APD/GBA (Belgium) - 19/2023

APD/GBA - 19/2023
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 12 GDPR Article 15 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	03.03.2023
Published:	03.03.2023
Fine:	n/a
Parties:	n/a
National Case Number/Name:	19/2023
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	French
Original Source:	Autorité de Protection des Données (in FR)
Initial Contributor:	n/a

The Belgian DPA ordered a controller to comply with its obligations to facilitate the exercise of data subjects' rights and, in particular, to respond to a data subject's request of access to his data after not responding to any of his emails.

English Summary

Facts

On 7 September 2022, a data subject sent a request of access to his data and requested a copy of it, pursuant to Article 15 GDPR. The data subject then proceeded to send a second email after not receiving any response from the controller. His email received no response yet again. On 22 November 2022, the data subject lodged a complaint with the Belgian DPA. Following the Belgian DPA’s recommendations, the data subject sent an email to another of the controller’s email addresses on 19 January 2023. One month later, there was still no reply.

Holding

The Belgian DPA held that the controller may have violated Article 12 GDPR and Article 15 GDPR for having failed to facilitate the exercise of the data subject’s right of access in a timely manner and no later than one month from the time the request was received, or to give the data subject a reason for its impossibility to do so.

Thus, the Belgian DPA ordered the controller to comply with the data subject’s request of access and to provide him with a copy of his data. It ordered the controller to respond to future requests of data subjects to exercise their rights, and finally ordered the controller to inform the DPA by e-mail of the outcome of this decision.

Comment

The purpose of this decision was to inform the alleged controller of the fact that it may have committed a breach of the provisions of the GDPR, and consequently to enable it to comply further with them.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/6





                                                                          Litigation Chamber


                                                             Decision 19/2023 of March 3, 2023





File number: DOS-2022-04521


Subject: Complaint following the lack of response to a request to exercise the right of access

and copy




The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke

Hijmans, chairman;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and

to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the

data protection), hereinafter “GDPR”;

Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, hereinafter

“ACL”;


Having regard to the internal regulations as approved by the House of Representatives on 20
December 2018 and published in the Belgian Official Gazette on January 15, 2019;


Considering the documents in the file;



Made the following decision regarding:


The plaintiff: X, hereinafter “the plaintiff”; .

                                                                                                          .

The defendant: Y, hereinafter: “the defendant”. . Decision 19/2023 – 2/6



I. Facts and procedure


 1. On November 2, 2022, the complainant filed a complaint with the Data Protection Authority

       data (hereinafter “the DPA”), against the defendant.

 2. On December 5, 2022, the complaint was declared admissible by the Front Line Service on

       the basis of Articles 58 and 60 of the LCA and the complaint is forwarded to the Litigation Chamber

       pursuant to Article 62, § 1 of the LCA.


 3. Pursuant to article 95 § 2, 3° of the LCA as well as article 47 of the rules of order

       inside the DPA, a copy of the file may be requested by the parties. If one of

       parties wishes to make use of the possibility of consulting the file, the latter is required to

       contact the secretariat of the Litigation Chamber, preferably via the address

       litigationchamber@apd-gba.be.


II. Motivation



    4. The complaint concerning the lack of response from the defendant following the request for exercise
        of his right of access and copy by the complainant. This one sent a first email

        requesting the exercise of his right of access and copy (article 15 GDPR) on September 7

        2022. He then sent a reminder on October 10, 2022. He denounces having received no return to

        any of his emails. Following a letter from the APD of January 19, 2023 recommending to the

        complainant to contact the address […] (contact email address listed on the website of the

        respondent) instead of […], the complainant repeated his request for access and copying on the day

        same (to the email addresses […] and […]). On February 26, 2023, more than a month later, the

        complainant indicates that he received no response.


    5. The Litigation Chamber recalls that in its capacity as data controller, the

        defendant is bound by data protection principles and must be

        able to demonstrate that these are respected (principle of responsibility – article

        5.2. GDPR). It must also implement all the measures necessary for this.

        effect (Article 24 GDPR).

    6. Pursuant to Article 15 § 1 of the GDPR, the data subject has the right to obtain

        controller confirmation that personal data the

        concerning are or are not processed. When this is the case, the person concerned has the

        right to obtain access to said personal data as well as a series

        information listed in Article 15 § 1 a) - h) such as the purpose of the processing of its



1
 Pursuant to article 61 LCA, the Litigation Chamber informs the parties by this decision, of the fact that the complaint has been
declared admissible.
2 Pursuant to Article 95, § 2 LCA, by this decision, the Litigation Division informs the parties of the fact that following
of this complaint, the file was forwarded to him. Decision 19/2023 – 3/6


        data, the possible recipients of his data as well as information relating to

        the existence of his rights, including the right to request the rectification or erasure of his

        data or that of filing a complaint with the protection control authority

        data (APD).


    7. Pursuant to § 3 of Article 15 of the GDPR, the data subject also has the right

        to obtain a copy of the personal data which is the subject of the processing. THE §
        4 of Article 15 of the GDPR provides that this right to copy may not infringe the rights and

        freedoms of others.


