APD/GBA (Belgium) - 140/2022
From GDPRhub
| APD/GBA - Decision 140-2022 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 16 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 24.11.2020 |
| Decided: | 29.09.2022 |
| Published: | 02.10.2022 |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | Decision 140-2022 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Dutch |
| Original Source: | GBA (in NL) |
| Initial Contributor: | n/a |
The DPA held that, pursuant to Article 16 GDPR, a controller had to comply with a rectification request concerning incorrect contact information which prevented the data subject from receiving its daughter's progress reports.
English Summary
Facts
The data subject requested the rectification of certain contact-information about itself and its daughter (Article 16 GDPR). The daughter had problems which were not further specified. The controller had passed on information to another entity to follow up on these problems. A document (Motivatiedocument) was produced to pass on information from the controller to this other entity. However, the data subject claimed that certain contact-information in this document was incorrect, such as address-details and e-mail of the data subject and address details of both the daughter (living with the data subject) and the mother. The data subject stated that it hasn’t received letters or e-mails regarding its daughters progress because of the incorrect contact details.
The data subject stated that the controller didn’t reply to its requests in a sufficient manner. It made 5 requests: In person at 5 February 2020, in writing at 10 February 2020, 20 March 2020 and 6 April 2020 and by phone at 7 April 2020.
The controller stated that it had answered the request already verbally (5 February 2020). This was not the case according to the data subject because the contact information was still incorrect. At 7 April 2020, the data subject received a letter of the controller that the letter of the data subject (6 April 2020) had been well received and that the period of one month had to be extended with two months due to the complexity of the request.
The controller must provide the data subject without delay and, in any case, within at least within one month of receiving the request, information on the follow-up given to the request, or inform the data subject that the period of one month - given the complexity of the request - is extended by two months extended (Article 12(3) GDPR).
Holding
The DPA acknowledged that it had taken almost two years to make a decision, despite multiple requests of the data subject to receive more information about the circumstances of this case. The DPA stated that this was because of the large workload at the DPA.
The DPA held that the controller didn’t answer the data subject in a sufficient enough manner and more than two months after the data subject had made its first request. The DPA held that the controller violated Article 16 GDPR and held that the controller had to comply with the request of the data subject. The DPA didn’t sanction the controller in any other way.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/6
Dispute room
Decision 140/2022 of 29 September 2022
File number : DOS-2020-06006
Subject: Complaint for failing to comply with a request for rectification
The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke Hijmans,
single chairperson;
Having regard to Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 on
the protection of natural persons with regard to the processing of personal data and
on the free movement of such data and repealing Directive 95/46/EC (General
Data Protection Regulation), hereinafter GDPR;
Having regard to the law of 3 December 2017 establishing the Data Protection Authority, hereinafter WOG;
Having regard to the internal rules of procedure, as approved by the Chamber of Representatives
on December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;
Having regard to the documents in the file;
has taken the following decision regarding:
The complainant: Mr X, hereinafter: the complainant.
The defendant: Y, hereinafter referred to as “the controller”. Decision 140/2022 - 2/6
I. Facts procedure
1. On 24 November 2020, the complainant lodged a complaint with the Data Protection Authority against
the controller.
Due to a certain problem of the (then minor) daughter of the complainant, the
daughter followed up by the controller. The controller
however, has passed this data on to another body for further follow-up. In the
As part of this further follow-up, an electronic Motivation Document was drawn up. the complainant
has determined, however, that it contains incorrect personal data of his daughter and himself
recorded by the controller. More specifically, the following are
data incorrect: a residence address of the complainant, the surname of the complainant and his daughter, the
domicile details of the complainant, the e-mail address of the complainant, the domicile details of the
mother and the domicile details of the daughter who resides with her father. As a result of this
incorrect information, the complainant has sent certain emails and letters about the progress of his
daughter not received.
The complainant argues in his complaint that he submitted to the controller on 5 February 2020
in person and then on February 10, 2020 and April 6, 2020 in writing and on April 7, 2020
has telephoned the controller to provide this incorrect data
to fit. However, the complainant has not been allowed a sufficient substantive answer to these requests
receive.
2. On January 21, 2021, the complaint will be declared admissible by the Frontline Service on the basis of
Articles 58 and 60 of the WOG and the complaint pursuant to Article 62, §1 of the WOG will be forwarded to
the Disputes Chamber.
II. Justification
3. The Disputes Chamber is aware that it took almost two years to resolve this complaint
despite the complainant's repeated requests for more information on the status
of cases on file. This is the result of the large workload at the Disputes Chamber
as a result of which files have a (too) long processing time. In view of the above
the complainant's repeated requests to the Disputes Chamber show that the object of the
complaint has not yet been resolved in the meantime, as a result of which the Disputes Chamber proceeds to the
handling the complaint. Decision 140/2022 - 3/6
II.1. Correction of data
4. The Disputes Chamber is of the opinion that the requests of the complainant, both personally dated. February 5
2020, if in writing dated. February 10, 2020, March 10, 2020, April 6, 2020, if by phone on April 7
2020 constitute an exercise of his right to rectification, as referred to in Article 16 of the GDPR.
5. Pursuant to Article 12.3 GDPR, the controller must inform the data subject without undue delay and in
in any case within one month of receipt of the request, provide information regarding
the follow-up given to the request, or must inform the data subject that the
term of one month – given the complexity of the request – is extended by two months
extended.
6. The controller replied on March 10, 2020 that the complainant already
would have received answers to his questions during a personal meeting on February 5, 2020,
which, according to the complainant, is incorrect because the data is still incorrect. On April 7th
2020, the complainant received a letter from the controller informing them
that the letter from the complainant dated 6 April 2020 was well received and delivered to the concerned
employee within the controller.
