APD/GBA (Belgium) - 03/2024
From GDPRhub
| APD/GBA - 03/2024 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 12 GDPR Article 17 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 15.09.2023 |
| Decided: | 09.01.2024 |
| Published: | 09.01.2024 |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 03/2024 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | APD/GBA (in NL) |
| Initial Contributor: | Matthias Vandamme |
The DPA found a recruitment agency to have breached Article 12 GDPR and Article 17 GDPR for contacting the data subject even after a deletion was confirmed to the data subject.
English Summary
Facts
On 1 August 2023, the data subject received a phone call from the controller: a recruitment agency. On the same day, the complainant contacted the controller requesting to be deleted from their database and to not be contacted.
On 2 August 2023, the data subject received an email from an employee of the controller about new job opportunities, to which the data subject replied requesting to not be contacted again. On 4 September 2023, the data subject received another phone call from the controller and on 5 September 2023, the data subject received an email from the employee concerned confirming that their data had been erased.
After receiving another phone call from the controller on 15 September 2023, the data subject lodged a complaint with the Belgian DPA.
Holding
The Belgian DPA reiterated that in line with Article 17 GDPR and Article 12 GDPR, a controller is obliged to erase the personal data of a data subject upon request without delay. Furthermore, under Article 12(3) GDPR, the controller should inform the data subject as soon as possible, but at least within a month, about the action taken on his request.
The DPA established based on the facts of the case as provided by the data subject that he had exercised his deletion request several times but was still contacted afterwards. Moreover, even if the controller did respond after the data subject's second request confirming that the personal data had been deleted, the data subject still received messages from the controller.
Therefore, the DPA held that the controller infringed Article 12(3) GDPR, Article 12(4) GDPR and Article 17(1) GDPR and ordered the controller to deal with the data subject's request within 30 days after the decision.
Comment
As this is a 'prima facie' decision, not much information is available. The Litigation Chamber of the DPA has ruled solely based on the complaint without having a procedure. The controller could demand for a procedure within 30 days after the decision.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/6
Dispute Chamber
Decision 03/2024 of January 9, 2024
File number: DOS-2023-03819
Subject: Complaint due to no response to the request to exercise the right to
data erasure
The Disputes Chamber of the Data Protection Authority, composed of Mr
Hielke HIJMANS, sole chairman;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of
personal data and regarding the free movement of such data and to the revocation of
Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”;
Having regard to the law of 3 December 2017 establishing the Data Protection Authority,
hereinafter “WOG”;
In view of the internal rules of order, as approved by the House of Representatives
Representatives on December 20, 2018 and published in the Belgian Official Gazette on
January 15, 2019;
Considering the documents in the file;
Has made the following decision regarding:
Complainant: X, hereinafter “the complainant”;
The defendant: Y, hereinafter “the defendant”. Decision 03/2024 – 2/6
I. Facts and procedure
1. The subject of the complaint concerns the fact that the complainant continues to communicate by telephone and via
email is contacted by the defendant, being a recruitment agency, despite
repeated requests for data deletion from the complainant.
2. On August 1, 2023, the complainant received a call from the defendant. That same day, the
Complaintsent an email to the defendant's local office with the question no longer
be contacted and her details removed from the database “according to the
GDPR Guidelines”. On August 2, 2023, the complainant receives an email from an employee
from the defendant's local office regarding job opportunities. The complainant answers
tells the employee that she no longer wants to be contacted and asks her again
delete data. According to the complainant, neither email was answered by
the defendant.
3. On September 4, 2023, the complainant was called again by the defendant. The complainer
sends an email to the same employee of the defendant's local office with
again the question not to be contacted again. On 5 September 2023 the replied
employee concerned with the message that all data has been removed from the file. The
concerned employee also recommends the application form for exercising
rights via the website, which the complainant says he does.
4. On September 15, 2023, the complainant will be called again by the defendant.
5. On September 15, 2023, the complainant submits a complaint to the
Data Protection Authority against the defendant.
