APD/GBA (Belgium) - 137/2022

APD/GBA - Decision 137-2022
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 12(3) GDPR Article 12(4) GDPR Article 17(1) GDPR
Type:	Complaint
Outcome:	Upheld
Started:	08.08.2022
Decided:	26.09.2022
Published:	02.10.2022
Fine:	n/a
Parties:	n/a
National Case Number/Name:	Decision 137-2022
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Dutch
Original Source:	GBA (in NL)
Initial Contributor:	n/a

The Belgian DPA used Article 58(2)(c) GDPR to order a controller to comply with an erasure request of a data subject pursuant to Article 17 GDPR after it failed to reply to the initial request.

English Summary

Facts

The data subject exercised its right to be forgotten on 19 June 2022, but the controller didn’t provide an answer. On 8 August 2022, the data subject filed a complaint at the Belgium DPA for the lack of an answer to the request.

Holding

The DPA held that the data subject had exercised its right to be forgotten according to Article 17(1) GDPR and had done so in a way as described in the privacy policy of the controller. Since the controller did not provide an answer at all, the DPA held that it had violated Article 12(3) GDPR (the controller failed to answer within a month), Article 12(4) GDPR (The controller failed to provide a reason why it did not comply with the request) and Article 17(1) GDPR. The DPA held that the controller had to comply with the request of the data subject and ordered the controller to delete the personal data within 30 days, based on Article 58(2)(c) GDPR and Article 95 §1,5 WOG. The DPA also held that the controller had notify the DPA within 30 days about the result of this decision.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

                                                                                                   1/5







                                                                                  Dispute room



                                                   Decision 137/2022 of 26 September 2022



File number : DOS-2022-03284



Subject: Exercising the right to erasure without informing the defendant

follows



The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke Hijmans,
single chairperson;



Having regard to Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 on

the protection of natural persons with regard to the processing of personal data and

on the free movement of such data and repealing Directive 95/46/EC (General
Data Protection Regulation), hereinafter GDPR;



Having regard to the law of 3 December 2017 establishing the Data Protection Authority, hereinafter WOG;


Having regard to the internal rules of procedure, as approved by the Chamber of Representatives

on December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;



Having regard to the documents in the file;




has taken the following decision regarding:

                                                                                                  .

The complainant: Mr X, hereinafter referred to as “the complainant”; .
                                                                                                  .

The Defendant: Y, hereinafter referred to as “the Defendant”. Decision 137/2021 - 2/5



I. Facts procedure


    1. On 8 August 2022, the complainant lodged a complaint with the Data Protection Authority against

        the defendant.


    2. On June 19, 2022, the complainant addressed the defendant with a request for the

        delete personal data pursuant to Article 17.1 GDPR, in accordance with .'s privacy policy

        the defendant. On August 8, 2022, the complainant has not yet received a reply from the defendant in
        in connection with the request for erasure. Following on from this, the

        complainant lodged a complaint with the Data Protection Authority.


    3. On April 22, 2022, the complaint will be declared admissible by the Frontline Service on the basis of the

        Articles 58 and 60 WOG and the complaint on the basis of art. 62, §1 WOG transferred to the
        Dispute room.


II. Justification


    4. The Disputes Chamber determines on the basis of the documents that substantiate the complaint that the complainant is entitled to

        exercised the erasure of data in accordance with Article 17.1 of the GDPR on June 19, 2022. From the documents accompanying

        the complaint, the Disputes Chamber concludes that the complainant has submitted his request for erasure

        performed as specified in the Defendant's Privacy Policy. Pursuant to Article 12.3 GDPR
        the controller, in this case the defendant, must respond to the request for

        to reply to the deletion of data within one month of receipt of the request. Possibly can

        this period can be extended by a further two months, given the complexity of the

        request. The complainant must then, within one month after the request for the erasure of data about this

        extension to be notified. If the defendant decides not to comply with the

        request of the complainant, it must communicate this within one month of receipt of the request
        to the data subject, in accordance with Article 12.4 GDPR. It is not apparent from the file that the complainant

        answer has been received about the effect that the weather has on the data erasure

        is given. As a result, the controller has acted in violation of Article

        12.3 and 12.4 GDPR, as well as Article 17.1 GDPR.

    5. The Disputes Chamber is of the opinion that on the basis of the above analysis,

        concluded that an infringement of the provisions of the GDPR was committed by the defendant,

        which justifies the taking of a decision in this case on the basis of

        of Article 95, §1, 5° WOG, in particular to order the defendant to comply with the

        exercise by the complainant of his right to erasure (Article 17.1 GDPR).

    6. The present decision is a prima facie decision taken by the Disputes Chamber

        in accordance with article 95 WOG on the basis of the complaint submitted by the complainant, in the context of Decision 137/2021 - 3/5



                                                                       1
        the ‘procedure prior to the decision on the merits’ and not a decision on the merits of the

        Dispute Chamber within the meaning of Article 100WOG. The Dispute Chamber has thus decided on the grounds

        of Articles 58.2. c) and 95, §1, 5° of the law of December 3, 2017, to order the defendant

        that the data subject's requests to exercise his rights are met, more

        determines the right to erasure (“right to be forgotten”) as defined in Article 17 of the GDPR.


