APD/GBA (Belgium) - 40/2024

APD/GBA - 40/2024
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 12(3) GDPR Article 12(4) GDPR Article 17(1) GDPR
Type:	Complaint
Outcome:	Other Outcome
Started:	24.01.2024
Decided:	23.02.2024
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	40/2024
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Dutch
Original Source:	GBA (in NL)
Initial Contributor:	nzm

The DPA ordered a controller who sent unsolicited letters to a data subject to erase their data after the latter had made an erasure request, to which the controller failed to respond.

English Summary

Facts

The data subject received unsolicited letters from the controller on a regular basis. On 27 July 2023, the data subject requested the controller that his data be deleted and to stop the communications. The data subject alleged that the influx of letters increased after these communications. The data subject lodged a complaint with the Belgian DPA (“APD”) asking them to force the controller to delete their data.

Holding

Article 17(1) GDPR establishes that under certain conditions, a data subject may obtain the erasure of personal data without undue delay. Article 12(3) GDPR specifies this period by indicating that the controller provides information on action taken under a request regarding the data subject’s rights, without undue delay and in any event within one month of receipt of the request. This period may be extended by two months if necessary. Article 12(4) GDPR adds that if the controller does not take action, it must inform the data subject without delay and at the latest within one month of receiving the request of the reasons for not taking action and on the possibility of lodging a complaint with the DPA.

In the present case, the APD found that the controller did not respond to the erasure request. Therefore, the DPA concluded that there was a breach of Articles 12(3), 12(4) and 17(1) GDPR and ordered the controller to proceed with the deletion of the data subject’s data.

Comment

As this was a prima facie decision, if the controller does not agree with the contents of the decision or believes that it has factual and/or legal arguments that could lead to a different decision, it may submit a request for a hearing to the APD within 30 days of the notification of the decision.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

1/6



                                                                          Dispute Chamber


                                                Decision 40/2024 of February 23, 2024


File number: DOS-2024-00171


Subject: complaint for failure to respond to a request for data erasure



The Disputes Chamber of the Data Protection Authority, composed of Mr

Hielke HIJMANS, sole chairman;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

on the protection of natural persons with regard to the processing of

personal data and regarding the free movement of such data and to the revocation of

Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”;


Having regard to the law of 3 December 2017 establishing the Data Protection Authority,

hereinafter “WOG”;

In view of the internal rules of order, as approved by the House of Representatives

Representatives on December 20, 2018 and published in the Belgian Official Gazette on

January 15, 2019;


Considering the documents in the file;


Has made the following decision regarding:


Complainant: Mr and Mrs X, hereinafter “the complainant”



The defendant: Y, hereinafter “the defendant” Decision 40/2024 — 2/6



I. Facts and procedure

 1. The subject of the complaint concerns the failure to respond to the complainant's request

       to delete data so that it no longer receives written communication from the

       defendant, being a non-profit organization.


 2. On January 11, 2024, the complainant submits a complaint to the Data Protection Authority

       against the defendant.

       In the complaint, the complainant states that he receives unsolicited letters on a very regular basis

       of the defendant. On July 27, 2023, the complainant wrote to the chairman

       from the defendant asking him to delete his data in order to make these communications

       fuses. The complainant states that the influx of letters continues after this communication

       increased, which is also demonstrated by copies of communications from the

       defendant on dates of August 11, 2023, September 4, 2023, October 18, 2023, 9

       November 2023, December 4, 2023 and December 12, 2023. The complainant asks the GBA between

       to force the defendant to erase his data.

 3. On January 24, 2024, the complaint will be declared admissible by the First Line Service on

       on the basis of articles 58 and 60 of the WOG and the complaint is filed on the basis of article 62, § 1
                                                          2
       of the WOG transferred to the Disputes Chamber.

 4. In accordance with Article 95, § 2, 3° of the WOG as well as Article 47 of the internal regulations

       order of the GBA, the parties can request a copy of the file. If one

       both parties wish to make use of the opportunity to consult and

       copying the file, he or she must contact the secretariat of the

       Disputes Chamber, preferably via litigationchamber@apd-gba.be.



II. Justification


 5. Article 17.1 GDPR provides that the data subject of the controller without

       can obtain the deletion of personal data relating to him without unreasonable delay. The

       controller is obliged to process personal data without unreasonable

       delay to erase when the personal data is no longer necessary for the
       purposes for which they were collected or otherwise processed.


 6. In accordance with Article 12.3 GDPR, the controller shall provide the

       person concerned without delay and in any case within one month of receipt of the request

       pursuant to Articles 15 to 22 GDPR information about the outcome of the request



1In accordance with Article 61 of the WOG, the Disputes Chamber hereby informs the parties that the complaint is admissible
declared.
2In accordance with Article 95, § 2 of the WOG, the Disputes Chamber hereby informs the parties that the file will be sent to
has been transferred to her as a result of this complaint. Decision 40/2024 — 3/6


        is given. Depending on the complexity of the requests and the number of requests

        that period may be extended by a further two months if necessary. The

        the controller shall inform the data subject within one month of receipt of the


        request of such extension.

