APD/GBA (Belgium) - 33/2022

From GDPRhub
Revision as of 09:54, 28 March 2022 by Kc (talk | contribs) (changed GDPR Articles in accordance with style guide; changed claimant to data subject and defendant to controller)
APD/GBA (Belgium) - 33/2022
LogoBE.png
Authority: APD/GBA (Belgium)
Jurisdiction: Belgium
Relevant Law: Article 5(1)(f) GDPR
Article 5(2) GDPR
Article 12(3) GDPR
Article 12(4) GDPR
Article 15(1) GDPR
Article 24 GDPR
Article 25 GDPR
Article 32 GDPR
Article 33 GDPR
Article 58(2)(a) GDPR
Article 58(2)(c) GDPR
Type: Complaint
Outcome: Upheld
Started: 08.07.2021
Decided: 10.03.2022
Published: 10.03.2022
Fine: None
Parties: X
Y1 and Y2
National Case Number/Name: 33/2022
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): French
Original Source: APD/GBA (in FR)
Initial Contributor: Solène Tobler

The Belgian DPA finds that a car dealership failed to comply with Articles 12 and 15 GDPR due to the lack of response to an access request, and with Articles 5, 24 and 32 GDPR due to the inadequacy of the security measures.

English Summary

Facts

After contracting for the purchase of a vehicle, the claimant (data subject) received two consecutive emails from an employee of the defendant, a car dealership (data controller). The first email contained the amount that the data subject still had to pay, as well as the bank account number that the transaction had to be issued to. The second email, sent from the same email address, contained a rectification, giving another bank account number to issue the transaction to.

It was only after the data subject issued the transaction to the bank account number given in the second email, that it was found that the computer system of the controller had been hacked, and that the data subject had been the victim of a fraud, due to the usurping of the employee’s email address. The data subject filed a complaint at their local police police office for fraud, while the controller filed another complaint at the police for fraud and computer hacking.

On 4 May 2021, the data subject sent a subject access request to the car dealership, in order to know which of their personal data was being processed by the data controller, and which personal data had been subjected to the computer hacking. The data controller ignored the request and left it unanswered.

Holding

On 8 July 2021, the data subject lodged a complaint in front of the Belgian DPA for the lack of response to an access request and for the violation of the obligation of security.


1. On the existence of a cyberattack

Some weeks after the events, the data subject received the report from a hired sworn-in expert stating that the server system used by the defendant had indeed been subjected to a cyberattack. The Belgian DPA states that, in order to establish the existence of this cyberattack with full certainty, a judicial warrant would be necessary. However, in the opinion of the Belgian DPA, the police complaint filed by the data controller for computer hacking suggests that the controller implicitly acknowledged having been a victim of a computer hacking.


2. Legal Reasoning

2.1. The failure of the controller to respond to the data subject access request

The Belgian DPA notes that the data subject filed a subject access request under Article 15 GDPR, respecting the conditions set out in Article 12 GDPR. The Belgian DPA then reminds that it is the duty of the data controller to provide the requested information to the data subject without undue delay, and in any case, within one month. As stated by Article 12(3) GDPR, this delay may be extended by further two months when this is justified by the amount or the complexity of the request(s). In such cases, the data controller should inform the data subject of this delay and its underlying reasons within one month of receipt of the request.

As stated by Article 12(4) GDPR, if the data controller cannot answer to the request, it should inform the data subject within one month, and inform the data subject of his or her right to lodge a complaint in front of a supervisory authority.

The Belgian DPA considers that, in the present case, the data controller failed to respect Articles 12(3), 12(4) and 15(1) GDPR, and commands the controller to comply with the complainant's request to exercise his right of access, and thus to provide him with a copy of all personal data held by him, specifying which data had been the subject of the computer hacking.


2.2. The inadequacy of the controller's security measures

Firstly, the Belgian DPA reminds that the data controller is subjected to the principle of integrity and confidentiality enshrined in Articles 5(1)(f) and 32 GDPR. According to this principle, the data controller should ensure the security, integrity and confidentiality of the personal data held by them using appropriate technical and organisational measures, in particular against unauthorised or unlawful processing and against accidental loss, destruction or alteration of the data. The Belgian DPA then states Recitals 83, 85 and 87 GDPR, reminding that the processing of personal data should be protected from unlawful divulgation likely to result in material damages, and that the data controller should make sure that proper technical and organisational safeguards have been put in place in order to immediately know if a breach of personal data has occurred, and to inform the supervisory authority and the data subjects without delay.

