APD/GBA (Belgium) - 172/2022

APD/GBA - 172/2022
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 6 GDPR Article 6(1)(a) GDPR Article 6(1)(f) GDPR Article 12(1) GDPR Article 12(3) GDPR Article 12(4) GDPR Article 17(1) GDPR Article 19 GDPR Article 21(1) GDPR Article 58(2) GDPR
Type:	Complaint
Outcome:	Upheld
Started:	06.09.2022
Decided:	24.11.2022
Published:	24.11.2022
Fine:	n/a
Parties:	Mister X (the data subject) the estate agency (the controller)
National Case Number/Name:	172/2022
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	French
Original Source:	Autorité de Protection des Données (ADP) (in FR)
Initial Contributor:	n/a

The Belgian DPA warned a real estate agency for failing to respond to an erasure request and an objection request. The controller did not remove an advertisement for the property sold to the data subject after the purchase was already completed.

English Summary

Facts

On 27 July 2022, the data subject bought a house with a real estate agency (controller), acting as an intermediary between the data subject and the seller. However, pictures of the house, the postal address and other information were still available on the controller’s website in an advertisement. This advertisement included, amongst other information, the address of the property and identification numbers of the cadastral parcels. On 24 June, the data subject requested the erasure of this data and objected to the processing by the controller. The controller refused to comply with these requests for marketing purposes, specifically for the controller’s commercial activity as a real estate agency. The data subject also contacted the host of the controller’s website (processor) to delete the information, without apparent success.

On 6 July 2022, the data subject filed a complaint at the Belgian DPA because the controller refused to comply with the requests. The DPA found that the advertisement, including the displayed information and pictures, was still online on the website on 12 October 2022.

Holding

The DPA held that the controller failed to comply with Articles 12, 13, 17(1) and 21(1) GDPR, because the controller did not respond to the data subject's objection request and erasure request within one month. Moreover, the DPA held that the controller did not have a legal basis for the processing on the controller’s website. The DPA determined that the controller was not able to use the legal basis of contract (Article 6(1)(b) GDPR), because the data subject was not a party to the contract between the controller and the seller of the property. The publication of the advertisement could therefore not be based on Article 6(1)(b) GDPR, especially not after the sale of the property.

The DPA continued by stating that the controller did not meet any of the lawfulness requirements of Article 6 GDPR, but examined nevertheless if the controller could rely on legitimate interest (Article 6(1)(f) GDPR), for which three cumulative requirements had to be fulfilled. Regarding the first requirement, the purpose test, the DPA considered that the purpose of publishing advertisements for commercial purposes was a legitimate interest in order to display professional qualities and attract attention (see also recital 47). However, the DPA determined that the controller did not fulfil the second requirement, the necessity test. The DPA assessed whether it was necessary for the controller’s commercial purposes (such as promote its work, its seriousness and the past commercial experiences, etc.) to post the data subject’s postal address and pictures with identification data of the property. The DPA concluded that the posting of the information was not necessary to meet this commercial purpose, because the pictures with identification data could also have been posted without this identification data. The second requirement was therefore not fulfilled because the principle of data minimisation (Article 5(1)(c) GDPR) was not respected. Moreover, the DPA also determined that the controller did not fulfil the third requirement, the balancing test, and stated that the data subject could never expect the posting of pictures of his newly acquired house with identification data for commercial purposes. The controller also did not ask the data subject for his consent for the publication of this data on the controller’s website. Thus, the controller did not seem to comply with Article 6 GDPR. Therefore, the controller had to comply with the erasure – and objection requests of the data subject as soon as possible. The controller was also obliged under Article 19 GDPR to notify each recipient to whom the data subject’s personal data had been disclosed, in this case the processor, of any erasure of personal data carried out in accordance with Article 17(1) GDPR, unless such communication would prove impossible or would require disproportionate efforts. This was not the case according to the DPA in this decision.

