APD/GBA (Belgium) - 93/2024

APD/GBA - 93/2024
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 15 GDPR Article 17(3)(e) GDPR
Type:	Complaint
Outcome:	Other Outcome
Started:
Decided:	17.06.2024
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	93/2024
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	French
Original Source:	APD/GBA (Belgium) (in FR)
Initial Contributor:	wp

The DPA decided to close the case on unlawful processing of a business e-mail address data, referring to the expediency requirement. According to the DPA, the case encompassed a broader dispute, not to be solved by the DPA decision.

English Summary

Facts

A data subject entered into contract with a company (data controller). Under the terms of the contract, the controller created a dedicated business e-mail address for data subject. Due to a conflict that arisen between the data subject and the controller, the parties decide to end business relations.

One of disputed issues was data subject’s e-mail address. The data subject expected the controller to properly close their e-mail address and inform interested parties about the cessation of collaboration and new contact data. Allegedly, the controller did not shut down the e-mail address once the collaboration was over. The e-mail address remained active. According to the data subject, the controller accessed the e-mail inbox, as well as read the incoming messages.

The data subject decided to exercise his rights of access, as well as restriction of processing and deletion of data. The controller responded to the access request. Yet, by invoking the confidentiality of the data at hand, provided the data subject with data partially unreadable (data referring to third-parties). Regarding the right to deletion and right to restriction of processing, the controller rejected the request, claiming, in general, that the data may be necessary for possible legal actions.

In response, the data subject lodged a complaint with the Belgian DPA (ADP/GBA).

Holding

The DPA decided not to investigate and close the case, recalling the expediency of the proceedings. They emphasised the subject matter of complaint referred to a broader dispute that to be examined by a competent court. A potential decision of the DPA would not solve the dispute at hand. Because of that, the alleged violations of the GDPR (exercise of the data subject rights), and the case before the DPA, were only ancillary to the main dispute going beyond the provisions of the GDPR.

Nevertheless, the DPA referred to the merits of the case. The DPA did not contest the fact the controller, in response to the access request under Article 15 GDPR, disclosed the unreadable data, since in that way the controller prevented from infringing the right of third-parties data. The alleged violation of Article 17 GDPR were also dubious, because Article 17(3)(e) GDPR mentioned by the controller, did not require the weighting the rights and freedoms of data subject, as indicated in the complaint.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/10

Litigation Chamber

Decision 93/2024 of 17 June 2024

File number: DOS-2023-02477

Subject: Complaint regarding the late closure, access to a nominative professional email address and its use after the end of the collaboration contract,

as well as the lack of an appropriate response to requests to exercise rights,

in particular access, limitation and deletion of personal data

The Litigation Chamber of the Data Protection Authority, consisting of Mr.

Hielke HIJMANS, President, sitting alone;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and

on the free movement of such data, and repealing Directive 95/46/EC (General Data

Protection Regulation), (hereinafter "GDPR");

Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, (hereinafter

"LCA");

Having regard to the Law of 30 July 2018 on the protection of natural persons with regard to the

processing of personal data, (hereinafter "LTD");

Having regard to the Rules of Procedure as approved by the Chamber of Representatives on

20 December 2018 and published in the Belgian Official Journal on 15 January 2019;

Having regard to the documents in the file;

Has taken the following decision concerning:

The complainant: X, represented by Maître Christophe D ELMARCELLE, hereinafter “the complainant”;

The defendant: Y, represented by Maître Vincent D ECKERS, hereinafter “the defendant”. Decision 93/2024 — 2/10

I. Facts and procedure

1. The complaint concerns the complainant’s professional email address and the exercise of the

rights conferred on the complainant by the GDPR.

2. On 30 June 2022, the defendant entered into a service provision contract with the

complainant’s company, also including the creation of a nominative professional

email address for the complainant.

3. Following the termination of the collaboration, which occurred in the second half of 2022

in a litigious context marked by threats according to the complainant, numerous

disagreements arose between the complainant and the defendant:

• The defendant allegedly failed to close the complainant's professional

personal email address (hereinafter referred to as the "disputed address"),

thus causing confusion and sending errors for senders. In addition, it allegedly

continued to access this disputed address and read incoming emails without

informing the complainant. The latter alleges that the defendant maintained this access

in order to offer its own services to email recipients. ;

• In addition, problems arose regarding the payment of the services provided

by the complainant to the defendant. ;

• Questions were also raised regarding copyright in the

documents provided by the complainant and intellectual property. ;

• Finally, disputes arose regarding the terms of termination of the

service provision contract between the complainant and the defendant.