Recital 39 and 86 of the GDPR are then cited: data subjects should be informed without undue delay when a breach of personal data is likely to result in a high risk for their rights, so that they might take the appropriate precautions. The Belgian DPA emphasises on the fact that Recital 88 of the GDPR explicitly mentions the possibility of identity theft, such as in the present case.

2.3. The responsibility of the data controller

The Belgian DPA reminds that Article 32 GDPR should be read in combination with Articles 5(2), 24 and 25 GDPR. The principle of accountability, along with Article 24(1) and 24(2) GDPR, aims at ensuring that the data controller implements appropriate data protection policies proportional to the context of the data processing and the level of the potential risk.

The Belgian DPA cites Recital 74 GDPR, which states that the data controller should be able to demonstrate that they have put in place the appropriate measures to ensure that the data processing is in line with the GDPR. From Article 25 GDPR, the Belgian DPA recommends the controller to establish policies that ensure the respect of the GDPR: measures to protect the email address of employees and an updated and more secure system to issue payment transactions.

The Belgian DPA concludes that the appropriate measures to safeguard personal data should be put in place in order to ensure the fundamental right to privacy, particularly in our contemporary context in which information technologies play such a major role.


3. Outcome of the decision

The Belgian DPA considers that the data controller has failed to comply with articles 5(1)(f) , 5(2), 24 and 32 GDPR and issues a warning as provided by article 58(2)(a) GDPR. Pursuant to article 58(2)(c) GDPR , it orders the data controller to answer to the data subject access request by giving out the requested information within 14 days.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details. 