The DPA concluded by stating that the controller failed to comply with Articles 12(3), 12(4), 17(1), 19 and 21(1) GDPR. The DPA ordered the controller to comply with the data subject’s request for erasure (Article 17(1) GDPR) and his right to object (Article 21(1) GDPR), pursuant to Article 95(1)(5) WOG and Article 58(2)(c) GDPR. In particular, the controller had to erase the postal address of the property, including on Google MAPS, and the identification numbers of the data subject's cadastral parcels on the controller's website. Moreover, the DPA ordered the controller to notify the data subject on the erasure of his personal data (Article 19 GDPR) and to no longer process this data.

The DPA also issued a decision pursuant to Article 95(1)(4) WOG and issued a warning to the controller pursuant to Article 58(2)(a) GDPR, because the controller seemed to have failed to comply with Article 6 GDPR, in order to ensure that the controller would respond to data subject’s requests in the future.

Comment

This is a prima facie decision, not a decision on the merits. Both parties still have the possibility to continue with the procedure if they wish so.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/13






                                                                        Litigation Chamber


                                                   Decision 172/2022 of 24 November 2022



File number: DOS-2022-02927


Subject: Complaint relating to a refusal to respond to a request to exercise the right

erasure, the right to object and the right to restriction of processing by a

real estate agency.


The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke

Hijmans, chairman;


Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and

to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the
data protection), hereinafter “GDPR”;


Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, hereinafter

“ACL”;


Having regard to the internal regulations as approved by the House of Representatives on 20

December 2018 and published in the Belgian Official Gazette on January 15, 2019;


Considering the documents in the file;


Made the following decision regarding:


The plaintiff: Mr. X, hereinafter “the plaintiff”;
                                                                                                        .

The defendant: Agency Y, hereinafter: “the defendant”. .
                                                                                                        . Decision 172/2022 - 2/13



I. Facts and procedure


 1. On July 6, 2022, the complainant filed a complaint with the Data Protection Authority

       (hereinafter “the DPA”) against the defendant. The subject of the complaint concerns the agency's refusal

       real estate (hereinafter “defendant”) to withdraw from its website the advertisement of a property

       real estate that the plaintiff (purchaser) bought on June 27, 2022 from the former owner

       (seller).


 2. On June 24, 2022, the complainant exercises his right of erasure and opposition. It emerges from

       documents in the file that: the plaintiff asked the defendant "by telephone and by e-mail from the

       June 14 and June 16” to remove from the website (…) the information on his house located at “…”

       (minimum sale price; detailed descriptions; images of its interior and exterior;

       images with identification numbers of cadastral parcels; Google MAPS); the

       defendant refuses to comply with the plaintiff's request to maintain "[the] publication, and

       this for marketing purposes of [his] commercial activity as an agent”; the complainant asked

       the creator of the website, company Z, “to act promptly to remove the information

       [published on the defendant's website] or make access to them impossible”; the

       plaintiff indicates that he will "not hesitate to take the appropriate actions in order to defend
       [his] rights, including in particular [to file] a complaint with the Professional Institute of Agents

       immovable property (IPI) in relation to the actions of Y [and] [...] of the Direction générale de

       the Economic Inspection with regard to [the] commercial practices via its point of contact

       contact ". In support of his argument, the plaintiff cites in particular judgment 71/2020 of the

       Litigation Chamber. 1


 3. On July 8, 2022, the Front Line Service (hereinafter “SPL”) of the APD requests

       additional information to the complainant, particularly if "the publications

       concerning [the]propertymention[...][its] nameandaddressoftheproperty”, and in the affirmative of

       provide him with the evidence. On the same date, the complainant informed the SPL that

       his name, unlike his postal address, is not mentioned on the publication

       contentious and attaches a screenshot taken at 6:11 p.m. The complainant adds in his e-mail from

       July 8, 2022 sent at 6:16 p.m. that his address is equivalent to personal data being

       given that anyone with access to his address can make the link between his

       real estate and his personal situation.


 4. On September 6, 2022, the SPL declares the complaint admissible on the basis of Articles 58 and 60

       of the LCA, and sends it to the Litigation Chamber in accordance with Article 62, § 1

       of the ACL.



