

    3. In the complaint form, the complainant explained that in December 2020, the defendant

        1decided, without notice, to block his bank accounts because of an overdraft of 1400

        euros. The complainant also specified that this debt had been transferred to an office

        recovery, namely defendant 2.


    4. On February 5, 2021, the plaintiff contacted defendant 1 to request the

        deletion of personal data. In this same email, the complainant explains

        that he would have repaid the debt in question shortly after his accounts had been blocked, and

        he asks defendant 1 to justify her action. The complainant also criticizes

        defendant 1 for not answering his questions during their telephone exchanges.

    5. As part of the complaint form, the complainant reported that he had still not received

        response from defendant 1 regarding its request for access. He added that he

        would also have asked defendant 1 to provide all the information she

        holds towards him. The plaintiff explained that defendant 1 did not respond to these

        questions by telephone and had even blocked his email address.


        Furthermore, the complainant allegedly, on an unknown date, contacted defendant 2 to

        also request the deletion of their personal data. However, the

        Defendant 2 would have responded by indicating that she was able to keep the

        personal data of the complainant for a period of 10 years. Faced with this response, the

        complainant questions the legality of such a practice.


    6. On November 23, 2023, the complaint was declared admissible by the Front Line Service
                                                                      1
        (hereinafter “SPL”) on the basis of articles 58 and 60 of the LCA and the complaint was transmitted to
                                                              st 2
        the Litigation Chamber under article 62, § 1 of the LCA.










1Pursuant to article 61 LCA, the Litigation Chamber informs the parties by this decision of the fact that the complaint has been declared
admissible.
2Pursuant to article 95, § 2 LCA, by this decision, the Litigation Chamber informs the parties of the fact that following this complaint,
the file was sent to him. Decision 47/2024 — 3/7



II. Motivation



    7. Pursuant to Article 4, §1 of the LCA, the AP is responsible for controlling the principles

        data protection contained in the GDPR and other laws containing

        provisions relating to the protection of the processing of personal data.

    8. Pursuant to article 33, §1 of the LCA, the Litigation Chamber is the body of

        administrative litigation of the APD. It receives complaints that the SPL sends to it in


        application of article 62, § 1 of the LCA, or admissible complaints. In accordance with

        Article 60, paragraph 2 of the LCA, complaints are admissible if they are drawn up in one

        national languages, contain a statement of the facts and the necessary indications for

        identify the processing of personal data to which they relate and which

        fall under the jurisdiction of the APD.


    9. Based on the facts described in the complaint file as summarized above, and on the

        basis of the powers assigned to it by the legislator under article 95,
           er
        § 1 of the LCA, the Litigation Chamber decides on the follow-up to be given to the file; in

        occurrence, the Litigation Chamber decides to proceed with the classification without further action of the

        complaint, in accordance with article 95, § 1, 3° of the LCA, for the reasons set out below.


    10. In matters of dismissal, the Litigation Chamber is required to provide reasons for its decision.
                            3
        decision by step and to:

            - pronounce a classification without technical follow-up if the file does not contain or not


                sufficient evidence likely to lead to a sanction or if it includes a

                technical obstacle preventing it from rendering a decision;


            - or pronounce a classification without further opportunity, if despite the presence

                of elements likely to lead to a sanction, the continuation of the examination of the

                file does not seem appropriate given the priorities of the Authority of

                data protection as specified and illustrated in the Privacy Policy

                classification without further action by the Litigation Chamber. 4


    11. In the event of dismissal based on several grounds for dismissal, these

        last (respectively, classification without technical follow-up and classification without follow-up

        opportunity) must be treated in order of importance. 5








3Market Court (Brussels Court of Appeal), September 2, 2020, judgment 2020/AR/329, p. 18.
4In this regard, the Litigation Chamber refers to its policy of classification without further action as developed and published on the Authority’s website
of data protection, available at https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-
the-chamber-contentious.pdf.
5APD, “Disclosure policy of the Litigation Chamber: 3. – In what cases is my complaint likely to be closed
sanssuiteparlaChambreContentieuse?”, June 18, 2021, available at https://www.autoriteprotectiondonnees.be/publications/politique-de-
classification-without-suite-of-the-contentious-chamber.pdf. Decision 47/2024 — 4/7



    12. The Litigation Chamber notes that the complainant raises two complaints against the

        defendant 1, namely the lack of response to his request for erasure and his request

        access. Furthermore, it notes that the complainant raises a grievance against the

        defendant 2, namely the failure to take into account her request for erasure.

    13. The Litigation Chamber decides to proceed with a classification without further action on the complaint for

        reason of opportunity. The decision of the Litigation Chamber is based more precisely on

        two reasons why it considers it inappropriate to continue monitoring the

        file, and therefore decides not to proceed, among other things, with an examination of

        the case on the merits.


    14. Firstly, the Litigation Chamber notes that, on the one hand, the complaint presents

        not have the necessary details or evidence required to assess the existence

        a violation of the GDPR; on the other hand, it does not seem to have a societal impact

        and/or high staff; consequently, the Litigation Chamber decides to classify the

        complaint without action for reasons of expediency (criterion B.5).