4. These disagreements led the defendant to threaten the complainant with

criminal proceedings against him and to possibly claim damages from the

complainant. For his part, the complainant put the defendant on formal notice and reserved the

right to bring the matter before a competent court.

5. According to the complainant, the defendant also violated the

fundamental principles of the GDPR by failing to comply with the principles of

purpose, minimization and limitation of data retention. Despite its alleged specialisation in data protection

and the certification of its managers, the defendant allegedly failed to take the

necessary measures to block the complainant’s email, insert an

automatic message informing correspondents of the cessation of activity, and

provide new contact details.

6. In January 2023, the complainant allegedly exercised his data

protection rights, including the right to access, limit and erase his personal

data. Decision 93/2024 — 3/10

However, the defendant allegedly responded unsatisfactorily by contesting the

right of access and the disclosure of personal data, invoking confidentiality

clauses and claiming that disclosure would be prejudicial to its own

rights.

7. Furthermore, the defendant allegedly challenged the complainant's right to erasure of his personal data based on the possibility of legal action, without

concretely assessing the legitimate interest pursued and without providing

a precise justification for the restriction of processing. The complainant contests this

justification, claiming that it does not prevent a disproportionate

impact on his rights and freedoms.

8. Finally, the defendant allegedly also challenged the restriction of processing of the

complainant's personal data based on the possibility of legal action, without

adequately assessing the legitimate interest pursued.

9. On 2 June 2023, the complainant filed a complaint with the

Data Protection Authority.

10. On 30 June 2023, the Frontline Service of the Data Protection Authority

declared the complaint admissible on the basis of Articles 58 and 60 of the LCA, and forwarded it to the

Litigation Chamber in accordance with Article 62, § 1 of the LCA.

II. Grounds

11. Pursuant to Article 4, § 1 of the LCA, the DPA is responsible for monitoring the data

protection principles contained in the GDPR and other laws containing provisions

relating to the protection of the processing of personal data.

12. Pursuant to Article 33, § 1 of the LCA, the Litigation Chamber is the administrative

litigation body of the DPA. It is seized of complaints that the SPL transmits to it in

application of Article 62, § 1 of the LCA, i.e. admissible complaints. In accordance with Article

60, paragraph 2 of the LCA, complaints are admissible if they are written in one of the

national languages, contain a statement of the facts and the information necessary to
identify the processing of personal data to which they relate and which

fall within the jurisdiction of the APD.

13. On the basis of the facts described in the complaint file as summarised above, and on

the basis of the powers assigned to it by the legislator under Article
er
95, § 1 of the LCA, the Litigation Chamber decides on the follow-up to be given to the file; in
this case, the Litigation Chamber decides to proceed with the dismissal of

the complaint, in accordance with Article 95, § 1, 3° of the LCA, for the reasons set out

below. Decision 93/2024 — 4/10

14. In matters of dismissal, the Litigation Chamber is required to justify its
1
decision by stage and to:

- pronounce a dismissal of technical action if the file does not contain or

not enough elements likely to lead to a sanction or if it contains a

technical obstacle preventing it from rendering a decision;

- or pronounce a dismissal of opportunity, if despite the presence

of elements likely to lead to a sanction, the continuation of the examination of the

file does not seem appropriate to it taking into account the priorities of the

Data Protection Authority as specified and illustrated in the

Dismissal Policy of the Litigation Chamber. 2

15. In the event of a dismissal based on several grounds for dismissal, the

latter (respectively, dismissal on technical grounds and dismissal on

expediency grounds) must be treated in order of importance. 3

16. In this case, the Litigation Chamber decides to dismiss

the complaint on grounds of expediency. The decision of the Litigation Chamber is based more

specifically on a reason why it considers that it is inappropriate to pursue

the case, and consequently decides not to proceed, among other things, with

an examination of the case on the merits.

