APD/GBA (Belgium) - 17/2020: Difference between revisions

From GDPRhub
 
(9 intermediate revisions by 2 users not shown)
Line 7: Line 7:
|DPA_With_Country=APD/GBA (Belgium)
|DPA_With_Country=APD/GBA (Belgium)


|Case_Number_Name=DOS-2019-05450
|Case_Number_Name=17/2020
|ECLI=
|ECLI=


|Original_Source_Name_1=APD/GBA
|Original_Source_Name_1=APD
|Original_Source_Link_1=https://www.autoriteprotectiondonnees.be/sites/privacycommission/files/documents/Decision_CC_17-2020_FR_.pdf
|Original_Source_Link_1=https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-17-2020.pdf
|Original_Source_Language_1=French
|Original_Source_Language_1=French
|Original_Source_Language__Code_1=FR
|Original_Source_Language__Code_1=FR


|Type=Complaint
|Type=Complaint
|Outcome=Partly Upheld
|Outcome=Upheld
|Date_Decided=
|Date_Decided=
|Date_Published=
|Date_Published=
Line 23: Line 23:
|Currency=
|Currency=


|GDPR_Article_1=Article 5(1)(a) GDPR
|GDPR_Article_1=Article 12(3) GDPR
|GDPR_Article_Link_1=Article 5 GDPR#1a
|GDPR_Article_Link_1=Article 12 GDPR#3
|GDPR_Article_2=Article 6(1)(f) GDPR
|GDPR_Article_2=Article 15(1) GDPR
|GDPR_Article_Link_2=Article 6 GDPR#1f
|GDPR_Article_Link_2=Article 15 GDPR#1
 
|GDPR_Article_3=Article 15(3) GDPR
|GDPR_Article_Link_3=Article 15 GDPR#3




Line 50: Line 51:
}}
}}


The Belgian data protection authority (APD/GBA) ruled that an employer who collected orally personal information relating to a former employee and further shared to a third party for the purpose of legal defense, breached the GDPR.   
The Belgian DPA (APD/GBA) ruled that a bank was subject to the GDPR in its capacity as a controller and should have answered access requests under Article 15 GDPR.  
 
==English Summary==
 
===Facts===
The complainants are clients of the defendant, a bank. In September 2019, the complainants made an access request to the bank’s controller. More precisely, they both sent a letter through their counsels, requesting “a copy of all the personal data [the bank] hold(s) as well as any additional information [the bank] ha(s) against [us] asking”.  In response, the defendant asked them to provide for their ID cards and to specify which right they wanted to exercise. As the complainants found that the question was self-explanatory, they did not answer and lodged directly a complaint with the DPA in October 2019.
 
The complainants argued that the defendant should not have made the exercise of their access right conditional on either a clarification of the right at stake nor the sending of on a copy of the complainants' identity card.   


== English Summary ==
The Defendant mainly argued that the data protection authority was not competent because the banking sector is not subject to data protection act.
===Dispute===
The authority has to clarify the scope of application of Article 15 GDPR. 


=== Facts ===
===Holding===
The complainant has been dismissed in December 2017 and April 2018 by  the two defendants who are thus, former employers. In April 2018, the Complainant and his Union challenged the first dismissal and further exchanged with the first employers regarding the dismissal. The second employer initiated a proceeding against him to retrieve documents, over the same period in 2018. 
The authority ruled that the data subjects who exercised their access right are not required to identify the applicable and relevant legal framework as long as the authority can assist them and ensure a clear understanding of the potential violation which is under its jurisdiction. Where necessary, the authority can change the legal qualification of the facts and review new facts within the limits of a contradictory debate. Thus, the authority is competent to examine the merits of a complaint as legally reclassified and submitted under Article 15 GDPR.  
The complainants learned through his Union that the second employer gave personal information linked to the undergoing litigation to the first employer. The first employer further shared the same information to the Union.  
Thus, the Complaint filed a complaint with the Belgian data protection authority claiming that the second employer unlawfully transmitted personal data to the first employer who unlawfully collected and further shared that information with a third party, the Union.  


=== Dispute ===
Also, the authority reminded that the controller must reply to an access request within the limit of one month under Article 12(3) ''juncto'' Article 15 GDPR. This deadline can be extended only under specific circumstances. In this regard, the defendant did not justify the delay and the incompleteness due specific circumstances such as complexity or the amount of requests to handle.
The Authority had to discuss whether the two processing at stake fallen into the scope of the GDPR and then, if there were unlawful.  


=== Holding ===
First, the complainants’ identity was made sufficiently clear in the access requests. Then, the authority recalled that the validity of an access request does not depend on whether a legal basis is invoked but on whether the access request is clear enough. Finally, the authority clarified that if the data subject does not request explicitly specific information, the controlled is required to give at once all the persona data mentioned by virtue of Article 15(1) GDPR, in the lights of Recital (63) GDPR.
Concerning the second employer, the authority ruled that personal information linked to the litigation was not a processing within the meaning of Article 2(1) GDPR. Indeed, the first employer never had access to the ruling which was issued shortly before the two employers talked about the complainant only orally. Thus, there is neither an automated processing system, nor a filing system. As a consequence, the first part of the complaint was rejected.
Concerning the first employer, the authority ruled that the information collected from the second employer was unlawfully processed under Aticle 6(1)(f) GDPR, and thus, the controller breached the principle of fairness under Article 5(1)(a) GDPR.  
First, the authority pointed out that the information linked to the civil litigation does not fall under Article 10 GDPR which only applies to criminal convictions and offences.
Secondly, the authority recalled that the processing is lawful under Article 6(1)(f) GDPR to the extent that the pursuit of a legitimate interest by the controller (a), the necessity of the processing for the fulfilment of the legitimate interest pursued (b) and the condition that the fundamental rights and freedoms of the data subjects do not prevail over the interest pursued (c), are cumulative -.
The authority acknowledged that the interest invoked by the controller, namely his legal defense, was legitimate. However, it also ruled that the necessity and proportionally criteria were not fulfilled. Indeed, the authority highlighted that it would be excessive and disproportional to accept that all previous employers can exchange any information relating to an employee, for their legal defense. Thus the sharing of information to the Union was unlawful.  


== Comment ==
Thus, the authority ruled that the lack of a complete answer was a breach of Articles 12(3), 15(1) and 15(3) GDPR


==Comment==


== Further Resources ==
''share your comment here!''
==Further Resources==
''Share blogs or news articles here!''
''Share blogs or news articles here!''


== English Machine Translation of the Decision ==
==English Machine Translation of the Decision==
The decision below is a machine translation of the French original. Please refer to the French original for more details.
The decision below is a machine translation of the French original. Please refer to the French original for more details.


<pre>
<pre>
Chambre Contentieuse
 
                                                             
Litigation Chamber
Substantive Decision 17/2020 of 28 April 2020
 
File No.: DOS-2019-05450
Subject: Complaint by two customers against their bank following their request for communication by return mail of all the personal data it had about them.
The Litigation Chamber of the Data Protection Authority, consisting of Mr Hielke Hijmans, president, and Messrs Jellle Stassijns and Christophe Boerave, members, which takes over the case in its present composition;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Regulation on Data Protection), hereinafter referred to as the DPA;
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter LCA);
   
   
Décision 03/2020 du 21 février 2020
Having regard to the Law of 30 July 2018 on the protection of individuals with regard to the processing of personal data (hereinafter the "Data Protection Law");
   
   
Having regard to the internal rules of procedure of the Data Protection Authority as approved by the
House of Representatives on 20 December 2018 and published in the Moniteur belge on 15 January 2019 ;
   
   
Having regard to the documents on file;
   
   
N° de dossier : DOS-2018-05326
Has taken the following decision concerning: - the complainants 
   
   
Objet : Plainte de Monsieur X à l’encontre deux anciens employeurs  
- the defendant (controller)  
   
   
La Chambre Contentieuse de l'Autorité de protection des données, constituée de Monsieur Hielke
1. History of the procedure
Hijmans, président, et de Messieurs Romain Robert et Christophe Boeraeve, membres ;
   
   
Vu le Règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l'égard du traitement des données à caractère personnel et à la libre circulation de ces données, et abrogeant la Directive 95/46/CE (Règlement Général sur la Protection des Données), ci-après RGPD;  
1. Having regard to the complaint lodged on 16 October 2019 with the Data Protection Authority by the complainants, through their counsel ;  
   
   
Vu la Loi du 3 décembre 2017 portant création de l'Autorité de protection des données (ci-après LCA);
2. Having regard to the additional information provided by the complainants' counsel to the DPA on 13 November 2019.
   
   
Vu le règlement d'ordre intérieur de l’Autorité de protection des données tel qu'approuvé par la
3. Having regard to the decision of 22 November 2019 of the Data Protection Authority's First Line Service (hereinafter "DPA") declaring the complaint admissible and the transmission of the complaint to the Litigation Chamber on the same date ;
Chambre des représentants le 20 décembre 2018 et publié au Moniteur belge le 15 janvier 2019 ;  
   
   
Vu les pièces du dossier ;
4. Having regard to the decision of the President of the Litigation Chamber that the file was ready for processing on the merits pursuant to Articles 95 § 1, 1° and 98 ACL, the President invited the parties to conclude by registered letter of 20 January 2020, with a copy of the complaint and the inventory of the file. 
   
   
A pris la décision suivante concernant :
5. Having regard to the letter of 31 January 2020 in which counsel for the defendant requested a copy of the documents in the file, which was sent to them by the Secretariat of the Litigation Chamber on 4 February 2020.
- le plaignant 
   
   
- le responsable de traitement 1 (ci-après  le premier défendeur)
6. Having regard to the submissions of the defendant, received on 21 February 2020 ;  
- le responsable de traitement 2 (ci-après le second défendeur) 
 
I. Rétroactes de la procédure
Vu la plainte déposée le 30 septembre 2018 par le plaignant auprès de l’Autorité de protection des données ;
   
   
Vu la décision du 15 octobre 2018 du Service de première ligne de l’Autorité de protection des données déclarant la plainte recevable et la transmission de celle-ci à la Chambre Contentieuse à cette même date ; 
7. Having regard to the conclusions of the plaintiffs, received on 6 March 2020 ;   
 
Vu la décision prise par la Chambre Contentieuse lors de sa séance du 23 octobre 2018 de considérer que le dossier était prêt pour traitement quant au fond en vertu des articles 95 § 1er, 1° et 98 LCA ;   
   
   
Vu le courrier daté du 30 octobre 2018 de la Chambre Contentieuse informant les parties de sa décision précitée de considérer le dossier comme étant prêt pour traitement au fond sur la base de l’article 98 LCA ;   
8. Having regard to the form of order sought by the defendant, received on 20 March 2020.
   
   
Vu l’invitation du 29 novembre 2018 adressée par la Chambre Contentieuse aux parties les invitant à faire valoir leurs arguments selon un calendrier établi ; 
2. The facts and subject-matter of the complaint
   
   
Vu les modifications apportées au calendrier initial par décisions de la Chambre Contentieuse du 9 janvier 2019, du 30 avril 2019 et du 12 juin 2019; 
9. The complainants are clients of the defendant for bank accounts related to their activities as managers of several companies. By letter of 10 September 2019 addressed through their counsel, the complainants requested the defendant to disclose by return of post all personal data in its possession. The request was worded as follows: "my clients request that you communicate to them without delay
and by return, a copy of all the personal data you hold as well as any additional information you have against them". This request was made in the context of a challenge to the closure by the defendant of the complainants' bank accounts. 
   
   
Vu les conclusions en réponse du premier défendeur déposées par ses conseils, reçues le 28 janvier 2019 ; 
10. In response, the defendant requested additional information by e-mail of 11 September 2019: "With regard to the request for the Right of Access, in order to be able to process
At your request we need the following information: which right do you wish to exercise and for what reason? Please attach to your email a copy of the front side of your customer's identity card and send it to ...
   
   
Vu la demande  formulée par le premier défendeur aux termes de ces conclusions d’être, à l’issue de l’échange de conclusions, entendu par la Chambre Contentieuse en application de l’article 51 du Règlement d’ordre intérieur de l’Autorité de protection des données;  
11. The complainants did not feel that they had to answer positively to this request for a copy of their identity card. By e-mail of 12 September 2019, the complainants, through their counsel, indicated that "the request made by letter of 10 September 2019 was unambiguous as to the provision of a copy of all the personal data you hold with regard to my clients", and that this letter was the deadline within which the requested information had to be provided. In this e-mail, counsel for the complainants also stated that the request of his clients was, in his opinion, based on the "Data Protection Act", more precisely Article 38 § 1.  
   
   
Vu les conclusions du plaignant reçues par la Chambre Contentieuse le 27 mars 2019 ;  
12. On 16 October 2019, the complainants lodged a complaint with the DPA, stating that the defendant had not yet responded to their request for access to their personal data.  
   
   
Vu la demande formulée par le plaignant dans ses conclusions d’être entendu par la Chambre Contentieuse à l’issue de l’échange des conclusions en application de l’article 51 du Règlement d’ordre intérieur de l’Autorité de protection des données;
13. 13. In their complaint, the complainants argued in particular that the defendant could not make the processing of their request conditional on either a clarification of the right they wished to exercise or the sending of a copy of the complainants' identity card. The complainants consider that their request for access to the data was clearly notified by letter of 10 September and that the defendant had no reason to doubt their identity or the validity of the information provided by their counsel as to their identity. 
   
