APD/GBA (Belgium) - 172/2022
From GDPRhub
| APD/GBA - 172/2022 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 6 GDPR Article 6(1)(a) GDPR Article 6(1)(f) GDPR Article 12(1) GDPR Article 12(3) GDPR Article 12(4) GDPR Article 17(1) GDPR Article 19 GDPR Article 21(1) GDPR Article 58(2) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 06.09.2022 |
| Decided: | 24.11.2022 |
| Published: | 24.11.2022 |
| Fine: | n/a |
| Parties: | Mister X (the data subject) the estate agency (the controller) |
| National Case Number/Name: | 172/2022 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | French |
| Original Source: | Autorité de Protection des Données (ADP) (in FR) |
| Initial Contributor: | n/a |
The Belgian DPA warned a real estate agency for failing to respond to an erasure request and an objection request. The controller did not remove an advertisement for the property sold to the data subject after the purchase was already completed.
English Summary
Facts
On 27 July 2022, the data subject bought a house with a real estate agency (controller), acting as an intermediary between the data subject and the seller. However, pictures of the house, the postal address and other information were still available on the controller’s website in an advertisement. This advertisement included, amongst other information, the address of the property and identification numbers of the cadastral parcels. On 24 June, the data subject requested the erasure of this data and objected to the processing by the controller. The controller refused to comply with these requests for marketing purposes, specifically for the controller’s commercial activity as a real estate agency. The data subject also contacted the host of the controller’s website (processor) to delete the information, without apparent success.
On 6 July 2022, the data subject filed a complaint at the Belgian DPA because the controller refused to comply with the requests. The DPA found that the advertisement, including the displayed information and pictures, was still online on the website on 12 October 2022.
Holding
The DPA held that the controller failed to comply with Articles 12, 13, 17(1) and 21(1) GDPR, because the controller did not respond to the data subject's objection request and erasure request within one month. Moreover, the DPA held that the controller did not have a legal basis for the processing on the controller’s website. The DPA determined that the controller was not able to use the legal basis of contract (Article 6(1)(b) GDPR), because the data subject was not a party to the contract between the controller and the seller of the property. The publication of the advertisement could therefore not be based on Article 6(1)(b) GDPR, especially not after the sale of the property.
The DPA continued by stating that the controller did not meet any of the lawfulness requirements of Article 6 GDPR, but examined nevertheless if the controller could rely on legitimate interest (Article 6(1)(f) GDPR), for which three cumulative requirements had to be fulfilled. Regarding the first requirement, the purpose test, the DPA considered that the purpose of publishing advertisements for commercial purposes was a legitimate interest in order to display professional qualities and attract attention (see also recital 47). However, the DPA determined that the controller did not fulfil the second requirement, the necessity test. The DPA assessed whether it was necessary for the controller’s commercial purposes (such as promote its work, its seriousness and the past commercial experiences, etc.) to post the data subject’s postal address and pictures with identification data of the property. The DPA concluded that the posting of the information was not necessary to meet this commercial purpose, because the pictures with identification data could also have been posted without this identification data. The second requirement was therefore not fulfilled because the principle of data minimisation (Article 5(1)(c) GDPR) was not respected. Moreover, the DPA also determined that the controller did not fulfil the third requirement, the balancing test, and stated that the data subject could never expect the posting of pictures of his newly acquired house with identification data for commercial purposes. The controller also did not ask the data subject for his consent for the publication of this data on the controller’s website. Thus, the controller did not seem to comply with Article 6 GDPR. Therefore, the controller had to comply with the erasure – and objection requests of the data subject as soon as possible. The controller was also obliged under Article 19 GDPR to notify each recipient to whom the data subject’s personal data had been disclosed, in this case the processor, of any erasure of personal data carried out in accordance with Article 17(1) GDPR, unless such communication would prove impossible or would require disproportionate efforts. This was not the case according to the DPA in this decision.
The DPA concluded by stating that the controller failed to comply with Articles 12(3), 12(4), 17(1), 19 and 21(1) GDPR. The DPA ordered the controller to comply with the data subject’s request for erasure (Article 17(1) GDPR) and his right to object (Article 21(1) GDPR), pursuant to Article 95(1)(5) WOG and Article 58(2)(c) GDPR. In particular, the controller had to erase the postal address of the property, including on Google MAPS, and the identification numbers of the data subject's cadastral parcels on the controller's website. Moreover, the DPA ordered the controller to notify the data subject on the erasure of his personal data (Article 19 GDPR) and to no longer process this data.