    15. On the one hand, the Litigation Chamber notes that the grievances raised by the complainant do not

        do not meet the criteria of high general or personal impact, as defined by
                                                                                    7
        the APD in its note on the classification policy of June 18, 2021.

    16. On the other hand, if the criteria of high general or personal impact do not apply, the

        Litigation Chamber weighs the personal impact of the circumstances of the complaint

        for the rights and fundamental freedoms of the complainant, and the efficiency of his intervention,

        to decide whether it considers it appropriate to deal with the complaint in depth.


    17. In the present case, the Litigation Chamber notes that it does not have sufficient

        evidence that would make it possible to verify whether the complainant's allegations

        constitute a potential violation of GDPR and data protection laws. In

        Indeed, the Litigation Chamber notes that it cannot comment on a possible

        lack of response from defendant 1 to the plaintiff's request for erasure, fault

        sufficient evidence provided by the latter. The copy of a single email presented by the

        complainant does not authenticate the information provided or constitute a

        conclusive proof. Furthermore, this single email appears to be part of a series of

        correspondence between the complainant and the defendant 1 of which the complainant failed to

        provide the copy. With regard to the request for access mentioned in the form

        complaint, the Litigation Chamber notes that it has no proof of

        the submission of such a prior request to defendant 1 (see point 5).




6APD, “Disclosure policy of the Litigation Chamber: 3. – In what cases is my complaint likely to be closed
sanssuiteparlaChambreContentieuse?”, June 18, 2021, available at https://www.autoriteprotectiondonnees.be/publications/politique-de-
classification-without-suite-of-the-contentious-chamber.pdf.
7Ibidem. Decision 47/2024 — 5/7



    18. Likewise, the Litigation Chamber notes that it does not have any


        sufficient evidence regarding the allegations regarding the

        defendant 2. The Litigation Chamber notes that the plaintiff provides no evidence

        exchanges with defendant 2, mentioning only in the form of

        complaint that he contacted her to request the erasure of her data, without

        support your statements with factual support (see point 5).


    19. The Litigation Chamber recalls that it evaluates the efficiency of its intervention and the

        means necessary to deal with the complaint thoroughly. In this case, without

        minimize the importance of the reported incident, a thorough investigation would require

        disproportionate means of gathering additional evidence, interviewing


        parties involved and assess the circumstances surrounding the allegations.

    20. Finally, the Litigation Chamber notes that the complaint is clearly


        excessive within the meaning of article 57.4 of the GDPR; and decides to close the complaint without further action
                                                 8
        for reasons of opportunity (criterion B.4).


    21. The Litigation Chamber may classify a complaint as manifestly excessive by
                                            9
        under article 57.4 of the GDPR in cases where it considers that the complaint is judged

        manifestly abusive, particularly if a significant period of time has elapsed between the

        alleged facts and the filing of the complaint, without any valid justification, such as

        unless an attempt at mediation is provided. The APD, including the Litigation Chamber,

        can therefore decide not to follow up on such complaints to preserve the effectiveness of the

        personal data protection mechanisms.


    22. In the present case, the Litigation Chamber notes that the facts took place between December

        2020 and February 2021 (see points 3 to 5). However, the complainant did not file his complaint with

        of ODA until November 23, 2023, which represents a delay of more than 2 years and 9 months


        since the last exchanges with defendants 1 and 2. The Litigation Chamber

        underlines that no valid justification has been provided to explain this lapse of time

        important between the facts in dispute and the filing of the complaint.


    23. To the extent that it appears from the documents in the file that the efficiency of the intervention of the

        Litigation Chamber is, in this case, not demonstrated and only the means to be implemented

        work to support the complaint are potentially excessive, the Litigation Chamber does not








8A dismissal for reasons of expediency does not mean that the Litigation Chamber legally notes that no
violation has occurred, but the resources required to substantiate the complaint are potentially excessive. ; APD, “Policy of
classification without further action by the Litigation Chamber", June 18, 2021, available on
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-contentieuse.pdf.
9Article 57.4 of the GDPR provides: “When requests are manifestly unfounded or excessive, due, in particular, to their
repetitive nature, the supervisory authority may require payment of reasonable fees based on administrative costs or refuse to provide
Following the request. It is the responsibility of the supervisory authority to demonstrate that the request is manifestly unfounded or excessive.” Decision 47/2024 — 7/7



                                                                                                                                   14
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , Or

via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. judic.).


To enable it to consider any other possible course of action, the Litigation Chamber refers

the complainant to the explanations provided in its classification policy without further action. 15









(sé). Hielke HIJMANS



President of the Litigation Chamber































































14The request, accompanied by its annex, is sent, in as many copies as there are parties involved, by registered letter to
clerk of the court or filed with the registry.
15APD, “Discontinuation policy of the Litigation Chamber: Title 4 – What can I do if my complaint is dismissed? ",
June 18, 2021, available at https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-

litigation.pdf.