   
Vu les conclusions déposées par le second défendeur représenté par ses conseils, reçues par la Chambre Contentieuse le 26 avril 2019 ;  
3. The conclusions exchanged following the complaint  
   
   
Vu les conclusions en réplique du premier défendeur déposées par ses conseils, reçues le 3 mai 2019 ; 
14. In its conclusions, the defendant states that the failure to reply to the request for access within the time-limits laid down by the RGPD is the result of a combination of exceptional circumstances: the request was made in the context of a broader dispute and was not submitted in accordance with the procedures laid down by the defendant for that purpose in accordance with Article [X] of its Privacy Charter, namely, via an e-mail with a copy of the identity card, or via various applications. According to the defendant, a human error then led to a delay in the response: the complainants' contact person at the defendant re-addressed the application to the wrong addressee and that person was then absent due to illness without a back-up having been provided. 
2
   
   
Vu l’octroi par la Chambre Contentieuse d’un dernier délai pour conclure adressé à toutes les parties en date du 12 juin 2019 ;
15. Finally, the defendant considers that the complaint is unfounded because it is based on an erroneous article of law: the complainants invoke provisions of the Data Protection Act which concern requests for access to data processed by the authorities referred to in Article 26(7) of that Act, within the scope of which the defendant is not covered. 
   
   
Vu les invitations à l’audition adressées par la Chambre Contentieuse en dates du 20 décembre 2019 et du 15 janvier 2020 ;  
16. In their conclusions in reply, the complainants point out that their request for access to the personal data, which the defendant has at its disposal with regard to them, was requested in a sufficiently clear manner by letter of 10 January 2020. The complainants complain that the defendant transmitted the personal data requested to them late and in part, i.e. four months later, and without providing any details as to the reason why the defendant terminated its contractual relations (bank accounts) with the complainants. The complainants are of the opinion that the defendant could not have taken such a decision without having "disposed of and/or collected the information on the basis of which it took the decision to terminate the business relationship" and that, since this information constitutes personal data, the defendant was obliged to communicate it to the complainants. Finally, the complainants state that by failing to communicate these data, the defendant continues to infringe the DPMR, in particular Article 15 thereof.  
   
   
Vu l’audition lors de la séance de la Chambre Contentieuse du 28 janvier 2020 au cours de laquelle seul le plaignant était présent ;  
17. In its reply, the defendant argues that the Litigation Chamber cannot take into account the legal basis which the complainants invoked by way of conclusion only. According to the defendant, it follows from Articles 94 and 95 ACL that the facts and grievances invoked in the complaint must be specified either in the complaint or by means of an investigation which the Litigation Chamber may request from the Inspection Service within 30 days of the admissibility of the complaint. According to the defendant's interpretation, the qualification of the facts described in the complaint must be fixed from the moment the Litigation Chamber considers that the file is in a state of being processed on the merits, pursuant to article 95 of the LCA. The defendant refers in this case to the letter of 20 January 2020 in which the Litigation Chamber invited the parties to conclude and in which the complaint is described as a request for access to personal data formulated on the basis of Articles 36 § 4 and § 5 as well as 38 § 1" of the Data Protection Act, in accordance with the legal provisions initially invoked by the complainants. According to the Respondent, the complainants are "not permitted to change their position during the proceedings and to invoke a new
The Litigation Chamber is not allowed to change the scope of the procedure once the investigation phase has been completed [...] to allow such a change of wording after any possibility of involvement of the inspection service, even though the LAPD [LCA] does not contain any provision allowing the complainant or the Litigation Chamber to make such an amendment, would invite the worst violations of the rights of defence of the accused managers and subcontractors before the Litigation Chamber ... If there were to be the slightest doubt as to the legal characterization of a complaint and its basis (p. Should there be any doubt as to the legal characterization of a complaint and its basis (e.g. for a complaint brought by an individual without the intermediary of a lawyer), the Litigation Chamber should ask the ODA Inspection Service to clarify the matter". Thus, the complainants consider that, by not requesting a further investigation by the inspection service and by considering that the case could be dealt with on the merits without any investigative measure, the Litigation Chamber clearly considered that the legal qualification chosen was the only relevant one for claiming access to the complainants' personal data.  
   
   
Vu le procès-verbal d’audition du 28 janvier 2020 et les annotations du plaignant du 4 février 2020 qui y ont été jointes et communiquées aux premier et second défendeurs le 11 février 2020.  
18. 18. In the alternative, the defendant submits that the request under Article 15 of the GDR is unfounded, alleging that it provided its reply on 10 January 2020 to the complainants, that the longer than usual time-limit for reply is due to human error combined with the illness of a key participant in the proceedings. The defendant further submits the measures it has put in place to remedy these shortcomings in the future.
   
   
19. With regard to the complainants' allegation that the personal data provided by the defendant is incomplete (lack of response as to the reasons for the breach of contract that occurred), the defendant invokes the Law of 18 September 2017 on the prevention of money laundering and terrorist financing and on restrictions on the use of cash ("BC/FT" Law), which prohibits it from communicating any reason for termination to any customer, whether or not that customer is concerned by suspicions of money laundering, according to the defendant.
   
   
II. Les faits et l’objet de la plainte
   
   
La plainte introduite par le plaignant s’inscrit dans le contexte d’un conflit qui l’oppose à son ancien employeur, le premier défendeur ainsi qu’à un second ancien employeur, le deuxième défendeur.
   
   
Le premier défendeur – qui regroupe plusieurs médecins généralistes - a engagé le plaignant le 24 août 2016 en qualité d’assistant marketing et communication. Le plaignant a été licencié par le premier défendeur moyennant l’exécution d’un préavis à prester de deux mois par courrier recommandé du 2 octobre 2017. 
4. On the grounds of the decision 
On the competence of the Administrative Jurisdiction Division to assess whether the complaint is well-founded on the basis of the legal characterisation of the facts as corrected by the complainants by way of submissions and on the basis of a new complaint submitted by the complainants by way of submissions 
   
   
Le premier défendeur produit dans le cadre de la présente procédure un certain nombre de courriers adressés au plaignant desquels il ressort que, selon le premier défendeur, ce dernier n’exécutait pas les prestations demandées pendant la période de préavis, soit au cours des mois de novembre et de décembre 2017. Dans son courrier recommandé adressé au plaignant le 10 janvier 2018, le premier défendeur considère que le plaignant a manqué à ses obligations professionnelles en ne prestant pas l’entièreté du travail convenu et décide dès lors, pour le mois de décembre 2017, de le déclarer en congé sans solde sans droit à rémunération.   
20. According to the legal basis invoked in their complaint, the complainants seek access to the personal data held by the defendant in respect of them, on the basis of the provisions of the Act.  
Data Protection included under Title 2 of this law and which specifically applies to "competent authorities for the purpose of the prevention, investigation, detection and prosecution of criminal offences or the execution of criminal penalties, including the protection against and prevention of threats to public security and implements Directive 2016/680/EU of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data by those competent authorities" (the "Police Justice Directive").   
   
   
A la suite de ce courrier, le plaignant a saisi son organisation syndicale. Celle-ci indique au plaignant avoir adressé une mise en demeure au premier défendeur en date du 11 avril 2018. Un échange de lettres s’en est suivi entre le syndicat et le premier défendeur, dont le courrier - objet du litige porté devant la Chambre Contentieuse - du 14 juin 2018 adressé par le premier défendeur au syndicat.   
21. In this respect, the defendant rightly points out in its conclusions that, as a company active in the provision of banking services, it is not concerned by the scope of Title 2 of the Data Protection Law.   
   
   
3
22. However, the defendant wrongly disputes the competence of the Administrative Jurisdiction Division to examine the facts mentioned in the complaint - a request for access to personal data - from the point of view of the legal basis invoked by the complainants in their submissions, namely Article 15 of the DPMR, taking the view that only the Inspection Service would be competent to re-qualify the facts submitted in the original complaint. Furthermore, the defendant wrongly disputes that the Litigation Chamber would be competent to examine new facts or complaints invoked by the complainants by way of conclusion (such as the fact that the answer given in the meantime to their request for access would be incomplete).  
Il ressort des pièces déposées dans le cadre de la procédure que, par ce courrier du 14 juin 2018, le premier défendeur écrit au syndicat notamment ce qui suit (extrait) : 
« Depuis, son nouvel employeur – le second défendeur - , nous a contacté pour nous faire part de son attitude comparable à celle qu’il avait au sein de notre société, c’est-à-dire qu’il ne s’est plus présenté sur son lieu de travail après un certain temps et n’a plus rendu compte de ses prestations. La société a dû lui remettre son préavis après 2 mois.
   
   
D’après mes informations, un litige s’est récemment déroulé entre votre affilié et son nouvel employeur au cours duquel il aurait utilisé des faux arguments et agit à l’encontre du règlement de la société.  
23. The Litigation Chamber is an ODA body, established under Article 4(1) of the DCA, enjoying a certain degree of autonomy within ODA and taking its decisions independently in accordance with Article 43 of the DCA. In Belgium, the ODA is the authority responsible for monitoring compliance with the PGRD within the meaning of Article 8 of the Charter of Fundamental Rights of the European Union, Article 16 of the Treaty on the Functioning of the European Union and Article 51 of the PGRD. This control by the ODA and its Litigation Chamber is an essential element of the protection of individuals with regard to the processing of personal data, as organised by the PGRDD.
   
   
Le tribunal l’a condamné à payer des dommages et intérêts pour ces faits».  
24. Under Articles 51(1), 51(2) and 52(1) of the DPMR, Member States are required to entrust one or more independent public authorities with the supervision of the application of the DPMR in order to protect the fundamental rights and freedoms of natural persons with regard to the processing and to facilitate the free flow of personal data in the Union. These supervisory authorities should exercise their powers with a view to the effective implementation of European data protection law, including the PPMR. Ensuring the effectiveness of European law is one of the main duties of Member States' authorities under EU law. 
Après avoir été licencié par le premier défendeur, le plaignant a travaillé de janvier à avril 2018 pour le second défendeur. Il a été licencié par le second défendeur quelques mois après avoir débuté auprès de cette société, soit en avril 2018. Il ressort du jugement prononcé par le Tribunal de première instance de Bruxelles siégeant en référé produit dans le cadre de la présente procédure que le second défendeur a engagé une procédure en référé par citation à l’encontre du plaignant pour récupérer des fichiers auprès de lui. C’est à cette décision – avec mention erronée de sa date – que le premier défendeur fait allusion dans son courrier du 14 juin adressé au syndicat.   
 
25. It is their responsibility to facilitate the exercise of fundamental rights with regard to the protection of personal data. The supervisory authorities must in this respect play an active role through the tasks and powers conferred on them under Articles 57 and 58 of the PDSG. For example, under Article 57(2) of the EPR, each supervisory authority is required to "facilitate" the lodging of complaints by a data subject or a body. Logically, the processing of this complaint (or claim) should facilitate the exercise of the rights and contribute to a better control of citizens over their personal data.   
   
   
Ce courrier du 14 juin est la réponse du premier défendeur au courrier que lui a adressé le syndicat le 23 mai 2018.
26. The right to complain to ODA has been constructed by the legislator as an alternative to the judicial procedure (see articles 77 to 79 of the GDMP). The lodging of a complaint should remain an easy step for data subjects whose personal data are processed. The conditions of admissibility of this complaint are moreover defined in a minimal way in Article 60 ACL. To be admissible, a complaint lodged with the ODA must be written in one of the national languages, contain a "statement of the facts and the information necessary to identify the processing operation to which it relates" and fall within the competence of the ODA (Article 60 of the ACL).  
   
   
Dans ce courrier du 23 mai, le syndicat conteste les motifs du licenciement du plaignant (qualifiant le licenciement de manifestement déraisonnable) et réclame notamment, outre le paiement des prestations effectuées pendant son préavis par le plaignant :  
27. 27. Thus, complainants are not required to invoke any legal provision in order for their complaint to ODA to be admissible, as long as ODA can determine that the complaint concerns a legal provision that it has the task of monitoring. When considering whether the complaint is well-founded, the Litigation Chamber must therefore assess not whether the complainants have invoked the correct legal provision in support of their claim, in the formal complaint lodged with ODA, but whether the facts reported constitute an infringement of one of the legal provisions whose observance is subject to ODA control.  
   
   
- Une indemnité correspondant à 17 semaines de rémunération conformément à l’article 9 de la Convention collective n° 109 du 12 février 2014 concernant la motivation du licenciement 
28. 28. Similarly, complainants are not required to invoke all the relevant facts relating to the violation alleged in their complaint. The Litigation Chamber should be able to assist them by asking questions directed in such a way as to ensure a clear understanding of the potential infringement in fact and in law.
(absence de motif de licenciement) ; 
to a fundamental right that the complainant wishes to bring to his or her attention. The Litigation Chamber may also take into account grievances developed subsequently by way of a conclusion by the complainant, provided that they concern facts or legal arguments relating to the alleged violation referred to it by way of a complaint, and with due respect for the rights of the defence.  
La plainte déposée par le plaignant auprès de l’Autorité de protection des données comporte deux volets : 
 Premier volet à l’encontre du second défendeur
Le plaignant reproche au second défendeur d’avoir communiqué au premier défendeur des informations relatives à l’exécution de son travail auprès de ce dernier ainsi que des informations relatives à la procédure judiciaire l’opposant au second défendeur pour récupération de documents appartenant à cette société à l’issue de leur relation contractuelle (décision du Tribunal de première instance de Bruxelles siégeant en référé).
4
   
   
 Second volet à l’encontre du premier défendeur
29. 29. During the procedure following the complaint, the Dispute Chamber therefore has the possibility of changing the legal qualification of the facts submitted to it, or examining new facts related to the complaint, without necessarily calling upon the intervention of the Inspection Service, in particular by putting questions to the parties or by taking into account the new facts or qualifications invoked by way of conclusion, and this within the limits of the adversarial debate, i.e. provided that the parties have had the opportunity to discuss these facts or legal qualifications in a manner consistent with the rights of the defence. If need be, it is for the Litigation Chamber to give rise to such debate either in its letter of invitation to conclude under article 98 of the ACL or subsequently in the context of a reopening of the proceedings.  
Le plaignant reproche en outre au premier défendeur d’avoir collecté ces mêmes informations auprès du second défendeur et de les avoir, par courrier du 14 juin 2018, communiqué  à son syndicat.
   
