APD/GBA (Belgium) - 70/2024

APD/GBA - 70/2024
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 12(3) GDPR Article 12(4) GDPR Article 15(1) GDPR Article 58(2)(c) GDPR
Type:	Complaint
Outcome:	Upheld
Started:	11.03.2024
Decided:	06.05.2024
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	70/2024
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Dutch
Original Source:	APD/GBA (in NL)
Initial Contributor:	Violette Maris

In a prima facie decision the DPA ordered the provider of a weekly magazine to comply with a data subject’s access request within one month.

English Summary

Facts

The data subject claims to have received a dispatch from the weekly "Z", while arguing that he had not previously subscribed to the weekly. Subsequently, the data subject exercised his right of access under Article 15(1)(g) GDPR by requesting information about the source of his data. On 3 March 2024 the data subject allegedly repeated his requested by email. The controller failed to respond within the 1 month statutory deadline set out by Article 12(3) GDPR.

Holding

The DPA issued a prima facie decision. The DPA held that the controller had to comply with the data subject's request to exercise his rights under Article 15(1) GDPR. Consequently, the controller had to provide the data subject with this information within a period of 30 days from the notification of the decision by the DPA.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

1/6



                                                                          Dispute Chamber


                                                      Decision 70/2024 of May 6, 2024


File number: DOS-2024-01290


Subject: Exercise of the right in respect of which the defendant does not follow suit

would have given



The Disputes Chamber of the Data Protection Authority, composed of Mr

Hielke HIJMANS, sole chairman;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

on the protection of natural persons with regard to the processing of

personal data and regarding the free movement of such data and to the revocation of

Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”;


Having regard to the law of 3 December 2017 establishing the Data Protection Authority,
hereinafter “WOG”;


In view of the internal rules of order, as approved by the House of Representatives

Representatives on December 20, 2018 and published in the Belgian Official Gazette on

January 15, 2019;


Considering the documents in the file;


Has made the following decision regarding:


Complainant: X, hereinafter “the complainant”



The defendant: Y, hereinafter “the defendant” Decision 70/2024 — 2/6



I. Facts and procedure


 1. On March 11, 2024, the complainant submits a complaint to the Data Protection Authority

       against the defendant.

 2. The subject of the complaint concerns the exercise of the right of access by the complainant

       without receiving any response from the defendant inside

       the period of one month (Article 12.3GDPR). The request for access was received on February 7, 2024

       addressed by the complainant to the defendant's email address […]. On March 3, 2024, the

       complainant repeated his request by email. The complainant states that his requests were made at the time

       of the complaint had gone completely unanswered.


 3. On March 28, 2024, the complaint was declared admissible by the First Line Service on the grounds
                                               1
       of Articles 58 and 60 of the WOG and the complaint is filed on the basis of Article 62, § 1 of
       the WOG transferred to the Disputes Chamber.     2


 4. In accordance with Article 95, § 2, 3° of the WOG as well as Article 47 of the internal regulations

       order of the GBA, the parties can request a copy of the file. If one

       both parties wish to make use of the opportunity to consult and

       copying the file, he or she must contact the secretariat of the

       Disputes Chamber, preferably via litigationchamber@apd-gba.be.



II. Justification


 5. The complainant says he received a shipment of the weekly magazine “Z” on February 7, 2024.

       This shipment is said to be addressed to him personally, even though he claims not to have subscribed

       are in the weekly magazine. The Disputes Chamber will determine on the basis of the documents that support the complaint

       established that the complainant subsequently exercised his right of access on February 7, 2024.

       More specifically, the complainant requested information about the source of his data. Corresponding

       Article 15.1.g) GDPR, this information is part of the right of access
       person involved. However, the defendant allegedly failed to respond to the request

       the complainant within the statutory period of 1 month (Article 12.3 GDPR). As a result, the














1
 In accordance with Article 61 of the WOG, the Disputes Chamber hereby informs the parties that the complaint is admissible.
declared.
2In accordance with Article 95, § 2 of the WOG, the Disputes Chamber hereby informs the parties that the file will be sent to
has been transferred to her as a result of this complaint.                                                                                                      Decision 70/2024 — 3/6


                                                                                                    3
         defendant may have acted in violation of Articles 12.3 and 12.4 of the GDPR, as well as Article 15.1
               4
         GDPR .


  6. The Disputes Chamber is of the opinion that based on the above analysis

         concluded that the defendant may have violated the provisions of the GDPR

         would have been committed, which justifies taking action in this case

         a decision on the basis of Article 95, § 1, 5° of the WOG, more specifically the defendant

         orders to comply with the complainant's exercise of his right of access

         (Article 15.1 GDPR) and this in particular in view of the documents that the complainant has provided


         which shows that the complainant has indeed exercised his right of access, but the

         defendant would not have complied with this.


  7. This decision is a prima facie decision taken by the Disputes Chamber

         in accordance with Article 95 of the WOG on the basis of the complaint submitted by the complainant,





3Article 12 GDPR.