1Litigation Chamber,decisiononthemerits71/2020of30October2020,Thefulltextofthejudgmentisavailableat
the website of the Data Protection Authority, at the following address:
https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-71-2020.pdf. Decision 172/2022 - 3/13



II. Motivation


 5. Pursuant to Article 4, § 1 of the LCA, the DPA is responsible for monitoring the principles

       of data protection contained in the GDPR and other laws containing

       provisions relating to the protection of the processing of personal data.

 6. Pursuant to Article 33, §1 of the LCA, the Litigation Chamber is the body for

       ODA administrative litigation. It receives complaints that the Service de Première

       Ligne (SPL) transmits to it pursuant to Article 62, § 1 of the LCA, i.e. complaints

       admissible. In accordance with Article 60 paragraph 2 of the LCA, complaints are admissible if

       they are written in one of the national languages, contain a statement of the facts and the

       indications necessary to identify the processing of personal data on

       which they relate and which fall within the competence of the DPA.


 7. Pursuant to articles 51 and s. of the GDPR and Article 4, § 1 of the LCA, it is up to the

       Litigation Chamber as an administrative litigation body of the DPA, to exercise

       effective control of the application of the GDPR and to protect the freedoms and rights

       fundamental rights of natural persons with regard to processing and to facilitate the free flow
       personal data within the Union.


 8. On the basis of the facts described in the complaint file as summarized above, and on the basis

       powers attributed to it by the legislator under Article 95, §1 of the

       the LCA, the Litigation Chamber decides to proceed, on the one hand, to take a decision

       in accordance with Article 95, § 1, 5° of the LCA, more specifically to order the person responsible

       processing to comply with the complainant's request to exercise his right to erasure

       (Art. 17.1 of the GDPR) and his right to object (Art. 21.1 of the GDPR), on the other hand, to a
                                                           er
       warning in accordance with Article 95, § 1, 4° of the LCA; and for the reasons

       set out below.

 9. The Litigation Chamber notes that the complainant raises the refusal by the head of the

       processing to follow up on the request to exercise the right to erasure (art.17.1.c of

       GDPR) and opposition (Art. 21.1 GDPR).


 10. Firstly, on the basis of the documents supporting the complaint, the Litigation Chamber finds

       that the complainant exercised, on June 24, 2022, his right to erasure (art. 17.1.c of the

       GDPR) and his right to object (Art. 21.1 of the GDPR) but that the controller

       did not respond to the complainant's request.


 11. The Litigation Chamber recalls that Article 4.7) of the GDPR defines the “responsible for the
                    2
       processing” as being “the natural or legal person, public authority, service



2GDPR, recitals 74, 79 and 81; GDPR, art. 4. 7), 4.8), 24, 26, 28, 29. Decision 172/2022 - 4/13


       oranotherbodywhich,aloneorjointlywithothers,determinesthepurposesand

       means of treatment”. Article 4, 8) of the GDPR defines “processor” as “the


       natural or legal person, public authority, agency or other body dealing

       personal data on behalf of the controller”.


 12. A “processing” of personal data means, according to the GDPR, “any

       operation or any set of operations whether or not carried out using processes

       automated and applied to personal data or sets of data

       personnel, such as collecting, recording, organizing, structuring,

       storage, adaptation or modification, extraction, consultation, use,

       communication by transmission, broadcast or any other form of making available, the

       reconciliation or interconnection, limitation, erasure or destruction”. 4



 13. As the EDPB pointed out in Guidelines 07/2020 regarding the notions of

       controller and processor, the controller may be
                                                            5
       designated by a legislative or regulatory text. Otherwise, to identify it, it

       should analyze the factual elements or circumstances of the case, in particular

       determine its legal and organizational capacity, as well as its autonomy in the

       definition of the purposes, i.e. the objectives pursued, and the means of processing.


 14. The Litigation Chamber recalls that the controller must follow up on the

       request made pursuant to Articles 15 to 22 of the GDPR by the complainant, in this case

       a request for erasure provided for in Article 17 of the GDPR (exercise of the right to erasure)

       and opposition provided for in Article 21 of the GDPR (exercise of the right of opposition), and this in the

                                                               6
       compliance with the conditions set out in Article 12 of the GDPR.