17. The Litigation Chamber notes that the complainant complains of a late closure but also of

access to his personal email address and its use after the

termination of the collaboration contract. In addition, it notes the complaints that the

defendant has not provided an appropriate response to the complainant's requests to exercise the rights of

access, limitation and deletion of personal data.

18. Firstly, the Litigation Chamber notes that the complaint is incidental to a

broader dispute that needs to be debated before the judicial and

administrative courts and tribunals or another competent authority; and decides to dismiss the

complaint without further action on grounds of expediency (criterion B.3). 4

19. The Litigation Chamber notes that the termination of the collaboration entered into by the

defendant under a service provision contract with the complainant,

1Court of Markets (Brussels Court of Appeal), 2 September 2020, judgment 2020/AR/329, p. 18.
2 APD, “Policy for the classification without further action of the Litigation Chamber”, 18 June 2021, available at
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-contentieuse.pdf
3 APD, “Policy for the classification without further action of the Litigation Chamber: 3. – In which cases is my complaint likely to be classified without further action by the Litigation Chamber?”, 18 June 2021, available at https://www.autoriteprotectiondonnees.be/publications/politique-de-
classement-sans-suite-de-la-chambre-contentieuse.pdf.
4APD, “PolitiquedeclassementsanssuitedelaChambreContentieuse:3.2Critèresdeclassementsanssuited’opportunité –B.3– Votre complainte
est ancillary à un broader dispute qui necessiter être débatté avant la cours et administratifs ou une autreautorité
competente”, 18 June 2021, available at https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-
chambre-contentieuse.pdf. Decision 93/2024 — 5/10

intervenes in a litigious context where the latter alleges threats from the

defendant.

20. By examining the documents in the file, it appears that the dispute between the parties goes beyond the

only issues related to the alleged violations of the GDPR. It also encompasses conflicts

concerning the payment of the complainant for the services provided, the conditions for terminating the

contract, as well as copyright issues. This diversity of conflicts

demonstrates that the complaint submitted to the DPA is incidental to a broader dispute. In addition, the

Litigation Chamber underlines that this conflictual context seems to be confirmed through

the exchanges between the parties, as well as their nature. Whether it is the requests for data

formulated with a view to bringing legal actions or the defendant's response aimed

at protecting itself from possible legal proceedings, these elements indicate, or even confirm,

the existence of a broader and complex dispute that goes beyond the simple questions of

alleged violations of the GDPR (see points 3, 4, 7, 8 and 19), which the parties are trying to

resolve.

21. Therefore, given that the complaint is part of a broader context of breach of

the service contract between the complainant and the respondent, encompassing

issues that go beyond the alleged violations of the GDPR, such as

disputes over the payment of the complainant for the services provided, the

terms of termination of the contract or copyright issues, the

Litigation Chamber considers that its intervention is, in this case,

not strictly necessary. It would be more appropriate to submit the

complaint to a competent court or appropriate authority, which will be

able to examine in depth all the elements of the main dispute,

including access to the professional mailbox, thus ensuring

that the complaint is properly handled with a view to taking the

best possible decision.

22. Secondly, and without prejudice to the foregoing, the Disputes Chamber questions the possible existence of ongoing or

closed judicial or administrative proceedings dealing with the same grievances as those raised in this
5
complaint; and decides to dismiss the complaint on grounds of expediency (criterion B.2).

23. The elements of the complaint file, in particular the allegations of threats, the possibility

of legal action, the disagreements over payment for services, the termination of the

contract and the copyright issues, reveal the complexity and scale of the dispute between the

parties. This dispute goes far beyond the simple issues of alleged violations of the GDPR.

This complexity suggests that it could currently be examined by the Courts and

Tribunals, or other competent authorities; or at least that it will be in the future.

5
APD, “Policy for classification without further action of the Contentious Chamber: 3.2.2 – Efficiency criteria - B.2 There is a judicial procedure or

https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-contentieuse.pdf, available on Decision 93/2024 — 6/10

24. In addition, other elements of the file, such as the defendant’s mentions of

the “criminal setbacks” that the complainant could encounter, the formal notice of

payment under penalty of legal action, or the complainant’s intention to bring the

case [relating to non-payment for his services, the email address, the

conditions for termination of the collaboration or questions related to copyright] before the

competent courts, suggest that the dispute could also be currently

being examined or that it could be the subject of judicial or administrative proceedings in the future.

