APD/GBA (Belgium) - 91/2024

APD/GBA - 91/2024
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 77 GDPR
Type:	Complaint
Outcome:	Rejected
Started:
Decided:
Published:	03.06.2024
Fine:	n/a
Parties:	n/a
National Case Number/Name:	91/2024
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Dutch
Original Source:	APD/GBA (in NL)
Initial Contributor:	nzm

The DPA dismissed a case considering that the objective right to lodge a complaint does not imply that every complaint can and will also be thoroughly investigated by the competent authority, which can choose to handle complaints selectively with a view to an effective and efficient enforcement policy.

English Summary

Facts

The data subject’s parents leased a property to a relative. Upon termination of the residential lease, a release of the rental deposit was agreed. The data subject was asked by a bank (‘controller’) to provide a copy of the identity cards of her parents, or for her parents to go to the bank in person for the purpose of identification.

The data subject refused to do so, arguing that neither the anti-money laundering legislation, nor the legislation on residential tenancy imposed such a requirement for the release of the rental deposit. Moreover, due to their health condition, her parents could not visit the controller in person.

The data subject still provided a copy of her parents’ identity card; expressly stating that this action did not imply her agreement with the requirement to present these documents. She lodged a complaint with the Belgian DPA (‘GBA’) against the controller.

Holding

The GBA explained that the DPA can decide to dismiss a case and that there are two types of dismissals: (i) a ‘technical dismissal’ if the case file contains no or insufficient elements that could lead to a conviction or (ii) a ‘policy dismissal’ if, despite the presence of elements that could lead to a sanction, the continuation of the examination of the complaint does not seem appropriate in the light of the priorities of the DPA. In the present case, the GBA adopted such a ‘policy dismissal’.

First, the GBA did not consider it appropriate to conduct a hearing on the merits because of the low probability of success of the complaint. The DPA explained that it was clear from the submissions made by the data subject that the controller processed identity cards in the context of the obligations imposed on financial banking institutions under the Anti-Money Laundering Act. This regulation requires banks to identify and verify persons at the beginning of the business relationship, but also on an ongoing basis when occasional transactions occur.

The DPA referred to the duty of identification (know your customer principle) and to the duty of vigilance (Anti-Money Laundering Act) and considered that due to the existence of such a legal obligation on the controller, it was not appropriate to deal with the complaint in a hearing on the merits.

Second, the GBA decided not to follow up on the case for reasons of expediency. The DPA indicated that under Article 77 GDPR, any data subject whose personal data are processed within the territorial scope of the GDPR has the right to lodge a complaint. However, the GBA held that this objective right to lodge a complaint does not imply that every complaint can and will also be thoroughly investigated by the competent authority, given the intrinsic lack of resources and referred to CJEU, 16 July 2020, DPC v Facebook Ireland and Maximilan Schrems, C-311/18, §112 for this argument. The DPA pointed out that in this regard, the Belgian legislator has explicitly recognised the need for the DPA to be able to act selectively with a view to an effective and efficient enforcement policy in an explanatory memorandum to a legislative measure proposal.

Finally, the GBA considered that the context of the complaint made it more appropriate for it to be dealt with by another competent authority.

Comment

The GDPR in no way states that the objective right to lodge a complaint does not imply that every complaint can and will be thoroughly investigated. The GBA referenced §112 of the Schrems II case which indicates the following:

“Although the supervisory authority must determine which action is appropriate and necessary and take into consideration all the circumstances of the transfer of personal data in question in that determination, the supervisory authority is nevertheless required to execute its responsibility for ensuring that the GDPR is fully enforced with all due diligence.”

This in no way confirms the argument that the DPA is trying to put forward. Therefore, referencing this CJEU case to argue that a DPA does not have to thoroughly investigate the complaint given the intrinsic lack of resources is quite peculiar.

In fact, the CJEU has even confirmed in the Schufa judgement that DPAs are required to deal with data subject complaints with all due diligence, and must react appropriately in order to remedy GDPR violations. The DPAs maintain a margin of discretion as to the choice of the appropriate means. Therefore, there is a choice of appropriate means, not a choice of (in)action.

