APD/GBA (Belgium) - 99/2024

APD/GBA - 99/2024
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 12 GDPR Article 15 GDPR
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	24.07.2024
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	99/2024
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	French
Original Source:	APD/GBA (Belgium) (in FR)
Initial Contributor:	p

The DPA dismissed a data subject’s complaint regarding a claimed violation in the right of access since the controller’s time limit for answering the request has not expired at the time of the complaint.

English Summary

Facts

A data subject was an employee of a company (the controller). Due to a conflict between the data subject and their manager disciplinary proceedings against the data subject were initiated. The data subject was asked not to work onsite; their laptop was confiscated and the mailbox blocked.

The data subject received a document concerning the disciplinary proceedings from the controller to review and comment within 10 days. The document was sent via mail and e-mail. The controller provided the instruction on the remote access to the data subject’s mailbox.

The data subject was unable to access their mailbox and asked the controller for help. The controller forwarded the request to its IT department. Also, the controller informed the data subject they were entitled to use a computer within the company premises to access the mailbox.

After few days, the data subject found out their e-mail account password was changed without their consent or notification. Then, the data subject requested access from the controller to their mailbox’s logs and explanation of the situation at stake. The controller didn’t answer the access request.

The data subject filed a complaint with the Belgian DPA (ADP/GBA). The data subject claimed the controller failed to answer the access request and suspended their mailbox access.

Holding

The DPA dismissed the case on the grounds of expediency (understood as ineffectiveness of potential proceedings before the DPA).

According to the DPA, the subject matter of the case referred to the failure to answer the data subject's access request. The DPA explained the data subject lodged the complaint too early, i.e. three days after the access request was made. Hence, the controller was unable to react within the time frame under Article 12 GDPR. Thus, the violation of the GDPR didn’t occur yet. Moreover, for the DPA the complaint covered a broader dispute, related to the disciplinary proceedings. Because of that, potential investigation of the DPA was inappropriate.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/7

Litigation Chamber

Decision 99/2024 of July 24, 2024

File number: DOS-2023-03447

Subject: Complaint regarding access to the professional mailbox, including the suspension

of this access and the modification of its access codes without consent; as well as

the absence of a response to a request for access to the mailbox logs for a

determined period

The Litigation Chamber of the Data Protection Authority, consisting of Mr. Hielke

Hijmans, President, sitting alone;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and

on the free movement of such data, and repealing Directive 95/46/EC (General Data

Protection Regulation), hereinafter "GDPR";

Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, hereinafter

"LCA";

Having regard to the Law of 30 July 2018 on the protection of natural persons with regard to the

processing of personal data, hereinafter "LTD";

Having regard to the Rules of Procedure as approved by the Chamber of Representatives on 20

December 2018 and published in the Belgian Official Gazette on 15 January 2019;

Having regard to the documents in the file;

Has taken the following decision concerning:

The complainant: X, hereinafter “the complainant”;

The defendant: Y, hereinafter “the defendant”. Decision 99/2024 - 2/7

I. Facts and procedure

1. On 13 August 2023, the complainant, employed at Y, filed a complaint with the Data Protection Authority (hereinafter “DPA”) against the defendant, Y.

2. This complaint concerns access to the complainant’s professional mailbox, including the

suspension of this access and the modification of his access codes without his consent; as well as the

failure to respond to his request for access to his mailbox logs for a specified period.

3. On 3 August 2023, following the hearing of 31/07/2023, the minutes are sent to the complainant

by post and email, with a period of 10 days for any comments.

After this deadline, the disciplinary file will be forwarded to the Y Management Committee. In response to

the question concerning access to the complainant's professional email, instructions for

accessing it remotely are provided by the defendant.

4. On 7 August 2023, the complainant confirms that he will send the signed hearing minutes with his

comments by registered mail before the end of the week. He then expressed his concern

regarding access to his professional email account, which contained personal

documents and emails related to work. Despite the instructions provided for accessing

it, the complainant encountered difficulties and requested

explanations and a resolution of the problem. On the same date,

the respondent indicated that his request had been forwarded to the IT department.

An undated electronic correspondence informed the complainant that if the

connection problems persisted, he could check his email account from a

PC available at the workplace, with a room provided for him to save or transfer

documents. 5. On 10 August 2023, the complainant contacted the respondent to report that his password to

access his professional email account had been changed without his consent or

prior notification, which he considered to be a serious violation of his privacy and

fundamental rights. Under the GDPR, he demanded the immediate provision of

access logs to his email account for a given period (from Thursday 29 June 4:00 p.m. to

Tuesday 8 August), as well as explanations for this change. The complainant also demanded the immediate cessation of any

interference with his electronic correspondence and the protection of his right to

confidentiality of communications under penalty of legal proceedings.