   
Le plaignant demande à l’Autorité de protection des données de déclarer sa plainte fondée et de considérer les sanctions appropriées aux actes qui ont été posés et aux dommages qui en ont suivi.
30. 30. In this context, taking into account a new legal classification invoked by the complainant does not prejudice the fairness of the proceedings and the equality of arms, has been a matter of urgency.
a fortiori insofar as the decisions of the Litigation Chamber are likely to be
full appeal to the Market Court .   
   
   
III. L’audition du 28 janvier 2020 
31. The procedure conducted before the Litigation Chamber is therefore not strictly adversarial in nature as is the case before the Belgian civil courts, and the Litigation Chamber may on its own initiative modify the subject matter of the complaint in fact or in law.   
Lors de son audition du 28 janvier 2020, le plaignant a rappelé les faits et contesté plusieurs éléments mis en avant par le premier défendeur dans ses conclusions en se référant à ses propres conclusions. Il a ajouté les éléments suivants : 
- Sa lecture des conclusions du premier défendeur révèle que des contacts préalables à celui au terme duquel le second défendeur a communiqué au premier défendeur les informations litigieuses relatives à sa condamnation en justice ont eu lieu à son sujet entre les défendeurs ; 
- La nature de droit fondamental du droit à la protection des données ; 
- Le non-respect du principe de proportionnalité et de minimisation dans le chef des défendeurs lors de la communication de données le concernant et l’absence de pertinence des données communiquées au regard de la problématique d’absence de délivrance de l’original de son formulaire C4 (certificat de chômage) et de la nature du licenciement dont il avait fait l’objet de la part du second défendeur ; 
- L’absence de respect du principe de loyauté à son égard lors de cette même communication de données le concernant ;
- L’absence de base de licéité admissible, l’intérêt légitime prépondérant dans le chef des défendeurs tel qu’invoqué ne pouvant selon lui être retenu ;
- Une atteinte à son droit à l’oubli ainsi qu’à son droit d’opposition fut-ce celui-ci d’application ;
- L’absence de consentement dans son chef à la communication de données à caractère personnel le concernant entre les défendeurs.
- Les difficultés rencontrées pour obtenir son C4 (certificat de chômage) et le fait que celui-ci a été établi avant les contacts noués entre les défendeurs.   
   
   
IV. Quant à la compétence de l’APD, en particulier de la Chambre Contentieuse
32. This inquisitorial power which the Litigation Chamber grants itself on a case-by-case basis is justified and necessary in the context where the Litigation Chamber is responsible for supervising the exercise of rights which form an integral part of the fundamental right to protection of personal data, in the context of the implementation of Article 8(3) of the Charter of Fundamental Rights of the European Union. 
Quant à la compétence de l’Autorité de protection des données, en particulier de la Chambre Contentieuse
   
   
En application de l’article 4 § 1er de la LCA, l'Autorité de protection des données (APD) est responsable du contrôle du respect des principes fondamentaux de la protection des données à caractère personnel
33. 33. The Litigation Chamber refers in this respect to the judgment of the Court of Justice of the European Communities of 9 October 2019 in the case of ODA v ING SA, in which the Court stated that the exercise of a right provided for in the GDR such as the right to rectification of personal data is not a mere subjective right on the part of the parties, but involves the exercise of powers
5
of ODA on the basis of objective law, in the context where the right to rectification is an integral part of the fundamental right to protection of personal data and implements Article 8(3) of the Charter of Fundamental Rights of the European Union . The same reasoning applies to the right of access to personal data (art. 15 RGPD) which is the subject of the complaint submitted to the Litigation Chamber in the context of the present litigation.   
contenus dans le RGPD et dans d’autres lois contenant des dispositions relatives à la protection du traitement des données à caractère personnel.   
   
   
En application de l’article 33 § 1er de la LCA, la Chambre Contentieuse est l’organe de contentieux administratif de l’APD.  Elle est saisie des plaintes que le Service de première ligne lui transmet en application de l’article 62 § 1er LCA, soit des plaintes recevables dès lors que conformément à l’article 60 alinéa 2 LCA, ces plaintes sont rédigées dans l'une des langues nationales, contiennent un exposé des faits et les indications nécessaires pour identifier le traitement de données à caractère personnel sur lequel elles portent et relèvent de la compétence de l'Autorité de protection des données.  
34. 34. Thus, in the present case, the request for exercise of a right provided for by the GDR, such as the right of access to personal data enshrined in article 15 thereof, implies the exercise of ODA competences on the basis of objective law and does not concern only the subjective rights of the parties, insofar as the exercise of those rights is an integral part of the fundamental right to protection of personal data and implements article 8.3 of the Charter of Fundamental Rights of the European Union. 
   
   
Des traitements de données sont opérés dans de multiples secteurs d’activité, notamment dans le cadre des relations de travail contractuelles et post-contractuelles comme dans le cas d’espèce. Il n’en demeure pas moins que la compétence de l’Autorité de protection des données en général, et de la Chambre Contentieuse en particulier, est limitée au contrôle du respect de la règlementation applicable aux traitements de données, quel que soit le secteur d’activité dans lequel ces traitements de données interviennent. Son rôle n’est pas de se substituer aux juridictions du travail dans l’exercice des compétences qui sont les leurs en matière de droit du travail notamment.   
35. 35. The Litigation Chamber is therefore competent to examine the merits of the application as legally requalified by way of conclusion and made under Article 15 GDR. The Administrative Jurisdiction Division is also competent to examine the defendant's complaints by way of a final decision regarding the incompleteness of the reply to his request for access, insofar as that complaint relates to the request for access which is the subject of the initial complaint.   
   
   
L’article 2 § 1 du RGPD définit le champ d’application matériel du RGPD comme suit: 
« Le présent règlement s’applique au traitement de données à caractère personnel automatisé en tout ou en partie, ainsi qu’au traitement non  automatisé de données à caractère personnel contenues ou appelées à figurer dans un fichier ». 
   
   
Quant à la communication d’informations par le second défendeur au premier défendeur (volet 1 de la plainte), les défendeurs indiquent tous deux aux termes de leurs conclusions que cet échange d’information a bien eu lieu mais uniquement de manière orale. 
On the merits of the request under section 15 of the GDPR
   
   
Dans ses conclusions, le premier défendeur précise à cet égard :
36. Under Article 15(1) of the DPMR, "the data subject shall have the right to obtain from the controller confirmation as to whether or not personal data relating to him or her are being processed and, where this is the case, access to such personal data and the following information ...": 
« Avoir en effet eu un contact avec l’employeur suivant du plaignant qui mettra un terme à son contrat de travail quelques mois plus tard le 6 avril 2018 (cette information, relève du dossier de la présente procédure).   
- the purposes of the processing, 
- the categories of personal data concerned, 
- the recipients or categories of recipients to whom the personal data have been or will be disclosed [...],   
- where possible, the intended period of storage of personal data or, where that is not possible, the criteria used to determine that period ;  
- the existence of a right to request the controller to rectify or erase personal data, or a restriction on the processing of the data
(b) the right to object to the processing of personal data relating to the data subject; 
- the right to lodge a complaint to a supervisory authority; where the personal data are not obtained from the data subject, any available information as to their source ; 
- the existence of automated decision making, including profiling, as referred to in Article 22 (1) and (4) and, at least in such cases, relevant information concerning the underlying logic and the importance and intended consequences of the processing operation for the data subject. »  
   
   
Visiblement, les relations professionnelles entre le plaignant et son nouvel employeur sont conflictuelles comme le plaignant l’explique dans sa plainte en l’espèce.
37. Information must also be provided on the appropriate safeguards implemented, if any, when personal data are transferred to a third country or to an international organisation (Art. 15.2 GDR).  
   
   
6
38. Finally, Article 15(3) of the DPMR also provides that "the controller shall provide a copy of the personal data undergoing processing", this copy being the "copy of the personal data subject to processing".  
La démarche du premier défendeur, dans sa relation avec le deuxième défendeur, était essentiellement de comprendre la manière la plus optimale de réagir face aux plaintes du plaignant. (…) ».   
prescribed procedure for responding to an access request.   
   
   
Aux termes de ses conclusions, le premier défendeur certifie qu’il n’a cependant eu accès à aucun jugement  « puisque le jugement du … dont il est fait mention dans le courrier du 14 juin 2018 n’est même pas une donnée correcte dès lors que le plaignant affirme, dans sa plainte, que son jugement a été rendu le …, ce qui rend d’ailleurs plus malaisé une transmission de ce jugement entre les deux sociétés en cause, le même jour que celui de son prononcé par le tribunal d’une part, et de la rédaction, et l’envoi du courrier recommandé du 14 juin 2018 par le premier défendeur d’autre part ! ».  
39. The provisions of the PGRD are directly applicable to the processing operations defined in Article 3 of the PGRD, with the exception of the provisions providing for a discretionary power for the benefit of the Member States as regards the implementation of the PGRD . Article 15 of the DPMR is part of the directly applicable provisions of the DPMR, which may be invoked by complainants in support of their requests for access to personal data concerning them that are processed in the context of the activities of a data controller on Belgian territory.
   
   
Quant au second défendeur, il précise aux termes de ses conclusions dans le même sens  :  
In the present case, the Litigation Chamber must examine whether or not the defendant has infringed Article 15 of the GDR, which requires data controllers to comply with requests for access to their personal data. Indeed, the GDR does not impose any procedural conditions on the exercise of the right of access, such as the invocation of a specific legal basis.  
   
   
Traduction 
41. 41. From the point of view of the defence and the right to a fair trial, it is furthermore incumbent on the Litigation Chamber to examine whether the initial complaint was sufficiently comprehensible as to its subject matter to allow the defendant to identify it as a request for access under Article 15 of the GDR. Failing that, it was for the Litigation Chamber to reclassify the facts and allow an adversarial debate on the subject, either in its letter of invitation to conclude on the basis of Article 98 of the ACL, or subsequently in the context of a reopening of the proceedings.  
« 1.26. (…) En juin 2018,  la Deputy Executive Director du second défendeur, a été contactée par le précédent employeur du plaignant. Celui-ci lui a demandé quelles étaient ses expériences avec le plaignant. De bonne foi et de manière assez informelle, le second défendeur a dépeint de manière générale ses expériences avec le plaignant. Et a notamment fait savoir que le contrat de travail avec le plaignant avait pris fin et qu’ils avaient dû engager une procédure en référé afin de pouvoir récupérer auprès du plaignant certaines propriétés de l'entreprise. Aucune information écrite n'a été fournie, et encore moins a fortiori la décision (!)." 
Plus loin au point 3.2. de ses conclusions, le second défendeur conclut que:
   
   
Traduction 
42. In the context of the complaint submitted to it, the Litigation Chamber finds that the defendant did indeed respond to the request for access (albeit belatedly in view of the one-month time-limit laid down in Article 12 of the RGPD). The first response of the defendant to the complainants also explicitly refers to a "request for access" to personal data (e-mail of 11 September 2019: "With regard to the request for the right of access to personal data, the defendant has submitted a request for access to the personal data of the complainants.
"Tout d'abord, il ne s'agit pas dans ce cas d'un traitement automatisé de données à caractère personnel ou d'un traitement non-automatisé de données à caractère personnel qui sont reprises dans un fichier. En effet, le second défendeur a uniquement communiqué verbalement et par téléphone des informations générales à l'ancien employeur du plaignant, à la demande de ce dernier. Dès lors, (…) et le Règlement général sur la protection des données ne sont, à titre principal, pas d’application”.   
access, [...]").   
   
   
7
43. 43. On the basis of the facts set out by the complainants and not contested by the other side, it appears from the facts presented by the complainants and not contested by the other side that the request for access was formulated in a sufficiently clear manner for the defendant to identify that it was a request for the exercise of the right of access provided for in Article 15 of the GDR. The Litigation Chamber therefore considers that the complaint was validly submitted to it for examination of facts constituting a potential infringement of the right of access under Article 15 of the GDR.   
Il ne résulte par ailleurs pas des pièces du dossier déposées par le plaignant que cette communication aurait eu lieu de manière automatisée par le second défendeur.   
   
   
En conclusion, la communication par le second défendeur de l’information selon laquelle le plaignant avait fait l’objet d’une condamnation par les cours et tribunaux n’est pas constitutive, dans le chef du second défendeur, d’un traitement automatisé de données ni d’un traitement manuel de données appelées à figurer dans un fichier au sens de l’article 2 du RGPD.
44. 44. The Litigation Chamber is therefore competent to take account of the grievances developed by the complainant by way of a finding under article 15 of the GDR instead of the provisions of article 15 of the GDR.
36, § 4 and § 5 as well as Article 38, § 1 of the Law of 30 July 2018 (Data Protection Act).    
   
   
La Chambre Contentieuse de l’Autorité de protection des données n’est donc pas compétente à l’égard de ces faits. La plainte dans son volet dirigé à l’encontre du second défendeur est non-fondée.  
45. The Administrative Jurisdiction Division also notes that the defendant was able to develop its arguments by way of conclusion, albeit in the alternative, and put forward its complaints regarding the request for access by the complainants under Article 15 of the GDR. The Chamber should therefore not reopen the proceedings on this point, and decides that it is competent to examine and deal with the complaint and its two complaints, namely, the late and incomplete nature of the reply made by the defendant to a request for access to personal data, including a request for a copy, submitted to it by the complainants.  
   
   
V. Sur les motifs de la décision 
Sur le manquement à l’obligation de licéité par le premier défendeur (volet 2 de la plainte)
   
   
En sa qualité de responsable de traitement, le premier défendeur est tenu de respecter les principes de protection des données et doit être en mesure de démontrer que ceux-ci sont respectés (principe de responsabilité – article 5.2. du RGPD) et de mettre en œuvre toutes les mesures nécessaires à cet effet (article 24 du RGPD).
   