But even if it was said in an explanatory memorandum that the Belgian DPA must be able to act selectively with a view to an effective and efficient enforcement policy, such a practice would evidently be contrary to the GDPR and CJEU case-law.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

1/6



                                                                          Dispute Chamber


                                                     Decision 91/2024 of June 13, 2024


File number: DOS-2024-00832


Subject: Complaint regarding the obligation to submit (a copy).

of) of the identity card at a financial banking institution for fraud prevention



The Disputes Chamber of the Data Protection Authority, composed of Mr

Hielke HIJMANS, sole chairman;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

on the protection of natural persons with regard to the processing of

personal data and regarding the free movement of such data and to the revocation of

Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”;


Having regard to the law of 3 December 2017 establishing the Data Protection Authority,
hereinafter “WOG”;


In view of the internal rules of order, as approved by the House of Representatives

Representatives on December 20, 2018 and published in the Belgian Official Gazette on

January 15, 2019;


Considering the documents in the file;


Has made the following decision regarding:



Complainant: X, hereinafter “the complainant”


The defendant: Y, hereinafter “the defendant” Decision 91/2024 — 2/6


I. Facts and procedure


    1. On 29 November 2023, the complainant lodges a complaint with the Data Protection Authority

        against the defendant.


    2. The complainant's parents rented a property to a family member. Upon termination

        of the housing lease became a release of the rental deposit
        agreed. In this context, the defendant, a bank branch, informed the complainant

        asked to either provide a copy of the landlord's identity card, i.e.

        her parents, or that both parents would go to the bank office in person

        for the purpose of identification. The complainant initially refused this because she stated that

        neither the anti-money laundering legislation nor the legislation on residential rentals has any such effect

        requirement in the context of the release of the rental deposit. Besides, it was for

        her parents are unable to attend in person due to their health

        defendant. With a view to a quick release of the guarantee, the complainant has

        provided a copy of her parents' identity card, expressly stating:
        indicates that this action does not imply that she agrees with the requirement to do so

        to submit documents.


    3. On February 14, 2024, the complaint will be declared admissible by the First Line Service on

        on the basis of Articles 58 and 60 WOG and the complaint is filed on the basis of Article 62, § 1 WOG

        transferred to the Disputes Chamber.


II. Justification


    4. On the basis of the elements in the file that are known to the Disputes Chamber, and on the basis

        of the powers granted to it by the legislature on the basis of Article 95, § 1 WOG

        assigned, the Disputes Chamber will decide on the further follow-up of the file; in this case

        the Disputes Chamber will dismiss the complaint in accordance with Article 95,

        § 1, 3° WOG, based on the following justification.

    5. If a complaint is dismissed, the Disputes Chamber will make its decision

        to motivate gradually and:


           - to issue a technical dismissal if the file does not exist or is insufficient

               contains elements that could lead to a conviction, or if there is insufficient
               there is a prospect of a conviction due to a technical obstacle,

               which prevents her from reaching a decision;






1Court of Appeal Brussels, Market Court Section, 19 Chamber A, Chamber for Market Affairs, judgment 2020/AR/329, September 2, 2020,
p. 18. Decision 91/2024 — 3/6



            - or declare a policy rejection, if despite the presence of elements

                that could lead to a sanction, the continuation of the investigation

                dossier does not seem appropriate in the light of the priorities of the

                Data Protection Authority, as specified and explained in the

                dismissal policy of the Disputes Chamber. 2


    6. In the event of dismissal on more than one ground, the grounds for dismissal (resp.
                                                                                                3
        technical dismissal and policy dismissal) should be treated in order of importance.

    7. In the present file, the Disputes Chamber will dismiss the complaint,

        on the basis of policy grounds for dismissal. Below is an explanation of the


        reasoning of the Disputes Chamber that is the basis for the decision as to why

        considers it undesirable to take further action on the file and therefore decides not to proceed

        proceed to, inter alia, a substantive treatment.

    8. In this case, the Disputes Chamber does not consider it appropriate to proceed with a hearing

        due to the low risk of the complaint. In accordance with Article 6 of the GDPR

        There are six possible legal grounds on which a controller can carry out processing

        can base. This is clearly evident from the documents submitted by the complainant

        The defendant's processing of the complainant's identity card is part of the obligations

        be imposed on a financial banking institution in accordance with the Wet tot

        prevention of money laundering and the financing of terrorism

        of the use of cash of October 6, 2017 (hereinafter: the Anti-Money Laundering Act).


    9. Reference should therefore be made to the Anti-Money Laundering legislation that applies to

        financial banking institutions (in particular Article 8, §2, 1°, Article 19, §1, 1° and 3°, Article 21,

        §1 and 26, §1 and 27 and articles 30, 33 and 35). These provisions oblige banks to provide persons

        to identify and verify, not only at the beginning of the business relationship, but also

        continuously when occasional transactions occur (which is the case in this case).     4


    10. The Disputes Chamber refers in this case to the identification obligation (according to the Know-Your-

        Customer/Know-Your-Customer principle), as well as to the duty of vigilance provided for in
                                   5
        the Anti-Money Laundering legislation. The Disputes Chamber does not consider the current complaints procedure to be appropriate




