APD/GBA (Belgium) - 02/2023

APD/GBA - 02/2023
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 12(3) GDPR Article 12(4) GDPR Article 17(1) GDPR
Type:	Complaint
Outcome:	Other Outcome
Started:	03.01.2023
Decided:	18.01.2023
Published:	20.01.2023
Fine:	n/a
Parties:	n/a
National Case Number/Name:	02/2023
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Dutch
Original Source:	Gegevensbeschermingsautoriteit (in NL)
Initial Contributor:	Enzo Marquet

The Belgian DPA determined that a controller breached Articles 12(3), 12(4) and 17(1) GDPR by not responding an erasure request. The DPA ordered the controller to comply with the request pursuant of Article 58(2)(c) GDPR.

English Summary

Facts

On 1 December 2022, the data subject requested the controller to erase his personal data under Article 17(1) GDPR. In order to do so, he followed the instructions provided in the controller's privacy policy. However, the controller did not acknowledge receipt, not even after the data subject sent a reminder on 19 December 2022. On the 28 December 2022, almost a month after the data subject had submitted his erasure request, the controller sent him a promotional e-mail. The data subject filed a complaint at the Belgian DPA on 3 January 2023 for the lack of a response by the controller.

Holding

The DPA first confirmed that the data subject correctly exercised his right to erasure. The DPA held that the controller breached Articles 12(3) GDPR, 12(4) GDPR and 17(1) GDPR because it did not respond in time to the erasure request and even sent a promotional e-mail after the request had been submitted. The DPA ordered the controller to comply with the erasure request and ordered the controller to provide the DPA with an update within 30 days on which action it had taken.

Comment

This was a preliminary (Prima Facie) decision according to Article 95 WOG, prior to a decision on the merits.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

1/5







                                                                                  Litigation room



                                                         Decision 02/2023 of 18 January 2023



File number : DOS-2023-00059



Subject : Exercising the right to erasure without the defendant doing so

follows



The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke Hijmans,
sole chairman;



Having regard to Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 on

the protection of natural persons with regard to the processing of personal data and

on the free movement of such data and repealing Directive 95/46/EC (general
Data Protection Regulation), hereinafter GDPR;



Having regard to the law of 3 December 2017 establishing the Data Protection Authority, hereinafter WOG;


Having regard to the rules of internal order, as approved by the Chamber of Representatives

on December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;



Having regard to the documents in the file;




has taken the following decision regarding:

                                                                                                  .

The complainant: Mr X, hereinafter referred to as “the complainant”; .
                                                                                                  .

The defendant: Y, hereinafter “the defendant”. Decision 02/2023 - 2/5



I. Factual Procedure


    1. On January 3, 2023, the complainant filed a complaint with the Data Protection Authority against the

        defendant.


    2. On 1 December 2022, the complainant addressed the defendant with a request for the

        delete the relevant personal data pursuant to Article 17.1 GDPR, in accordance with the

        privacy policy of the defendant. The complainant has sent a reminder to the defendant
        December 19, 2022. As of January 3, 2023, the complainant has not yet received a response from the defendant

        in connection with the data erasure request. Received on December 28, 2022

        however, the complainant still receives an email with promotions from the defendant. Following this, the

        complainant lodged a complaint with the Data Protection Authority.

    3. On January 9, 2023, the complaint will be declared admissible by the First Line Service on the basis of the

        Articles 58 and 60 WOG and the complaint pursuant to Article 62, §1 WOG is transferred to the

        Litigation room.


II. Motivation


    4. The Disputes Chamber determines on the basis of the documents that substantiate the complaint that the complainant is entitled

        to data erasure in accordance with Article 17.1 GDPR has exercised on December 1, 2022, and a
        sent a reminder on December 19, 2022. From the documents accompanying the complaint, the

        Litigation Chamber that the complainant has carried out his request for data erasure by sending

        of an e-mail to the designated e-mail address of the defendant. Pursuant to Article 12.3 GDPR

        the controller, in this case the defendant, must respond to the request

        to respond to data erasure within one month of receipt of the request. Possibly possible

        this period may be extended by a further two months, given the complexity of the
        request. The complainant must then inform about this within one month of the request for data erasure

        extension will be notified. If the defendant decides not to comply with the

        request of the complainant, it must communicate this within one month of receipt of the request

        to the data subject, in accordance with Article 12.4 GDPR. It does not appear from the file that the complainant has any

        received an answer about the consequence of the data erasure by the defendant
        is given. In addition, it appears from the documents that were added to the complaint that the complainant

        received another email with promotions from the defendant on 28th December 2022. because of this

        the controller has acted in violation of Articles 12.3 and 12.4 GDPR, as well

        Article 17.1 GDPR.

    5. The Disputes Chamber is of the opinion that on the basis of the above analysis it should be

        concluded that a breach of the provisions of the GDPR has been committed by the defendant,

        which justifies that in this case a decision is taken on the basis of Decision 02/2023 - 3/5




        of Article 95, §1, 5° WOG, more specifically to order the defendant to comply with the

        exercise by the complainant of his right to erasure (article 17.1 GDPR).