   
En application de l’article 5 § 1 a) du RGPD, tout traitement de données à caractère personnel, fut-il totalement ou partiellement automatisé, doit notamment être loyal et licite. Pour être licite, tout traitement de donnée à caractère personnel doit notamment trouver un fondement à l’article 6 du RGPD. Il appartient au responsable de traitement de déterminer quel est ce fondement.   
Failure to comply with the obligation to reply to a request for access to personal data within one month of receipt of the request.   
   
   
En l’espèce, la collecte d’informations auprès du second défendeur et la communication par courrier du 14 juin 2018 du premier défendeur au syndicat de l’information des difficultés rencontrées dans  la relation de travail avec le plaignant ainsi que l’information selon laquelle le plaignant a fait l’objet d’une décision judiciaire sont des traitements de données à caractère personnel soumis à l’application du RGPD. Ils doivent s’appuyer sur l’une des base de licéité listées à l’article 6 du RGPD.   
46. According to Article 12.3 of the DPMR juncto Article 15 of the DPMR, a response to a request for access to personal data must be provided within one month of receipt of the request. This time limit may be extended by 2 months taking into account the complexity and number of requests, provided that the controller informs the data subject of this extension and the reason for the extension within one month of receipt of the request (Article 12.3 of the DPMR).
47. 47. The defendant, as controller of the complainants' personal data, was therefore under an obligation to respond to their request for access to their personal data and to their request to receive a copy of these personal data within one month of receipt of the request, unless the time limit was extended for reasons to be communicated to the complainants within one month. The Administrative Jurisdiction Division finds that the defendant did not respond to the request for access within the prescribed time-limit, nor did it give reasons within one month for the postponement of the communication of that information.   
   
   
Quant à la nature des données traitées, la Chambre Contentieuse rappelle que l’article 10 du RGPD concerne le traitement des seules données personnelles liées aux condamnations pénales et aux infractions ou aux mesure de sûreté connexe. L’article 10 du RGPD ne peut être étendu aux sanctions administratives ou jugements civils. Le champ d’application de cette disposition est réduit et la marge
48. 48. The Chamber considers that this failure to reply constitutes an infringement of Articles 15(1), 15(3) and 12(3) of the RGPD for the following reasons:
8
de manœuvre contenue dans la Directive 95/46/CE relative à la protection des personnes physiques
à l'égard du traitement des données à caractère personnel et à la libre circulation de ces données (article 8 § 5 alinéa 2) pour élargir la notion de « données judiciaires » n’existe plus. 
   
   
L’information selon laquelle le plaignant a été condamné par décision du Tribunal de première instance de Bruxelles ne constitue donc pas une donnée « judiciaire » au sens de l’article 10 du RGPD. Il n’en demeure pas moins que par nature, les informations relatives à des condamnations en justice telle que des données judiciaires à caractère civil comme en l’espèce, revêtent une sensibilité certaine.   
49. Firstly, the Litigation Chamber finds that the request for access was sufficiently clear as regards the identity of the persons concerned to enable the defendant to reply within one month. Indeed, the defendant did not state the reasons why it requested additional information in order to identify the complainants, as permitted by Article 12. 6 of the DPMR, which provides that the controller "may request further information to confirm the identity of the data subject" where "the controller has reasonable doubts as to the identity of the natural person making the request referred to in Articles 15 to 21", within one month from the receipt of the request (Article 12.3 DPMR).   
   
   
L’inexactitude de cette donnée (soit la date du jugement mentionnée au premier défendeur par le second défendeur, laquelle n’était pas la date exacte du jugement) ne lui fait cependant pas perdre sa qualification de donnée à caractère personnel. L’objet du jugement et le contexte dans lequel il s’inscrit sont autant de données à caractère personnel relatives au plaignant fut-ce la date du jugement inexacte. Cette même inexactitude, fut-elle imputable au second défendeur et non au premier défendeur, n’est pas non plus de nature à supprimer la matérialité des faits comme l’invoque le premier défendeur.   
50. 50. The defendant was therefore entitled to request that the complainants provide it with additional information (such as an identity card) to confirm their identity provided that it had reasonable doubt as to the identity of the natural person making the request. In the present case, the defendant did not give any reasons for doubting the mandate of their lawyer, a member of the bar, to represent clients, nor did it give any reasons for doubting the statements made by that lawyer with regard to the identity of his clients, in order to justify its request to return a copy of the front side of the clients' identity card. The defendant also replied to the complainants by letter dated 9 January 2020 addressed to one of the complainants. This fact shows that the defendant ultimately had no reasonable doubt as to the identity of this complainant. Without prejudice to the question whether, in view of the circumstances and the nature and volume of the data processed by it, a banking institution such as the defendant is entitled or not entitled to request a copy of the identity card of any person wishing to make a request for access to personal data in a standard manner, the Judicial Chamber notes that, in the present case, the intervention of a lawyer registered at the Brussels Bar and a letter sent with his paper to en en could enable the defendant to validate the factual data transmitted by that lawyer concerning the identity of his clients.
51. 51. It was incumbent on the defendant to provide all the personal data requested by the complainants, namely, according to the interpretation of the Litigation Chamber, all the personal data and information on this subject referred to in Article 15 of the GDR.   
   
   
Quant à licéité du traitement (article 5 § 1 a) du RGPD), le premier défendeur indique qu’il se fonde sur l’article 6 § 1 f) du RGPD aux termes duquel le traitement de données est licite « si, et dans la
52. 52. Secondly, the Litigation Chamber notes that the request for access to and copy of the personal data held by the defendant was, as to its purpose, formulated sufficiently clearly by the complainants to enable the defendant to reply within one month. The Litigation Chamber also takes into account the fact that Articles 15.1 and 15.3 juncto 12.3 of the RGPD did not allow the defendant to postpone its response to the request for access by requesting clarification of the "rights" that the complainants would like to exercise following their request for access.
mesure où, il est nécessaire aux fins des intérêts légitimes poursuivis par le responsable du traitement ou par un tiers, à moins que ne prévalent les intérêts ou les libertés et droits fondamentaux de la personne concernée qui exigent une protection des données à caractère personnel, notamment lorsque la personne concernée est un enfant ».  
   
   
Le premier défendeur expose que dans le contexte litigieux existant entre lui-même et le syndicat du plaignant, eu égard aux menaces d’enclencher une action en justice à son encontre formulées par le syndicat et compte tenu de la nécessité de faire valoir sa défense, le premier défendeur a recueilli et communiqué l’information litigieuse au syndicat.   
53. 53. Admittedly, the Litigation Chamber understands that the defendant asked the complainants to specify which rights they wished to exercise, since according to the case-law of the Court of Justice, in order to comply with a request for a right of access, "it is sufficient
 
that the applicant be provided with a complete overview of those data in an intelligible form, that is to say, in a form which enables the applicant to acquaint himself with those data and to verify that they are accurate and processed in accordance with that Directive, so that the applicant may, where appropriate, exercise the rights conferred on him by that Directive. » . This case-law (under the former Directive 95/46) is relevant insofar as it does not make requests for access subject to the condition of indicating which right the data subject intends to exercise following his request for access. Recital 63 of the GDPMR states that the right of access to personal data must enable a data subject to "become acquainted with the processing operation and to exercise it in accordance with the law".
Le plaignant estime quant à lui qu’aucun motif ne permet de légitimer la prise de contact opérée par les défendeurs entre – eux, en particulier par le premier défendeur auprès du second défendeur, ni la communication des informations le concernant à son organisation syndicale.  
verify lawfulness", without indicating that the controller may postpone its response pending information on the purposes of the access request.   
54. 54 54. Recital 63 of the DPMR specifies, however, that it should be possible for the controller to postpone the response to a request for right of access in order to obtain specific additional information, namely "on which data or on what data, if any, should be disclosed".
processing operations his request is related to", and this is the case when the controller processes a large amount of data relating to the data subject. Where appropriate, it is the responsibility of the controller to "facilitate the exercise of the rights" of the data subjects under Article 12(2) of the PGRD, which excludes the possibility of asking such questions in an irrelevant manner and/or for dilatory purposes, all the more so as Article 8(2) of the Charter of Fundamental Rights of the European Union mentions the right of access as one of the founding principles of the right to protection of personal data.  
   
   
La Chambre Contentieuse relève que le point f) de l’article 6 du RGPD renvoie à un intérêt légitime poursuivi par le responsable du traitement (a). Le traitement des données à caractère personnel doit être «nécessaire à la réalisation de l’intérêt légitime»  poursuivi par le responsable du traitement (b).  
55. 55. In the present case, the only requests for additional information possible under recital 63 of the GDR were not made by the defendant, so that the Chamber considers that the request for access made by the complainants was sufficiently clear in terms of its content to enable the defendant to reply within the legal time-limit of one month from receipt.   
9
Enfin, le recours à l’intérêt légitime est expressément subordonné à un critère supplémentaire de mise en balance, qui vise à protéger l’intérêt et les droits et libertés fondamentaux des personnes concernées. En d’autres termes, l’intérêt légitime poursuivi par le responsable du traitement doit être comparé avec l’intérêt ou les droits et libertés fondamentaux de la personne concernée, l’objectif de la mise en balance étant de prévenir une incidence disproportionnée sur ces droits et libertés. L’intérêt poursuivi par le responsable de traitement, fut-il légitime et nécessaire, ne peut valablement être invoqué que si les droits et libertés fondamentaux des personnes concernées ne prévalent pas sur cet intérêt. La Cour de Justice de l’Union européenne a précisé que ces trois conditions – soit la poursuite d’un intérêt légitime par le responsable de traitement (a), la nécessité du traitement  pour la réalisation de l’intérêt légitime poursuivi (b) et la condition que les droits et libertés fondamentaux des personnes concernées ne prévalent pas sur l’intérêt poursuivi (c), sont cumulatives .   
   
   
Si c’est au responsable du traitement des données qu’il revient initialement d’apprécier si les conditions énoncées à l’article 6 § 1 (en ce compris donc le litera f)) du RGPD sont satisfaites, la légitimité du traitement peut ensuite faire l’objet d’une autre évaluation, et éventuellement être contestée, entre autres par les personnes concernées et par les autorités chargées du contrôle de la protection des données. Un examen au cas par cas, tenant compte des circonstances concrètes de chaque plainte, permettra ainsi à la Chambre Contentieuse de l’APD de conclure quant à la licité de traitements fondés sur la base de l’intérêt légitime invoqué, comme en l’espèce, par le responsable de traitement.
56. Finally, for all practical purposes, the Litigation Chamber also recalls that the GDR does not make the validity of a request for access dependent on the invocation of a particular legal basis such as Article 15 of the GDR. It is sufficient in this respect that the subject of the request is sufficiently clear, namely access to and/or copying of personal data. In the present case, the Administrative Jurisdiction Division finds that the request was sufficiently clear in this respect, as evidenced by the fact that the defendant immediately identified the request of the complainants as a request for access to their data, which is apparent from the wording of the first response to this request by the defendant (e-mail of 11 September 2019: "With regard to the request for the Right of Access, ...").
   
   
Le traitement des données à caractère personnel doit être «nécessaire à la réalisation de l’intérêt légitime»  poursuivi par le responsable du traitement. Cette condition de nécessité entre le traitement opéré et l’intérêt légitime poursuivi est particulièrement pertinente dans le cas de l’article 6 § 1 f) du RGPD afin de garantir que le traitement des données fondé sur l’intérêt légitime ne débouche pas sur une interprétation trop large de l’intérêt à traiter des données.   
57. 57. As a result, the Litigation Chamber finds that the defendant has infringed Articles 15.1, 15.3 and 12.3 of the RGPD.  
 
The completeness or otherwise of the reply to the request for access  
   
   
Dans ce contexte, la Chambre Contentieuse est d’avis que l’utilisation de moyens de défense s’appuyant sur des données résultant d’une collecte directe de données auprès de la personne concernée doit, pour satisfaire le principe de loyauté, être privilégiée.  
58. The Administrative Jurisdiction Division decided to dismiss the complaint lodged by the complainants by way of conclusion, namely, the fact that, in their view, the reply given by the defendant regarding access to any personal data relating to the reasons for the decision to terminate the commercial relations between the parties was not complete.
59. 59. In the present case, the Litigation Chamber considers that this request for access is part of a broader commercial dispute which a court of first instance may decide if it is seised of the following questions: whether or not the defendant had the right to terminate its commercial relationship with the plaintiffs without giving reasons, and is it correct that the anti-money laundering provisions which it must apply exonerate it from any duty to provide information as to the reasons for the decision to terminate the commercial relationship.  
   
   
Le premier défendeur invoque pour intérêt légitime sa défense à l’égard des griefs qui lui étaient opposés par l’organisation syndicale représentant le plaignant. La Chambre Contentieuse estime qu’en l’espèce, cette défense participe de  la « défense  en justice », soit d’un droit fondamental consacré à l’article 48 de la Charte des droits fondamentaux de l’Union. De manière générale, la « défense en
60. 60. However, the Litigation Chamber intends to provide some clarification and its assessment of the scope of the information to be provided in response to requests for access under article 15 of the GDR. Insofar as the plaintiffs' request did not indicate which personal data or specific information relating to those data was requested among the various items of information provided for in Article 15.1 of the GDR (e.g. storage period, origin of the personal data, etc.), the Litigation Chamber considers that it was incumbent on the defendant to provide within the legal time limit of at least one month a complete overview of the personal data or categories of personal data being processed (Art. 15.1.b), including the purposes of that processing (Article 15.1.a), as well as the recipients or categories of recipients for each category of data (Article 15.1.c), where possible, the storage period or the criteria used to determine that period (Article 15.1.d), the source of the data where they are not obtained from the data subject (Article 15.1.g), and the information set out in Articles 15.1.e, f and h and 15.2 of the GDR. As regards the form of this information, the Administrative Jurisdiction Division considers that the information should enable the data subject to acquaint himself with the data processing operations and to verify their lawfulness, in accordance with the purpose of the right of access as set out in recital 63 of the GPRD.   
10
justice » peut effectivement être considérée comme un intérêt légitime licite dans le contexte de l’application de l’article 6 § 1 f) du RGPD. Conformément à l’Avis 06/2014 du Groupe de l’Article 29 sur la notion d’intérêt légitime  , cet intérêt doit être réel et présent, soit non hypothétique.   
   