The DPA also issued a decision pursuant to Article 95(1)(4) WOG and issued a warning to the controller pursuant to Article 58(2)(a) GDPR, because the controller seemed to have failed to comply with Article 6 GDPR, in order to ensure that the controller would respond to data subject’s requests in the future.
Comment
This is a prima facie decision, not a decision on the merits. Both parties still have the possibility to continue with the procedure if they wish so.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/13
Litigation Chamber
Decision 172/2022 of 24 November 2022
File number: DOS-2022-02927
Subject: Complaint relating to a refusal to respond to a request to exercise the right
erasure, the right to object and the right to restriction of processing by a
real estate agency.
The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke
Hijmans, chairman;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and
to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the
data protection), hereinafter “GDPR”;
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, hereinafter
“ACL”;
Having regard to the internal regulations as approved by the House of Representatives on 20
December 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Made the following decision regarding:
The plaintiff: Mr. X, hereinafter “the plaintiff”;
.
The defendant: Agency Y, hereinafter: “the defendant”. .
. Decision 172/2022 - 2/13
I. Facts and procedure
1. On July 6, 2022, the complainant filed a complaint with the Data Protection Authority
(hereinafter “the DPA”) against the defendant. The subject of the complaint concerns the agency's refusal
real estate (hereinafter “defendant”) to withdraw from its website the advertisement of a property
real estate that the plaintiff (purchaser) bought on June 27, 2022 from the former owner
(seller).
2. On June 24, 2022, the complainant exercises his right of erasure and opposition. It emerges from
documents in the file that: the plaintiff asked the defendant "by telephone and by e-mail from the
June 14 and June 16” to remove from the website (…) the information on his house located at “…”
(minimum sale price; detailed descriptions; images of its interior and exterior;
images with identification numbers of cadastral parcels; Google MAPS); the
defendant refuses to comply with the plaintiff's request to maintain "[the] publication, and
this for marketing purposes of [his] commercial activity as an agent”; the complainant asked
the creator of the website, company Z, “to act promptly to remove the information
[published on the defendant's website] or make access to them impossible”; the
plaintiff indicates that he will "not hesitate to take the appropriate actions in order to defend
[his] rights, including in particular [to file] a complaint with the Professional Institute of Agents
immovable property (IPI) in relation to the actions of Y [and] [...] of the Direction générale de
the Economic Inspection with regard to [the] commercial practices via its point of contact
contact ". In support of his argument, the plaintiff cites in particular judgment 71/2020 of the
Litigation Chamber. 1
3. On July 8, 2022, the Front Line Service (hereinafter “SPL”) of the APD requests
additional information to the complainant, particularly if "the publications
concerning [the]propertymention[...][its] nameandaddressoftheproperty”, and in the affirmative of
provide him with the evidence. On the same date, the complainant informed the SPL that
his name, unlike his postal address, is not mentioned on the publication
contentious and attaches a screenshot taken at 6:11 p.m. The complainant adds in his e-mail from
July 8, 2022 sent at 6:16 p.m. that his address is equivalent to personal data being
given that anyone with access to his address can make the link between his
real estate and his personal situation.
4. On September 6, 2022, the SPL declares the complaint admissible on the basis of Articles 58 and 60
of the LCA, and sends it to the Litigation Chamber in accordance with Article 62, § 1
of the ACL.
1Litigation Chamber,decisiononthemerits71/2020of30October2020,Thefulltextofthejudgmentisavailableat
the website of the Data Protection Authority, at the following address:
https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-71-2020.pdf. Decision 172/2022 - 3/13
II. Motivation
5. Pursuant to Article 4, § 1 of the LCA, the DPA is responsible for monitoring the principles
of data protection contained in the GDPR and other laws containing
provisions relating to the protection of the processing of personal data.
6. Pursuant to Article 33, §1 of the LCA, the Litigation Chamber is the body for
ODA administrative litigation. It receives complaints that the Service de Première
Ligne (SPL) transmits to it pursuant to Article 62, § 1 of the LCA, i.e. complaints
admissible. In accordance with Article 60 paragraph 2 of the LCA, complaints are admissible if
they are written in one of the national languages, contain a statement of the facts and the
indications necessary to identify the processing of personal data on
which they relate and which fall within the competence of the DPA.