6. On September 18, 2023, the complaint will be declared admissible by the First Line Service on
on the basis of Articles 58 and 60 of the WOG and the complaint is filed on the basis of Article 62,
§ 1 of the WOG transferred to the Disputes Chamber. 2
7. In accordance with Article 95, § 2, 3° of the WOG as well as Article 47 of the internal regulations
order of the GBA, the parties can request a copy of the file. If one
both parties wish to make use of the opportunity to consult and
copying the file, he or she must contact the secretariat of the
Disputes Chamber, preferably via litigationchamber@apd-gba.be.
1In accordance with Article 61 of the WOG, the Disputes Chamber hereby informs the parties that the complaint is admissible
declared.
2In accordance with Article 95, § 2 of the WOG, the Disputes Chamber hereby informs the parties that the file will be sent to
has been transferred to her as a result of this complaint. Decision 03/2024 – 3/6
II. Justification
8. Article 17.1 GDPR provides that the data subject has the right from the controller
has, without unreasonable delay, erased the personal data concerning him
to acquire. The controller is obliged to process personal data without
unreasonable delay when the personal data is no longer necessary for
the purposes for which they were collected or otherwise processed.
9. In accordance with Article 12.3 GDPR, the controller provides the
person concerned without delay and in any case within one month of receipt of the request
pursuant to Articles 15 to 22 GDPR information about the outcome of the request
is given. Depending on the complexity of the requests and the number of requests
that period may be extended by a further two months if necessary. The
the controller shall inform the data subject within one month of receipt of the
request of such extension. If the defendant decides not to
to comply with the complainant's request, it must do so within one month after the
communicate receipt of the request to the data subject, in accordance with Article 12.4 GDPR
10. The Disputes Chamber states on the basis of the documents that support the complaint, consisting of a
screenshot of the calls received from the defendant's phone number and
from various emails between the complainant and the defendant, it is established that the complainant is entitled to
erasure of data has been carried out. The Disputes Chamber cannot determine on the basis of
the file that the complainant may have received any answer about the consequences caused by this
defendant is given the request for data erasure after the first request of
the complainant dd. August 1, 2023. The Disputes Chamber, on the other hand, notes that the
defendant, after the complainant's second request for data deletion dated. September 4
2023, on 5 September 2023, she confirmed that her data had been deleted.
However, the complainant points out that even after this confirmation she was still contacted by the
defendant. As a result, the defendant would potentially have acted in violation of Article
12.3 and 12.4 GDPR, as well as Article 17.1 GDPR.
11. The above suggests to the Disputes Chamber that it should be concluded that
the defendant may have committed an infringement of the provisions of the GDPR,
which justifies taking a decision in this case
pursuant to Article 95, § 1, 5° of the WOG, more specifically to order the defendant to take action
to indicate the complainant's exercise of his right to erasure of data and this in the
particularly in view of the documents that the complainant has provided showing that the complainant has the
the defendant has repeatedly requested that her data be deleted,
without appropriate action being taken by the defendant. Decision 03/2024 – 4/6
12. This decision is a prima facie decision taken by the Disputes Chamber
in accordance with Article 95 of the WOG on the basis of the complaint submitted by the complainant
the context of the “procedure prior to the decision on the merits” and not a decision
on the merits of the Disputes Chamber within the meaning of Article 100 of the WOG.
The Disputes Chamber has thus decided, on the basis of Article 58.2 c) GDPR and
Article 95, § 1, 5° of the WOG, to order the defendant to comply with the request
of the data subject to exercise his rights, in particular the right to
erasure (“right to be forgotten”) as provided for in Article 17 GDPR.
13. The purpose of this decision is to inform the defendant of the fact that
it has committed an infringement of the provisions of the GDPR and this is possible
to still comply with the aforementioned provisions.
