APD/GBA (Belgium) - 101/2024

APD/GBA - 101/2024
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 12(3) GDPR Article 12(4) GDPR Article 15 GDPR Article 95 Loi du 3 décembre 2017 portant création de l'Autorité de protection des données
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	25.07.2024
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	101/2024
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	French
Original Source:	APB/GBA (Belgium) (in FR)
Initial Contributor:	wp

A data controller received an order from the DPA to answer the data subjects’ access request under Article 15 GDPR regarding delivery of unsolicited advertising e-mails.

English Summary

Facts

Employees of company A, including a DPO, received an advertising e-mail. The e-mail was sent to the professional e-mail address, promoting an auction organised by the company B (data controller). Later on, the employees received other unsolicited, advertising e-mails.

The DPO, acting on behalf of the company’s A employees and themselves, exercised the right of access under Article 15 GDPR, asking for explanation how the controller got access to the list of employees’ e-mail addresses.

The controller did not respond to the request. Hence, the DPO lodged a complaint with the Belgian DPA (APD/BGA) on behalf one of the employees and themselves.

Holding

The DPA upheld the complaint.

The DPA held the controller violated Article 12 GDPR because it did not react to the request made under Article 15 GDPR in a proper manner. Also, the DPA emphasised that Article 15 GDPR had to be treated as a "gateway" allowing the data subject to exercise other rights conferred on them by the GDPR.

Consequently, the DPA found the violation of Article 12(3) GDPR, Article 12(4) GDPR and Article 15 GDPR. The DPA issued a prima facie decision under Article 95 of Act establishing the Data Protection Authority (Loi du 3 décembre 2017 portant création de l'Autorité de protection des données), ordering the controller to comply with the data subjects request within 30 days.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/7

Litigation Chamber

Decision 101/2024 of 25 July 2024

File number: DOS-2023-04076

Subject: Complaint regarding the lack of response to the exercise of the right of access

The Litigation Chamber of the Data Protection Authority, consisting of Mr.

Hielke H IJMANS, President;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and on the

free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter "GDPR";

Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, hereinafter

“LCA”;

Having regard to the internal regulations as approved by the Chamber of Representatives on 20

December 2018 and published in the Belgian Official Journal on 15 January 2019;

Having regard to the documents in the file;

Has taken the following decision concerning:

The complainant: X, hereinafter “the complainant”;

The defendant: Y, hereinafter: “the defendant” or “the defendant”. Decision 101/2024 — 2/7

I. Facts and procedure

1. On 4 October 2023, the complainant, in his capacity as DPO of company Z, lodged a complaint

with the Data Protection Authority (hereinafter “the DPA”) on behalf of the

company’s employees and in his own name, against Y (hereinafter “the

respondent” or “the respondent party”).

2. The subject of the complaint concerns a failure to respond to the exercise of the right of access.

3. On 26 September 2023, the complainant received an automated email at his

personal professional email address from the respondent, which promoted an

auction organised by the latter.

4. On 27 September 2023, the complainant exercised his right of access by requesting the

defendant, on behalf of the company’s employees as well as on his own behalf, to

provide him with specific information. More specifically, he requested that the

defendant provide him with the means by which it was able to access the list of

professional email addresses of the staff of the company where the complainant is

employed.

5. In the complaint form, the complainant indicated that his colleagues had been

receiving unsolicited advertising emails on their professional addresses for

several days.

In an annex to his complaint, the complainant provided as evidence the

email he had received on 26 September 2023 on his only nominative professional

email address.

6. On 24 November 2023, the complaint was declared admissible by the Front Line Service

(hereinafter "FLS") on the basis of Articles 58 and 60 of the LCA and the complaint was forwarded to the
2nd Litigation Chamber pursuant to Article 62, § 1 of the LCA.

7. On 24 January 2024, the complainant informed the DPA that there had been no response from the

defendant.

II. Grounds

8. Pursuant to Article 4, § 1 of the LCA, the DPA is responsible for monitoring the data

protection principles contained in the GDPR and other laws containing

provisions relating to the protection of the processing of personal data.

9. Pursuant to Article 33, § 1 of the LCA, the Litigation Chamber is the administrative litigation body of the APD. It is seized of complaints that the SPL transmits to it pursuant to Article 62, § 1 of the LCA, i.e. admissible complaints. In accordance with Article 60, paragraph 2 of the LCA, complaints are admissible if they are written in one of the national languages, contain a statement of the facts and the information necessary for

1
Pursuant to Article 61 of the LCA, the Litigation Chamber hereby informs the parties that the complaint has been
2declared admissible.
Pursuant to Article 95, § 2 of the LCA, the Litigation Chamber hereby informs the parties that, following
this complaint, the file has been forwarded to it. Decision 101/2024 — 3/7

identify the processing of personal data to which they relate and which

fall within the competence of the DPA.