2In this context, the Disputes Chamber refers to its dismissal policy as explained in detail on the GBA website:
https://www.gegevensbeschermingsautoriteit.be/publications/sepotbeleid-van-de-geschikkamer.pdf
3
  Cf. Title 3 – In which cases is my complaint likely to be dismissed by the Disputes Chamber? from the
dismissal policy of the Disputes Chamber.
4G. GOYVAERTS and V. SEYNAEVE, “[Preventive part of the anti-money laundering legislation] The law of 18 September 2017” in A.
TIBERGHIEN, Handbook of Tax Law, Wolters Kluwers Belgium, Mechelen, 2023, 3056.
5
 Act of 18 September 2018 on the prevention of money laundering and the financing of terrorism and on limiting
of the use of cash, hereinafter “Anti-Money Laundering Act”:

https://www.ejustice.just.fgov.be/eli/wet/2017/09/18/2017013368/justel;enReglementvandeNationaleBankvanBelgiëvan
November 21, 2017 on the prevention of money laundering and terrorist financing; D. Goens, Data
protection at financial institutions, Intersentia, Antwerp, 2018, 442 et seq. Decision 91/2024 — 4/6


        prevents the defendant from refusing to issue the requested release of the rental deposit

        if the complainant continues to refuse the requested identification documents from her parents

        and/or provide the update of these identification documents to the defendant and

        that in the light of the aforementioned Anti-Money Laundering legislation. The Dispute Chamber points out

        Please note that the institutions subject to these anti-money laundering obligations have a

        have developed procedural processing activity that is plausible and that it

        presentation of (a copy of) the electronic identity card

        anti-money laundering purposes are not questioned by the Disputes Chamber. Also the

        necessary/legal updating of the personal data via another copy or


        reading of the identity card is not questioned by the Disputes Chamber.

    11. It is because of the existence of such a legal obligation under

        defendant that the Disputes Chamber does not consider it appropriate to file the relevant complaint

        ground to be treated. Primafacie, they cannot establish a violation of the GDPR.


    12. The Disputes Chamber decides not to follow up on the matter for expediency reasons

        file. Under Article 77 of the GDPR, every data subject whose personal data

        are processed within the territorial scope of the GDPR, of a

        right of complaint. However, this objective right to complain does not imply that every complaint also applies

        can and will be thoroughly investigated by the competent authority, given the intrinsic nature

        lack of resources.    7 The Belgian legislator has recognized in this regard “the need for the

        Data protection authority to be able to act selectively with a view to a

        effective and efficient enforcement policy” is explicitly recognised. 8


    13. Secondly, and in a subordinate order, the Disputes Chamber determines that the complaint is appropriate

        in a broader context which it is more appropriate to be dealt with by a

        other competent authority. The Disputes Chamber determines that the complaint must be framed

        are in the broader context of the release of the rental deposit and the applicable

        procedures set up for this purpose by the defendant in accordance with applicable legislation

        about this. The Disputes Chamber does not consider it appropriate for it to suspend the procedures of


        to test the defendant regarding the release of the rental deposit against the applicable

        legislation in this regard. Bearing this in mind, the Disputes Chamber rules that its intervention in

        in this case is not strictly necessary and that it is more expedient for the complainant to




6See in particular Article 35 of the Anti-Money Laundering Act

7Cf. Court of Justice EU, judgment of 16 July 2020, DPC v. Facebook Ireland & Maximillian Schrems, C-311/18, para. 112
8
 Own emphasis in quotation, cf. Belgian Chamber of Representatives, Explanatory Memorandum to the
Draft law establishing the Data Protection Authority, Doc. 2648/001 (Parliamentary term 54), available via:

https://www.dekamer.be/kvvcr/showpage.cfm?section=/flwb&language=nl&cfm=/site/wwwcfm/flwb/flwbn.cfm?lang=N&leg
islat=54&fileID=2648, 51
9
   Ground for dismissal B.3 of the dismissal policy of the Disputes Chamber, dated. June 18, 2021, available via
https://www.gegevensbeschermingsautoriteit.be/publications/sepotbeleid-van-de-geschikkamer.pdf.                                                                                               Decision 91/2024 — 6/6



in accordance with Article 1034quinquies of the Dutch Civil Code. , or via the e-Deposit

IT system of Justice (Article 32ter of the Judicial Code).


To enable the complainant to consider other possible remedies, the

Disputes Chamber will refer the complainant to the explanation in its dismissal policy.            15







(get). Hielke H IJMANS


Chairman of the Disputes Chamber































































14The application and its attachment will be sent by registered letter in as many copies as there are parties involved
deposited with the clerk of the court or at the registry.

15Cf. Title 4 – What can I do if my complaint is closed? of the dismissal policy of the Disputes Chamber.