APD/GBA (Belgium) - 40/2024
From GDPRhub
| APD/GBA - 40/2024 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 12(3) GDPR Article 12(4) GDPR Article 17(1) GDPR |
| Type: | Complaint |
| Outcome: | Other Outcome |
| Started: | 24.01.2024 |
| Decided: | 23.02.2024 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 40/2024 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Dutch |
| Original Source: | GBA (in NL) |
| Initial Contributor: | nzm |
The DPA ordered a controller who sent unsolicited letters to a data subject to erase their data after the latter had made an erasure request, to which the controller failed to respond.
English Summary
Facts
The data subject received unsolicited letters from the controller on a regular basis. On 27 July 2023, the data subject requested the controller that his data be deleted and to stop the communications. The data subject alleged that the influx of letters increased after these communications. The data subject lodged a complaint with the Belgian DPA (“APD”) asking them to force the controller to delete their data.
Holding
Article 17(1) GDPR establishes that under certain conditions, a data subject may obtain the erasure of personal data without undue delay. Article 12(3) GDPR specifies this period by indicating that the controller provides information on action taken under a request regarding the data subject’s rights, without undue delay and in any event within one month of receipt of the request. This period may be extended by two months if necessary. Article 12(4) GDPR adds that if the controller does not take action, it must inform the data subject without delay and at the latest within one month of receiving the request of the reasons for not taking action and on the possibility of lodging a complaint with the DPA.
In the present case, the APD found that the controller did not respond to the erasure request. Therefore, the DPA concluded that there was a breach of Articles 12(3), 12(4) and 17(1) GDPR and ordered the controller to proceed with the deletion of the data subject’s data.
Comment
As this was a prima facie decision, if the controller does not agree with the contents of the decision or believes that it has factual and/or legal arguments that could lead to a different decision, it may submit a request for a hearing to the APD within 30 days of the notification of the decision.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/6
Dispute Chamber
Decision 40/2024 of February 23, 2024
File number: DOS-2024-00171
Subject: complaint for failure to respond to a request for data erasure
The Disputes Chamber of the Data Protection Authority, composed of Mr
Hielke HIJMANS, sole chairman;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of
personal data and regarding the free movement of such data and to the revocation of
Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”;
Having regard to the law of 3 December 2017 establishing the Data Protection Authority,
hereinafter “WOG”;
In view of the internal rules of order, as approved by the House of Representatives
Representatives on December 20, 2018 and published in the Belgian Official Gazette on
January 15, 2019;
Considering the documents in the file;
Has made the following decision regarding:
Complainant: Mr and Mrs X, hereinafter “the complainant”
The defendant: Y, hereinafter “the defendant” Decision 40/2024 — 2/6
I. Facts and procedure
1. The subject of the complaint concerns the failure to respond to the complainant's request
to delete data so that it no longer receives written communication from the
defendant, being a non-profit organization.
2. On January 11, 2024, the complainant submits a complaint to the Data Protection Authority
against the defendant.
In the complaint, the complainant states that he receives unsolicited letters on a very regular basis
of the defendant. On July 27, 2023, the complainant wrote to the chairman
from the defendant asking him to delete his data in order to make these communications
fuses. The complainant states that the influx of letters continues after this communication
increased, which is also demonstrated by copies of communications from the
defendant on dates of August 11, 2023, September 4, 2023, October 18, 2023, 9
November 2023, December 4, 2023 and December 12, 2023. The complainant asks the GBA between
to force the defendant to erase his data.
3. On January 24, 2024, the complaint will be declared admissible by the First Line Service on
on the basis of articles 58 and 60 of the WOG and the complaint is filed on the basis of article 62, § 1
2
of the WOG transferred to the Disputes Chamber.
4. In accordance with Article 95, § 2, 3° of the WOG as well as Article 47 of the internal regulations
order of the GBA, the parties can request a copy of the file. If one
both parties wish to make use of the opportunity to consult and
copying the file, he or she must contact the secretariat of the
Disputes Chamber, preferably via litigationchamber@apd-gba.be.
II. Justification
5. Article 17.1 GDPR provides that the data subject of the controller without
can obtain the deletion of personal data relating to him without unreasonable delay. The
controller is obliged to process personal data without unreasonable
delay to erase when the personal data is no longer necessary for the
purposes for which they were collected or otherwise processed.
6. In accordance with Article 12.3 GDPR, the controller shall provide the
person concerned without delay and in any case within one month of receipt of the request
pursuant to Articles 15 to 22 GDPR information about the outcome of the request
1In accordance with Article 61 of the WOG, the Disputes Chamber hereby informs the parties that the complaint is admissible
declared.
2In accordance with Article 95, § 2 of the WOG, the Disputes Chamber hereby informs the parties that the file will be sent to
has been transferred to her as a result of this complaint. Decision 40/2024 — 3/6
is given. Depending on the complexity of the requests and the number of requests
that period may be extended by a further two months if necessary. The
the controller shall inform the data subject within one month of receipt of the
request of such extension.