25. The Litigation Chamber recalls that it assesses the efficiency of its intervention and the

means necessary to deal with the complaint in depth. In this case, without

minimising the importance of the incident reported, a thorough investigation would

require considerable means to gather additional evidence, question the parties

involved and assess the circumstances surrounding the allegations.

26. Thirdly, and without prejudice to the foregoing, the Litigation Chamber considers

that a thorough examination of the complaint would not be proportionate, taking into account, for

example, the means necessary to examine it, the chances of success of the complaint, or

the volume of complaints received on the same topic; and decides

to dismiss the complaint on grounds of expediency (criterion B.7). 6

27. In this case, it is clear that the complainant and the respondent are engaged in a complex

conflict involving various requests and claims regarding the processing of

personal data. The complainant claims several rights, including the right of

access, erasure and restriction of processing, while the respondent puts forward

arguments to justify its actions in accordance with the GDPR.

28. Regarding the right of access, the complainant argues that certain

information is omitted, which restricts its ability to fully exercise this right. The respondent justifies

this omission by invoking the need to protect its professional secrets and

prevent violations of the rights of others. In response, it allegedly provided as much

personal data as possible while preserving the confidentiality of third parties,

including by rendering third-party data illegible.

6APD, “PolitiquedeclassementsanssuitedelaChambreContentieuse:3.2.2 –Criteriaforefficiency-B.7Athoroughexaminationofyourcomplaintwouldnotbeproportionatetakinginto,forexample,theresourcesnecessarytoexamineit,theprobabilitiesofsuccessofthecomplaint,ortakingintoaccountthevolumeofcomplaintsreceivedonthesametheme”,18June2021,availableathttps://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-contentieuse.pdf; A classification
without follow-up on grounds of expediency does not, however, mean that theContemptible Chamber legally finds that no violation has taken place, but that the resourcesnecessarytosupportthecomplaintarepotentiallyexcessive. ; APD, “Policy for filing without follow-up of the Contentious Chamber”, 18 June 2021, available at https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-
suite-de-la-chambre-contentieuse.pdf
7In addition to providing a secure USB stick containing a copy of the complainant’s data, the defendant also
transmitted a detailed table including the different categories of personal data, the purposes of the processing, the
recipients, the retention period, information on the exercise of the complainant’s rights in accordance with the GDPR, as well as
information on the existence of automated decision-making. Decision 93/2024 — 7/10

8
29. The complainant refers to a previous decision of the Contentious Chamber concerning the

non-disclosure of personal data to protect the rights of third parties to

contest the defendant’s arguments. This previous decision establishes that rendering

third-party personal data illegible before the data subject exercises his

right of access satisfies the requirement of not infringing their rights. In the present case, the

defendant gave the complainant a copy of the data, while rendering

any third-party data illegible.

30. Regarding the right to erasure and restriction of processing, the complainant criticises

the defendant for not having adequately responded to his requests. He alleges

a failure to balance the fundamental rights and freedoms of the data subject

with the legitimate interest of the defendant. He adds that the defendant’s

refusal to fully comply with his requests, by invoking the establishment,

exercise or defence of his rights in court, is “purely rhetorical and not precise”.

Furthermore, the complainant claims that the defendant has no legitimate interest, citing the decision

on the merits 46/2022 of the Contentious Chamber. In addition to the fact that Article 17.3 e) of the

GDPR does not require balancing the fundamental rights and freedoms of the data

subject and the legitimate interest of the defendant, and that the cited decision concerns the

legal basis and the legitimate interest of an employer to recover files that have been

deleted by an employee (these are therefore not the same facts), the defendant has, in this case,

indicated in its response that some of the applicant's personal data would be deleted.

As for the limitation of processing, the defendant maintains that it limits the processing

of the complainant's personal data to simple retention and states that any other

processing would require the complainant's consent.

