APD/GBA (Belgium) - 50/2024

APD/GBA - 50/2024
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 17(3)(e) GDPR
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	29.03.2024
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	50/2024
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Dutch
Original Source:	GBA (in NL)
Initial Contributor:	nzm

The DPA considered that the possibility that personal data could contribute as evidence in a legal action in the future justifies the refusal to comply with an erasure request.

English Summary

Facts

On 13 October 2023, the data subject submitted a request for access and subsequent erasure of his personal data, as he feared a “major negative personal impact” in the form of defamation. The controller responded that it would not act on the data erasure request because (i) the data subject had given consent to the processing of this personal data in a prior agreement and (ii) the controller needed to retain the personal data due to an overriding public interest.

On 30 December 2023, the data subject filed a complaint with the Belgian DPA (“APD”). On 23 February 2024, the APD asked the controller to clarify 3 points: firstly, the APD asked the controller on what exception they relied on to refuse to grant the data subject access to his personal data. The controller explained that it had not allowed access to the document as it could pose a possible threat to the privacy of others, partly because a file against the data subject was opened by the police in June 2023.

Secondly, the APD asked clarifications regarding the “prior agreement” the controller relied on to refuse the access and erasure requests. The controller responded that the data subject signed a privacy notice.

Thirdly, the APD asked additional information concerning the “substantial public interest” that the controller relied on. The controller explained that the data subject was accused of criminal offences in which the controller could contribute evidence for the benefit of the public interest.

In its responses, the controller also indicated that it was willing to give the data subject access to the file, and that it would make the necessary practical arrangements to this end.

Holding

Regarding the failure to respond to the access request, the APD considered that although the controller did not respond to access request submitted in October 2023, the controller expressed its willingness to grant inspection to the data subject in its reply in March 2024.

Regarding the failure to erase the data on compelling public interest grounds, the APD considered that the complaint was manifestly unfounded as the right to erasure does not apply when processing is necessary for the establishment, exercise or defence of legal claims pursuant to Article 17(3)(e) GDPR. The APD therefore considered it sufficient that there could be a “possible” legal action in the future to justify not deleting the data subject’s data under Article 17(3)(e) GDPR. The APD also insisted on the fact that the controller must ensure the confidentiality and integrity of the personal data, under Article 5(1)(f) GDPR.

Thus, the APD decided to dismiss the complaint.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

1/5



                                                                          Dispute Chamber


                                                  Decision50/2024 of March 29, 2024


File number: DOS-2024-00353


Subject: The alleged unlawful forwarding of an e-mail to a third party



The Disputes Chamber of the Data Protection Authority, composed of Mr

Hielke HIJMANS, sole chairman;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

on the protection of natural persons with regard to the processing of

personal data and regarding the free movement of such data and to the revocation of

Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”;


Having regard to the law of 3 December 2017 establishing the Data Protection Authority,

hereinafter “WOG”;

In view of the internal rules of order, as approved by the House of Representatives

Representatives on December 20, 2018 and published in the Belgian Official Gazette on

January 15, 2019;


Considering the documents in the file;


Has made the following decision regarding:



Complainant: X, hereinafter “the complainant”


The defendant: Y, hereinafter “the defendant” Decision 50/2024 — 2/5


I. Facts and procedure


 1. On January 19, 2024, the complainant submits a complaint to the Data Protection Authority

       against the defendant.


 2. The subject of the complaint concerns the defendant's response to an email from

       the complainant with a third party in copy (hereinafter, “cc”). The dispute takes place in the context of
       the acquisition of real estate co-owned by the complainant's son. The

       Defendant is an expert surveyor and made an appraisal of the property. The

       The complainant had a counter estimate made and then contacted the defendant

       to ask whether the data in the estimate report was correct. The defendant wrote

       the following in a short email: “The rating in the report provided is

       in accordance with my original report.” The defendant added a third party (the other

       co-owner of the property) in cc of that email, so that the latter both

       of the defendant's quoted response as the complainant's initial email notice

       could take. According to the complainant, this violated her privacy.

 3. On January 26, 2024, the complaint will be declared admissible by the First Line Service on

       on the basis of Articles 58 and 60 WOG and the complaint is filed on the basis of Article 62, § 1 WOG

       transferred to the Disputes Chamber.



II. Justification


 4. On the basis of the elements in the file that are known to the Disputes Chamber, and on the basis
       of the powers granted to it by the legislature on the basis of Article 95, § 1 WOG

       assigned, the Disputes Chamber will decide on the further follow-up of the file; in this case

       the Disputes Chamber will dismiss the complaint in accordance with Article 95,

       § 1, 3° WOG, based on the following justification.


