APD/GBA (Belgium) - 146/2022
From GDPRhub
| APD/GBA - 146/2022 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 5(1) GDPR Article 5(1)(c) GDPR Article 5(1)(e) GDPR |
| Type: | Complaint |
| Outcome: | Other Outcome |
| Started: | 29.06.2022 |
| Decided: | 13.10.2022 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 146/2022 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | French |
| Original Source: | Gegevensbeschermingsautoriteit (in FR) |
| Initial Contributor: | Enzo Marquet |
The DPA classifies a case without follow-up because the grievance is part of a broader dispute which can be more effectively solved through other legal remedies.
English Summary
Facts
The data subject had received a formal request to pay an outstanding electricity bill by controller 1 (a debtor) . Controller 1 subrogated the rights of controller 2 (electricity company) to recover the amounts due.
However, the data subject claims to have never lived at the address specified in the request and claims his identity was stolen. On top of that, he demands that both controllers remove his personal data from their systems. Additionally, the data subject stated that he had filed several complaints for these facts to different entities.
Holding
The DPA classifies the case without follow-up because the grievance is part of a broader dispute which can be more effectively solved through other legal remedies.
The DPA specifies that even if controller 2 was being subrogated, this does not relinquish them from correctly applying the GDPR. The DPA holds that the data subject must be informed of substantial changes, especially when the identity of the controller changes. This allows the data subject to exercise their rights appropriately.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/7
Litigation Chamber
Decision 146/2022 of October 13, 2022
File number: DOS-2022-02818
Subject: Complaint relating to the exercise of a right to erasure – main dispute of a nature
commercial - suspicion of identity theft - dismissal
The Litigation Chamber of the Data Protection Authority, made up of Mr Hielke
Hijmans, President, sitting alone;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and
to the free movement of such data, and repealing Directive 95/46/EC (general regulation on the
data protection), hereinafter GDPR;
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter
ACL);
Having regard to the Law of 30 July 2018 relating to the protection of natural persons with regard to
processing of personal data (hereinafter LTD);
Having regard to the Rules of Procedure as approved by the House of Representatives on 20
December 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Made the following decision regarding:
The plaintiff: Mr. X; Hereinafter “the complainant”;
The defendant: Y1, Hereinafter “the first defendant”;
Y2, Hereinafter “the second defendant”;
Hereinafter referred to together as “the defendants”. Decision 146-22/7
I. Facts and procedure
1. The complainant filed a complaint with the Data Protection Authority (DPA) on 29
June 2022 against the defendants.
2. Under the terms of his complaint, the complainant reports that he He was sent during 2022, a-
mail of formal notice to pay the sum of [….] euros for electricity bills
unpaid by the second defendant to whom the first defendant had assigned its
claim, the second defendant being therefore subrogated in the rights of the first
defendant to recover the amounts due. The plaintiff was notified of this transfer
of debt by the aforementioned e-mail.
3. Questioned by the plaintiff, the first defendant told the plaintiff that the
energy consumption bill covered the period from […..] to an address at [….] to
which the complainant indicated in response to the aforementioned email that he had never lived. There's
also requests the deletion of his e-mail address from the database of the
first defendant.
4. The complainant added that it had never been provided by the first defendant, was not
therefore not a client and therefore could not be liable for any sum for its benefit
nor to that of the second defendant subrogated in the rights of the first.
5. The complainant alleges identity theft and, according to the complaint form
filed, requests the deletion of his e-mail address from the database of both the
first than of the second defendants.
6. According to the complaint form submitted, the complainant also indicates that he has filed
Complaint to different authorities for the same facts:
- Complaint to the first defendant for the unauthorized use of one email
as of his name;
- Complaint to the second defendant;
- Complaint to the police for identity theft;
- Complaint to the FPS Economy against the second defendant regarding
amicable collection;
- Complaint to the CWAPE (Walloon Energy Commission), either to the
Walloon regulator for the electricity and gas market, contrary to the first
defendant. Decision 146/2-3/7
7. On July 4, 2022, the Front Line Service (SPL) of the APD declared the complaint of the
admissible complainant and forwarded it to the Litigation Chamber.