6. In the complaint form, the complainant explains that a disagreement with his hierarchical

superior led to an order from the general management of the establishments (…) to no longer

go to his workplace and the initiation of disciplinary proceedings against him.

In the context of these events, the management of the establishment where the complainant worked (hereinafter

"the establishment") confiscated his work laptop and blocked his access to work

messaging. Decision 99/2024 - 3/7

7. On 25 August 2023, the SPL declared the complaint admissible on the basis of

Articles 58 and 60 of the LCA, and forwarded it to the Litigation Chamber in accordance with Article 62, § 1 of the LCA.

II. Motivation

8. Pursuant to Article 4, § 1 of the LCA, the DPA is responsible for monitoring the data protection

principles contained in the GDPR and other laws containing provisions

relating to the protection of the processing of personal data.

9. Pursuant to Article 33, § 1 of the LCA, the Litigation Chamber is the administrative

litigation body of the DPA. It is seized of complaints that the SPL transmits to it

pursuant to Article 62, § 1 of the LCA, i.e. admissible complaints. In accordance

with Article 60, paragraph 2 of the LCA, complaints are admissible if they are written in one of the

national languages, contain a statement of the facts and the information

necessary to identify the processing of personal data to which they relate and which fall

within the competence of the DPA.

10. On the basis of the facts described in the complaint file as summarised above, and on the basis of

the powers conferred on it by the legislator under Article 95, § 1

of the LCA, the Litigation Chamber decides on the follow-up to be given to the file; in this case,

the Litigation Chamber decides to proceed with the dismissal of the complaint,

in accordance with Article 95, § 1, 3° of the LCA, for the reasons set out below.

11. In matters of dismissal of the complaint, the Litigation Chamber is required to justify its
1
decision by stage and to:

- pronounce a technical dismissal if the file does not contain or does not

contain sufficient evidence likely to lead to a sanction or if it contains a
technical obstacle preventing it from rendering a decision;

- or to pronounce a classification without further action as a matter of opportunity, if, despite the presence of elements

likely to result in a sanction, the continuation of the examination of the file does not seem

appropriate to him given the priorities of the Data Protection Authority as

specified and illustrated in the Classification without further action policy of the

Contentious Chamber.2

1Court of Markets (Brussels Court of Appeal), 2 September 2020, judgment 2020/AR/329, p. 18.
2 APD, “Policy of classification without further action of the Contentious Chamber”, 18 June 2021, available at
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
contentieuse.pdf. Decision 99/2024 - 4/7

12. In the event of a dismissal based on several grounds for dismissal, the latter

(respectively, dismissal on technical grounds and dismissal on grounds of

expediency) must be treated in order of importance.

13. In this case, the Litigation Chamber decides to dismiss the

complaint on grounds of expediency. The decision of the Litigation Chamber is based

more specifically on three reasons (criteria B1; B2; B3) for which it considers that

it is inappropriate to continue monitoring the case, and consequently decides not

to proceed, among other things, with an examination of the case on the merits.

14. The Litigation Chamber notes that the main grievance raised by the complainant lies in

the defendant's failure to respond to his request made on 10 August 2023. This request

includes the provision of access logs, explanations concerning the incident in question, as well as

the requirement for an immediate cessation of any interference in his electronic correspondence.

15. While it is technically possible to examine your complaint, the Litigation Chamber

begins by verifying whether the general criteria of high societal or personal impact, as

defined by the APD in its note on the policy of dismissal of 18 June 2021, are

applicable in this case. In the event that these high societal or personal impact criteria are not applicable, the Litigation Chamber then weighs the personal impact of the circumstances of the complaint on the fundamental rights and freedoms of the person concerned, and the efficiency of the Litigation Chamber’s intervention. 

16. After examining the high societal or personal impact criteria, the Litigation Chamber concludes that none of these criteria are applicable to the present case. Consequently, the Litigation Chamber assesses the personal impact of the circumstances of the complaint on the fundamental rights and freedoms of the complainant against the efficiency of his or her intervention in order to decide whether to deal with the complaint in depth.

17. According to efficiency criterion B.1, it is imperative to have previously filed a complaint

with the entity responsible for processing personal data and to have waited a

reasonable period of time to obtain a response. This requirement aims to promote efficient use

of the resources of the Litigation Chamber, by reserving its intervention for cases where

a prior complaint has not been satisfactorily resolved.