 5. If a complaint is dismissed, the Disputes Chamber will make its decision
       to motivate gradually and:


            - to issue a technical dismissal if the file does not exist or is insufficient

               contains elements that could lead to a conviction, or if there is insufficient

               there is a prospect of a conviction due to a technical obstacle,

               which prevents her from reaching a decision;

            - or declare a policy rejection, if despite the presence of elements

               that could lead to a sanction, the continuation of the investigation

               dossier does not seem appropriate in the light of the priorities of the



1Court of Appeal Brussels, Market Court Section, 19 Chamber A, Chamber for Market Affairs, judgment 2020/AR/329, September 2, 2020,
p. 18. Decision 50/2024 — 3/5



                   Data Protection Authority, as specified and explained in the

                   dismissal policy of the Disputes Chamber. 2


        In the event of dismissal on more than one ground, the grounds for dismissal (resp.

        technical dismissal and policy dismissal) should be treated in order of importance. 3


 6. In the present case, the Disputes Chamber considers it undesirable to take further action

        to the file and decides to proceed with an expedient dismissal on the basis of the


        following two grounds: (a) Your complaint is not supported by evidence that the

        could enable the Disputes Chamber to decide whether or not there is a

        infringement of the GDPR and your complaint does not have a major social and/or personal impact

        impact, and (b) Your complaint is a side dispute to a wider dispute that needs to be resolved

        settled before courts and tribunals and administrative courts or another

                                 5
        competent authority.


 7. To begin with, the Disputes Chamber will examine, in accordance with its dismissal policy, whether the

        submitted complaint contains grievances with a major social and/or personal impact

        impact. In order to evaluate the foregoing, the Disputes Chamber bases itself on the

        criteria included in Article 35 GDPR for “high risk” processing

        identify. In this case, the Disputes Chamber determines that the processing on which the complaint was lodged


        relates prima facie cannot be accommodated in any of the situations that
                                                       7
        are listed in article 35.3GDPR. The latter are characterized by the

        “large-scale” or “systematic” nature of the data processing, while the

        The present complaint relates to an incident involving only one email from the complainant

        was released to a third party. It also fell within reasonable expectations


        that the defendant would address his response to both the complainant and the third party

        as he is a co-owner of the property, and the information provided by the







2In this context, the Disputes Chamber refers to its dismissal policy as explained in detail on the GBA website:

https://www.gegevensbeschermingsautoriteit.be/publications/sepotbeleid-van-de-geschikkamer.pdf
3 Ibid. Title 3 – In which cases is my complaint likely to be dismissed by the Disputes Chamber? from the
dismissal policy of the Disputes Chamber.

4Ibid. Ground for dismissal B5, p. 15.
5
 Ibid. Ground for dismissal B3, p. 13.
6Ibid. section 3.2.1, p. 9.

7a) a systematic and comprehensive assessment of personal aspects of natural persons, which is based on

automated processing, including profiling, and on which decisions are based which is natural
legal consequences are attached to the person or which significantly affect the natural person in a similar manner;

(b) large-scale processing of special categories of personal data referred to in Article 9(1) or of data

with regard to criminal convictions and offenses referred to in Article 10; or
c) systematic and large-scale monitoring of publicly accessible areas.

8 See also Brussels Court of Appeal, Market Court Section 19 dekamer A, Chamber for Market Affairs, judgment 2022/AR/1085, March 1
2023 p. 8 Decision 50/2024 — 4/5



       The appraiser provides information about the property that belongs to the

       third party.

 8. As a second motive, the Disputes Chamber determines that the complaint is a secondary dispute

       is part of a broader dispute for which it is not competent. Based on the pieces from the

       file, the Disputes Chamber determines that there is a broader dispute between the parties,

       namely, the acquisition of the property owned by the complainant's son and the third party

       party are co-owners. In the context of this broader dispute, the Disputes Chamber of

       judges that its intervention is not strictly necessary and that it is more appropriate for the

       parties to, if desired, bring the broader dispute before the competent court

       as the competent court has insight into all elements of this dispute.

 9. Although the Disputes Chamber cannot prima facie rule out that infringements have indeed occurred

       have occurred on the GDPR, it must take into account, firstly, the lack of

       an existence of great personal and social impact and, secondly, it

       in the context of a broader dispute, conclude that the complaint cannot be dealt with on the merits

       required. The Disputes Chamber decides not to follow up on expediency reasons

       file.



III. Publication and communication of the decision


 10. Considering the importance of transparency with regard to decision-making

       Dispute Chamber, this decision will be published on the website of the

       Data Protection Authority. On the other hand, it is not necessary that the

       identification details of the parties are disclosed directly.

 11. In accordance with its dismissal policy, the Disputes Chamber will make the decision to the defendant

       to transfer . After all, the Disputes Chamber has decided to dismiss its decisions

       ex officio to the defendants. However, the Dispute Chamber decided not to do so

       such notification where the complainant has requested anonymity

       of the defendant and the notification of the decision to the defendant, even if

       it is pseudonymised, nevertheless makes it possible to contact the complainant

       (re)identify . However, this is not the case in the present case.









9
 Dismissal policy of the Disputes Chamber, published on June 18, 2021,
https://www.gegevensbeschermingsautoriteit.be/publications/sepotbeleid-van-de-geschikkamer.pdf, section 3.2.2.B.3.
10
  Cf. Title 5 – Will the dismissal of my complaint be published? Will the other party be informed of this?
of the dismissal policy of the Disputes Chamber.
1Ibid.