File number: DOS-2021-05171
Subject: Complaint relating to the lack of reaction on the part of the controller to a request for access and to the insufficiency of security measures, following a computer hacking
The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke Hijmans, President, sitting alone;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter GDPR;
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter LCA);
Having regard to the Law of 30 July 2018 relating to the protection of natural persons with regard to the processing of personal data (hereinafter LTD);
Having regard to the Rules of Procedure as approved by the House of Representatives on December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Made the following decision regarding:
The plaintiff: X, hereinafter "the plaintiff", represented by Maître Geert Coene; The defendants: Y1 and Y2, hereinafter “the defendants”;
I. Facts and procedure
1. On July 8, 2021, the plaintiff filed a complaint with the Data Protection Authority (hereinafter "DPA") against the defendants, for failure to react to a request for access, as well as for breach of the security obligation, following a computer hacking.
2. On December 7, 2020, the plaintiff ordered a vehicle (..) worth (.. EUR) and paid a deposit of (..EUR) to the defendants.
3. On February 4, 2021, an employee of the defendants sent an email to the plaintiff with the bank account number to which the outstanding balance was to be paid. On February 5, 2021, the plaintiff received a new email, sent from the email address of the defendants' employee, which stated that the bank account initially communicated was "bad" and informed of the new account number to which the transfer should be performed.
4. On February 8, 2021, the plaintiff informed the employee of the defendants by email that the transfer in the amount of (..EUR) had been ordered. The plaintiff's account was debited on February 9, 2021. On February 11, 2021, the defendants' employee indicated in an email that the outstanding amount had not been collected and requested proof of payment. This was attached by the complainant in an email dated February 12, 2021.
5. On March 15, 2021, the Complainant learned that he had been the victim of an online scam, the email address of the Defendants' employee having probably been spoofed. According to the complainant, the employee in question and an executive of the company admitted to having been victims of computer hacking.
6. On March 17, 2021, the complainant filed a complaint for Internet fraud with the Brussels Capital Ixelles police zone. On the same date, the director of the company lodged a complaint for fraud and piracy (hacking) on the Internet (“hoofde van oplichting met internet en hacking”)1 to the Zaventem police zone.
7. On April 28, 2021, the Complainant received a report from a sworn IT expert he had hired for this purpose: the report states that the server used by the company suffered a “major breach [...] at the beginning of 2021", that this breach "would allow, among other things, identity theft" but that in order to be able to conclude with certainty of a hacking, additional checks are required for which a judicial warrant is necessary.
8. On May 4, 2021, the plaintiff gave the defendants formal notice to communicate all the personal data concerning him at their disposal, specifying which data had been the subject of the hack. According to the plaintiff, the defendants did not respond to this formal notice.
9. On July 17, 2021, the APD's Front Line Service (SPL) declared the complaint admissible on the basis of Articles 58 and 60 of the LCA and forwarded it, pursuant to Article 62, § 1st of the LCA, in the Litigation Chamber.
II. Motivation
10. Pursuant to Article 4, § 1 of the LCA, the DPA is responsible for monitoring the data protection principles contained in the GDPR and other laws containing provisions relating to the protection of the processing of personal data.
11. Pursuant to Article 33, §1 of the LCA, the Litigation Chamber is the administrative litigation body of the DPA. It receives complaints that the Service de Première Ligne (SPL) forwards to it pursuant to Article 62, § 1 of the LCA, i.e. admissible complaints. In accordance with Article 60 paragraph 2 of the LCA, complaints are admissible if they are written in one of the national languages, contain a statement of the facts and the indications necessary to identify the processing of personal data to which they relate. and which fall within the competence of the ODA.
12. Pursuant to articles 51 and s. of the GDPR and Article 4, § 1 of the LCA, it is up to the Litigation Chamber, as the DPA's administrative litigation body, to exercise effective control of the application of the GDPR and to protect the fundamental rights and freedoms of natural persons with regard to processing and to facilitate the free flow of personal data within the Union.
13. The Litigation Chamber notes that the complainant raises the lack of response from the controller to the request to exercise his right of access in accordance with Article 15 of the GDPR.
14. The Litigation Chamber recalls that the data controller must respond to the request made pursuant to Articles 15 to 22 of the GDPR by the complainant, in this case a request for access provided for in Article 15 of the GDPR (exercise of the right of access), in compliance with the conditions set out in article 12 of the GDPR2.
15. The Litigation Chamber also emphasizes that it is the responsibility of the controller to provide the complainant with information on the measures taken following a request made pursuant to Articles 15 to 22 of the GDPR, as soon as possible and in all status within one month of receipt of the request. Article 12.3 of the GDPR provides that this period may, if necessary, be extended by two months, taking into account the complexity and the number of requests3. In such a case, the controller shall inform the complainant of this extension and the reasons for the postponement within one month of receipt of the request 4.
16. In the event that the controller does not comply with the request made by the complainant, he shall inform the latter without delay and at the latest within one month of receipt of the request from the reasons for its inaction and the possibility of lodging a complaint with a supervisory authority and bringing a judicial remedy5.