 15. The Litigation Chamber also emphasizes that it is the responsibility of the controller

       to provide the complainant with information on the measures taken following a request

       formulated in application of Articles 15 to 22 of the GDPR, as soon as possible

       cause within one month of receipt of the request. Article 12.3 of the

       GDPR provides that this period may, if necessary, be extended by two months, taking into account the

       complexity and number of requests. In such a case, the controller

       inform the complainant of this extension and the reasons for the postponement within one month from

       from receipt of the request. 9






3
4GDPR, Art. 4.7), 4.8), 24, 26, 28, 29; GDPR, recitals 74, 79 and 81.
 GDPR, art. 4, 2).
5EDPB, “Guidelines 07/2020 concerning the notions of controller and processor in the
GDPR”, adopted on July 7, 2021.
6 GDPR, Art. 12.
7GDPR, Art. 12.2 and 12.3.
8 GDPR, Art. 12.3.
9
 GDPR, art. 12.3. Decision 172/2022 - 5/13



 16. In the event that the data controller does not respond to the request made

       by the complainant, he shall inform the latter without delay and at the latest within one month from

       from receipt of the request, the reasons for its inaction and the possibility

       to lodge a complaint with a supervisory authority and to lodge an appeal
                      10
       jurisdictional.

 17. In this case, the Litigation Division – based on the definition of “responsible for

       treatment” included in Article 4.7) of the GDPR – declares the real estate agency as the

       controller and company Z as the processor since the latter has,

       it seems, created the website on behalf of and according to the instructions of the said agency

       real estate .11


 18. In addition, the Litigation Division notes that the controller did not give

       following requests to exercise the right to erasure and opposition made by the

       complainant, therefore the controller has not complied with the requirements of Articles 12,

       17.1 and 21.1 GDPR.


 19. Secondly, on the basis of the documents supporting the complaint, the Litigation Chamber finds

       that :


       - the complainant indicated to the SPL – in his email of July 8, 2022 sent at 6:16 p.m. – that

            his name, unlike his postal address, is not mentioned on the publication

            disputed and attached a screenshot taken at 6:11 p.m. to support his complaint;

       - the ad in dispute is still published on the website of the real estate agency – in

            date of September 12, 2022 at 10:05 a.m. (Belgian time) and October 12, 2022 at 11:30 a.m. (Belgian time)

            Belgian) – at the following URL (…)


       - the postal address of the property, namely "..." is mentioned in the published announcement

            by the controller on its website.





Figure 1 - Screenshot from September 12, 2022 at 10:05 a.m. (Belgian time – following URL address (…)

                                  [Screenshot]





Figure 2 - Screenshot from October 12, 2022 at 11:30 a.m. (Belgian time – following URL address (…





10 GDPR, art. 12.4.
11The data processor processes the personal data only on behalf of the data controller.
processing. The data processor is generally a third party outside the company. ;GDPR,art.4.7),4.8),24,26,28,
29; GDPR, recitals 74, 79 and 81; EDPB, “Guidelines 07/2020 concerning the notions of data controller
GDPR”, adopted on July 7, 2021. Decision 172/2022 - 6/13


                                          [Screenshot]




 20. Article 4(1) of the GDPR defines “personal data” as “any

       information relating to an identified or identifiable natural person (hereinafter

       referred to as the "data subject"); is deemed to be an "identifiable natural person"

       a natural person who can be identified, directly or indirectly, in particular

       by reference to an identifier, such as a name, an identification number, data of

       location, an online identifier, or to one or more specific elements specific to its

       physical, physiological, genetic, psychological, economic, cultural or

       social”.