   
La Chambre Contentieuse constate que cet intérêt constituait au moment des faits un intérêt légitime réel et présent. En effet,  lors de  la prise de contact entre le premier défendeur et le second défendeur en juin 2018, le premier défendeur s’était vu adresser plusieurs courriers déjà depuis avril 2018, notamment le courrier du 23 mai 2018  de la part du syndicat le mettant en cause comme cela a été relaté ci-dessus dans l’exposé des faits.  
61. If the controller does not provide from the outset all the information that the data subject is likely to obtain under Article 15 of the GDR, the Administrative Jurisdiction Division considers that it is at least incumbent on it to specify in the reply to the request for access how the data subject can obtain this additional information relating to the data processed, for example the Privacy Charter, provided that this document is sufficiently clear in this respect and that the reference to it is sufficiently precise to enable the data subject to easily find the information referred to in Article 15(1) of the GDR.  
62. 62. The Litigation Chamber notes that the defendant has an automated system enabling it to respond to this type of request. The Litigation Chamber notes, however, that the result of this automatic response does not include all the information referred to in Article 15(1) of the GDR. The Administrative Jurisdiction Division notes that the reply sent by the defendant to the complainants contained, in particular, information on the categories of data processed, their origin and the purposes of the processing, as well as on the choices made by the complainants with regard to the processing of data for marketing purposes. In addition, the plaintiff was invited to address any request for further information to an e-mail address of the bank.
   
   
Néanmoins, pour que cet intérêt légitime de « défense en justice » du premier défendeur prévale, le traitement des données doit être «nécessaire» et «proportionné» à l’exercice de cette défense en justice. Il serait excessif et contraire à ces exigences de nécessité et de proportionnalité d’admettre que tous les précédents employeurs d’un employé puissent, de par cette qualité, échanger toute information relative à un employé, fut-ce pour des besoins de défense en justice.  
63. Thus, the document does not provide any information on :
- the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular recipients who are established in third countries or international organisations (Article 15 § 1, c GDR) ;
- the envisaged period of retention of the personal data or, where this is not possible, the criteria used to determine this period (Article 15(1)(d) of the ECHR);
- the existence of the right to request from the controller the rectification or erasure of personal data, or a restriction on the processing of personal data relating to the data subject, or the right to object to such processing (Art. 15 § 1, e PGRD) ;
- the right to lodge a complaint with a supervisory authority (art. 15 § 1, f PGRD) ; 
- the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4) and, at least in such cases, useful information concerning the underlying logic, as well as the importance and the expected consequences of such processing for the data subject (Article 15(1)(h) of the Data Protection Regulation);
- if personal data are transferred to a third country or to an international organisation, the appropriate safeguards put in place with respect to such transfer (Art.
15 § 2 RGPD).  
   
   
A cet égard, la Chambre Contentieuse, sur la base des pièces du dossier, constate que le premier défendeur a licencié le plaignant et formulé les motifs de ce licenciement avant tout échange avec le second défendeur. Dans sa lettre du 14 juin 2018 au syndicat, le premier défendeur écrit avoir notifié les motifs de licenciement du plaignant à ce dernier en date du 21 décembre 2018. Ledit courrier du
64. The reply formulated by the defendant therefore appears to the Litigation Chamber to be incomplete. However, the Litigation Chamber will not uphold these complaints insofar as they have not therefore been the subject of an adversarial hearing in the context of the present case. The
21 décembre 2018 est par ailleurs produit. Lors de son audition, le plaignant a indiqué que son C4 (certificat de chômage) transmis à l’Office National de l’Emploi (ONEM) avait lui aussi été rédigé avant cette prise de contact.  
Chambre contentieuse understands that the plaintiffs' challenge is to the incompleteness of the categories of data provided with regard to the reasons for the breach of contract and not to the potentially incomplete nature of the information provided about the data processed by the defendant in general. The Litigation Chamber therefore does not reopen the proceedings on the latter point.  
65. In view of the facts and complaints submitted to it, the Litigation Chamber therefore closes the complaint with regard to the complaint concerning the incompleteness of the reply to the request for access.  
   
   
En d’autres termes, les motifs du licenciement du plaignant dont le premier défendeur pouvait légitimement se prévaloir à l’égard du syndicat sont indépendants  et antérieurs à toute information que le second défendeur a pu ou aurait pu apporter. En effet, c’est au moment du licenciement, de l’information du plaignant quant à ses motifs ainsi que de l’établissement du C4 qu’il appartenait au premier défendeur d’identifier les motifs du licenciement. Et c’est au regard de ceux-ci que le premier défendeur pouvait légitimement se défendre, le syndicat qualifiant le licenciement intervenu de manifestement déraisonnable.
On corrective measures and sanctions
   
   
11
La « défense en justice » ne peut légitimer la collecte et d’autres traitements subséquents tels la diffusion ou la communication à des tiers de toute donnée relative à la personne concernée. Ces traitements de données doivent, pour être nécessaires et proportionnés, s’inscrire de manière pertinente et proportionnée dans la finalité précisément identifiée de cet intérêt légitime, soit sa défense en justice à l’égard du litige concerné. 
   
   
En l’espèce, les informations traitées par le premier défendeur sont en réalité venues compléter les moyens de défense dont disposait déjà le premier défendeur à l’égard du licenciement du plaignant et ce, sans avoir de lien de pertinence avec celui-ci. Les motifs de licenciement sur lesquels le premier défendeur s’était appuyé pour licencier le plaignant et délivrer son C4 étant au cœur du litige avec le syndicat, d’autres données personnelles étrangères à ces motifs étaient sans pertinence, et a fortiori non nécessaires en l’espèce, pour sa défense sur cet aspect vis-à-vis du syndicat.    
66. Under article 100 of the LCA, the Litigation Chamber has the power to : 
    
La Chambre Contentieuse conclut au regard de ce qui précède que le premier défendeur ne pouvait fonder les traitements de données visés par la plainte sur son intérêt légitime à défaut  pour ces traitements d’être nécessaires et proportionnés au sens de l’article 6 § 1 f) du RGPD.  En l’absence de base de licéité, la Chambre Contentieuse conclut que l’article 5 § 1 a) du RGPD combiné à l’article 6 du RGPD n’ont pas été respectés en l’espèce.   
"1° dismiss the complaint without further action;  
2° order the dismissal; 
3° pronounce a suspension of the pronouncement;    
4° propose a settlement; 
5° issue warnings or reprimands;    
6° order to comply with the requests of the person concerned to exercise these rights;
7° order that the person concerned be informed of the security problem;
(8) order the temporary or permanent freezing, restriction or prohibition of treatment;
(9) order that the treatment be brought into conformity;
10° order the rectification, restriction or deletion of the data and the notification of the data to the recipients of the data;
11° order the withdrawal of the approval of certification bodies;
(12° give penalty payments;
13° give administrative fines;
14° order the suspension of transborder data flows to another State or international organization;
15° transmit the file to the Public Prosecutor's Office of the King's Prosecutor of Brussels, which informs it of the follow-up given to the file;
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. »  
   
   
La Chambre Contentieuse constate également que le premier défendeur n’a pas respecté le principe de loyauté également consacré à l’article 5 § 1 a) du RGPD en traitant des informations disproportionnées et non pertinentes - puisque, comme exposé ci-dessus, sans lien avec les motifs sur lesquels elle avait fondé le licenciement du plaignant - obtenues auprès de tiers à l’insu délibéré du plaignant.   
67. The complainants request that the Litigation Chamber declare their complaint well-founded. The complaint does not include a specific provision on the measures requested. The Litigation Chamber understands that the complainants request that it find that the response to their request for access was late and incomplete and that the Litigation Chamber orders the defendant to comply with their request for access to personal data not yet disclosed, according to the complainants.
68. 68. The defendant acknowledges that it reacted late to the request for access, but denies having any personal data about the complainants other than those which it transmitted to them. The defendant justifies the four-month time-limit for reply by a combination of circumstances. As a reminder, the addressee of the request was absent due to illness without provision having been made for a back-up, in the context where the request was not submitted in accordance with the procedures laid down by the defendant for that purpose in accordance with Article [X] of its Privacy Charter, namely, via an e-mail with a copy of the identity card, or via various applications. The defendant has put measures in place to deal with such circumstances in the future, which it asks the Administrative Jurisdiction Division to take into account in the context of the measures to be ordered. »  
   
   
VI. Sur les mesures correctrices et les sanctions
69. The defendant further refers to the existence of a procedure for processing access requests since 2018, with more than 25600 requests processed since then, without a customer having complained, according to the defendant's information.  
Aux termes de l’article 100 LCA, la Chambre Contentieuse a le pouvoir de : 
1° classer la plainte sans suite ; 
2° ordonner le non-lieu ; 
3° prononcer une suspension du prononcé ; 
4°  proposer une transaction ; 
5° formuler des avertissements ou des réprimandes ; 
6° ordonner de se conformer aux demandes de la personne concernée d'exercer ces droits;
7° ordonner que l'intéressé soit informé du problème de sécurité;
8° ordonner le gel, la limitation ou l'interdiction temporaire ou définitive du traitement;
9° ordonner une mise en conformité du traitement;
10° ordonner la rectification, la restriction ou l'effacement des données et la notification de celles-ci aux récipiendaires des données;
12
11° ordonner le retrait de l'agréation des organismes de certification;
12° donner des astreintes;
13° donner des amendes administratives;
14° ordonner la suspension des flux transfrontières de données vers un autre Etat ou un organisme international;
15° transmettre le dossier au parquet du Procureur du Roi de Bruxelles, qui l'informe des suites données au dossier;
16° décider au cas par cas de publier ses décisions sur le site internet de l'Autorité de protection des données.
   
   
Les principes de licéité et de loyauté consacrés à l’article 5 § 1 a) du RGPD sont des principes fondateurs de l’encadrement de la protection des données. Leur respect est essentiel. L’exigence d’une base de licéité - laquelle fait défaut en l’espèce - en fait partie.
70. 70. In that context, the defendant requests that the complaint be dismissed inasmuch as it considers it unfounded in view of the legal basis relied on by the complainants. In the alternative, if the Administrative Jurisdiction Division considers that it should deal with the complaint, the Respondent requests that the case be dismissed under Article 100 § 1, 2° ACL. In the further alternative, the defendant requests suspension of the proceedings in accordance with Article 100 § 1, 3° ACL. In particular, the defendant takes the view that, in view of the particular circumstances of the case, in particular the manifestly unfounded nature of the complainants' allegations, human error and the considerable efforts it has made to respond to the requests for access, a further penalty would be disproportionate. In addition, the defendant claims confidentiality of the publication of the decision to be taken in an 'anonymous' manner, inasmuch as it cannot be accused of negligence in the present case.  
   
   
Quant à la nature des données à caractère personnel traitées, la Chambre Contentieuse a déjà rappelé qu’il y a notamment eu traitement de données judiciaires à caractère civil. Ces données ne sont pas visées par l’article 10 du RGPD mais elles n’en revêtent pas moins une sensibilité certaine.
71. 71. In the present case, the Litigation Chamber recalls that the right of access to personal data, enshrined in Article 15 of the GDR, is a fundamental right of personal data protection. The one-month time-limit for reply has not only applied since the entry into force of the RGPD on 24 May 2018, but also since the entry into force in 1993 of the Act of 8 December 1992 on the processing of personal data, which preceded it, where the time-limit was 45 days (Article 10 § 1 (3) of that earlier Act). Failure to comply with the 30-day time-limit is, according to the Litigation Chamber, a failure to comply with the time-limit.
72. The argument put forward by the respondent that human error had occurred and that a person was ill therefore does not stand up to analysis. Those exceptional circumstances do not detract from the fact that, at the material time, there was no procedure for dealing with requests for access outside the standard methods of communication advocated by the defendant.  
   
   
Quant à la manière dont les données à caractère personnel ont été  traitées, la Chambre Contentieuse constate que les données litigieuses ont été initialement collectées oralement et rendues accessibles par un courrier unique, à un destinataire unique, le syndicat, lequel représentait le plaignant lui-même. La Chambre Contentieuse relève également que le personnel du syndicat est, outre le fait que le syndicat est lui-même tenu de respecter les obligations découlant du RGPD, soumis à une obligation de confidentialité propre.  
73. 73. The defendant acknowledges by way of conclusion that there was a certain degree of delay in processing the Complainants' request and states that it has taken appropriate organisational measures to remedy this in the future: 
   
   
La Chambre Contentieuse relève également la nature ponctuelle des dits traitements et l’absence de violation pertinente commise précédemment par le premier défendeur.   
"Due to a combination of unfortunate circumstances, in particular the long absence of the competent manager (due to illness) and a human error when sending an e-mail, the request could not be followed up in accordance with the usual procedure. In order to remedy this in the future, the defendant identified certain concrete measures:
(i) The establishment of an internal, strictly monitored reminder system: if the competent person coordinating or handling a complaint is absent, that person will in future be followed up by a back-up person who will receive an automated reminder.
(ii) The establishment of reminders of the possibility of access via automated tools: since any data subject can consult his or her own data in various applications, the defendant must further increase the visibility of this possibility, in particular by means of a standardised reply to any person making an access request reminding him or her of the existence of these tools. In this way, any data subject can benefit from the ease and speed of these tools. There is of course nothing to prevent the request being processed manually if the data subject so wishes, but this will make the procedure even more efficient. »  
   
   
En conclusion, au regard de l’ensemble des éléments développés ci-dessus propres à cette affaire, la Chambre Contentieuse estime que les faits constatés et le manquement aux articles 5 § 1 a) et 6 du
74. The Administrative Jurisdiction Division takes note of these efforts made by the respondent to improve the future handling of access requests made outside its specific automated procedures, and therefore confines itself to reprimanding the respondent on the basis of Article 100 § 1, 5° ACL. The Litigation Chamber refrains from any other sanction insofar as this is the first complaint it receives concerning the processing of access requests by the defendant, which is of course responsible for implementing the appropriate procedures that enable the effective exercise of the right of access (Article 24 RGPD juncto art. 15 RGPD). 
RGPD, justifient qu’au titre de sanction effective, proportionnée et dissuasive telle que prévue à l’article 83 du RGPD une réprimande (article 100 § 1er, 5° LCA) soit prononcée à l’encontre du premier défendeur.  
75. On the basis of this finding of infringement of the PGRD, it is for the complainants to argue before the trial judge - if necessary - whether or not this lack of response deprived them of an opportunity to assert their rights in court, in the event that the response provided late would be considered incomplete in the context of such proceedings, which in this case the Litigation Chamber cannot assess on the basis of the facts submitted to it.
   