17. On the basis of the documents supporting the complaint, the Litigation Chamber notes that the complainant exercised his right of access in accordance with Article 15 of the GDPR, but that the controller did not respond to the request of the complainant.
18. The Litigation Chamber considers that the data controller did not, prima facie, comply with Articles 12.3 and 12.4 of the GDPR, as well as Article 15.1 of the GDPR, which in this case justifies taking a decision on the basis of article 95, § 1, 5° of the LCA.
19. The Litigation Chamber orders the controller to comply with the complainant's request to exercise the right of access, and therefore to provide him with a copy of all the personal data he holds, specifying which data has is the subject of hacking.
20. Secondly, the Litigation Chamber notes the insufficiency of the security measures on the part of the defendants, pointed out by the complainant.
21. The Litigation Chamber recalls that the controller is subject to the principle of security and confidentiality enshrined in Articles 5.1.f and 32 of the GDPR.
22. Pursuant to Articles 5.1.f) and 32 of the GDPR, the controller must ensure the security, integrity and confidentiality of the personal data it holds by means of appropriate technical and organizational measures, in particular against unauthorized or unlawful processing and against accidental loss, destruction or alteration of data.
23. Recital 83 of the GDPR envisages that “[...] the controller [...] assesses the risks inherent in the processing and [implements] measures to mitigate them [...]. These measures should ensure an appropriate level of security, including confidentiality, taking into account the state of knowledge and the costs of implementation in relation to the risks and the nature of the personal data to be protected. As part of the data security risk assessment, account should be taken of the risks posed by the processing of personal data, such as destruction, loss or alteration, unauthorized disclosure of personal data transmitted, stored or processed in any other way or unauthorized access to such data, accidentally or unlawfully, which is likely to cause physical or material damage or moral damage. ".
24. Recital 85 of the GDPR adds that "a breach of personal data risks, if we do not intervene in time and in an appropriate manner, to cause the natural persons concerned physical, material or moral damage such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or theft, financial loss, unauthorized reversal of the pseudonymisation procedure, violation of the reputation, loss of confidentiality of personal data. ". Thus, recital 87 of the GDPR invites the controller to check "whether all appropriate technical and organizational protection measures have been implemented to immediately establish whether a personal data breach has occurred and to promptly inform the supervisory authority and the data subject. »
25. Recital 39 of the GDPR reinforces the idea that “data subjects should be informed of the risks, rules, safeguards and rights related to the processing of personal data and the modalities for exercising their rights with regard to this processing [...]. ". To this end, recital 86 of the GDPR provides that "the controller [communicates] a personal data breach to the data subject without undue delay when this breach is likely to create a high risk for the rights and freedoms of the natural person so that he can take the necessary precautions. The communication should describe the nature of the personal data breach and make recommendations to the individual concerned to mitigate the potential negative effects. »
26. Recital 88 of the GDPR states that “when laying down detailed rules concerning the form and procedures applicable to the notification of personal data breaches, due account should be taken of the circumstances of such breach, including the whether or not the personal data was protected by appropriate technical protection measures, effectively limiting the likelihood of identity theft or other forms of misuse. ".
27. Next, the Litigation Chamber recalls that Article 32 GDPR must be read in conjunction with Articles 5.2, 24 and 25 of the GDPR, subjecting the controller to the principle of responsibility.
28. According to Article 24.1 of the GDPR, it is the responsibility of the controller to implement “appropriate technical and organizational measures to ensure and be able to demonstrate that the processing is carried out in accordance with the [GDPR]. These measures are reviewed and updated if necessary. ". Then, article 24.2 of the GDPR stipulates that “where this is proportionate with regard to the processing activities, the measures [mentioned in article 24.1. of the GDPR] include the implementation of appropriate data protection policies by the data controller”.
29. Recital 74 of the GDPR adds that “it is important, in particular, that the controller is required to implement appropriate and effective measures and is able to demonstrate the compliance of processing activities with the [GDPR] , including the effectiveness of the measures. These measures should take into account the nature, scope, context and purposes of the processing as well as the risk it presents to the rights and freedoms of natural persons”.
30. It is also the responsibility of the data controller, pursuant to Article 25 of the GDPR, to integrate the necessary compliance with the rules of the GDPR upstream of his acts and procedures (for example, to provide for measures which protect the electronic address of employees in order to avoid computer hacking; consider methods that reinforce the security of payments or the communication of bank details; etc.).
31. Ultimately, the data controller is required, on the basis of Article 32 of the GDPR, to ensure the security of the processing, "taking into account the state of knowledge, the costs of implementation and the nature , the scope, context and purposes of the processing as well as the risks, the degree of likelihood and severity of which vary, for the rights and freedoms of natural persons”. In the absence of appropriate measures to secure the personal data of the persons concerned, the effectiveness of the fundamental rights to privacy and to the protection of personal data cannot be guaranteed, a fortiori in view of the crucial role played by information and communication technologies in our society.
32. Based on the factual elements present in the file, the Litigation Division finds that:
at. the controller organized the communication of bank details by sending an e-mail so that the complainant could finalize his purchase;