10. Pursuant to Articles 51 et seq. of the GDPR and Article 4, § 1 of the LCA, it is up to the

Litigation Chamber, as the administrative litigation body of the DPA, to exercise

effective control of the application of the GDPR and to protect the fundamental rights and

freedoms of natural persons with regard to the processing and to facilitate the free flow

of personal data within the Union.

11. Pursuant to Article 95 § 2, 3° of the LCA and Article 47 of the

Rules of Procedure of the DPA, a copy of the file may be requested by the parties. If one of the

parties wishes to make use of the possibility of consulting the file, it is required to

contact the secretariat of the Litigation Chamber, preferably via the address

litigationchamber@apd-gba.be.

12. On the basis of the facts described in the complaint file as summarised above, and on

the basis of the powers assigned to it by the legislator under Article 95,

§ 1 of the LCA, the Litigation Chamber decides on the follow-up to be given to the complaint; in

this case, the Litigation Chamber decides on the basis of Article 58.2.c) of the GDPR and

Article 95, § 1, 5° of the LCA, to order the defendant to comply with the

request of the person concerned to exercise his rights, more precisely the right of access

submitted by the complainant on 27 September 2023, and this within 30 days from

notification of this decision.

13. The Litigation Chamber takes into consideration the complaint raised by the complainant regarding

the lack of response from the defendant to his request for access exercised

on 27 September 2023, in accordance with Article 15 of the GDPR.

14. Article 4.7) of the GDPR defines the “data controller” as “the natural or legal person, public authority, service or other body which, alone or

jointly with others, determines the purposes and means of the processing”. 3

15. The Litigation Chamber recalls that the data controller must respond to the

request made pursuant to Articles 15 to 22 of the GDPR by the data subject,

in this case a request for access provided for in Article 15 of the GDPR, and in compliance with the

conditions set out in Article 12 of the GDPR.

16. Under Article 12.1 of the GDPR, it is the responsibility of the data controller to take "

appropriate measures to provide any information referred to in Articles 13 and 14 and

to carry out any communication under Articles 15 to 22 and Article 34 with regard to

3
According to Article 4, 2) of the GDPR, "processing" of personal data means "any operation or set of

operations which is performed on personal data or on sets of personal

data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or

alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of

availability, alignment or combination, restriction, erasure or destruction".

GDPR, Art. 12. Decision 101/2024 — 4/7

relates to the processing to the data subject in a concise, transparent,

comprehensible and easily accessible manner, in clear and simple terms [...]. ».

17. The Litigation Chamber also stresses that it is the responsibility of the data controller

to provide the data subject with information on the measures taken following a

request made pursuant to Articles 15 to 22 of the GDPR, as soon as possible and
5
in any event within one month of receipt of the request.

Article 12.3 of the GDPR provides that this period may, if necessary, be extended by two months,

taking into account the complexity and number of requests. In such a case, the data controller

shall inform the data subject of this extension and of the reasons for the postponement

within one month of receipt of the request. 7

18. In the event that the controller does not respond to the request made

by the data subject, it shall inform the data subject without delay and at the latest

within one month of receipt of the request of the reasons for its inaction and of the

possibility of lodging a complaint with a supervisory authority and of seeking a

judicial remedy.

19. Furthermore, the Chamber also recalls that, as the controller, the

defendant is required to comply with the data protection principles and must be

able to demonstrate that these are being complied with. It must also

implement all necessary measures to this end (principle of liability – Articles 5.2 and 24 of the

GDPR).

20. Finally, the Litigation Chamber recalls that the right of access is one of the

major requirements of the right to data protection, it constitutes the "gateway" that allows

the exercise of the other rights that the GDPR confers on the data subject, such as the

right to rectification, the right to limitation of processing or the right to erasure.

21. On the basis of the documents supporting the complaint, the Litigation Chamber notes that the

complainant did indeed exercise his right of access on 27 September 2023, in accordance

with Article 15.1 of the GDPR. In addition, it should be noted that the complainant, not appearing to have received a

response to his request, submitted his complaint to the APD on 24 November 2023, thus exceeding the

5GDPR, Art. 12.2 and 12.3 deadlines.