    8. Article 12 of the GDPR relating to the procedures for exercising their rights by persons

        concerned provides in particular that the data controller must facilitate

        the exercise of their rights by the data subject (Article 12 § 2 of the GDPR) and provide them with

        information on the measures taken following his request as soon as possible and

        no later than within one month of his request (article 12§3 of the GDPR).
        the data controller does not intend to follow up on the request, he must notify

        its refusal within one month accompanied by the information that an appeal

        against this refusal can be lodged with the data protection supervisory authority.

        data (12 § 4 GDPR).


    9. As indicated above, the complainant sent two emails requesting the exercise of his

        access and copy to the email address […], and repeated his request to the email address […]. He

        explained that he had received no feedback from the defendant.

 10. The Litigation Chamber considers that on the basis of the aforementioned facts, there is reason to

       conclude that the defendant may have violated Articles 15 and 12 of the GDPR,

       which justifies that in this case, a decision is made in accordance with

       Article 95, § 1, 5° of the LCA, more specifically to order compliance with the request

       the complainant to follow up on his request for access and copy on the basis of article 15 GDPR,

       in the terms of article 12 GDPR.

 11. This decision is a prima facie decision taken by the Litigation Chamber

       pursuant to Article 95 of the LCA on the basis of the complaint submitted by the complainant,
                                                                          3
       within the framework of the “procedure prior to the substantive decision” and not a decision on the

       merits of the Litigation Chamber within the meaning of Article 100 of the LCA.

 12. The purpose of this decision is to inform the defendant, allegedly responsible for the

       processing, because it may have violated the provisions of the GDPR,

       in order to enable it to still comply with the aforementioned provisions.





3Section 3, Subsection 2 of the ACL (articles 94 to 97 inclusive). Decision 19/2023 – 4/6


 13. If, however, the defendant does not agree with the content of this decision

        prima facie and believes that it can make factual and/or legal arguments that

        could lead to another decision, it may send the Litigation Chamber a

        request for treatment on the merits of the case via the e-mail address litigationchamber@apd-

        gba.be, within 30 days of notification of this decision. The case

        applicable, the execution of this decision is suspended for the period

        aforementioned.


 14. In the event of further processing of the case on the merits, pursuant to Articles 98, 2° and 3°

        juncto article 99 of the LCA, the Litigation Chamber will invite the parties to introduce their

        conclusions and attach to the file all the documents they deem useful. If applicable, the

        this decision is permanently suspended.


 15. With a view to transparency, the Litigation Division finally emphasizes that a

        dealing with the case on the merits may lead to the imposition of the measures mentioned in

        section 100 of the ACL.



III. Publication of the decision


 16. Given the importance of transparency regarding the decision-making process of the Chamber


        Litigation, this decision is published on the website of the Protection Authority

        Datas. However, it is not necessary for this purpose that the identification data

        of the parties are communicated directly.
















4Art. 100. § 1. The litigation chamber has the power to
 1° dismiss the complaint without follow-up;
 2° order the dismissal;
 3° pronouncing the suspension of the pronouncement;

 4° to propose a transaction;
 5° issue warnings and reprimands;
 6° order to comply with requests from the data subject to exercise his or her rights;
 7° order that the person concerned be informed of the security problem;
 8° order the freezing, limitation or temporary or permanent prohibition of processing;
 9° order compliance of the processing;
 10° order the rectification, restriction or erasure of the data and the notification thereof to the recipients of the
     data ;
 11° order the withdrawal of accreditation from certification bodies;
 12° to issue periodic penalty payments;

 13° to issue administrative fines;
 14° order the suspension of cross-border data flows to another State or an international body;
 15° forward the file to the public prosecutor's office in Brussels, who informs it of the follow-up given to the file;
 16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. Decision 19/2023 – 5/6






    FOR THESE REASONS,


    the Litigation Chamber of the Data Protection Authority decides, subject to

    the introduction of a request by the defendant for treatment on the merits in accordance with

    to articles 98 e.s. of the ACL:

       - pursuant to Article 58.2.c) of the GDPR and Article 95, §1, 5° of the LCA, to order

           the defendant to respond to the plaintiff's request for access and copy, and this

           within 30 days of notification of this decision;


       - under article 58.2.c) of the GDPR and article 95, §1, 4° of the ACL, to formulate

           a warning to the defendant to respond in the future to requests

           exercise of subjects of rights

       - to order the defendant to inform by e-mail the Data Protection Authority

           data (Litigation Chamber) of the follow-up given to this decision, in the

           same deadline, via the e-mail address litigationchamber@apd-gba.be; And


       - if the defendant does not comply in good time with what is requested of it

           above, to deal ex officio with the case on the merits, in accordance with articles 98 e.s. of

           the ACL.












In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged,

within thirty days of its notification, to the Court of Markets (court

d'appel de Bruxelles), with the Data Protection Authority as defendant.

Such an appeal may be introduced by means of an interlocutory request which must contain the

information listed in article 1034ter of the Judicial Code. The interlocutory motion must be








5
 The request contains on pain of nullity:
 (1) indication of the day, month and year;
 2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
     Business Number;
 3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
 (4) the object and summary statement of the means of the request;
 (5) the indication of the judge who is seized of the application;
 6° the signature of the applicant or his lawyer. Decision 19/2023 – 6/6


                                                                                                          6
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , Or

via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).







   (Sr.) Hielke H IJMANS

   President of the Litigation Chamber





































































6The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.