   
Compte tenu de l'importance de la transparence en ce qui concerne le processus décisionnel et les  décisions de la Chambre Contentieuse, cette décision sera publiée sur le site Internet de l'Autorité de protection des données moyennant la suppression des données d’identification directe des parties et des personnes citées, qu’elles soient physiques ou morales.
76. Furthermore, in view of the importance of transparency with regard to the decision-making process and the decisions of the Administrative Jurisdiction Division, the decision will be published on the website of the Data Protection Authority with the deletion of data directly identifying the parties and the persons cited, whether natural or legal persons.  
13
   
   
PAR CES MOTIFS,
   
   
La Chambre Contentieuse de l'Autorité de protection des données décide, après délibération : 
ON THESE GROUNDS,  
   
   
- de déclarer la plainte non-fondée à l’égard du second défendeur ;  
The Litigation Chamber of the Data Protection Authority decides, after deliberation, to : 
- Declare the complaint well-founded with regard to the late nature of the response provided by the defendant to the request for access to personal data made by the complainants, find that there has been an infringement of Articles 15.1 and 15.3 juncto 12.1 of the DPA and for this reason, issue a reprimand against the defendant on the basis of Article 100 § 1, 5° LCA ;  
   
   
- de prononcer à l’encontre du premier défendeur une réprimande sur la base de l’article 100 § 1er, 5° LCA ;
- To dismiss the complaint (art. 100 § 1, 1° LCA) with regard to the incompleteness of the defendant's response to the request for access to personal data, in particular with regard to any personal data processed in connection with the reasons for the breach of contract by the defendant;  
En vertu de l’article 108, § 1 LCA, cette décision peut faire l’objet d’un recours auprès de la Cour des marchés dans un délai de 30 jours à compter de sa notification, avec l'Autorité de protection des données en tant que défenderesse.
   
   
 
Pursuant to Article 108 § 1 ACL, this decision may be appealed to the Market Court within 30 days of its notification, with the Data Protection Authority as defendant.
   
   
   
Hielke Hijmans  
Hielke Hijmans  
Président de la Chambre Contentieuse
President of the Litigation Chamber
14
 
 


</pre>
</pre>

Latest revision as of 16:55, 12 December 2023

APD/GBA - 17/2020
LogoBE.png
Authority: APD/GBA (Belgium)
Jurisdiction: Belgium
Relevant Law: Article 12(3) GDPR
Article 15(1) GDPR
Article 15(3) GDPR
Type: Complaint
Outcome: Upheld
Started:
Decided:
Published:
Fine: None
Parties: n/a
National Case Number/Name: 17/2020
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): French
Original Source: APD (in FR)
Initial Contributor: n/a

The Belgian DPA (APD/GBA) ruled that a bank was subject to the GDPR in its capacity as a controller and should have answered access requests under Article 15 GDPR.  

English Summary

Facts

The complainants are clients of the defendant, a bank. In September 2019, the complainants made an access request to the bank’s controller. More precisely, they both sent a letter through their counsels, requesting “a copy of all the personal data [the bank] hold(s) as well as any additional information [the bank] ha(s) against [us] asking”. In response, the defendant asked them to provide for their ID cards and to specify which right they wanted to exercise. As the complainants found that the question was self-explanatory, they did not answer and lodged directly a complaint with the DPA in October 2019.

The complainants argued that the defendant should not have made the exercise of their access right conditional on either a clarification of the right at stake nor the sending of on a copy of the complainants' identity card.

The Defendant mainly argued that the data protection authority was not competent because the banking sector is not subject to data protection act.

Dispute

The authority has to clarify the scope of application of Article 15 GDPR.

Holding

The authority ruled that the data subjects who exercised their access right are not required to identify the applicable and relevant legal framework as long as the authority can assist them and ensure a clear understanding of the potential violation which is under its jurisdiction. Where necessary, the authority can change the legal qualification of the facts and review new facts within the limits of a contradictory debate. Thus, the authority is competent to examine the merits of a complaint as legally reclassified and submitted under Article 15 GDPR.

Also, the authority reminded that the controller must reply to an access request within the limit of one month under Article 12(3) juncto Article 15 GDPR. This deadline can be extended only under specific circumstances. In this regard, the defendant did not justify the delay and the incompleteness due specific circumstances such as complexity or the amount of requests to handle.

First, the complainants’ identity was made sufficiently clear in the access requests. Then, the authority recalled that the validity of an access request does not depend on whether a legal basis is invoked but on whether the access request is clear enough. Finally, the authority clarified that if the data subject does not request explicitly specific information, the controlled is required to give at once all the persona data mentioned by virtue of Article 15(1) GDPR, in the lights of Recital (63) GDPR.

Thus, the authority ruled that the lack of a complete answer was a breach of Articles 12(3), 15(1) and 15(3) GDPR

Comment

share your comment here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details. 


                                                              
Litigation Chamber 
 
Substantive Decision 17/2020 of 28 April 2020 
 

File No.: DOS-2019-05450 
 
Subject: Complaint by two customers against their bank following their request for communication by return mail of all the personal data it had about them. 
 
The Litigation Chamber of the Data Protection Authority, consisting of Mr Hielke Hijmans, president, and Messrs Jellle Stassijns and Christophe Boerave, members, which takes over the case in its present composition; 
 
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Regulation on Data Protection), hereinafter referred to as the DPA; 
 
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter LCA); 
 
Having regard to the Law of 30 July 2018 on the protection of individuals with regard to the processing of personal data (hereinafter the "Data Protection Law"); 
 
Having regard to the internal rules of procedure of the Data Protection Authority as approved by the 
House of Representatives on 20 December 2018 and published in the Moniteur belge on 15 January 2019 ; 
 
Having regard to the documents on file; 
 
Has taken the following decision concerning: - the complainants  
 
	- the defendant (controller)  
 
1.	History of the procedure 
 
1.	Having regard to the complaint lodged on 16 October 2019 with the Data Protection Authority by the complainants, through their counsel ; 
 
2.	Having regard to the additional information provided by the complainants' counsel to the DPA on 13 November 2019. 
 
3.	Having regard to the decision of 22 November 2019 of the Data Protection Authority's First Line Service (hereinafter "DPA") declaring the complaint admissible and the transmission of the complaint to the Litigation Chamber on the same date ;  
 
4.	Having regard to the decision of the President of the Litigation Chamber that the file was ready for processing on the merits pursuant to Articles 95 § 1, 1° and 98 ACL, the President invited the parties to conclude by registered letter of 20 January 2020, with a copy of the complaint and the inventory of the file.  
 
5.	Having regard to the letter of 31 January 2020 in which counsel for the defendant requested a copy of the documents in the file, which was sent to them by the Secretariat of the Litigation Chamber on 4 February 2020. 
 
6.	Having regard to the submissions of the defendant, received on 21 February 2020 ; 
 
7.	Having regard to the conclusions of the plaintiffs, received on 6 March 2020 ;  
 
8.	Having regard to the form of order sought by the defendant, received on 20 March 2020. 
 
2.	The facts and subject-matter of the complaint 
 
9.	The complainants are clients of the defendant for bank accounts related to their activities as managers of several companies. By letter of 10 September 2019 addressed through their counsel, the complainants requested the defendant to disclose by return of post all personal data in its possession. The request was worded as follows: "my clients request that you communicate to them without delay 
and by return, a copy of all the personal data you hold as well as any additional information you have against them". This request was made in the context of a challenge to the closure by the defendant of the complainants' bank accounts.  
 
10.	In response, the defendant requested additional information by e-mail of 11 September 2019: "With regard to the request for the Right of Access, in order to be able to process 
At your request we need the following information: which right do you wish to exercise and for what reason?  Please attach to your email a copy of the front side of your customer's identity card and send it to ... 
 
11.	The complainants did not feel that they had to answer positively to this request for a copy of their identity card. By e-mail of 12 September 2019, the complainants, through their counsel, indicated that "the request made by letter of 10 September 2019 was unambiguous as to the provision of a copy of all the personal data you hold with regard to my clients", and that this letter was the deadline within which the requested information had to be provided. In this e-mail, counsel for the complainants also stated that the request of his clients was, in his opinion, based on the "Data Protection Act", more precisely Article 38 § 1.  
 
12.	On 16 October 2019, the complainants lodged a complaint with the DPA, stating that the defendant had not yet responded to their request for access to their personal data.  
 
13.	13. In their complaint, the complainants argued in particular that the defendant could not make the processing of their request conditional on either a clarification of the right they wished to exercise or the sending of a copy of the complainants' identity card. The complainants consider that their request for access to the data was clearly notified by letter of 10 September and that the defendant had no reason to doubt their identity or the validity of the information provided by their counsel as to their identity.  
 
3.	The conclusions exchanged following the complaint  
 
14.	In its conclusions, the defendant states that the failure to reply to the request for access within the time-limits laid down by the RGPD is the result of a combination of exceptional circumstances: the request was made in the context of a broader dispute and was not submitted in accordance with the procedures laid down by the defendant for that purpose in accordance with Article [X] of its Privacy Charter, namely, via an e-mail with a copy of the identity card, or via various applications. According to the defendant, a human error then led to a delay in the response: the complainants' contact person at the defendant re-addressed the application to the wrong addressee and that person was then absent due to illness without a back-up having been provided.  
 
15.	Finally, the defendant considers that the complaint is unfounded because it is based on an erroneous article of law: the complainants invoke provisions of the Data Protection Act which concern requests for access to data processed by the authorities referred to in Article 26(7) of that Act, within the scope of which the defendant is not covered.   
 
16.	In their conclusions in reply, the complainants point out that their request for access to the personal data, which the defendant has at its disposal with regard to them, was requested in a sufficiently clear manner by letter of 10 January 2020. The complainants complain that the defendant transmitted the personal data requested to them late and in part, i.e. four months later, and without providing any details as to the reason why the defendant terminated its contractual relations (bank accounts) with the complainants. The complainants are of the opinion that the defendant could not have taken such a decision without having "disposed of and/or collected the information on the basis of which it took the decision to terminate the business relationship" and that, since this information constitutes personal data, the defendant was obliged to communicate it to the complainants. Finally, the complainants state that by failing to communicate these data, the defendant continues to infringe the DPMR, in particular Article 15 thereof.  
 
17.	In its reply, the defendant argues that the Litigation Chamber cannot take into account the legal basis which the complainants invoked by way of conclusion only. According to the defendant, it follows from Articles 94 and 95 ACL that the facts and grievances invoked in the complaint must be specified either in the complaint or by means of an investigation which the Litigation Chamber may request from the Inspection Service within 30 days of the admissibility of the complaint. According to the defendant's interpretation, the qualification of the facts described in the complaint must be fixed from the moment the Litigation Chamber considers that the file is in a state of being processed on the merits, pursuant to article 95 of the LCA. The defendant refers in this case to the letter of 20 January 2020 in which the Litigation Chamber invited the parties to conclude and in which the complaint is described as a request for access to personal data formulated on the basis of Articles 36 § 4 and § 5 as well as 38 § 1" of the Data Protection Act, in accordance with the legal provisions initially invoked by the complainants. According to the Respondent, the complainants are "not permitted to change their position during the proceedings and to invoke a new 
The Litigation Chamber is not allowed to change the scope of the procedure once the investigation phase has been completed [...] to allow such a change of wording after any possibility of involvement of the inspection service, even though the LAPD [LCA] does not contain any provision allowing the complainant or the Litigation Chamber to make such an amendment, would invite the worst violations of the rights of defence of the accused managers and subcontractors before the Litigation Chamber ... If there were to be the slightest doubt as to the legal characterization of a complaint and its basis (p. Should there be any doubt as to the legal characterization of a complaint and its basis (e.g. for a complaint brought by an individual without the intermediary of a lawyer), the Litigation Chamber should ask the ODA Inspection Service to clarify the matter". Thus, the complainants consider that, by not requesting a further investigation by the inspection service and by considering that the case could be dealt with on the merits without any investigative measure, the Litigation Chamber clearly considered that the legal qualification chosen was the only relevant one for claiming access to the complainants' personal data.  
 
18.	18. In the alternative, the defendant submits that the request under Article 15 of the GDR is unfounded, alleging that it provided its reply on 10 January 2020 to the complainants, that the longer than usual time-limit for reply is due to human error combined with the illness of a key participant in the proceedings. The defendant further submits the measures it has put in place to remedy these shortcomings in the future.  
 
19.	With regard to the complainants' allegation that the personal data provided by the defendant is incomplete (lack of response as to the reasons for the breach of contract that occurred), the defendant invokes the Law of 18 September 2017 on the prevention of money laundering and terrorist financing and on restrictions on the use of cash ("BC/FT" Law), which prohibits it from communicating any reason for termination to any customer, whether or not that customer is concerned by suspicions of money laundering, according to the defendant. 
 