6GDPR, Art. 12.3.
7
8GDPR, art. 12.3.
GDPR, art. 12.4.
9Under this Article 15, the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where they are, access to the said personal data as well as the following information (Article 15.1. of the GDPR): the purposes of the processing (a), the categories of personal data (b), the recipients or categories of recipients of the data (c), the retention period (d), information on other rights conferred by the GDPR (e), the right to lodge a complaint with the data protection authority (f), any information on the source of the data when these have not been collected from the data subject (g) and the existence of automated decision-making (h). Article 15.2 of the GDPR
provides that if data is transferred to a third country or an international organisation, the data subject has the
right to be informed of the appropriate safeguards relating to the transfer, in accordance with Article 46 of the GDPR. Article 15.3.
of the GDPR provides that the controller must provide a copy of the personal data undergoing
processing. The controller may charge a reasonable fee for additional copies. If the data subject makes
the request by electronic means, the information must be provided in a commonly used electronic form, unless the data subject
requests otherwise. Decision 101/2024 — 5/7

of the response to the controller pursuant to Articles 12.3 and 12.4 of the GDPR.

As of 24 January 2024, no response has been provided to the complainant. Finally, the

Litigation Chamber underlines that if the defendant had fully complied with the

requirements set out in Article 12 of the GDPR, it would have taken the request for access into account.

This approach would have potentially avoided the complainant having to initiate proceedings before

the DPA.

22. Following the above analysis, the Litigation Chamber considers that the defendant

may have committed a violation of the following provisions: Article 15 of the

GDPR, in conjunction with Articles 12.3 and 12.4 of the GDPR; which justifies the taking of a prima facie decision

by the Litigation Chamber which is as follows: pursuant to Article

58.2.c) of the GDPR and Article 95, §1, 5° of the LCA, to order the defendant to

comply with the complainant's request to exercise his right of access.

23. This decision is a prima facie decision taken by the Litigation Chamber

in accordance with Article 95 of the LCA on the basis of the complaint lodged by the complainant,
10
within the framework of the "procedure prior to the substantive decision" and not a decision on the

merits of the Litigation Chamber within the meaning of Article 100 of the LCA.

24. The purpose of this decision is to inform the defendant, presumed to be responsible

for the processing, of the fact that it may have committed a violation of the provisions of the

GDPR, in order to enable it to still comply with the aforementioned provisions.

25. If the defendant does not agree with the content of this prima facie decision and

considers that it can provide factual and/or legal arguments that could lead to a

new decision, it may request a review by the Litigation Chamber in accordance with the

procedure established by Articles 98juncto99 of the LCA, known as the "procedure

on the merits" or "processing of the case on the merits". This request must be sent to

the email address litigationchamber@apd-gba.be within 30 days of

notification of this prima facie decision. Where applicable, the execution of this

decision is suspended for the aforementioned period.

26. In the event of continued processing of the case on the merits, pursuant to Articles 98, 2° and 3°

in conjunction with Article 99 of the LCA, the Litigation Chamber will invite the parties to submit their

submissions and to attach to the file all the documents they deem useful. Where applicable, this

decision is definitively suspended.

27. In the interests of transparency, the Litigation Chamber finally stresses that

processing of the case on the merits may lead to the imposition of the measures referred to in

Article 100 of the LCA.

10
11Section 3 Subsection 2 of the LCA (Articles 94 to 97 inclusive).
Art. 100. § 1 . The Litigation Chamber has the power to

1° dismiss the complaint without further action;

2° order the dismissal of the case;

3° pronounce the suspension of the decision; Decision 101/2024 — 7/7

litigationchamber@apd-gba.be, and this within 30 days after notification of this

decision. If applicable, the execution of this decision is suspended during the

abovementioned period.

And, on the other hand, the defendant may lodge an appeal against this decision in

accordance with Article 108, § 1 of the LCA, within 30 days of its notification, with the

Market Court (Brussels Court of Appeal), with the Data Protection Authority as the

defendant party. Such an appeal may be lodged by means of an interlocutory application which must

contain the information listed in Article 1034ter 12 of the Judicial Code. The interlocutory application must be filed with the registry of the Market Court in accordance with Article

1034quinquies of the Judicial Code, or via the e-Deposit information system of the Ministry of Justice

(Article 32ter of the Judicial Code).

(sé). Hielke H IJMANS

President of the Litigation Chamber

12The application must contain, under penalty of nullity:
1° the indication of the day, month and year;
2° the surname, first name, address of the applicant, as well as, where applicable, his/her qualities and his/her national register number or
company number;

3° the surname, first name, address and, where applicable, the quality of the person to be summoned;
4° the subject and summary statement of the grounds of the application;
5° the indication of the judge who is seized of the application;
6° the signature of the applicant or his/her lawyer.
13The application, accompanied by its annex, is sent, in as many copies as there are parties involved, by registered letter to the clerk of the court or filed with the registry.