APD/GBA (Belgium) - 70/2024
From GDPRhub
| APD/GBA - 70/2024 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 12(3) GDPR Article 12(4) GDPR Article 15(1) GDPR Article 58(2)(c) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 11.03.2024 |
| Decided: | 06.05.2024 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 70/2024 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Dutch |
| Original Source: | APD/GBA (in NL) |
| Initial Contributor: | Violette Maris |
In a prima facie decision the DPA ordered the provider of a weekly magazine to comply with a data subject’s access request within one month.
English Summary
Facts
The data subject claims to have received a dispatch from the weekly "Z", while arguing that he had not previously subscribed to the weekly. Subsequently, the data subject exercised his right of access under Article 15(1)(g) GDPR by requesting information about the source of his data. On 3 March 2024 the data subject allegedly repeated his requested by email. The controller failed to respond within the 1 month statutory deadline set out by Article 12(3) GDPR.
Holding
The DPA issued a prima facie decision. The DPA held that the controller had to comply with the data subject's request to exercise his rights under Article 15(1) GDPR. Consequently, the controller had to provide the data subject with this information within a period of 30 days from the notification of the decision by the DPA.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/6
Dispute Chamber
Decision 70/2024 of May 6, 2024
File number: DOS-2024-01290
Subject: Exercise of the right in respect of which the defendant does not follow suit
would have given
The Disputes Chamber of the Data Protection Authority, composed of Mr
Hielke HIJMANS, sole chairman;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of
personal data and regarding the free movement of such data and to the revocation of
Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”;
Having regard to the law of 3 December 2017 establishing the Data Protection Authority,
hereinafter “WOG”;
In view of the internal rules of order, as approved by the House of Representatives
Representatives on December 20, 2018 and published in the Belgian Official Gazette on
January 15, 2019;
Considering the documents in the file;
Has made the following decision regarding:
Complainant: X, hereinafter “the complainant”
The defendant: Y, hereinafter “the defendant” Decision 70/2024 — 2/6
I. Facts and procedure
1. On March 11, 2024, the complainant submits a complaint to the Data Protection Authority
against the defendant.
2. The subject of the complaint concerns the exercise of the right of access by the complainant
without receiving any response from the defendant inside
the period of one month (Article 12.3GDPR). The request for access was received on February 7, 2024
addressed by the complainant to the defendant's email address […]. On March 3, 2024, the
complainant repeated his request by email. The complainant states that his requests were made at the time
of the complaint had gone completely unanswered.
3. On March 28, 2024, the complaint was declared admissible by the First Line Service on the grounds
1
of Articles 58 and 60 of the WOG and the complaint is filed on the basis of Article 62, § 1 of
the WOG transferred to the Disputes Chamber. 2
4. In accordance with Article 95, § 2, 3° of the WOG as well as Article 47 of the internal regulations
order of the GBA, the parties can request a copy of the file. If one
both parties wish to make use of the opportunity to consult and
copying the file, he or she must contact the secretariat of the
Disputes Chamber, preferably via litigationchamber@apd-gba.be.
II. Justification
5. The complainant says he received a shipment of the weekly magazine “Z” on February 7, 2024.
This shipment is said to be addressed to him personally, even though he claims not to have subscribed
are in the weekly magazine. The Disputes Chamber will determine on the basis of the documents that support the complaint
established that the complainant subsequently exercised his right of access on February 7, 2024.
More specifically, the complainant requested information about the source of his data. Corresponding
Article 15.1.g) GDPR, this information is part of the right of access
person involved. However, the defendant allegedly failed to respond to the request
the complainant within the statutory period of 1 month (Article 12.3 GDPR). As a result, the
1
In accordance with Article 61 of the WOG, the Disputes Chamber hereby informs the parties that the complaint is admissible.
declared.
2In accordance with Article 95, § 2 of the WOG, the Disputes Chamber hereby informs the parties that the file will be sent to
has been transferred to her as a result of this complaint. Decision 70/2024 — 3/6
3
defendant may have acted in violation of Articles 12.3 and 12.4 of the GDPR, as well as Article 15.1
4
GDPR .
6. The Disputes Chamber is of the opinion that based on the above analysis
concluded that the defendant may have violated the provisions of the GDPR
would have been committed, which justifies taking action in this case
a decision on the basis of Article 95, § 1, 5° of the WOG, more specifically the defendant
orders to comply with the complainant's exercise of his right of access
(Article 15.1 GDPR) and this in particular in view of the documents that the complainant has provided
which shows that the complainant has indeed exercised his right of access, but the
defendant would not have complied with this.
7. This decision is a prima facie decision taken by the Disputes Chamber
in accordance with Article 95 of the WOG on the basis of the complaint submitted by the complainant,
3Article 12 GDPR.