 
 
4.	On the grounds of the decision  
On the competence of the Administrative Jurisdiction Division to assess whether the complaint is well-founded on the basis of the legal characterisation of the facts as corrected by the complainants by way of submissions and on the basis of a new complaint submitted by the complainants by way of submissions  
 
20.	According to the legal basis invoked in their complaint, the complainants seek access to the personal data held by the defendant in respect of them, on the basis of the provisions of the Act. 
Data Protection included under Title 2 of this law and which specifically applies to "competent authorities for the purpose of the prevention, investigation, detection and prosecution of criminal offences or the execution of criminal penalties, including the protection against and prevention of threats to public security and implements Directive 2016/680/EU of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data by those competent authorities" (the "Police Justice Directive").  
 
21.	In this respect, the defendant rightly points out in its conclusions that, as a company active in the provision of banking services, it is not concerned by the scope of Title 2 of the Data Protection Law.  
 
22.	However, the defendant wrongly disputes the competence of the Administrative Jurisdiction Division to examine the facts mentioned in the complaint - a request for access to personal data - from the point of view of the legal basis invoked by the complainants in their submissions, namely Article 15 of the DPMR, taking the view that only the Inspection Service would be competent to re-qualify the facts submitted in the original complaint. Furthermore, the defendant wrongly disputes that the Litigation Chamber would be competent to examine new facts or complaints invoked by the complainants by way of conclusion (such as the fact that the answer given in the meantime to their request for access would be incomplete). 
 
23.	The Litigation Chamber is an ODA body, established under Article 4(1) of the DCA, enjoying a certain degree of autonomy within ODA and taking its decisions independently in accordance with Article 43 of the DCA. In Belgium, the ODA is the authority responsible for monitoring compliance with the PGRD within the meaning of Article 8 of the Charter of Fundamental Rights of the European Union, Article 16 of the Treaty on the Functioning of the European Union and Article 51 of the PGRD. This control by the ODA and its Litigation Chamber is an essential element of the protection of individuals with regard to the processing of personal data, as organised by the PGRDD.  
 
24.	Under Articles 51(1), 51(2) and 52(1) of the DPMR, Member States are required to entrust one or more independent public authorities with the supervision of the application of the DPMR in order to protect the fundamental rights and freedoms of natural persons with regard to the processing and to facilitate the free flow of personal data in the Union.  These supervisory authorities should exercise their powers with a view to the effective implementation of European data protection law, including the PPMR. Ensuring the effectiveness of European law is one of the main duties of Member States' authorities under EU law.  
  
25.	It is their responsibility to facilitate the exercise of fundamental rights with regard to the protection of personal data. The supervisory authorities must in this respect play an active role through the tasks and powers conferred on them under Articles 57 and 58 of the PDSG. For example, under Article 57(2) of the EPR, each supervisory authority is required to "facilitate" the lodging of complaints by a data subject or a body. Logically, the processing of this complaint (or claim) should facilitate the exercise of the rights and contribute to a better control of citizens over their personal data.  
 
26.	The right to complain to ODA has been constructed by the legislator as an alternative to the judicial procedure (see articles 77 to 79 of the GDMP). The lodging of a complaint should remain an easy step for data subjects whose personal data are processed. The conditions of admissibility of this complaint are moreover defined in a minimal way in Article 60 ACL. To be admissible, a complaint lodged with the ODA must be written in one of the national languages, contain a "statement of the facts and the information necessary to identify the processing operation to which it relates" and fall within the competence of the ODA (Article 60 of the ACL). 
 
27.	27. Thus, complainants are not required to invoke any legal provision in order for their complaint to ODA to be admissible, as long as ODA can determine that the complaint concerns a legal provision that it has the task of monitoring. When considering whether the complaint is well-founded, the Litigation Chamber must therefore assess not whether the complainants have invoked the correct legal provision in support of their claim, in the formal complaint lodged with ODA, but whether the facts reported constitute an infringement of one of the legal provisions whose observance is subject to ODA control.  
 
28.	28. Similarly, complainants are not required to invoke all the relevant facts relating to the violation alleged in their complaint. The Litigation Chamber should be able to assist them by asking questions directed in such a way as to ensure a clear understanding of the potential infringement in fact and in law. 
to a fundamental right that the complainant wishes to bring to his or her attention. The Litigation Chamber may also take into account grievances developed subsequently by way of a conclusion by the complainant, provided that they concern facts or legal arguments relating to the alleged violation referred to it by way of a complaint, and with due respect for the rights of the defence. 
 
29.	29. During the procedure following the complaint, the Dispute Chamber therefore has the possibility of changing the legal qualification of the facts submitted to it, or examining new facts related to the complaint, without necessarily calling upon the intervention of the Inspection Service, in particular by putting questions to the parties or by taking into account the new facts or qualifications invoked by way of conclusion, and this within the limits of the adversarial debate, i.e. provided that the parties have had the opportunity to discuss these facts or legal qualifications in a manner consistent with the rights of the defence. If need be, it is for the Litigation Chamber to give rise to such debate either in its letter of invitation to conclude under article 98 of the ACL or subsequently in the context of a reopening of the proceedings. 
 
30.	30. In this context, taking into account a new legal classification invoked by the complainant does not prejudice the fairness of the proceedings and the equality of arms, has been a matter of urgency. 
a fortiori insofar as the decisions of the Litigation Chamber are likely to be 
full appeal to the Market Court .    
 
31.	The procedure conducted before the Litigation Chamber is therefore not strictly adversarial in nature as is the case before the Belgian civil courts, and the Litigation Chamber may on its own initiative modify the subject matter of the complaint in fact or in law.  
 
32.	This inquisitorial power which the Litigation Chamber grants itself on a case-by-case basis is justified and necessary in the context where the Litigation Chamber is responsible for supervising the exercise of rights which form an integral part of the fundamental right to protection of personal data, in the context of the implementation of Article 8(3) of the Charter of Fundamental Rights of the European Union.  
 
33.	33. The Litigation Chamber refers in this respect to the judgment of the Court of Justice of the European Communities of 9 October 2019 in the case of ODA v ING SA, in which the Court stated that the exercise of a right provided for in the GDR such as the right to rectification of personal data is not a mere subjective right on the part of the parties, but involves the exercise of powers 
of ODA on the basis of objective law, in the context where the right to rectification is an integral part of the fundamental right to protection of personal data and implements Article 8(3) of the Charter of Fundamental Rights of the European Union . The same reasoning applies to the right of access to personal data (art. 15 RGPD) which is the subject of the complaint submitted to the Litigation Chamber in the context of the present litigation.  
 
34.	34. Thus, in the present case, the request for exercise of a right provided for by the GDR, such as the right of access to personal data enshrined in article 15 thereof, implies the exercise of ODA competences on the basis of objective law and does not concern only the subjective rights of the parties, insofar as the exercise of those rights is an integral part of the fundamental right to protection of personal data and implements article 8.3 of the Charter of Fundamental Rights of the European Union.  
 
35.	35. The Litigation Chamber is therefore competent to examine the merits of the application as legally requalified by way of conclusion and made under Article 15 GDR. The Administrative Jurisdiction Division is also competent to examine the defendant's complaints by way of a final decision regarding the incompleteness of the reply to his request for access, insofar as that complaint relates to the request for access which is the subject of the initial complaint.  
 
 
On the merits of the request under section 15 of the GDPR 
 
36.	Under Article 15(1) of the DPMR, "the data subject shall have the right to obtain from the controller confirmation as to whether or not personal data relating to him or her are being processed and, where this is the case, access to such personal data and the following information ...":  
- the purposes of the processing,  
- the categories of personal data concerned,  
- the recipients or categories of recipients to whom the personal data have been or will be disclosed [...],  
- where possible, the intended period of storage of personal data or, where that is not possible, the criteria used to determine that period ;  
- the existence of a right to request the controller to rectify or erase personal data, or a restriction on the processing of the data 
(b) the right to object to the processing of personal data relating to the data subject;  
- the right to lodge a complaint to a supervisory authority; where the personal data are not obtained from the data subject, any available information as to their source ;  
- the existence of automated decision making, including profiling, as referred to in Article 22 (1) and (4) and, at least in such cases, relevant information concerning the underlying logic and the importance and intended consequences of the processing operation for the data subject. »  
 
37.	Information must also be provided on the appropriate safeguards implemented, if any, when personal data are transferred to a third country or to an international organisation (Art. 15.2 GDR). 
 
38.	Finally, Article 15(3) of the DPMR also provides that "the controller shall provide a copy of the personal data undergoing processing", this copy being the "copy of the personal data subject to processing". 
prescribed procedure for responding to an access request.  
 
39.	The provisions of the PGRD are directly applicable to the processing operations defined in Article 3 of the PGRD, with the exception of the provisions providing for a discretionary power for the benefit of the Member States as regards the implementation of the PGRD . Article 15 of the DPMR is part of the directly applicable provisions of the DPMR, which may be invoked by complainants in support of their requests for access to personal data concerning them that are processed in the context of the activities of a data controller on Belgian territory.  
 
In the present case, the Litigation Chamber must examine whether or not the defendant has infringed Article 15 of the GDR, which requires data controllers to comply with requests for access to their personal data. Indeed, the GDR does not impose any procedural conditions on the exercise of the right of access, such as the invocation of a specific legal basis.  
 
41.	41. From the point of view of the defence and the right to a fair trial, it is furthermore incumbent on the Litigation Chamber to examine whether the initial complaint was sufficiently comprehensible as to its subject matter to allow the defendant to identify it as a request for access under Article 15 of the GDR. Failing that, it was for the Litigation Chamber to reclassify the facts and allow an adversarial debate on the subject, either in its letter of invitation to conclude on the basis of Article 98 of the ACL, or subsequently in the context of a reopening of the proceedings. 
 
42.	In the context of the complaint submitted to it, the Litigation Chamber finds that the defendant did indeed respond to the request for access (albeit belatedly in view of the one-month time-limit laid down in Article 12 of the RGPD). The first response of the defendant to the complainants also explicitly refers to a "request for access" to personal data (e-mail of 11 September 2019: "With regard to the request for the right of access to personal data, the defendant has submitted a request for access to the personal data of the complainants. 
access, [...]").  
 
43.	43. On the basis of the facts set out by the complainants and not contested by the other side, it appears from the facts presented by the complainants and not contested by the other side that the request for access was formulated in a sufficiently clear manner for the defendant to identify that it was a request for the exercise of the right of access provided for in Article 15 of the GDR. The Litigation Chamber therefore considers that the complaint was validly submitted to it for examination of facts constituting a potential infringement of the right of access under Article 15 of the GDR.  
 
44.	44. The Litigation Chamber is therefore competent to take account of the grievances developed by the complainant by way of a finding under article 15 of the GDR instead of the provisions of article 15 of the GDR. 
36, § 4 and § 5 as well as Article 38, § 1 of the Law of 30 July 2018 (Data Protection Act).     
 
45.	The Administrative Jurisdiction Division also notes that the defendant was able to develop its arguments by way of conclusion, albeit in the alternative, and put forward its complaints regarding the request for access by the complainants under Article 15 of the GDR. The Chamber should therefore not reopen the proceedings on this point, and decides that it is competent to examine and deal with the complaint and its two complaints, namely, the late and incomplete nature of the reply made by the defendant to a request for access to personal data, including a request for a copy, submitted to it by the complainants. 
 
 
 
Failure to comply with the obligation to reply to a request for access to personal data within one month of receipt of the request.  
 
46.	According to Article 12.3 of the DPMR juncto Article 15 of the DPMR, a response to a request for access to personal data must be provided within one month of receipt of the request. This time limit may be extended by 2 months taking into account the complexity and number of requests, provided that the controller informs the data subject of this extension and the reason for the extension within one month of receipt of the request (Article 12.3 of the DPMR). 
47.	47. The defendant, as controller of the complainants' personal data, was therefore under an obligation to respond to their request for access to their personal data and to their request to receive a copy of these personal data within one month of receipt of the request, unless the time limit was extended for reasons to be communicated to the complainants within one month. The Administrative Jurisdiction Division finds that the defendant did not respond to the request for access within the prescribed time-limit, nor did it give reasons within one month for the postponement of the communication of that information.  
 
48.	48. The Chamber considers that this failure to reply constitutes an infringement of Articles 15(1), 15(3) and 12(3) of the RGPD for the following reasons: 
 
49.	Firstly, the Litigation Chamber finds that the request for access was sufficiently clear as regards the identity of the persons concerned to enable the defendant to reply within one month. Indeed, the defendant did not state the reasons why it requested additional information in order to identify the complainants, as permitted by Article 12. 6 of the DPMR, which provides that the controller "may request further information to confirm the identity of the data subject" where "the controller has reasonable doubts as to the identity of the natural person making the request referred to in Articles 15 to 21", within one month from the receipt of the request (Article 12.3 DPMR).  
 
50.	50. The defendant was therefore entitled to request that the complainants provide it with additional information (such as an identity card) to confirm their identity provided that it had reasonable doubt as to the identity of the natural person making the request. In the present case, the defendant did not give any reasons for doubting the mandate of their lawyer, a member of the bar, to represent clients, nor did it give any reasons for doubting the statements made by that lawyer with regard to the identity of his clients, in order to justify its request to return a copy of the front side of the clients' identity card. The defendant also replied to the complainants by letter dated 9 January 2020 addressed to one of the complainants. This fact shows that the defendant ultimately had no reasonable doubt as to the identity of this complainant. Without prejudice to the question whether, in view of the circumstances and the nature and volume of the data processed by it, a banking institution such as the defendant is entitled or not entitled to request a copy of the identity card of any person wishing to make a request for access to personal data in a standard manner, the Judicial Chamber notes that, in the present case, the intervention of a lawyer registered at the Brussels Bar and a letter sent with his paper to en en could enable the defendant to validate the factual data transmitted by that lawyer concerning the identity of his clients. 
51.	51. It was incumbent on the defendant to provide all the personal data requested by the complainants, namely, according to the interpretation of the Litigation Chamber, all the personal data and information on this subject referred to in Article 15 of the GDR.  
 