 21. The Litigation Chamber emphasizes that the processing is "lawful only if, and to the extent

       where at least one of the following conditions is met:


       a) the data subject has consented to the processing of his or her personal data

       for one or more specific purposes;

       b) the processing is necessary for the performance of a contract to which the data subject is

       party or the execution of pre-contractual measures taken at the latter's request;


       c) processing is necessary for compliance with a legal obligation to which the controller
       processing is submitted;


       d) the processing is necessary to safeguard the vital interests of the data subject
       or another natural person;


       e) processing is necessary for the performance of a task carried out in the public interest or falling within the
       the exercise of official authority vested in the controller;


       f) processing is necessary for the purposes of the legitimate interests pursued by the controller

       processing or by a third party, unless the interests or freedoms and rights

       fundamentals of the data subject which require data protection to be
                                                                                                 13
       personal nature, in particular when the person concerned is a child. [...] » .


 22. In this case, the Litigation Chamber recalls that the publication of an image – in concreto

       images of a house published with the postal address of the person concerned and a

       image with identification numbers of cadastral parcels – is a processing of

       personal data within the meaning of Article 4.1) of the GDPR. 14





12 GDPR, Art. 4, 1). ; Opinion 4/2007 of the “article 29” working group on data protection on the concept of personal data
personal character, adopted on 20 June 2007, available at https://cnpd.public.lu/dam-assets/fr/publications/groupe-
art29/wp136_en.pdf. ; See the judgments Nowak (CJEU, 20 December 2017, C-434/16, ECLI:EU:C:2017:994) and Breyer (CUJE, 19
October 2016, C-582/14, ECLI: EU: C:2016:779).
13 GDPR, Art. 6.1.
14
 Opinion 4/2007 of the “article 29” working group on data protection on the concept of personal data
personnel, adopted on 20 June 2007, available at https://cnpd.public.lu/dam-assets/fr/publications/groupe-
art29/wp136_en.pdf. ; See the judgments Nowak (CJEU, 20 December 2017, C-434/16, ECLI:EU:C:2017:994) and Breyer (CUJE, 19
October 2016, C-582/14, ECLI: EU: C:2016:779). ; Data Protection Authority, Litigation Chamber, October 30 Decision 172/2022 - 7/13


 23. The Litigation Chamber understands that processing such as the publication of images of a

       building is necessary for the performance of a contract between a real estate agency and a

       owner of real estate. A real estate agency can establish the legality of this

       processing on the basis of Article 6.1, b) of the GDPR: the processing is necessary for

       the fulfillment of the mission of intermediary with which it is invested, namely to rent or

       sell the property of an owner to a third party. A real estate agency could not

       achieve the purpose of the contract without the specific data processing being implemented

       work (for example, the publication of photos of a property on the website).

       However, the Litigation Chamber understands that the complainant is the new owner

       of the real estate (purchaser) and that he is not a party to the contract which binds the real estate agency

       and the previous owner (seller). Therefore, the publication of the announcement on the site

       Internet of the controller cannot, in principle, be based on the contract ((article

       6.1, b) of the GDPR), even less after the sale of June 27, 2022.


 24. The Contentious Chamber considers that the controller does not respond to any of the

       conditions of lawfulness provided for in Article 6 of the GDPR. The Chamber nevertheless examines whether the

       data processing could be based on the legal basis of “legitimate interest”

       provided for in Article 6.1, f) of the GDPR. Indeed, to prove the lawfulness of the publication of

       the announcement on the website with the postal address of the complainant and the numbers

       identification of cadastral parcels, the controller could – in

       lack of complainant or contract consent – rely on “legitimate interest”

       provided for in Article 6.1, f) of the GDPR.


 25. In accordance with Article 6.1, f) of the GDPR and the case law of the Court of Justice of the Union

       European Union (hereinafter “the Court”), three cumulative conditions must be met in order to

       that a data controller can validly invoke this basis of lawfulness, "to

       namely, firstly, the pursuit of a legitimate interest by the controller or


       by or third parties to whom the data is communicated, secondly, the need for the

       processing of personal data for the fulfillment of the legitimate interest

       pursued and, thirdly, the condition that the fundamental rights and freedoms of the
                                                                                 16
       person concerned by data protection do not prevail”