7. It does not appear from the file that the controller adequately
responded to these requests on the date of the complaint, i.e. more than two months after
the complainant had sent his first request.
8. The Disputes Chamber is of the opinion that on the basis of the above analysis,
concluded that the controller has violated the provisions of the GDPR.
9. More specifically, the violation concerns the failure to respond to the requests of the
complainant to exercise his right to rectification (Article 16 of the GDPR) and this in particular
considering:
- the extracts of the electronic Motivation Document from which the incorrect personal data
to turn out; and
- the written requests dated. February 10, 2020, March 10, 2020 and April 6, 2020 until rectification
of the personal data of himself and his daughter.
10. This justifies that in the present case a decision must be taken to
in accordance with Article 95, § 1, 5°, of the WOG, compliance with the complainant's request to
order.
11. The present decision is a prima facie decision taken by the Disputes Chamber
in accordance with article 95 WOG on the basis of the complaint submitted by the complainant, in the context of
the “procedure prior to the decision on the merits and not a decision on the merits of the”
Dispute Chamber within the meaning of Article 100WOG. The Dispute Chamber has thus decided on the grounds
of Articles 58.2.c) and 95, §1, 5° of the Law of 3 December 2017, Decree 140/2022 - 4/6
order the controller to comply with the data subject's requests
to exercise its rights, in particular the right to rectification as defined in article 16 of the GDPR.
12. The purpose of this decision is to inform the defendant that it is a
has committed a breach of the provisions of the GDPR and to give them the opportunity to
to still conform with the aforementioned provisions.
13. However, if the defendant does not agree with the contents of this prima facie
decision and is of the opinion that it can assert factual and/or legal arguments that lead to
could lead to a different decision, this can be done via the e-mail address litigationchamber@apd-
gba.be submit a request for treatment on the merits of the case to the Disputes Chamber and this
within 30 days of notification of this decision.
14. In the event of a continuation of the handling of the case on the merits, the Disputes Chamber will
the parties on the basis of Articles 98, 2° and 3° in conjunction with Article 99 WOG invite their
to submit defenses and to attach to the file any documents they deem useful. The
If necessary, this decision will be definitively suspended.
15. For the sake of completeness, the Disputes Chamber points out that a hearing of the merits of the case can be
lead to the imposition of the measures referred to in Article 100 WOG. 1
16. Finally, the Disputes Chamber points out the following:
If one of the parties wishes to make use of the possibility to consult and
copyingthefile(article95,§2,3°WOG),shouldreturntothesecretariat
of the Disputes Chamber, preferably via litigationchamber@apd-gba.be, in order to make an appointment
If a copy of the file is requested, the documents will be
2
delivered electronically or otherwise by regular mail.
11° to dismiss a complaint;
2° order the suspension of prosecution;
3° order the suspension of the judgment;
4° propose a settlement;
5° to formulate warnings and reprimands;
6° order compliance with the data subject's requests to exercise his or her rights;
7° to order that the data subject is informed of the security problem;
8° order that the processing be temporarily or permanently frozen, restricted or prohibited;
9° to order that the processing is brought into conformity;
10° the rectification, restriction or deletion of data and notification thereof to the recipients of the data
to command;
11° order the withdrawal of the recognition of certification bodies;
12° to impose periodic penalty payments;
13° impose administrative fines;
14° order the suspension of cross-border data flows to another State or an international institution;
15° to transfer the file to the public prosecutor's office of the Public Prosecutor in Brussels, who will inform it of the consequence that
the file is given;
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority.
2Due to the extraordinary circumstances due to COVID-19, the possibility of collection at the secretariat of
the Disputes Chamber is NOT provided. Moreover, in principle all communication takes place electronically. Decision 140/2022 - 5/6
III. Publication of the decision
17. Given the importance of transparency in the decision-making of the
Litigation Chamber, this decision is published on the website of the
Data Protection Authority. However, it is not necessary that the identification data
of the parties be published directly.
FOR THESE REASONS,
the Disputes Chamber of the Data Protection Authority also decides, subject to the
submission of a request by the controller for processing on the merits
in accordance with Article 98 et seq. WOG, to:
- on the basis of Article 58.2.c) GDPR and Article 95, §1, 5° WOG to the controller
order that the complainant's request to exercise his rights is complied with, in particular the
right to rectification (Article 16 GDPR) within the period of 30 days from the date
notification of this decision;
- to order the controller to the Data Protection Authority (Dispute Chamber)
by e-mail within the same period of the result of this decision via the
e-mail address litigationchamber@apd-gba.be; and
- in the absence of timely implementation of the above by the controller, the
to handle the case on the merits ex officio in accordance with Articles 98 et seq. WOG.
The Disputes Chamber will send a copy of the present decision to the controller
To deliver.
Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the notification
appeal against this decision to the Marktenhof (Brussels Court of Appeal), with the
Data Protection Authority as Defendant.
Such an appeal may be lodged by means of an adversarial petition that the
3
1034terof the Judicial Code, the statements listed should contain .The application to
3The petition states, on pain of nullity:
1° the day, month and year;
2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
company number;
3° the surname, first name, place of residence and, where appropriate, the capacity of the person to be summoned;
4° the subject matter and the brief summary of the grounds of the claim; Decision 140/2022 - 6/6
contradiction must be submitted to the registry of the Market Court in accordance with Article
1034quinquiesof the Ger.W. , or via the Justice Deposit Information System (Article 32ter of
the Ger.W.).
(get). Hielke H IJMANS
Chairman of the Disputes Chamber
5° the court before whom the claim is brought;
6° the signature of the applicant or of his lawyer.
4The application with its annex is sent by registered letter, in as many copies as there are parties involved, to
the clerk of the court or at the registry.
