APD/GBA (Belgium) - 87/2023
From GDPRhub
| APD/GBA - 87/2023 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 12(3) GDPR Article 12(4) GDPR Article 13 GDPR Article 14 GDPR Article 17(1) GDPR Article 27(3) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 27.06.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 87/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | APD/GBA (in NL) |
| Initial Contributor: | n/a |
According to the Belgian DPA, a US-based controller whose activity includes the organisation of conferences in Europe is subject to the GDPR and must, among other obligations, appoint a representative.
English Summary
Facts
A Belgian data subject was receiving direct marketing emails from a controller based in the US whose activity was to organize conferences in different countries, including in Europe. On 23 February 2023, he requested from the controller to delete his data under Article 17(1) GDPR but the controller did not follow up. On 28 March 2023, the data subject filed a complaint with the Belgian DPA.
Holding
The DPA first assessed if the GDPR was applicable. Since the controller was based outside the EU, according to Article 3(2) GDPR, two cumulative conditions must be met for the GDPR to be applicable: the processing must concern a data subject that is in the Union and the processing activity relates to the offering of goods or services to these data subjects or the monitoring of their behavior as far as their behavior takes place in the EU.
In this case, the DPA considered that the processing activity in question was related to the offering of goods and services to a data subject in the EU. Indeed, some conferences organized by the controller happen in Europe and the controller has a GDPR policy. These elements imply, according to the DPA, that the controller had an intention to actively offer these services within the EU.
Regarding the erasure request, the DPA considered that by not responding to the erasure request, the controller breached Articles 12(3), 12(4) and 17(1) GDPR.
The DPA added that the controller should have appointed a representative in one of the Member States where it is active according to Article 27(3) GDPR and that the identity and contact details of such representative must be provided to the data subjects according to Articles 13 and 14 GDPR. The DPA therefore warned the controller.
Comment
This decision is prima facie. Its purpose is to notify the controller of its breaches and give it the opportunity to comply with the provisions.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/7
Litigation room
Decision 87/2023 of 27 June 2023
File number : DOS-2023-01459
Subject: Exercising the right to erasure without the defendant having done so
follows
The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke Hijmans,
sole chairman;
Having regard to Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 on
the protection of natural persons with regard to the processing of personal data and
on the free movement of such data and repealing Directive 95/46/EC (general
Data Protection Regulation), hereinafter GDPR;
Having regard to the law of 3 December 2017 establishing the Data Protection Authority, hereinafter WOG;
Having regard to the rules of internal order, as approved by the Chamber of Representatives
on December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;
Having regard to the documents in the file;
has taken the following decision regarding:
.
The complainant: Mr X, hereinafter referred to as “the complainant”; .
.
The Defendant: Y, hereinafter “the Defendant”. Decision 87/2023 - 2/7
I. Factual Procedure
1. On March 28, 2023, the complainant filed a complaint with the Data Protection Authority against the
defendant.
2. The complainant receives direct marketing emails from the defendant. On February 23, 2023, the
the complainant sends a request for data erasure to the defendant. However, the complainant receives
no reply to the request to view, but still direct marketing emails on 1,3,6,9,15,20,
22, and 28 March 2023. On 28 March 2023, the complainant repeated its request for data erasure. Also
the complainant receives no response to this request. Following this, the complainant submits a complaint to the
Data Protection Authority and hereby makes the two requests for data erasure and the
receive direct marketing emails about.
3. On April 6, 2023, the complaint will be declared admissible by the First Line Service on the basis of the
articles 58 and 60 WOG and the complaint is settled on the basis of art. 62, §1 WOG transferred to the
Litigation room.
II. Motivation
4. In order for the Disputes Chamber - to which the complainant appealed pursuant to Article 77 of the GDPR -
would be competent to deal with his complaint, it is first of all necessary that the
GDPR applies to the litigious facts or that other legislation related to
data protection that may form the basis of the competence of the Litigation Chamber
applies to.
5. With regard to the territorial scope of the GDPR, Article 3 of the GDPR is assumed
of two different cases. In the first case (Article 3.1 of the GDPR), the
data processing carried out in the context of the activities of an establishment of a
controller in the territory of the European Economic Area. This
The first hypothesis therefore presupposes the existence of an establishment on the territory of
European Economic Area. The complaint in the present case is directed against a legal entity
which is located in the United States and has no place of business in the territory of the
European Economic Area exists. Article 3.1 of the GDPR is therefore not applicable.
6. The second case provided for in Article 3.2 GDPR specifies that the GDPR applies to the
processing of personal data that meet the following three cumulative conditions:
- the processing has been carried out by a controller that is not established in the
European Economic Area;
- the processing concerns data subjects who are located on the territory of the European
Economic Area; and
- these processing activities are related to: Decision 87/2023 - 3/7
a) offering goods or services to these data subjects (article 3.2.a) GDPR) or
b) monitoring their behavior, insofar as this behavior in the European Economic Area
takes place (article 3.2.b) GDPR).