 7. The Disputes Chamber determines that the complainant is on the basis of the documents supporting the complaint

        exercised the right to erasure of data on July 27, 2023. The Disputes Chamber can


        However, it cannot be determined on the basis of the complaint that the complainant has received an answer. The inde

        documents attached communication from the defendant on the date of August 11, 2023, 4

        September 2023, October 18, 2023, November 9, 2023, December 4, 2023 and December 12

        2023, however, the Disputes Chamber suspects that there has been an infringement against it

        Articles 12.3 and 12.4 GDPR, as well as Article 17.1 GDPR. 4


 8. Based on the above analysis, it could be concluded that the defendant

        has committed an infringement of the provisions of the GDPR, which justifies this in this case

        a decision will be taken on the basis of Article 95, § 1, 5° of the

        WOG, in particular to order the defendant to comply with the exercise by

        the complainant of his right to erasure (Article 17.1 GDPR) and this in particular in view

        on the documents that the complainant has provided showing that the complainant is the defendant

        has requested that his data be deleted.


 9. This decision is a prima facie decision taken by the Disputes Chamber

        in accordance with Article 95 of the WOG on the basis of the complaint submitted by the complainant,




3Article 12 GDPR

[…]
3. The controller shall provide the data subject without undue delay and in any case within one month of receipt
the request pursuant to Articles 15 to 22 information about the consequence that has been given to the request.Depending on
the complexity of the requests and the number of requests may extend this period by another two months if necessary

be extended. The controller shall notify the data subject within one month of receiving the request
notice of such extension. When the data subject submits his request electronically, the information is if
may be provided electronically, unless the data subject requests otherwise. 4. When the controller does not
responds to the data subject's request, he shall communicate the latter without delay and at the latest within one month of receipt
of the request why the request was unsuccessful and informs him of the possibility to file a complaint
to a supervisory authority and to appeal to the courts. […]
4
 Article 17 GDPR
1. The data subject has the right to have his or her data erased without undue delay by the controller
concerning personal data and the controller is obliged to obtain personal data without

unreasonable delay where one of the following applies:
a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;

(b) the data subject withdraws consent to which processing is carried out in accordance with Article 6(1)(a) or Article 9(2)(a)
is based on, and there is no other legal basis for, the processing;
c) the data subject objects to the processing in accordance with Article 21(1), and there are no mandatory

legitimate grounds for the processing, or the data subject objects to the processing in accordance with Article
21(2);
d) the personal data have been processed unlawfully;

(e)the personal data must be erased in order to comply with a requirement laid down in Union or Member State law
legal obligation incumbent on the controller;
f) the personal data have been collected in connection with an offer of information society services as referred to

in Article 8(1). Decision 40/2024 — 4/6


        in the context of the “procedure prior to the decision on the merits” 5 and none

        decision on the merits of the Disputes Chamber within the meaning of Article 100 of the WOG.


        The Disputes Chamber has thus decided, on the basis of Article 58.2.c) GDPR and

        Article 95, § 1, 5° of the WOG, to order the defendant to comply with the request

        of the data subject to exercise his rights, in particular the right to

        erasure (“right to be forgotten”) as provided for in Article 17 GDPR.


 10. The purpose of this decision is to inform the defendant of the fact that this

        has committed an infringement of the provisions of the GDPR and has the opportunity to do so

        still agree to comply with the aforementioned provisions.


 11. If the defendant does not agree with the content of the present primafacie

        decision and is of the opinion that it can apply factual and/or legal arguments

        that could lead to a different decision, this can be done via the e-mail address

        litigationchamber@apd-gba.be send a request to hear the merits of the case

        to the Disputes Chamber within 30 days after notification of this

        decision. The implementation of this decision will, if necessary, continue for a period of time

        suspended for the aforementioned period.


 12. In the event of a continuation of the merits of the case, the

        Dispute Chamber the parties on the basis of Articles 98, 2° and 3° in conjunction with Article 99 WOG

        invite them to submit their defenses as well as any documents they consider useful in the case

        file to add. If necessary, the present decision will be permanently suspended.

 13. Finally, for the sake of completeness, the Disputes Chamber points out that a hearing on the merits

                                                                                                                6
        of the case may lead to the imposition of the measures stated in Article 100 of the WOG.






5Section 3, Subsection 2 of the WOG (Articles 94 to 97).

6Article 100. § 1. The Disputes Chamber has the authority to:
 1° to dismiss a complaint;
 2° to order the dismissal of prosecution;
 3° order the suspension of the ruling;
 4° to propose a settlement;
 5° formulate warnings and reprimands;
 6° order that the data subject's requests to exercise his rights be complied with;

 7° to order that the person concerned is informed of the security problem;
 8° order that processing be temporarily or permanently frozen, restricted or prohibited;
 9° to order that the processing be brought into compliance;
 10°the rectification, limitation or deletion of data and its notification to the recipients of the data
     recommend data;
 11° order the withdrawal of the recognition of certification bodies;
 12° to impose penalty payments;
 13° to impose administrative fines;
 14° the suspension of cross-border data flows to another State or an international institution
     command;

 15° to transfer the file to the public prosecutor's office in Brussels, who will inform it of the
     follow-up given to the file;
 16° decide on a case-by-case basis to publish its decisions on the website of the
     Data Protection Authority. Decision 40/2024 — 6/6


an objection petition must be submitted to the registry of the Market Court

in accordance with Article 1034quinquies of the Dutch Civil Code. .8 or via e-Deposit

IT system of Justice (Article 32ter of the Judicial Code).








(get). HielkeIJMANS


Chairman of the Disputes Chamber


























































8
 The petition with its attachment will be sent by registered letter, in as many copies as there are parties involved.
deposited with the clerk of the court or at the registry.