52.	52. Secondly, the Litigation Chamber notes that the request for access to and copy of the personal data held by the defendant was, as to its purpose, formulated sufficiently clearly by the complainants to enable the defendant to reply within one month. The Litigation Chamber also takes into account the fact that Articles 15.1 and 15.3 juncto 12.3 of the RGPD did not allow the defendant to postpone its response to the request for access by requesting clarification of the "rights" that the complainants would like to exercise following their request for access.  
 
53.	53. Admittedly, the Litigation Chamber understands that the defendant asked the complainants to specify which rights they wished to exercise, since according to the case-law of the Court of Justice, in order to comply with a request for a right of access, "it is sufficient 
that the applicant be provided with a complete overview of those data in an intelligible form, that is to say, in a form which enables the applicant to acquaint himself with those data and to verify that they are accurate and processed in accordance with that Directive, so that the applicant may, where appropriate, exercise the rights conferred on him by that Directive. » . This case-law (under the former Directive 95/46) is relevant insofar as it does not make requests for access subject to the condition of indicating which right the data subject intends to exercise following his request for access. Recital 63 of the GDPMR states that the right of access to personal data must enable a data subject to "become acquainted with the processing operation and to exercise it in accordance with the law". 
verify lawfulness", without indicating that the controller may postpone its response pending information on the purposes of the access request.  
54.	54 54. Recital 63 of the DPMR specifies, however, that it should be possible for the controller to postpone the response to a request for right of access in order to obtain specific additional information, namely "on which data or on what data, if any, should be disclosed". 
processing operations his request is related to", and this is the case when the controller processes a large amount of data relating to the data subject. Where appropriate, it is the responsibility of the controller to "facilitate the exercise of the rights" of the data subjects under Article 12(2) of the PGRD, which excludes the possibility of asking such questions in an irrelevant manner and/or for dilatory purposes, all the more so as Article 8(2) of the Charter of Fundamental Rights of the European Union mentions the right of access as one of the founding principles of the right to protection of personal data. 
 
55.	55. In the present case, the only requests for additional information possible under recital 63 of the GDR were not made by the defendant, so that the Chamber considers that the request for access made by the complainants was sufficiently clear in terms of its content to enable the defendant to reply within the legal time-limit of one month from receipt.  
 
56.	Finally, for all practical purposes, the Litigation Chamber also recalls that the GDR does not make the validity of a request for access dependent on the invocation of a particular legal basis such as Article 15 of the GDR. It is sufficient in this respect that the subject of the request is sufficiently clear, namely access to and/or copying of personal data. In the present case, the Administrative Jurisdiction Division finds that the request was sufficiently clear in this respect, as evidenced by the fact that the defendant immediately identified the request of the complainants as a request for access to their data, which is apparent from the wording of the first response to this request by the defendant (e-mail of 11 September 2019: "With regard to the request for the Right of Access, ..."). 
 
57.	57. As a result, the Litigation Chamber finds that the defendant has infringed Articles 15.1, 15.3 and 12.3 of the RGPD. 
  
The completeness or otherwise of the reply to the request for access  
 
58.	The Administrative Jurisdiction Division decided to dismiss the complaint lodged by the complainants by way of conclusion, namely, the fact that, in their view, the reply given by the defendant regarding access to any personal data relating to the reasons for the decision to terminate the commercial relations between the parties was not complete. 
59.	59. In the present case, the Litigation Chamber considers that this request for access is part of a broader commercial dispute which a court of first instance may decide if it is seised of the following questions: whether or not the defendant had the right to terminate its commercial relationship with the plaintiffs without giving reasons, and is it correct that the anti-money laundering provisions which it must apply exonerate it from any duty to provide information as to the reasons for the decision to terminate the commercial relationship.   
 
60.	60. However, the Litigation Chamber intends to provide some clarification and its assessment of the scope of the information to be provided in response to requests for access under article 15 of the GDR. Insofar as the plaintiffs' request did not indicate which personal data or specific information relating to those data was requested among the various items of information provided for in Article 15.1 of the GDR (e.g. storage period, origin of the personal data, etc.), the Litigation Chamber considers that it was incumbent on the defendant to provide within the legal time limit of at least one month a complete overview of the personal data or categories of personal data being processed (Art. 15.1.b), including the purposes of that processing (Article 15.1.a), as well as the recipients or categories of recipients for each category of data (Article 15.1.c), where possible, the storage period or the criteria used to determine that period (Article 15.1.d), the source of the data where they are not obtained from the data subject (Article 15.1.g), and the information set out in Articles 15.1.e, f and h and 15.2 of the GDR. As regards the form of this information, the Administrative Jurisdiction Division considers that the information should enable the data subject to acquaint himself with the data processing operations and to verify their lawfulness, in accordance with the purpose of the right of access as set out in recital 63 of the GPRD.  
 
61.	If the controller does not provide from the outset all the information that the data subject is likely to obtain under Article 15 of the GDR, the Administrative Jurisdiction Division considers that it is at least incumbent on it to specify in the reply to the request for access how the data subject can obtain this additional information relating to the data processed, for example the Privacy Charter, provided that this document is sufficiently clear in this respect and that the reference to it is sufficiently precise to enable the data subject to easily find the information referred to in Article 15(1) of the GDR.  
62.	62. The Litigation Chamber notes that the defendant has an automated system enabling it to respond to this type of request. The Litigation Chamber notes, however, that the result of this automatic response does not include all the information referred to in Article 15(1) of the GDR. The Administrative Jurisdiction Division notes that the reply sent by the defendant to the complainants contained, in particular, information on the categories of data processed, their origin and the purposes of the processing, as well as on the choices made by the complainants with regard to the processing of data for marketing purposes. In addition, the plaintiff was invited to address any request for further information to an e-mail address of the bank.  
 
63.	Thus, the document does not provide any information on : 
- the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular recipients who are established in third countries or international organisations (Article 15 § 1, c GDR) ; 
- the envisaged period of retention of the personal data or, where this is not possible, the criteria used to determine this period (Article 15(1)(d) of the ECHR); 
- the existence of the right to request from the controller the rectification or erasure of personal data, or a restriction on the processing of personal data relating to the data subject, or the right to object to such processing (Art. 15 § 1, e PGRD) ; 
- the right to lodge a complaint with a supervisory authority (art. 15 § 1, f PGRD) ;  
- the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4) and, at least in such cases, useful information concerning the underlying logic, as well as the importance and the expected consequences of such processing for the data subject (Article 15(1)(h) of the Data Protection Regulation); 
- if personal data are transferred to a third country or to an international organisation, the appropriate safeguards put in place with respect to such transfer (Art. 
15 § 2 RGPD). 
 
64.	The reply formulated by the defendant therefore appears to the Litigation Chamber to be incomplete. However, the Litigation Chamber will not uphold these complaints insofar as they have not therefore been the subject of an adversarial hearing in the context of the present case. The 
Chambre contentieuse understands that the plaintiffs' challenge is to the incompleteness of the categories of data provided with regard to the reasons for the breach of contract and not to the potentially incomplete nature of the information provided about the data processed by the defendant in general. The Litigation Chamber therefore does not reopen the proceedings on the latter point. 
65.	In view of the facts and complaints submitted to it, the Litigation Chamber therefore closes the complaint with regard to the complaint concerning the incompleteness of the reply to the request for access. 
 
On corrective measures and sanctions 
 
 
66. Under article 100 of the LCA, the Litigation Chamber has the power to :  
 
"1° dismiss the complaint without further action;  
2° order the dismissal;   
3° pronounce a suspension of the pronouncement;   
4° propose a settlement;  
5° issue warnings or reprimands;   
6° order to comply with the requests of the person concerned to exercise these rights; 
7° order that the person concerned be informed of the security problem; 
(8) order the temporary or permanent freezing, restriction or prohibition of treatment; 
(9) order that the treatment be brought into conformity; 
10° order the rectification, restriction or deletion of the data and the notification of the data to the recipients of the data; 
11° order the withdrawal of the approval of certification bodies; 
(12° give penalty payments; 
13° give administrative fines; 
14° order the suspension of transborder data flows to another State or international organization; 
15° transmit the file to the Public Prosecutor's Office of the King's Prosecutor of Brussels, which informs it of the follow-up given to the file; 
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. »  
 
67.	The complainants request that the Litigation Chamber declare their complaint well-founded. The complaint does not include a specific provision on the measures requested. The Litigation Chamber understands that the complainants request that it find that the response to their request for access was late and incomplete and that the Litigation Chamber orders the defendant to comply with their request for access to personal data not yet disclosed, according to the complainants. 
68.	68. The defendant acknowledges that it reacted late to the request for access, but denies having any personal data about the complainants other than those which it transmitted to them. The defendant justifies the four-month time-limit for reply by a combination of circumstances. As a reminder, the addressee of the request was absent due to illness without provision having been made for a back-up, in the context where the request was not submitted in accordance with the procedures laid down by the defendant for that purpose in accordance with Article [X] of its Privacy Charter, namely, via an e-mail with a copy of the identity card, or via various applications. The defendant has put measures in place to deal with such circumstances in the future, which it asks the Administrative Jurisdiction Division to take into account in the context of the measures to be ordered. »  
 
69.	The defendant further refers to the existence of a procedure for processing access requests since 2018, with more than 25600 requests processed since then, without a customer having complained, according to the defendant's information. 
 
70.	70. In that context, the defendant requests that the complaint be dismissed inasmuch as it considers it unfounded in view of the legal basis relied on by the complainants. In the alternative, if the Administrative Jurisdiction Division considers that it should deal with the complaint, the Respondent requests that the case be dismissed under Article 100 § 1, 2° ACL. In the further alternative, the defendant requests suspension of the proceedings in accordance with Article 100 § 1, 3° ACL. In particular, the defendant takes the view that, in view of the particular circumstances of the case, in particular the manifestly unfounded nature of the complainants' allegations, human error and the considerable efforts it has made to respond to the requests for access, a further penalty would be disproportionate. In addition, the defendant claims confidentiality of the publication of the decision to be taken in an 'anonymous' manner, inasmuch as it cannot be accused of negligence in the present case. 
 
71.	71. In the present case, the Litigation Chamber recalls that the right of access to personal data, enshrined in Article 15 of the GDR, is a fundamental right of personal data protection. The one-month time-limit for reply has not only applied since the entry into force of the RGPD on 24 May 2018, but also since the entry into force in 1993 of the Act of 8 December 1992 on the processing of personal data, which preceded it, where the time-limit was 45 days (Article 10 § 1 (3) of that earlier Act). Failure to comply with the 30-day time-limit is, according to the Litigation Chamber, a failure to comply with the time-limit. 
72.	The argument put forward by the respondent that human error had occurred and that a person was ill therefore does not stand up to analysis. Those exceptional circumstances do not detract from the fact that, at the material time, there was no procedure for dealing with requests for access outside the standard methods of communication advocated by the defendant.   
 
73.	73. The defendant acknowledges by way of conclusion that there was a certain degree of delay in processing the Complainants' request and states that it has taken appropriate organisational measures to remedy this in the future:  
 
"Due to a combination of unfortunate circumstances, in particular the long absence of the competent manager (due to illness) and a human error when sending an e-mail, the request could not be followed up in accordance with the usual procedure. In order to remedy this in the future, the defendant identified certain concrete measures: 
(i) The establishment of an internal, strictly monitored reminder system: if the competent person coordinating or handling a complaint is absent, that person will in future be followed up by a back-up person who will receive an automated reminder. 
(ii) The establishment of reminders of the possibility of access via automated tools: since any data subject can consult his or her own data in various applications, the defendant must further increase the visibility of this possibility, in particular by means of a standardised reply to any person making an access request reminding him or her of the existence of these tools. In this way, any data subject can benefit from the ease and speed of these tools. There is of course nothing to prevent the request being processed manually if the data subject so wishes, but this will make the procedure even more efficient. »  
 
74.	The Administrative Jurisdiction Division takes note of these efforts made by the respondent to improve the future handling of access requests made outside its specific automated procedures, and therefore confines itself to reprimanding the respondent on the basis of Article 100 § 1, 5° ACL. The Litigation Chamber refrains from any other sanction insofar as this is the first complaint it receives concerning the processing of access requests by the defendant, which is of course responsible for implementing the appropriate procedures that enable the effective exercise of the right of access (Article 24 RGPD juncto art. 15 RGPD).  
75.	On the basis of this finding of infringement of the PGRD, it is for the complainants to argue before the trial judge - if necessary - whether or not this lack of response deprived them of an opportunity to assert their rights in court, in the event that the response provided late would be considered incomplete in the context of such proceedings, which in this case the Litigation Chamber cannot assess on the basis of the facts submitted to it.  
 
76.	Furthermore, in view of the importance of transparency with regard to the decision-making process and the decisions of the Administrative Jurisdiction Division, the decision will be published on the website of the Data Protection Authority with the deletion of data directly identifying the parties and the persons cited, whether natural or legal persons. 
 
 
ON THESE GROUNDS, 
 
The Litigation Chamber of the Data Protection Authority decides, after deliberation, to :  
- Declare the complaint well-founded with regard to the late nature of the response provided by the defendant to the request for access to personal data made by the complainants, find that there has been an infringement of Articles 15.1 and 15.3 juncto 12.1 of the DPA and for this reason, issue a reprimand against the defendant on the basis of Article 100 § 1, 5° LCA ; 
 
- To dismiss the complaint (art. 100 § 1, 1° LCA) with regard to the incompleteness of the defendant's response to the request for access to personal data, in particular with regard to any personal data processed in connection with the reasons for the breach of contract by the defendant;   
 	 
 
Pursuant to Article 108 § 1 ACL, this decision may be appealed to the Market Court within 30 days of its notification, with the Data Protection Authority as defendant. 
  	 	 	 	  
 
Hielke Hijmans 
President of the Litigation Chamber
Retrieved from "https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_17/2020&oldid=37550"
Creative Commons Attribution-NonCommercial-ShareAlike
Powered by MediaWiki