II. Motivation
8. Based on the facts described in the complaint file as summarized above, and on the
basis of the powers attributed to it by the legislator under Article 95.1.
LCA, the Litigation Chamber decides to proceed with the filing of the complaint without follow-up,
in accordance with article 95.1, 3° LCA, for the reasons set out below.
9. In terms of classification without further action, the Litigation Chamber must give reasons for its decision by
step and:
- to pronounce a classification without technical continuation if the file does not contain or not
sufficient elements likely to lead to a sanction or if it includes a
technical obstacle preventing him from rendering a decision;
- or pronounce a classification without further opportunity, if despite the presence
elements likely to lead to a sanction, the continuation of the examination of the
file does not seem to him to be appropriate given the priorities of ODA such as
specified and illustrated in the Chamber's Discontinued Classification Policy
Litigation. 2
10. In the event of dismissal on the basis of several reasons (respectively,
classification without technical and/or opportunity follow-up), the reasons for the classification without follow-up
should be addressed in order of importance. 3
11. In this case, the Litigation Chamber decides to proceed with a classification without follow-up
of the complaint for the reason of opportunity explained below (points 16 et seq.).
12. Beforehand, however, the Litigation Chamber wishes to specify that if the second
defendant certainly claims to be subrogated in the rights of the first defendant, it does not
remains, however, that the latter remains bound to apply all the provisions
1Cour des marchés (Brussels Court of Appeal), 2 September 2020, 2020/AR/329, p. 18.
2https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
litigation.pdf
3 Discontinued policy of the Litigation Chamber, 06/18/2021, point 3 (“In which cases is my complaint
likely to be dismissed by the Litigation Chamber?”), available on
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
litigation.pdf Decision 146/-4/7
relevant to the GDPR to the complainant's data that it processes, including therefore those
that it would consider it could legitimately keep.
13. Similarly, if the second defendant came into possession of data at
personal character of the plaintiff, even by the assignment of debt between the
defendants, it is, in its capacity as data controller in this case
(quality which it also claims in the terms of the letter sent to the current complainant
2022) also required to apply the relevant provisions of the GDPR.
14. More generally, the person concerned must be informed of a change of
data controller when, as in the present case, such a change occurs. The
Guidelines of the European Data Protection Board (EDPB) on the
transparency specify in this regard that the responsibility for transparency
applies not only at the time of collection of personal data,
but also throughout the life cycle of their treatment. The person concerned must be
informed of any substantial modification. The factors that those responsible for the
treatment should take into account when assessing what constitutes a
substantial change include the impact on the data subject
(including his ability to exercise his rights) and the unexpected or surprising nature of the
change. Changes to the privacy policy that should always be
communicated to the person concerned are, in particular, a modification of the purpose
processing; a change in the identity of the controller; or a
change in the way data subjects can exercise their rights
4
concerning processing (point 29) .
15. In the present case, it appears from the documents in the file that in the email by which the second
defendant informs the plaintiff (alleged debtor) of the assignment of debt that has taken place,
the second defendant adds that it now acts as the person responsible for
processing with regard to the data linked to this debt and refers the complainant to its policy
confidentiality.
16. With regard to the classification without further opportunity that it decides, the Litigation Chamber
is based on criterion B.3. of its Discontinued Classification Policy Note, the case of which
of species is an illustration.