    6. The present decision is a prima facie decision taken by the Litigation Chamber

        in accordance with article 95 WOG on the basis of the complaint submitted by the complainant, in the context of
                                                                       1
        the 'procedure prior to the decision on the merits' and no decision on the merits of the

        Disputes Chamber within the meaning of Article 100 WOG. The Disputes Chamber has thus decided on the basis

        of Articles 58.2. c) and 95, §1, 5° of the Law of 3 December 2017, to order the defendant

        that the data subject's requests to exercise his rights are met, more

        determines the right to erasure (“right to be forgotten”) as stipulated in Article 17 GDPR.


    7. The purpose of this decision is to inform the defendant that it is a

        has committed an infringement of the provisions of the GDPR and to enable it

        still to comply with the aforementioned provisions.


    8. However, if the defendant does not agree with the contents of this prima facie

        decision and is of the opinion that it can assert factual and/or legal arguments that lead to

        could lead to a different decision, this can be done via the email address litigationchamber@apd-


        gba.be submit a request for consideration of the merits of the case to the Disputes Chamber and this

        within 30 days of notification of this decision. The implementation of

        if necessary, this decision will be suspended during the aforementioned period.


    9. In the event of a continuation of the handling of the case on the merits, the Disputes Chamber

        the parties pursuant to Articles 98, 2° and 3° in conjunction with Article 99 WOG invite their

        submit defenses as well as attach any documents they deem useful to the file. The

        the present decision will, if necessary, be definitively suspended.


    10. The Disputes Chamber points out for the sake of completeness so that a hearing on the merits of the case can take place

        lead to the imposition of the measures referred to in Article 100 WOG. 2




1Section 3, Subsection 2 WOG (Articles 94 through 97).
2
 1° to dismiss a complaint;
 2° to order the exclusion of prosecution;
 3° order the suspension of the judgment;
 4° propose a settlement;
 5° formulate warnings and reprimands;
 6° order that the data subject's requests to exercise his rights be complied with;
 7° order that the data subject be informed of the security problem;

 8° order that the processing be temporarily or permanently frozen, restricted or prohibited;
 9° order that the processing be brought into compliance;
 10° the rectification, restriction or deletion of data and the notification thereof to the recipients of the data
command;
 11° to order the withdrawal of the accreditation of certification bodies;
 12° to impose penalty payments;
 13° to impose administrative fines;
 14° order the suspension of cross-border data flows to another State or an international institution;
 15° transfer the file to the Public Prosecutor's Office of the Crown Prosecutor in Brussels, who informs it of the follow-up to the
file is given;

 16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. Decision 02/2023 - 4/5




    11. Finally, the Disputes Chamber points out the following:

        If one of the parties wishes to make use of the possibility to consult and

        copying the file (Article 95, § 2, 3 ° WOG), it should turn to the secretariat

        of the Disputes Chamber, preferably via litigationchamber@apd-gba.be, in order to make an appointment

        If a copy of the file is requested, the documents will be provided if possible

        delivered electronically or otherwise by regular mail.



III. Publication of the decision


    12. Given the importance of transparency with regard to decision-making by the

        Litigation Chamber, this decision will be published on the website of the

        Data Protection Authority. However, it is not necessary for this to include the identification data

        of the parties are disclosed directly.



 FOR THESE REASONS,
 the Disputes Chamber of the Data Protection Authority decides, subject to the

 submission of a request by the defendant for a hearing on the merits in accordance with Article

 98 ff. WOG , at:



 - on the basis of Article 58.2, c) GDPR and Article 95, §1, 5° WOG, to order the defendant to

    complied with the request of the data subject to exercise his rights, in particular the right

    to data deletion (article 17.1 GDPR), and to delete the relevant data

    personal data, and this within a period of 30 days from the notification of

    this decision;



 - order the defendant to inform the Data Protection Authority (Dispute Chamber) by e-mail
    within the same timeframe of the outcome of this decision via the e-mail

    email address litigationchamber@apd-gba.be; and



 - in the absence of the timely implementation of the above by the defendant, the case

    to be dealt with on the merits ex officio in accordance with Articles 98 et seq. of the WOG.




Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the notification

this decision may be appealed to the Marktenhof (Brussels Court of Appeal), with the

Data Protection Authority as defendant.



3Due to the extraordinary circumstances due to COVID-19, the possibility of collection at the secretariat of the
Dispute room NOT provided. In addition, all communication takes place electronically in principle. Decision 02/2023 - 5/5




Such an appeal may be lodged by means of an inter partes petition that the in art

                                                                                                       4
1034terofthe Judicial Codemustcontainenumeratedenumerations.

contradictions must be submitted to the Registry of the Market Court in accordance with Article

1034quinquiesvanhetGer.W. , or via the Deposit Information System of Justice (article 32ter of

the Ger.W.).








(get). Hilke Hijmans


Chairman of the Litigation Chamber


















































4
 The petition states under penalty of nullity:
  1° the day, month and year;
  2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
     enterprise number;

  3° the surname, first name, place of residence and, where appropriate, the capacity of the person to be summoned;
  4° the object and brief summary of the means of the claim;
  5° the court before which the action is brought;
  6° the signature of the applicant or his lawyer.
5
  The petition with its appendix, in as many copies as there are parties involved, is sent by registered letter to the
clerk of the court or deposited with the clerk of the court.