7. On the basis of the documents in the file, the Disputes Chamber is of the opinion that in this case
cumulative conditions are met. With regard to the first condition, the
Litigation Chamber established that the defendant is indeed not established in the European Economic Area
Room.With regard to the second condition, the Litigation Chamber notes that the complaint does not
it is clear whether the complainant was on the territory of the European Economic Area.
Assuming that the complainant was indeed on the territory of the European
Economic Area at the time of the indicted facts, this has also been complied with. Finally
is also satisfied with the third condition. After all, the processing activity in question is related
with "offering goods and services". After all, the defendant organizes conferences
in different parts of the world, including Europe (namely Amsterdam) and informs the data subject of this
and of its practical aspects, such as ticket sales and discount codes
direct marketing emails. The intention to also actively offer these services within the
European Economic Area is evidenced by the fact that the defendant has a "privacy policy" and a
published “GDPR policy”. Consequently, the contested processing fulfills the conditions
of Article 3.2 GDPR, which means that the GDPR applies.
8. Article 27.1 of the GDPR stipulates that controllers or processors acting on the basis of
Article 3.2 GDPR, fall under the GDPR, are obliged to appoint a representative in the Union.
The obligation contained in paragraph 1 of this article does not apply to: (i) incidental processing that does not
large-scale processing of special categories of personal data as referred to in Article
9(1) does not concern the processing of personal data related to criminal law
convictions and criminal offenses as referred to in Article 10, and where there is a small chance that they will be a
poses a risk to the rights and freedoms of natural persons, taking into account the
nature, context, scope and purposes of processing; or (ii). a government agency or
government body. These exemption criteria do not apply as the defendant
actively targets those affected in the European Economic Area territory for it
offering their services, and since the defendant is not a government agency or
government body.
9. The representative is established in one of the Member States where the data subjects are located whose
personal data are processed in connection with the provision of goods or services to them,
or whose behavior is being observed (Article 27.3 GDPR). The identity and contact details of the
representative must be provided to data subjects in accordance with Articles13 and
14 GDPR. However, the Litigation Chamber notes that the GDPR Policy as published on the website
of the defendant does not state the identity and contact details of the defendant. Decision 87/2023 - 4/7
10. In view of the above, the Disputes Chamber therefore considers it appropriate to dismiss the defendant
warn in accordance with article 58.1.a) AVG j ° article 95, § 1, 4 ° WOG, that they are considered not in the Union
established controller that is subject to the GDPR, but not
representative in the Union, or does not inform the data subjects about this, the
violates Articles 13.1.a), 14.1.a) and 27.1 GDPR.
11. The Disputes Chamber determines on the basis of the documents that substantiate the complaint that the complainant is entitled
exercised on data erasure in accordance with Article 17.1 GDPR on February 23, 2023. Pursuant to
Article 12.3 GDPR, the controller, in the case of the defendant, must respond to the request
to respond to data erasure within one month of receipt of the request. Possibly possible
this period may be extended by a further two months, given the complexity of the
request. The complainant must then inform about this within one month of the request for data erasure
extension will be notified. If the defendant decides not to comply with the
request of the complainant, it must communicate this within one month of receipt of the request
to the data subject, in accordance with Article 12.4 GDPR. It does not appear from the file that the complainant has any
received a reply regarding the action taken by the defendant to the
data erasure is performed. As a result, the controller has acted in
contravenes Articles 12.3 and 12.4 GDPR, as well as Article 17.1 GDPR.
12. The Disputes Chamber is of the opinion that on the basis of the above analysis it should be
concluded that a breach of the provisions of the GDPR was committed by the defendant,
which justifies that in this case a decision is taken on the basis
of Article 95, §1, 5° WOG, more specifically to order the defendant to comply with the
exercise by the complainant of his right to erasure (article 17.1 GDPR).
13. The present decision is a prima facie decision taken by the Litigation Chamber
in accordance with article 95 WOG on the basis of the complaint submitted by the complainant, in the context of
the 'procedure prior to the decision on the merits' and no decision on the merits of the
Disputes Chamber within the meaning of Article 100 WOG. The Disputes Chamber has thus decided on the basis
of Articles 58.2. c) and 95, §1, 5° of the Law of 3 December 2017, to order the defendant
that the data subject's requests to exercise his rights are met, more
determines the right to erasure (“right to be forgotten”) as stipulated in Article 17 GDPR.
14. The purpose of this decision is to inform the defendant that it is a
has committed an infringement of the provisions of the GDPR and to enable it
still to comply with the aforementioned provisions.
