APD/GBA (Belgium) - 160/2022
From GDPRhub
| APD/GBA - 160/2022 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 12(3) GDPR Article 12(4) GDPR Article 15 GDPR Article 17 GDPR Article 17(1) GDPR Wet tot oprichting Gegevensbeschermingsautoriteit |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 21.09.2022 |
| Decided: | 08.11.2022 |
| Published: | 24.11.2022 |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 160/2022 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | Gegevensbeschermingsautoriteit (in NL) |
| Initial Contributor: | Enzo Marquet |
The Belgian DPA ordered a controller to fulfil a data subject request. The controller had not responded to an access request (Article 15 GDPR) and an erasure request (Article 17 GDPR), resulting in violations of Articles 12(3), 15(1) and 17(1) GDPR.
English Summary
Facts
The data subject was called multiple times by the controller, which used different phone numbers. These were national -, foreign - and anonymous numbers. The nature of the controller was not specified in the decision. The data subject asked the controller for a copy of his data (Article 15 GDPR) and asked the controller multiple times to remove his data (Article 17 GDPR). The data subject submitted the erasure requests by e-mail and using the controller’s website. However, the controller never replied.
Holding
The DPA held that the data subject properly submitted his access - and erasure requests (Articles 15 and 17 GDPR). The DPA reaffirmed that Article 12(3) GDPR and Article 15(4) GDPR oblige the controller to provide the data subject with the requested information and remove personal data within one month. This period can be extended with two additional months for complex requests. However, the controller has to notify and justify this extension to the data subject within the first month. If the controller is unable to follow up on the requests of the data subject, the controller still has to inform the data subject about their incapacity and inform the data subject about their right to file a complaint at the regulatory authority.
The DPA held that the controller breached Articles 12(3) GDPR, Article 15(1) GDPR and Article 17(1) GDPR by not responding to any request made by the data subject.
The DPA ordered the controller to fulfil the data subject requests within 30 days. This order was based on Article 95, § 1, 5° WOG (law establishing the Belgian DPA) and Article 58(2)(c) GDPR. This order was not a final decision in light of article 100 WOG but a decision in a procedure prior to the decision on the merits.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/6
Litigation room
Decision 160/2022 of 8 November 2022
File number : DOS-2022-04158
Subject: Complaint due to insufficient follow-up to the right of inspection
The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke Hijmans,
sole chairman;
Having regard to Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 on
the protection of natural persons with regard to the processing of personal data and
on the free movement of such data and repealing Directive 95/46/EC (general
Data Protection Regulation), hereinafter GDPR;
Having regard to the law of 3 December 2017 establishing the Data Protection Authority, hereinafter WOG;
Having regard to the rules of internal order, as approved by the Chamber of Representatives
on December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;
Having regard to the documents in the file;
has taken the following decision regarding:
.
The complainant: Mr X, hereinafter referred to as “the complainant”; .
.
The defendant: Y, hereinafter “the defendant”. Decision 160/2022 - 2/6
I. Factual Procedure
1. On 21 September 2022, the complainant submitted a complaint to the Data Protection Authority
against the defendant.
The complainant works in the IT sector and is regularly called by the
controller, either via different (foreign) telephone numbers, or
anonymously. The complainant indicates that he has already made several requests during these telephone conversations
to delete his data, but this was never done. The complainant was allowed
nor did we receive a response to the request for data erasure via the website or email
regarding his data erasure request which he has sent directly to the
data protection officer. On August 16, 2022, the complainant received another email
a request for access in accordance with Article 15 GDPR and a request for data erasure
in accordance with Article 17 GDPR addressed to the controller, to which he has no
received a reply.
2. On 12 October 2022, this complaint was declared admissible by the First Line Service on the basis of
Articles 58 and 60 WOG and the complaint pursuant to Article 62, §1 WOG is transferred to
the Disputes Chamber.
II. Motivation
3. On the basis of the complaint and the enclosed supporting documents, the Disputes Chamber determines that the
the complainant has properly exercised his right to erasure and right of access.