In this case, the complainant reports that the defendant has not responded to his request for access

made on August 10, 2023. It is important to note that the defendant is required to comply with a

3 APD, “Policy for filing without further action of the Litigation Chamber: 3. –In which cases is my complaint likely

to be filed without further action by the Litigation Chamber? ", 18 June 2021, available at
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
contentieuse.pdf.
4APD, "Policy for classification without follow-up of the Contentious Chamber: 3. - In which cases is my complaint likely

to be classified without follow-up by the Contentious Chamber?", 18 June 2021, available at
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
contentieuse.pdf. Decision 99/2024 - 5/7

period of one month, which may be extended to two months, to respond to a request to exercise

rights, in accordance with the provisions of the GDPR. Although the complainant exercised his rights

through the electronic communication of 10 August 2023, the Litigation Chamber notes

that the complaint was filed on 13 August 2023, three days after the exercise of his right

of access, which has the effect of depriving the defendant of the reasonable period provided for by the

GDPR to provide a response. In such a context, the Litigation Chamber cannot rule

on the existence of a breach of the GDPR or personal data protection laws.

18. According to the opportunity criteria B.2 and B.3 set out in the said policy, the

Litigation Chamber may decide not to process a complaint in cases where a judicial or

administrative decision has already been rendered on the grievances of the complaint; when such decisions are

pending, or if the complaint is considered incidental to a broader dispute.

Furthermore, the Disputes Chamber notes, as indicated in the complaint form,

that a disagreement with a hierarchical superior allegedly led the general management of

the establishments (…) to suspend the complainant, thus preventing him from going to his

workplace and triggering disciplinary proceedings. In addition, the management of the

establishment allegedly confiscated his work laptop and blocked his access to

electronic mail. Contradictorily, undated electronic correspondence also

indicates to the complainant that he can consult his mailbox from a PC available at

the workplace if the connection problems persist, with a room made available to him

to save or transfer documents, which seems to contradict the allegation that the

password to access the professional mailbox has been changed. Based on the

aforementioned facts, the Disputes Chamber notes that the complaint is

incidental to a broader dispute with ongoing disciplinary proceedings. Consequently, the Litigation Chamber

considers that it is not appropriate to launch an investigation through the Inspection Service to

corroborate the complainant’s allegations, and consequently decides not to proceed,

among other things, with an examination of the case on the merits.

19. In conclusion, to the extent that it is clear from the documents in the file that the

efficiency of the Litigation Chamber’s intervention has not been demonstrated in this

case and that the means to be implemented to support the complaint are potentially excessive, the

Litigation Chamber cannot uphold the complainant’s complaint and decides to dismiss the

complaint without further action on grounds of expediency.

5
APD, “Policy for the classification without follow-up of the Litigation Chamber: 3.2.2 – Efficiency criteria - B.1 You have not
filed a prior complaint with the organisation that processes your data and/or have not given it a reasonable
period of time to respond” and “3.2.2 – Efficiency criteria - B.5 Your complaint is not sufficiently detailed or is not
supported by evidence that would allow the Litigation Chamber to decide on the existence or not of a violation
of the GDPR AND your complaint does not have a high societal and/or personal impact”, 18 June 2021, available at
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
contentieuse.pdf. 6A dismissal of the case on grounds of expediency does not mean that the Litigation Chamber legally finds that no violation has occurred, but that the resources required to support the complaint are potentially excessive. ; APD, “Policy on dismissal of the Litigation Chamber”, 18 June 2021, available on Decision 99/2024 - 7/7

filed with the registry of the Court of Markets in accordance with Article 1034quinquies of the Judicial Code, or 11

via the e-Deposit information system of the Ministry of Justice (Article 32ter of the Judicial Code).

To enable it to consider any other possible course of action, the Litigation Chamber refers

the complainant to the explanations provided in its dismissal policy. 12

The Litigation Chamber stresses that the classifications without follow-up that have occurred are likely

to be taken into account by the Data Protection Authority in order to set its future priorities

and/or could inspire future own-initiative investigations by the Inspection Service of the Data

Protection Authority.

(sé). Hielke HIJMANS

President of the Litigation Chamber

2° the name, first name, address of the applicant, as well as, where applicable, his/her qualities and his/her national register number or
company number;
3° the name, first name, address and, where applicable, the quality of the person to be summoned;
4° the subject and summary statement of the grounds of the application;
5° the indication of the judge who is seized of the application;

116° the signature of the applicant or his/her lawyer. The application, accompanied by its annex, is sent, in as many copies as there are parties involved, by registered letter to the clerk of the court or filed with the registry.
12APD, “Policy for filing without further action of the Contentious Chamber: 4. – What can I do if my complaint is filed without further action?”, 18 June 2021, available at https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-
suite-de-la-chambre-contentieuse.pdf.