[…]
3. The controller shall provide the data subject without undue delay and in any case within one month of receipt
the request pursuant to Articles 15 to 22 information about the consequence that has been given to the request. Depending on
the complexity of the requests and the number of requests may extend this period by another two months if necessary
be extended. The controller shall notify the data subject within one month of receiving the request
notice of such extension. When the data subject submits his request electronically, the information is if
may be provided electronically, unless the data subject requests otherwise.
4. If the controller does not respond to the data subject's request, he will inform the latter
without delay and no later than one month after receipt of the request, explain why the request has been unsuccessful,
and informs him about the possibility to file a complaint with a supervisory authority, appeal to the court
configure.
4Article 15 GDPR
1. The data subject has the right to obtain confirmation from the controller as to whether or not this is the case
process personal data concerning him and, where that is the case, to obtain access to them
personal data and the following information:
a) the purposes of processing;
b) the categories of personal data concerned;
c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular
recipients in third countries or international organizations;
d) where possible, the period for which the personal data is expected to be stored, or if
that is not possible, the criteria for determining that period;
e) that the data subject has the right to request that personal data be deleted from the controller
rectified or deleted, or that the processing of personal data concerning him is restricted, as well as the right
to object to that processing;
f) that the data subject has the right to lodge a complaint with a supervisory authority;
g) where the personal data is not collected from the data subject, all available information about its source
facts;
(h) the existence of automated decision-making, including profiling referred to in Article 22(1) and (4), and,
at least in cases, useful information about the underlying logic, as well as the importance and expected consequences of it
that processing for the data subject.
[…] Decision 70/2024 – 4/6
in the context of the “procedure prior to the decision on the merits” 5 and none
decision on the merits of the Disputes Chamber within the meaning of Article 100 of the WOG.
The Disputes Chamber has thus decided, on the basis of Article 58.2.c) GDPR and
Article 95, § 1.5° of the WOG, to order the defendant to comply with the request
of the data subject to exercise his rights, in particular the right of access such as
determined in article 15.1 GDPR.
8. The purpose of this decision is to inform the defendant of the fact that
it may have committed an infringement of the provisions of the GDPR and this is in the
the opportunity to still comply with the aforementioned provisions.
9. If the defendant does not agree with the content of this prima facie case
decision and is of the opinion that it can put forward factual and/or legal arguments that
could lead to a new decision, it can request a reconsideration
submit to the Disputes Chamber in accordance with the procedure established in Articles 98 in conjunction
99 of the WOG, known as a “treatment on the merits”. This request must be
sent to the email address litigationchamber@apd-gba.be within a period of 30
days after notification of this primafacie decision. If applicable, implementation will take place
of this decision is suspended for the above-mentioned period.
10. In the event of a continuation of the merits of the case, the
Disputes Chamber the parties on the basis of Articles 98, 2° and 3° in conjunction with Article 99 of the
invite WOG to submit their defenses and any documents they consider useful
to be added to the file. If necessary, the present decision will become final
suspended.
11. Finally, for the sake of completeness, the Disputes Chamber points out that a hearing on the merits
of the case may lead to the imposition of the measures referred to in Article 100 of the
WOG . 6
5Section 3, Subsection 2 of the WOG (Articles 94 to 97).
6
Article 100. § 1. The Disputes Chamber has the authority to:
1° to dismiss a complaint;
2° to order the dismissal of prosecution;
3° order the suspension of the ruling;
4° to propose a settlement;
5° formulate warnings and reprimands;
6° order that the data subject's requests to exercise his rights be complied with;
7° to order that the person concerned is informed of the security problem;
8° order that processing be temporarily or permanently frozen, restricted or prohibited;
9° to order that the processing be brought into compliance;
10°the rectification, limitation or deletion of data and its notification to the recipients of the data
recommend data;
11° order the withdrawal of the recognition of certification bodies;
12° to impose penalty payments;
13° to impose administrative fines;
14° the suspension of cross-border data flows to another State or an international institution
command; Decision 70/2024 — 6/6
an appeal can be lodged by means of an inter partes petition that is referred to in Article
1034ter of the Judicial Code (Ger.W.) must contain the elements listed. It 7
an application for intervention must be submitted to the registry of the Market Court
8
in accordance with Article 1034quinquies of the Dutch Civil Code. ,or via the Deposit Information System
the Ministry of Justice (Article 32ter of the Judicial Code).
(get). Hielke H IJMANS
Chairman of the Disputes Chamber
7
The petition states, under penalty of nullity:
1° the day, month and year;
2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register
or company number;
3° the surname, first name, place of residence and, where applicable, the capacity of the person to be
summoned;
4° the subject matter and brief summary of the grounds of the claim;
5° the judge before whom the claim is brought;
6° the signature of the applicant or his lawyer.
8The application with its attachment will be sent by registered letter in as many copies as there are parties involved
deposited with the clerk of the court or at the registry.