31. In these circumstances, the Litigation Chamber considers that it would be excessive to

mobilise the resources of the Inspection Service to support the evidence concerning the

requests for access, erasure and restriction of processing. This conclusion is

motivated by the complexity and scale of the broader conflict, where the intervention of the

Litigation Chamber is not strictly necessary. It would be more judicious to call upon

other competent courts or appropriate authorities to examine exhaustively all

aspects of the main dispute, including access to the professional

mailbox. This would ensure that the complaint is properly handled and would

promote the most informed decision-making possible.

32. Finally, and without prejudice to the foregoing, the Litigation Chamber notes

that on the one hand, the complaint does not provide the necessary details or the required evidence

8 Decision on the merits No. 15/2021 of the Litigation Chamber of the APD of 9 February 2021, available at
https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-15-2021.pdf;
9 Decision on the merits No. 46/2022 of the Litigation Chamber of the APD of 1 April 2022, available on
https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-46-2022.pdf Decision 93/2024 — 8/10

allowing the existence of a manifest violation of the GDPR to be assessed; on the other hand, it does not

appear to have a high societal and/or personal impact; consequently, the

Litigation Chamber decides to dismiss the complaint on grounds of expediency

10
(criterion B.5).

33. On the one hand, the Litigation Chamber notes that the grievances raised by the complainant do not

meet the criteria of high general or personal impact, as defined by

11
the APD in its note on the policy of dismissal of 18 June 2021.

34. On the other hand, if the criteria of high general or personal impact do not apply, the

Litigation Chamber balances the personal impact of the circumstances of the complaint

for the complainant's fundamental rights and freedoms, and the efficiency of its intervention,

to decide whether it considers it appropriate to deal with the complaint in depth.

35. In this case, the Litigation Chamber notes that it does not have, as

mentioned above in this decision, sufficient evidence that would allow it to

verify whether the complainant's allegations constitute a manifest violation of the GDPR and

data protection laws.

36. The Disputes Chamber recalls that it assesses the efficiency of its intervention and the

means necessary to deal with the complaint in depth. In this case, without

minimising the importance of the incident reported, and as already

mentioned above, a thorough investigation would require considerable resources to

gather additional evidence, question the parties involved and assess the

circumstances surrounding the allegations. It should be noted that the

complaint is part of a broader conflict context, including the breakdown of

a contractual collaboration between the complainant and the defendant, the allegations of

threats made by the complainant, the prospect of legal action initiated by the

latter, as well as disputes related to payment and copyright issues (see

above). It is precisely because of these main considerations that the efficiency of its intervention is, in this case, not demonstrated and that

the means to be implemented to support the complaint are potentially excessive, which

leads the Litigation Chamber not to uphold the complainant's grievances and to decide to
12
dismiss the complaint on grounds of expediency.

1APD, "Dismissal policy of the Litigation Chamber: 3.2 Dismissal criteria for expediency - B.5 - Your
complaint is not sufficiently detailed or is not supported by evidence that would allow the Litigation Chamber to rule on
whether or not there is a violation of the GDPR AND your complaint does not have a high societal and/or personal impact. », 18 June 2021, available
11r https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-contentieuse.pdf.
APD, « Policy for classification without follow-up of the Contentious Chamber: 3. – In which cases is my complaint likely to be classified without follow-up by the Contentious Chamber? », 18 June 2021, available at https://www.autoriteprotectiondonnees.be/publications/politique-de-
12assement sans-suite-de-la-chambre-contentieuse.pdf.
A classification without follow-up on grounds of expediency does not mean that the Contentious Chamber legally finds that no
violation has taken place, but that the resources needed to support the complaint are potentially excessive. ;APD, “Politiquedeclassement
sans suite de la Chambre Contentieuse”, 18 June 2021, available at https://www.autoriteprotectiondonnees.be/publications/politique-de-
classement-sans-suite-de-la-chambre-contentieuse.pdf Decision 93/2024 — 10/10

To allow the complainant to consider any other possible course of action, the Chamber Contentieuse refers

the complainant to the explanations provided in its policy on classification without further action. 17

(sé). Hielke HIJMANS

President of the Chamber Contentieuse

17APD, “Policy on classification without further action of the Chamber Contentieuse: 4. – What can I do if my complaint is classified without further action? », June 18, 2021, available at https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
contentieuse.pdf.