14. However, if the defendant does not agree with the contents of this fine
facie decision and is of the opinion that it may allow factual and/or legal arguments
funds that could lead to a different decision can be made via the e-mail address
litigationchamber@apd-gba.beeenrequesttohandlethesubstancesofthecase
to the Disputes Chamber and this within the period of 30 days after notification of this
decision. The implementation of this decision will be carried out if necessary
suspended for the aforementioned period.
15. In the event of a continuation of the merits of the case, the
Dispute Chamber the parties on the basis of Articles 98, 2° and 3° in conjunction with Article 99 WOG
invite them to submit their defenses as well as any documents they deem useful
file to add. If necessary, the present decision will be permanently suspended.
16. Finally, for the sake of completeness, the Disputes Chamber points out that a substantive hearing
of the case may lead to the imposition of the measures stated in Article 100 of the WOG. 4
3Section 3, Subsection 2 of the WOG (Articles 94 to 97).
4
Article 100. § 1. The Disputes Chamber has the authority to:
1° to dismiss a complaint;
2° to order the dismissal of prosecution;
3° order the suspension of the ruling;
4° to propose a settlement;
5° formulate warnings and reprimands;
6° order that the data subject's requests to exercise his rights be complied with;
7° to order that the person concerned is informed of the security problem;
8° order that processing be temporarily or permanently frozen, restricted or prohibited;
9° to order that the processing be brought into compliance;
10°the rectification, limitation or deletion of data and its notification to the recipients of the data
recommend data;
11° order the withdrawal of the recognition of certification bodies;
12° to impose penalty payments;
13° to impose administrative fines;
14° the suspension of cross-border data flows to another State or an international institution
command;
15° to transfer the file to the public prosecutor's office in Brussels, who will inform it of the
follow-up given to the file; Decision 03/2024 – 5/6
III. Publication of the decision
17. Considering the importance of transparency with regard to decision-making
Dispute Chamber, this decision will be published on the website of the
Data Protection Authority. However, it is not necessary that the
identification details of the parties are disclosed directly.
FOR THESE REASONS ,
the Disputes Chamber of the Data Protection Authority decides, with reservations
from the submission of a request by the defendant for a hearing on the merits
in accordance with Article 98 et seq. of the WOG, to:
- on the basis of Article 58.2.c) of the GDPR and Article 95, § 1, 5° of the WOG the
order the defendant to comply with the data subject's request
to exercise his rights, in particular the right to erasure of data (Article 17.1
GDPR), and to delete the relevant personal data from the
complainant within 30 days of notification
this decision;
- order the defendant to contact the Data Protection Authority (Dispute Chamber)
by e-mail within the same period of the consequences
this decision will be given via the email address litigationchamber@apd-gba.be;
and
- in the absence of timely implementation of the above by the defendant,
to consider the merits of the case ex officio in accordance with Articles 98 et seq.
of the WOG.
Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the
notice, an appeal against this decision will be filed with the Market Court (court of
appeal Brussels), with the Data Protection Authority as defendant.
Such an appeal can be lodged by means of an inter partes petition
must contain statements listed in Article 1034ter of the Judicial Code. It
16° decide on a case-by-case basis to publish its decisions on the website of the
Data Protection Authority.
5The petition states, under penalty of nullity:
1° the day, month and year;
2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
company number;
3° the surname, first name, place of residence and, where applicable, the capacity of the person to be
summoned;
4° the subject matter and brief summary of the grounds of the claim;
5° the judge before whom the claim is brought; Decision 03/2024 – 6/6
an objection petition must be submitted to the registry of the Market Court
in accordance with Article 1034quinquies of the Dutch Civil Code. , 6 or via e-Deposit
IT system of Justice (Article 32ter of the Judicial Code).
(get). Hielke IJMANS
Chairman of the Disputes Chamber
6° the signature of the applicant or his lawyer.
6
The petition with its attachment will be sent by registered letter, in as many copies as there are parties involved.
deposited with the clerk of the court or at the registry.