7. The Disputes Chamber determines that the complainant is on the basis of the documents supporting the complaint
exercised the right to erasure of data on July 27, 2023. The Disputes Chamber can
However, it cannot be determined on the basis of the complaint that the complainant has received an answer. The inde
documents attached communication from the defendant on the date of August 11, 2023, 4
September 2023, October 18, 2023, November 9, 2023, December 4, 2023 and December 12
2023, however, the Disputes Chamber suspects that there has been an infringement against it
Articles 12.3 and 12.4 GDPR, as well as Article 17.1 GDPR. 4
8. Based on the above analysis, it could be concluded that the defendant
has committed an infringement of the provisions of the GDPR, which justifies this in this case
a decision will be taken on the basis of Article 95, § 1, 5° of the
WOG, in particular to order the defendant to comply with the exercise by
the complainant of his right to erasure (Article 17.1 GDPR) and this in particular in view
on the documents that the complainant has provided showing that the complainant is the defendant
has requested that his data be deleted.
9. This decision is a prima facie decision taken by the Disputes Chamber
in accordance with Article 95 of the WOG on the basis of the complaint submitted by the complainant,
3Article 12 GDPR
[…]
3. The controller shall provide the data subject without undue delay and in any case within one month of receipt
the request pursuant to Articles 15 to 22 information about the consequence that has been given to the request.Depending on
the complexity of the requests and the number of requests may extend this period by another two months if necessary
be extended. The controller shall notify the data subject within one month of receiving the request
notice of such extension. When the data subject submits his request electronically, the information is if
may be provided electronically, unless the data subject requests otherwise. 4. When the controller does not
responds to the data subject's request, he shall communicate the latter without delay and at the latest within one month of receipt
of the request why the request was unsuccessful and informs him of the possibility to file a complaint
to a supervisory authority and to appeal to the courts. […]
4
Article 17 GDPR
1. The data subject has the right to have his or her data erased without undue delay by the controller
concerning personal data and the controller is obliged to obtain personal data without
unreasonable delay where one of the following applies:
a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
(b) the data subject withdraws consent to which processing is carried out in accordance with Article 6(1)(a) or Article 9(2)(a)
is based on, and there is no other legal basis for, the processing;
c) the data subject objects to the processing in accordance with Article 21(1), and there are no mandatory
legitimate grounds for the processing, or the data subject objects to the processing in accordance with Article
21(2);
d) the personal data have been processed unlawfully;
(e)the personal data must be erased in order to comply with a requirement laid down in Union or Member State law
legal obligation incumbent on the controller;
f) the personal data have been collected in connection with an offer of information society services as referred to
in Article 8(1). Decision 40/2024 — 4/6
in the context of the “procedure prior to the decision on the merits” 5 and none
decision on the merits of the Disputes Chamber within the meaning of Article 100 of the WOG.
The Disputes Chamber has thus decided, on the basis of Article 58.2.c) GDPR and
Article 95, § 1, 5° of the WOG, to order the defendant to comply with the request
of the data subject to exercise his rights, in particular the right to
erasure (“right to be forgotten”) as provided for in Article 17 GDPR.
10. The purpose of this decision is to inform the defendant of the fact that this
has committed an infringement of the provisions of the GDPR and has the opportunity to do so
still agree to comply with the aforementioned provisions.
11. If the defendant does not agree with the content of the present primafacie
decision and is of the opinion that it can apply factual and/or legal arguments
that could lead to a different decision, this can be done via the e-mail address
litigationchamber@apd-gba.be send a request to hear the merits of the case
to the Disputes Chamber within 30 days after notification of this
decision. The implementation of this decision will, if necessary, continue for a period of time
suspended for the aforementioned period.
12. In the event of a continuation of the merits of the case, the
Dispute Chamber the parties on the basis of Articles 98, 2° and 3° in conjunction with Article 99 WOG
invite them to submit their defenses as well as any documents they consider useful in the case
file to add. If necessary, the present decision will be permanently suspended.
13. Finally, for the sake of completeness, the Disputes Chamber points out that a hearing on the merits
6
of the case may lead to the imposition of the measures stated in Article 100 of the WOG.
5Section 3, Subsection 2 of the WOG (Articles 94 to 97).
6Article 100. § 1. The Disputes Chamber has the authority to:
1° to dismiss a complaint;
2° to order the dismissal of prosecution;
3° order the suspension of the ruling;
4° to propose a settlement;
5° formulate warnings and reprimands;
6° order that the data subject's requests to exercise his rights be complied with;
7° to order that the person concerned is informed of the security problem;
8° order that processing be temporarily or permanently frozen, restricted or prohibited;
9° to order that the processing be brought into compliance;
10°the rectification, limitation or deletion of data and its notification to the recipients of the data
recommend data;
11° order the withdrawal of the recognition of certification bodies;
12° to impose penalty payments;
13° to impose administrative fines;
14° the suspension of cross-border data flows to another State or an international institution
command;
15° to transfer the file to the public prosecutor's office in Brussels, who will inform it of the
follow-up given to the file;
16° decide on a case-by-case basis to publish its decisions on the website of the
Data Protection Authority. Decision 40/2024 — 6/6
an objection petition must be submitted to the registry of the Market Court
in accordance with Article 1034quinquies of the Dutch Civil Code. .8 or via e-Deposit
IT system of Justice (Article 32ter of the Judicial Code).
(get). HielkeIJMANS
Chairman of the Disputes Chamber
8
The petition with its attachment will be sent by registered letter, in as many copies as there are parties involved.
deposited with the clerk of the court or at the registry.