b. the complainant was the victim of an online scam, the email address of the employee of the controller having probably been usurped;
vs. the report of a sworn IT expert indicates that the server used by the controller was the subject of a "major breach [...] at the start of 2021", that this breach "would allow, among others, identity theft” although in order to be able to conclude with certainty of hacking, additional checks are required for which a judicial warrant is necessary;
d. the complaint filed by the data controller for fraud and hacking on the Internet suggests that the data controller implicitly acknowledges having been the victim of computer hacking;
e. the usurpation of the email address of the employee of the controller caused the complainant material damage which resulted in a financial loss of a value of (.. EUR).33. The Litigation Chamber notes a failure to respect the principles of security and responsibility on the part of the data controller. Indeed, the Litigation Chamber underlines the absence of sufficient technical and organizational measures envisaged by the controller to regulate the secure communication of bank details and thus guarantee secure payment. As a reminder, the data controller sells sports and luxury cars, which involves financial transactions of a relatively high value; that appropriate and effective measures should be implemented by the data controller to ensure the security of the processing. In addition, the data controller must also be able to demonstrate the compliance of the processing activities.
34. The Litigation Chamber also notes that no data leak notification was made by the defendants to the DPA, in violation of Article 33 of the GDPR.
35. In view of the aforementioned examination, the Litigation Chamber considers that the controller did not, prima facie, comply with Articles 5.1.f and 5.2 of the GDPR, as well as Articles 24 and 32 of the GDPR, which justifies in this case proceeding to take a decision on the basis of Article 95, § 1, 4° of the LCA.
The Litigation Chamber warns the defendant within the meaning of Article 58.2.a) of the GDPR,
that in the absence of compliance of its IT system with its obligation to ensure the security of processing, it would place itself at odds with its security obligation within the meaning of the GDPR.
36. This decision is a prima facie decision taken by the Litigation Chamber in accordance with article 95 of the LCA on the basis of the complaint lodged by the complainant, within the framework of the "procedure prior to the substantive decision", to be distinguished from a decision on the merits of the Litigation Chamber within the meaning of article 100 of the LCA.
37. The purpose of this decision is to inform the controller of the fact that he may have violated the provisions of the GDPR and to enable him to still comply with the aforementioned provisions.
38. If, however, the data controller does not agree with the content of this prima facie decision and considers that he can put forward factual and/or legal arguments which could lead to another decision, he ci can send the Litigation Chamber a request for processing on the merits of the case via the e-mail address litigationchamber@apd-gba.be, within 14 days of notification of this decision. If necessary, the execution of this decision is suspended for the above-mentioned period.
39. In the event of further processing of the case on the merits, by virtue of articles 98, 2° and 3° juncto article 99 of the LCA, the Litigation Chamber will invite the parties to introduce their conclusions and to attach to the file all the documents they deem useful. If necessary, this decision is definitively suspended.
With a view to transparency, the Litigation Chamber finally underlines that a treatment of the case on the merits can lead to the imposition of the measures mentioned in article 100 of the LCA6.
40. If one of the two parties wishes to make use of the possibility of consulting and copying the file
(art. 95, § 2, 3° of the LCA), it must contact the secretariat of the Litigation Chamber, preferably via the e-mail address litigationchamber@apd-gba.be, in order to set up an appointment. you. If a copy of the file is requested, the documents will be sent electronically or by ordinary mail if possible7.
III. Publication of the decision
41. Given the importance of transparency with regard to the decision-making process and the decisions of the Litigation Chamber, this decision will be published on the website of the Data Protection Authority8. However, it is not necessary for this purpose that the identification data of the parties be directly communicated.
FOR THESE REASONS,
The Litigation Chamber of the Data Protection Authority decides, subject to the introduction of a request by the controller for processing on the merits, in accordance with Articles 98 e.s. of the ACL:
- to order the data controller, pursuant to Article 58.2.c) of the GDPR and Article 95, § 1, 5° of the LCA, to comply with the complainant's request to exercise his rights , more specifically his right of access (art. 15.1 of the GDPR) and to provide the complainant with the information requested ("communicate all the data available to [the controller], specifying which data must have been the subject of the hacking “) also on the basis of article 95, § 1, 6° of the LCA, and this within the period of 14 days from the notification of this decision;
- to order the controller to inform the Data Protection Authority (Litigation Chamber) by e-mail of the outcome of this decision within the same period via the e-mail address litigationchamber@apd-gba.be; and
- to issue a warning to the data controller pursuant to Article 58.2.a) of the GDPR and Article 95, § 1, 4° of the LCA that he places himself at odds with of the GDPR in the event of non-compliance in the future of its IT system with its security obligation
- if the data controller does not comply in good time with what is requested of him above, to deal with the substance of the case ex officio, in accordance with Articles 98 e.s. of the ACL.
Under Article 108, § 1 of the LCA, this decision may be appealed to the Court of Markets within thirty days of its notification, with the Data Protection Authority. given as a defendant.
  (Sé). Hielke Hijmans
President of the Litigation Chamber
Retrieved from "https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_33/2022&oldid=24985"
Creative Commons Attribution-NonCommercial-ShareAlike
Powered by MediaWiki