4During the inaugural meeting of 25 May 2018, the European Data Protection Board (EDPS) took on its own account
theGuidelinesadoptedon29November2017byGroup29ontransparencywithinthemeaningoftheEURegulation
679/2016: https://edpb.europa.eu/our-work-tools/our-documents/guidelines/transparenThis is the Chamber
Litigation that stresses. Decision 146-5/72
17. Under this criterion, the Litigation Division states that complaints incidental to
a broader dispute that can be more effectively argued in other forums
more directly competent are likely to be dismissed. 5
18. In this regard, the Litigation Division notes that the issue of data protection
raised by the complainant in this case (i.e. the request to delete his e-mail address
databases of the defendants) is incidental to the contestation of the debt that he
would have (or not) initially contracted with respect to the first defendant, which
assigned its (alleged) claim to the second defendant. The complainant indicates in this sense
have filed a complaint both with these two companies and with the energy regulator
(CWaPE) and the FPS Economy. Likewise, this disputed debt would be the
consequence of identity theft for which the complainant mentions having seized
police services.
19. The Litigation Chamber therefore concludes that in this case, the complaint addressed to the DPA is
incidental to a commercial dispute between the parties. It is certainly not excluded
that the outcome of this dispute has consequences in terms of the protection of
data. However, the Litigation Chamber is neither able nor authorized to prejudge this.
It is therefore limited to recalling, with regard to the specific case, and without prejudice to its decision
to close the complaint without follow-up, that under the terms of the principle of minimization devoted to
Article 5.1c) of the GDPR, the data processed must be adequate, relevant and limited
to what is necessary in relation to the purposes for which they are processed. Likewise,
in application of the principle of limitation of storage set out in Article 5.1. e) from
GDPR, the data cannot be kept in a form allowing identification
data subjects only for a period not exceeding that necessary for the
with regard to the purposes for which they are processed.
20. In conclusion, as explained in point 11 above, the Litigation Chamber classifies
the complaint dismissed for reasons of opportunity.
III. Publication and communication of the decision
21. Given the importance of transparency with regard to the decision-making process and the
decisions of the Litigation Chamber, this decision will be published on the website of
ODA. However, it is not necessary for this purpose that the identification data of the
parties are directly mentioned.
5Idem footnote 4. The Litigation Chamber specifies in its note that if the complaint presents a societal interest
importantly, it can of course decide to deal with the complaint further. For all practical purposes, the Litigation Chamber does not
does not conclude that this is the case with the Complainant's complaint. Decision 146/20-26/7
22. As set out in its Discontinued Classification Policy, the Litigation Chamber
generally communicates its classification decisions without follow-up to the game
6
defendant. Indeed, the Litigation Chamber has decided to communicate to him its
classification decisions with no follow-up by default. The Litigation Chamber abstains
however, of such communication when the complainant has requested anonymity vis-à-vis
the defendant and when the communication of the decision to the latter, even
pseudonymised, may nevertheless allow its re-identification. In this case, the 7
complainant requested under the terms of the complaint form that his data be masked.
The Litigation Chamber therefore refrains in this case from communicating this
decision to the defendants.
FOR THESE REASONS,
the Litigation Chamber of the Data Protection Authority decides, after
deliberation:
- to close the present complaint without further action in application of article 95. 1.3° of the Law of3
December 2017 establishing the Data Protection Authority (hereinafter, the
ACL).
Under Article 108.1 LCA, this decision may be appealed to the Court of
contracts (Brussels Court of Appeal) within 30 days of its notification, with
DPA as respondent.
Such an appeal may be introduced by means of an interlocutory request which must contain the
8
information listed in article 1034ter of the Judicial Code (C. jud.) . The interlocutory motion
6
See Discontinued classification policy of the Litigation Chamber, 06/18/2021, title 5 ("The discontinued classification will be
he publishes? will the opposing party be informed?”), available at
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
litigation.pdf.
7 https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
contentieuse.pdf (title 5 Will the classification without follow-up be published? Will the opposing party be informed?)
8
The request contains on pain of nullity:
(1) indication of the day, month and year;
2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
Business Number;
3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
(4) the object and summary of the grounds of the application;
(5) the indication of the judge who is seized of the application;
6° the signature of the applicant or his lawyer. Decision 146/20-27/7
must be filed with the registry of the Market Court in accordance with article 1034quinquies of the C.
9
jud. , or via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).
(se). Hielke Hijmans
President of the Litigation Chamber
9The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.