    7. The purpose of this decision is to inform the defendant that it is a

        has committed a breach of the provisions of the GDPR and to give them the opportunity to

        to still conform with the aforementioned provisions.


    8. However, if the defendant does not agree with the contents of this prima facie

        decision and is of the opinion that it can assert factual and/or legal arguments that lead to

        could lead to a different decision, this can be done via the e-mail address litigationchamber@apd-

        gba.be submit a request for treatment on the merits of the case to the Disputes Chamber and this

        within 30 days of notification of this decision. The implementation of

        If necessary, this decision will be suspended during the aforementioned period.


    9. In the event of a continuation of the handling of the case on the merits, the Disputes Chamber will


        the parties on the basis of Articles 98, 2° and 3° in conjunction with Article 99 WOG invite their

        to submit defenses and to attach to the file any documents they deem useful. The

        If necessary, this decision will be definitively suspended.


    10. For the sake of completeness, the Disputes Chamber points out that a treatment of the substance of the case can be
                                                                                     2
        lead to the imposition of the measures referred to in Article 100 WOG.


    11. Finally, the Disputes Chamber points out the following:


        If one of the parties wishes to make use of the possibility to consult and

        copyingthefile(article95,§2,3°WOG),shouldreturntothesecretariat

        of the Disputes Chamber, preferably via litigationchamber@apd-gba.be, in order to make an appointment



1Section 3, Subsection 2 WOG (Articles 94 to 97).
2
 1° to dismiss a complaint;
 2° order the suspension of prosecution;
 3° order the suspension of the judgment;
 4° propose a settlement;
 5° to formulate warnings and reprimands;
 6° order compliance with the data subject's requests to exercise his or her rights;
 7° to order that the data subject is informed of the security problem;

 8° order that the processing be temporarily or permanently frozen, restricted or prohibited;
 9° to order that the processing is brought into conformity;
 10° the rectification, restriction or deletion of data and its notification to the recipients of the data
command;
 11° order the withdrawal of the recognition of certification bodies;
 12° to impose periodic penalty payments;
 13° impose administrative fines;
 14° order the suspension of cross-border data flows to another State or an international institution;
 15° to hand over the file to the public prosecutor's office in Brussels, who will inform it of the consequence that the
file is given;

 16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. Decision 137/2021 - 4/5




        If a copy of the file is requested, the documents will be

        delivered electronically or otherwise by regular mail .3



III. Publication of the decision


    12. Given the importance of transparency in the decision-making of the

        Litigation Chamber, this decision is published on the website of the

        Data Protection Authority. However, it is not necessary that the identification data

        of the parties be published directly.



 FOR THESE REASONS,

 the Disputes Chamber of the Data Protection Authority decides, subject to the

 submission of a request by the defendant for a hearing on the merits in accordance with Article
              1
 98 ff WOG , to:



 - on the basis of Article 58.2, c) AVG and Article 95, §1, 5° WOG to order the defendant that
    complied with the data subject's request to exercise his or her rights, in particular the right

    to erasure (Article 17.1 GDPR), and proceed to erasure of the relevant data

    personal data, and this within 30 days from the notification of

    this decision;



 - order the defendant to the Data Protection Authority (Dispute Chamber) by email

    within the same period of time about the outcome of this decision by e-mail

    email address litigationchamber@apd-gba.be; and



 - in the absence of the timely execution of the above by the defendant, the case

    to be dealt with on the merits ex officio in accordance with Articles 98 et seq. WOG.




Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the notification

appeal against this decision to the Marktenhof (Brussels Court of Appeal), with the

Data Protection Authority as Defendant.

Such an appeal may be lodged by means of an adversarial petition that the

1034terof the Judicial Code, the statements listed should contain .The application to



3Due to the extraordinary circumstances due to COVID-19, the possibility of collection at the secretariat of the
Dispute room NOT provided. In addition, all communication is in principle electronic.
4
 The petition states, on pain of nullity:
 1° the day, month and year;
 2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
    company number; Decision 137/2021 - 5/5




contradiction must be submitted to the registry of the Market Court in accordance with Article

1034quinquies of the Ger.W. , or via the Justice Deposit Information System (Article 32ter of


the Ger.W.).







(get) Hielke Hijmans


Chairman of the Disputes Chamber



























































  3° the name, first name, place of residence and, where applicable, the capacity of the person to be summoned;
  4° the subject matter and the brief summary of the grounds of the claim;
  5° the court before whom the claim is brought;
  6° the signature of the applicant or of his lawyer.

5 The application with its annex is sent, in as many copies as there are parties involved, by registered letter to the
clerk of the court or at the registry.