15. However, if the defendant does not agree with the contents of this prima facie
decision and is of the opinion that it can assert factual and/or legal arguments that lead to
1Section 3, Subsection 2 WOG (Articles 94 through 97). Decision 87/2023 - 5/7
could lead to a different decision, this can be done via the email address litigationchamber@apd-
gba.be submit a request for consideration of the merits of the case to the Disputes Chamber and this
within 30 days of notification of this decision. The implementation of
if necessary, this decision will be suspended during the aforementioned period.
16. In the event of a continuation of the handling of the case on the merits, the Disputes Chamber
the parties pursuant to Articles 98, 2° and 3° in conjunction with Article 99 WOG invite their
submit defenses as well as attach any documents they deem useful to the file. The
the present decision will, if necessary, be definitively suspended.
17. The Disputes Chamber points out for the sake of completeness so that a hearing on the merits of the case can take place
lead to the imposition of the measures referred to in Article 100 WOG. 2
18. Finally, the Disputes Chamber points out the following:
If one of the parties wishes to make use of the possibility to consult and
copying the file (Article 95, § 2, 3 ° WOG), it should turn to the secretariat
of the Disputes Chamber, preferably via litigationchamber@apd-gba.be, in order to make an appointment
If a copy of the file is requested, the documents will be provided if possible
delivered electronically or otherwise by regular mail. 3
III. Publication of the decision
19. Given the importance of transparency with regard to decision-making by the
Litigation Chamber, this decision will be published on the website of the
Data Protection Authority. However, it is not necessary for this to include the identification data
of the parties are disclosed directly.
2
1° to dismiss a complaint;
2° to order the exclusion of prosecution;
3° order the suspension of the judgment;
4° propose a settlement;
5° formulate warnings and reprimands;
6° order that the data subject's requests to exercise his rights be complied with;
7° order that the data subject be informed of the security problem;
8° order that the processing be temporarily or permanently frozen, restricted or prohibited;
9° order that the processing be brought into compliance;
10° the rectification, restriction or deletion of data and the notification thereof to the recipients of the data
command;
11° to order the withdrawal of the accreditation of certification bodies;
12° to impose penalty payments;
13° to impose administrative fines;
14° order the suspension of cross-border data flows to another State or an international institution;
15° transfer the file to the Public Prosecutor's Office of the Crown Prosecutor in Brussels, who informs it of the follow-up to the
file is given;
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority.
3
Due to the extraordinary circumstances due to COVID-19, the possibility of collection at the secretariat of the
Dispute room NOT provided. In addition, all communication takes place electronically in principle. Decision 87/2023 - 6/7
FOR THESE REASONS,
the Disputes Chamber of the Data Protection Authority decides, subject to the
submission of a request by the defendant for a hearing on the merits in accordance with Article
1
98 ff. WOG , at:
- pursuant to article 58.2.a) AVG and article 95, §1, 4° WOG to warn the defendant that
she as a controller not established in the Union that does fall under the GDPR, but
has not appointed a representative in the Union or the data subjects have not
informs , Articles 13.1.a), 14.1.a) and 27.1 GDPR violates GDPR.
- on the basis of article 58.2.c) AVG and article 95, §1, 5 ° WOG to order the defendant that
complied with the request of the data subject to exercise his rights, in particular the right
to data deletion (article 17.1 GDPR), and to delete the relevant data
personal data, and this within a period of 30 days from the notification of
this decision;
- order the defendant to inform the Data Protection Authority (Dispute Chamber) by e-mail
within the same timeframe of the outcome of this decision via the e-mail
email address litigationchamber@apd-gba.be; and
- in the absence of the timely implementation of the above stated by the defendant, the case
to be dealt with on the merits ex officio in accordance with Articles 98 et seq. of the WOG.
Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the notification
this decision may be appealed to the Marktenhof (Brussels Court of Appeal), with the
Data Protection Authority as defendant.
Such an appeal may be lodged by means of an inter partes petition that the in art
4
1034terofthe Judicial Codemustcontainenumeratedenumerations.
contradictions must be submitted to the Registry of the Market Court in accordance with Article
4 The petition states under penalty of nullity:
1° the day, month and year;
2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
enterprise number;
3° the surname, first name, place of residence and, where appropriate, the capacity of the person to be summoned;
4° the object and brief summary of the means of the claim;
5° the court before which the action is brought;
6° the signature of the applicant or his lawyer. Decision 87/2023 - 7/7
1034quinquiesvanhetGer.W. , or via the Deposit Information System of Justice (article 32ter of
the Ger.W.).
(get). Hilke Hijmans
Chairman of the Litigation Chamber
5 The petition with its annex, in as many copies as there are parties involved, is sent by registered letter to the
clerk of the court or deposited with the clerk of the court.