[…]
3. The controller shall provide the data subject without undue delay and in any case within one month of receipt

the request pursuant to Articles 15 to 22 information about the consequence that has been given to the request. Depending on
the complexity of the requests and the number of requests may extend this period by another two months if necessary

be extended. The controller shall notify the data subject within one month of receiving the request

notice of such extension. When the data subject submits his request electronically, the information is if
may be provided electronically, unless the data subject requests otherwise.

4. If the controller does not respond to the data subject's request, he will inform the latter

without delay and no later than one month after receipt of the request, explain why the request has been unsuccessful,
and informs him about the possibility to file a complaint with a supervisory authority, appeal to the court

configure.
4Article 15 GDPR

1. The data subject has the right to obtain confirmation from the controller as to whether or not this is the case

process personal data concerning him and, where that is the case, to obtain access to them
personal data and the following information:

a) the purposes of processing;

b) the categories of personal data concerned;
c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular

recipients in third countries or international organizations;
d) where possible, the period for which the personal data is expected to be stored, or if

that is not possible, the criteria for determining that period;

e) that the data subject has the right to request that personal data be deleted from the controller
rectified or deleted, or that the processing of personal data concerning him is restricted, as well as the right

to object to that processing;

f) that the data subject has the right to lodge a complaint with a supervisory authority;
g) where the personal data is not collected from the data subject, all available information about its source

facts;
(h) the existence of automated decision-making, including profiling referred to in Article 22(1) and (4), and,

at least in cases, useful information about the underlying logic, as well as the importance and expected consequences of it

that processing for the data subject.
[…] Decision 70/2024 – 4/6


       in the context of the “procedure prior to the decision on the merits” 5 and none

       decision on the merits of the Disputes Chamber within the meaning of Article 100 of the WOG.


       The Disputes Chamber has thus decided, on the basis of Article 58.2.c) GDPR and

       Article 95, § 1.5° of the WOG, to order the defendant to comply with the request

       of the data subject to exercise his rights, in particular the right of access such as

       determined in article 15.1 GDPR.

 8. The purpose of this decision is to inform the defendant of the fact that


       it may have committed an infringement of the provisions of the GDPR and this is in the

       the opportunity to still comply with the aforementioned provisions.

 9. If the defendant does not agree with the content of this prima facie case

       decision and is of the opinion that it can put forward factual and/or legal arguments that

       could lead to a new decision, it can request a reconsideration

       submit to the Disputes Chamber in accordance with the procedure established in Articles 98 in conjunction

       99 of the WOG, known as a “treatment on the merits”. This request must be

       sent to the email address litigationchamber@apd-gba.be within a period of 30

       days after notification of this primafacie decision. If applicable, implementation will take place

       of this decision is suspended for the above-mentioned period.


 10. In the event of a continuation of the merits of the case, the

       Disputes Chamber the parties on the basis of Articles 98, 2° and 3° in conjunction with Article 99 of the

       invite WOG to submit their defenses and any documents they consider useful

       to be added to the file. If necessary, the present decision will become final

       suspended.


 11. Finally, for the sake of completeness, the Disputes Chamber points out that a hearing on the merits

       of the case may lead to the imposition of the measures referred to in Article 100 of the

       WOG . 6





5Section 3, Subsection 2 of the WOG (Articles 94 to 97).
6
 Article 100. § 1. The Disputes Chamber has the authority to:
 1° to dismiss a complaint;
 2° to order the dismissal of prosecution;
 3° order the suspension of the ruling;
 4° to propose a settlement;
 5° formulate warnings and reprimands;
 6° order that the data subject's requests to exercise his rights be complied with;
 7° to order that the person concerned is informed of the security problem;
 8° order that processing be temporarily or permanently frozen, restricted or prohibited;
 9° to order that the processing be brought into compliance;
 10°the rectification, limitation or deletion of data and its notification to the recipients of the data
     recommend data;

 11° order the withdrawal of the recognition of certification bodies;
 12° to impose penalty payments;
 13° to impose administrative fines;
 14° the suspension of cross-border data flows to another State or an international institution
     command;                                                                                             Decision 70/2024 — 6/6



an appeal can be lodged by means of an inter partes petition that is referred to in Article

1034ter of the Judicial Code (Ger.W.) must contain the elements listed. It 7

an application for intervention must be submitted to the registry of the Market Court

                                                              8
in accordance with Article 1034quinquies of the Dutch Civil Code. ,or via the Deposit Information System

the Ministry of Justice (Article 32ter of the Judicial Code).







(get). Hielke H IJMANS

Chairman of the Disputes Chamber
















































7
 The petition states, under penalty of nullity:
      1° the day, month and year;

      2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register
          or company number;

      3° the surname, first name, place of residence and, where applicable, the capacity of the person to be
          summoned;

      4° the subject matter and brief summary of the grounds of the claim;

      5° the judge before whom the claim is brought;
      6° the signature of the applicant or his lawyer.

8The application with its attachment will be sent by registered letter in as many copies as there are parties involved
deposited with the clerk of the court or at the registry.