2020, decision on the merits 71/2020 (§56), available at
https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-71-2020.pdf.
15CJEU, 4 May 2017, C-13/16, Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde v Rīgas pašvaldības
SIA „Rīgas satiksme”, recital 28. See also CJEU, 11 December 2019, C-708/18, TK v Asociaţia de Proprietari
blockM5AScaraA,considering40. ;Data Protection Authority,Litigation Chamber,October 30,2020,decision
on the merits 71/2020 (§68), available at https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-
fund-n-71-2020.pdf.
16
  CJEU, 4 May 2017, C-13/16, Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde v Rīgas pašvaldības
SIA „Rīgas satiksme”, recital 28. See also CJEU, 11 December 2019, C-708/18, TK v Asociaţia de Proprietari
blockM5AScaraA,considering40. ;Data Protection Authority,Litigation Chamber,October 30,2020,decision
on the merits 71/2020 (§68), available at https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-
fund-n-71-2020.pdf. Decision 172/2022 - 8/13


 26. In other words, in order to be able to invoke the basis of lawfulness of “legitimate interest”

       in accordance with Article 6.1, f) of the GDPR, the controller must demonstrate that:


       1) the interests it pursues with the processing can be recognized as legitimate (the “

       finality test”);

       2) the envisaged processing is necessary to achieve those interests (the “necessity test”);
       and


       3) the weighing of these interests against the fundamental interests, freedoms and rights
       data subjects weighs in favor of the data controller (the “test of

       weighting”).

 27. With regard to the first condition (the "finality test"), the Litigation Chamber

       considers that the purpose of publishing announcements of immovable property sold by

       a real estate agency for commercial purposes to display the professional qualities

       and also attract the attention of potential buyers or future sellers by allowing them

       to get a more precise idea of the type of goods that have already been marketed must be

       considered to be made for a legitimate interest. In accordance with

       recital 47 of the GDPR, the interest that the defendant pursued as responsible for the

       processing can in itself be considered legitimate. The first condition repeated in
       Article 6, §1, f) of the GDPR is therefore fulfilled.


 28. With respect to the second condition (the “necessity test”), the head of the

       processing must demonstrate that the processing is necessary for the achievement of the purposes

       pursued. This means more precisely that one must ask oneself if the same result

       not be achieved by other means, without processing personal data or

       without unnecessary substantial processing for data subjects.


 29. Based on the purpose, namely the publication on the website of images of the goods sold

       with detailed descriptions, and this for commercial purposes to promote the work, the
       seriously, the qualities of enhancement of the buildings, or even the experiences

       the agency's past commercial activities, it is therefore necessary to check whether the publication of images

       showing the house with indication of the postal address of the person concerned and/or the

       cadastral parcel identification numbers may or may not contribute to the promotion of

       the real estate agency.


 30. The Litigation Chamber understands that the publication of images of goods sold by

       a real estate agency is a practice that may be deemed necessary to display the

       professional qualities and also attract the attention of potential or future buyers

       sellers allowing them to get a more precise idea of the type of goods that have already


17Data Protection Authority, Litigation Chamber, 30 October 2020, substantive decision 71/2020 (§69),
available at https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-71-2020.pdf.
18 Data Protection Authority, Litigation Chamber, October 30, 2020, substantive decision 71/2020 (§70 to 72),
available at https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-71-2020.pdf. Decision 172/2022 - 9/13



       been marketed. However, the Litigation Division considers that this purpose may

       also be achieved without publication of the images with the identification data of the
       complainant. The second condition is therefore not satisfied because the principle of

       data minimization (Article 5.1, c) of the GDPR) has not been complied with.


 31. With regard to the third condition (the “weighting test”), one must first take

       account of the reasonable expectations of the person concerned, in accordance with recital

       47 GDPR. In particular, it must be assessed whether "the data subject can

       reasonably expect, at the time and in the context of data collection, to

       personal character, that they are processed for a given purpose”.


 32. The Litigation Chamber finds that the plaintiff could not at any time have expected

       that images of his new home be published with his mailing address and/or

       cadastral parcel identification numbers for commercial purposes. Moreover, the
                                                                                            er
       controller does not appear to have requested, under Article 6, §1, a) of the

       GDPR, the consent of the complainant to publish the images of the goods sold with his

       postal address and/or the identification numbers of the cadastral parcels The third
       condition is therefore not met.