4. With regard to the right of access, the Disputes Chamber refers to Article 15 GDPR. In accordance
Article 15 GDPR, the data subject has the right to obtain a confirmation from the controller
about whether or not personal data concerning him is being processed and, when
that is the case, to obtain access to that personal data and to the following information:
a) the processing purposes;
b) the categories of personal data concerned;
c) the recipients or categories of recipients to whom the personal data are or will be
provided, in particular recipients in third countries or international organisations;
d) if possible, the period during which the personal data is expected to be retained
are stored, or if that is not possible, the criteria for determining that period;
e) that the data subject has the right to request from the controller that
personal data are rectified or erased, or that the processing concerns him
personal data is restricted, as well as the right to object to that processing; Decision 160/2022 - 3/6
f) that the data subject has the right to lodge a complaint with a supervisory authority;
g) where the personal data is not collected from the data subject, all available
information about the source of that data;
h) the existence of automated decision-making, including those referred to in Article 22(1) and
4, the profiling referred to, and, at least in those cases, useful information about the underlying
logic, as well as the importance and expected consequences of that processing for the data subject.
5. Based on Article 17.1 GDPR, the data subject has the right of the controller
to obtain the erasure of personal data concerning him without unreasonable delay.
6. Pursuant to Articles 12.3 and 12.4 GDPR, the controller shall inform the data subject within
at the latest one month after receipt of the request for access to the requested information
and to delete the personal data in question when requesting data erasure. In
in the case of complex requests, this period can be extended by a further two months if necessary
be extended. The controller shall inform the data subject within one month
receipt of the request of such extension. When the
controller does not comply with the request of the data subject, he shares it
the latter without delay and at the latest within one month of receipt of the request why it
request has not been acted upon, and informs him of the possibility of lodging a complaint
to a supervisory authority and appeal to the courts.
7. Based on the complaint and the documents submitted by the complainant, the Disputes Chamber will determine
that the complainant should not have received any reply from the controller
to his request for inspection, nor to his request for data erasure, which constitutes an infringement
to Article 12.3 GDPR, Article 15.1 GDPR and Article 17.1 GDPR.
8. The Disputes Chamber is of the opinion that on the basis of the above analysis it should be
concluded that the controller has committed a breach of the provisions of the
GDPR was committed, which justifies taking a
decision pursuant to Article 95, § 1, 5° WOG, in particular to order that the
request of the complainant to exercise his rights, in particular the right of access (article 15.1
AVG), and proceed to grant access to the relevant personal data and become
complied with the request of the data subject to exercise his rights, in particular the right
to data deletion (article 17.1 GDPR), and to delete the relevant data
personal data.
9. The present decision is a prima facie decision taken by the Litigation Chamber
in accordance with article 95 WOG on the basis of the complaint submitted by the complainant, in the context of Decision 160/2022 - 4/6
1
the “procedure prior to the decision on the merits” and no decision on the merits of the
Disputes Chamber within the meaning of Article 100 WOG.
10. The purpose of this decision is to inform the controller of the
fact that it may have committed a breach of the provisions of the GDPR and put it in the
possibility to still comply with the aforementioned provisions.
11. However, if the controller does not agree with the content of this
prima facie decision and considers that it may leave factual and/or legal arguments
funds that could lead to a different decision, this can be done via the e-mail address
litigationchamber@apd-gba.be to submit a request for consideration of the merits of the case to the
Litigation Chamber and this within the period of 30 days after notification of this decision. The
enforcement of this decision will, if necessary, take place during the aforementioned period
suspended.
12. In the event of a continuation of the handling of the case on the merits, the Disputes Chamber
the parties pursuant to Articles 98, 2° and 3° in conjunction with Article 99 WOG invite their
submit defenses as well as attach any documents they deem useful to the file. The
the present decision will, if necessary, be definitively suspended.
13. The Disputes Chamber points out for the sake of completeness so that a hearing on the merits of the case can take place
2
lead to the imposition of the measures referred to in Article 100 WOG.