 33. The Litigation Chamber concludes that all of the elements set out above demonstrate

       that the controller cannot invoke article 6.1, f) of the GDPR to qualify

       the publication of the announcement with the postal address of the complainant and/or the numbers

       identification of legal cadastral parcels. Therefore, the controller

       seems not to comply with the requirements of article 6 of the GDPR. Thus, the manager of

       treatment must respond favorably to the request to exercise the right to

       the erasure and opposition of the complainant: he has the obligation to erase, as soon as possible,

       the complainant's personal data (Art. 17.1 GDPR) and must no longer process them

       (Art. 21.1 GDPR).


 34. In addition, the data controller is required, under Article 19 of the GDPR, to

       the notification obligation with regard to the erasure of personal data

       complainant's staff: he must notify each recipient to whom the personal data
       complainant's staff were communicated, in this case the director and the host of the

       website of the real estate agency, any erasure of personal data

       made in accordance with Article 17.1 of the GDPR, unless such communication is

       proves impossible or requires disproportionate effort. The Litigation Chamber is

       of the opinion that such communication does not prove impossible since, in this case, it suffices to




19 GDPR, Recital 47. ;CJEU,11 December 2019,C-708/18,TKc/AsociaţiadeProprietariblocM5A-ScaraA,considering
58.; Data Protection Authority, Litigation Chamber, October 30, 2020, substantive decision 71/2020 (§73 to
75), available at https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-71-2020.pdf.
20 GDPR, art. 19. Decision 172/2022 - 10/13


       communicate with, at most, two recipients, namely the director/creator of the site

       Internet and/or the host.


 35. In conclusion, in view of the aforementioned examination, the Litigation Chamber considers that

       the data controller has not, prima facie, complied with Articles 12.3 and 12.4 of the GDPR,

       as well as Articles 17.1, 19 and 21.1 of the GDPR, which in this case justifies proceeding with the

       making a decision on the basis of Article 95, § 1, 5° of the LCA, more specifically
       to order the controller to comply with the complainant's request

       to exercise their right to erasure (art. 17.1 of the GDPR) and their right to object (art. 21.1 of the

       GDPR); to erase the personal data in question (namely

       the postal address of the property, including Google MAPS, and the numbers

       identification of the cadastral plots of the person concerned on the website of

       the real estate agency) ; to comply, under article 19 of the GDPR, with its obligation to

       notification regarding the erasure of personal data of the complainant

       ; and to no longer process this data.

 36. The Litigation Chamber also concludes that the controller did not,

       prima facie, complied with Article 6 of the GDPR, which in this case justifies taking

       a decision on the basis of Article 95, § 1, 4° of the LCA, more specifically to address the

       responsible for processing a warning within the meaning of Article 58.2.a) of the GDPR so that

       the latter ensures, in the future, to respond to requests for the exercise of human rights

       concerned and delete, in the absence of the consent of the person concerned, the address

       postal address (including Google MAPS), and other identifying data such as
       identification numbers of the cadastral plots of future real estate that would be

       sold and published on the website.


 37. This decision is a prima facie decision taken by the Litigation Chamber

       pursuant to Article 95 of the LCA on the basis of the complaint submitted by the complainant,
                                                                         21
       within the framework of the “procedure prior to the substantive decision” and not a decision on the

       merits of the Litigation Chamber within the meaning of Article 100 of the LCA.

 38. The purpose of this decision is to inform the defendant, allegedly responsible for the

       processing, because it may have violated the provisions of the GDPR,

       in order to enable it to still comply with the aforementioned provisions.


       If, however, the controller does not agree with the content of this

       prima facie decision and believes that he can make factual and/or legal arguments

       which could lead to another decision, the latter may address to the House
       Litigation a request for processing on the merits of the case via the e-mail address

       litigationchamber@apd-gba.be, within 30 days of notification of the


21Section 3, Subsection 2 of the LCA (arts. 94 to 97 inclusive). Decision 172/2022 - 11/13


        this decision. If necessary, the execution of this decision will be suspended.

        during the aforementioned period.