14. Finally, the Disputes Chamber points out the following:
1Section 3, Subsection 2 WOG (Articles 94 through 97).
2Art. 100. § 1. The Litigation Chamber has the power to:
1° to dismiss a complaint;
2° to order the exclusion from prosecution;
3° order the suspension of the judgment;
4° propose a settlement;
5° formulate warnings and reprimands;
6° order that the data subject's requests to exercise his rights be complied with;
7° order that the data subject be informed of the security problem;
8° order that the processing be temporarily or permanently frozen, restricted or prohibited;
9° order that the processing be brought into compliance;
10° the rectification, restriction or deletion of data and the notification thereof to the recipients of the data
command;
11° order the withdrawal of the accreditation of certification bodies;
12° to impose penalty payments;
13° to impose administrative fines;
14° order the suspension of cross-border data flows to another State or an international institution;
15° transfer the file to the Public Prosecutor's Office of the Crown Prosecutor in Brussels, who informs it of the follow-up to
the file is given;
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority.
§2.If, after application of §1,15°, the Public Prosecutor's Office decides not to institute criminal proceedings, an amicable settlement
or to propose mediation in criminal matters referred to in Article 216ter of the Code of Criminal Procedure, or when it
Public Prosecution Service has not taken a decision within a period of six months from the day of receipt of
the file, the Data Protection Authority decides whether the administrative procedure must be resumed. Decision 160/2022 - 5/6
If one of the parties wishes to make use of the possibility to consult and
copying the file (art. 95, § 2, 3° WOG), he must turn to the secretariat
of the Disputes Chamber, preferably via litigationchamber@apd-gba.be, in order to make an appointment
to capture.
If a copy of the file is requested, the documents will be sent electronically if possible
or otherwise delivered by regular mail.
III. Publication of the decision
15. Given the importance of transparency with regard to decision-making by the
Litigation Chamber, this decision will be published on the website of the
Data Protection Authority. However, it is not necessary for this to include the identification data
of the parties are disclosed directly.
FOR THESE REASONS,
the Disputes Chamber of the Data Protection Authority decides, after deliberation, to:
1. pursuant to Article 58.2, c) GDPR and Article 95, §1, 5° WOG order the defendant that
the request of the data subject to exercise his rights is complied with, more
determines the right of inspection (article 15.1 AVG), and to grant access to
the relevant personal data, and this within a period of 30 days, counting from
notification of this decision
2. pursuant to Article 58.2, c) GDPR and Article 95, §1, 5° WOG order the defendant that
the request of the data subject to exercise his rights is complied with, more
Hielke Hijmansd has the right to erasure (article 17.1 GDPR), and to delete the
Chairman of the personal data, and this within a period of 30 days from the
notification of this decision;
3. order the defendant to the Data Protection Authority (Litigation Chamber) by e-mail
to be informed within the same period of the effect of this decision
given via the e-mail address litigationchamber@apd-gba.be; and
4. in the absence of the timely implementation of the above by the defendant, the case
to be dealt with on the merits ex officio in accordance with Articles 98 et seq. of the WOG. Decision 160/2022 - 6/6
Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the notification
this decision may be appealed to the Marktenhof (Brussels Court of Appeal), with the
Data Protection Authority as defendant.
Such an appeal may be lodged by means of an inter partes petition that the in art
3
1034terofthe Judicial Codemustcontainenumeratedenumerations.
contradictions must be submitted to the Registry of the Market Court in accordance with Article
1034quinquiesvanhetGer.W. , or via the Deposit Information System of Justice (article 32ter of
the Ger.W.).
(get). Hielke HIJMANS
Chairman of the Litigation Chamber
3 The petition states, under penalty of nullity:
1° the day, month and year;
2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
enterprise number;
3° the surname, first name, place of residence and, where appropriate, the capacity of the person to be summoned;
4° the object and brief summary of the means of the claim;
5° the court before which the action is brought;
6° the signature of the applicant or his lawyer.
4 The petition with its annex is sent by registered letter in as many copies as there are parties involved
the clerk of the court or deposited at the clerk's office.