  39. In the event of further processing of the case on the merits, pursuant to Articles 98, 2° and 3°

        juncto article 99 of the LCA, the Litigation Chamber will invite the parties to introduce their


        conclusions and attach to the file all the documents they deem useful. If applicable, the

        this decision is permanently suspended.


  40. In the interests of transparency, the Litigation Chamber finally emphasizes that a

        dealing with the case on the merits may lead to the imposition of the measures mentioned in
                                   22
        section 100 of the ACL.





III. Publication of the decision



  41. Given the importance of transparency regarding the decision-making process of the Chamber

        Litigation, this decision is published on the website of the Protection Authority

        Datas. However, it is not necessary for this purpose that the identification data

        of the parties are communicated directly.
























22 st
  Art. 100. § 1. The litigation chamber has the power to
  1° dismiss the complaint without follow-up;
  2° order the dismissal;
  3° pronouncing the suspension of the pronouncement;
  4° to propose a transaction;
  5° issue warnings and reprimands;
  6° order to comply with requests from the data subject to exercise his or her rights;
  7° order that the person concerned be informed of the security problem;

  8° order the freezing, limitation or temporary or permanent prohibition of processing;
  9° order compliance of the processing;
  10° order the rectification, restriction or erasure of the data and the notification thereof to the recipients
     Datas ;
  11° order the withdrawal of the approval of the certification bodies;
  12° to issue periodic penalty payments;
  13° to issue administrative fines;
  14° order the suspension of cross-border data flows to another State or an international body;

  15° forward the file to the public prosecutor's office in Brussels, who informs it of the follow-up given to the file;
  16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. Decision 172/2022 - 12/13



FOR THESE REASONS,

the Litigation Chamber of the Data Protection Authority decides, under

subject to the introduction of a request by the controller of a

treatment on the merits in accordance with articles 98 e.s. of the ACL:

   - under article 58.2.c) of the GDPR and article 95, §1, 5° of the ACL,

      to order the controller to comply with the request

      of the data subject to exercise their rights, more specifically to

      comply with the complainant's request to exercise his right to erasure

      (Art. 17.1 GDPR) and his right to object (Art. 21.1 GDPR); of
      delete the personal data in question

      (i.e. the postal address of the property, including Google MAPS,

      and the identification numbers of the cadastral plots of the person

      concerned on the website of the real estate agency); to comply with

      its obligation to notify with regard to the erasure of data

      personal nature of the complainant; to no longer process this data; And this
      within 30 days of notification of this decision;


   - pursuant to Article 58.2.a) of the GDPR and Article 95, §1, 4° of the LCA,

      issue a warning against the controller
      so that the latter ensures, in the future, to respond to requests for exercise

      of the rights of the person concerned and delete, in the absence of

      consent of the person concerned, the postal address (including

      GoogleMAPS), and other identification data such as phone numbers

      identification of the cadastral plots of future real estate which

      would be sold and published on the website;

   - to order the controller to inform the Authority by email

      of data protection (Litigation Chamber) of the suite which is

      given to this decision, within the same period, via the e-mail address
      litigationchamber@apd-gba.be; and


   - if the controller does not comply in due time with what

      it is asked above, to deal ex officio with the case on the merits,

      in accordance with articles 98 e.s. of the ACL. Decision 172/2022 - 13/13



In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged,

within thirty days of its notification, to the Court of Markets (court

d'appel de Bruxelles), with the Data Protection Authority as defendant.



Such an appeal may be introduced by means of an interlocutory request which must contain the
                                                                              23
information listed in article 1034ter of the Judicial Code. The interlocutory motion must be

filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 24

via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).






(se).Hielke H IJMANS



President of the Litigation Chamber













































23
  The request contains on pain of nullity:
  1° indication of the day, month and year;
  2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
     Business Number ;
  3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;

  4° the object and the brief statement of the means of the request;
  5° the indication of the judge who is seized of the application;
  6° the signature of the applicant or his lawyer.
24The request, accompanied by its annex, shall be sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.