7. Pursuant to articles 51 and s. of the GDPR and Article 4, § 1 of the LCA, it is up to the
Litigation Chamber as an administrative litigation body of the DPA, to exercise
effective control of the application of the GDPR and to protect the freedoms and rights
fundamental rights of natural persons with regard to processing and to facilitate the free flow
personal data within the Union.
8. On the basis of the facts described in the complaint file as summarized above, and on the basis
powers attributed to it by the legislator under Article 95, §1 of the
the LCA, the Litigation Chamber decides to proceed, on the one hand, to take a decision
in accordance with Article 95, § 1, 5° of the LCA, more specifically to order the person responsible
processing to comply with the complainant's request to exercise his right to erasure
(Art. 17.1 of the GDPR) and his right to object (Art. 21.1 of the GDPR), on the other hand, to a
er
warning in accordance with Article 95, § 1, 4° of the LCA; and for the reasons
set out below.
9. The Litigation Chamber notes that the complainant raises the refusal by the head of the
processing to follow up on the request to exercise the right to erasure (art.17.1.c of
GDPR) and opposition (Art. 21.1 GDPR).
10. Firstly, on the basis of the documents supporting the complaint, the Litigation Chamber finds
that the complainant exercised, on June 24, 2022, his right to erasure (art. 17.1.c of the
GDPR) and his right to object (Art. 21.1 of the GDPR) but that the controller
did not respond to the complainant's request.
11. The Litigation Chamber recalls that Article 4.7) of the GDPR defines the “responsible for the
2
processing” as being “the natural or legal person, public authority, service
2GDPR, recitals 74, 79 and 81; GDPR, art. 4. 7), 4.8), 24, 26, 28, 29. Decision 172/2022 - 4/13
oranotherbodywhich,aloneorjointlywithothers,determinesthepurposesand
means of treatment”. Article 4, 8) of the GDPR defines “processor” as “the
natural or legal person, public authority, agency or other body dealing
personal data on behalf of the controller”.
12. A “processing” of personal data means, according to the GDPR, “any
operation or any set of operations whether or not carried out using processes
automated and applied to personal data or sets of data
personnel, such as collecting, recording, organizing, structuring,
storage, adaptation or modification, extraction, consultation, use,
communication by transmission, broadcast or any other form of making available, the
reconciliation or interconnection, limitation, erasure or destruction”. 4
13. As the EDPB pointed out in Guidelines 07/2020 regarding the notions of
controller and processor, the controller may be
5
designated by a legislative or regulatory text. Otherwise, to identify it, it
should analyze the factual elements or circumstances of the case, in particular
determine its legal and organizational capacity, as well as its autonomy in the
definition of the purposes, i.e. the objectives pursued, and the means of processing.
14. The Litigation Chamber recalls that the controller must follow up on the
request made pursuant to Articles 15 to 22 of the GDPR by the complainant, in this case
a request for erasure provided for in Article 17 of the GDPR (exercise of the right to erasure)
and opposition provided for in Article 21 of the GDPR (exercise of the right of opposition), and this in the
6
compliance with the conditions set out in Article 12 of the GDPR.
15. The Litigation Chamber also emphasizes that it is the responsibility of the controller
to provide the complainant with information on the measures taken following a request
formulated in application of Articles 15 to 22 of the GDPR, as soon as possible
cause within one month of receipt of the request. Article 12.3 of the
GDPR provides that this period may, if necessary, be extended by two months, taking into account the
complexity and number of requests. In such a case, the controller
inform the complainant of this extension and the reasons for the postponement within one month from
from receipt of the request. 9
3
4GDPR, Art. 4.7), 4.8), 24, 26, 28, 29; GDPR, recitals 74, 79 and 81.
GDPR, art. 4, 2).
5EDPB, “Guidelines 07/2020 concerning the notions of controller and processor in the
GDPR”, adopted on July 7, 2021.
6 GDPR, Art. 12.
7GDPR, Art. 12.2 and 12.3.
8 GDPR, Art. 12.3.
9
GDPR, art. 12.3. Decision 172/2022 - 5/13
16. In the event that the data controller does not respond to the request made
by the complainant, he shall inform the latter without delay and at the latest within one month from
from receipt of the request, the reasons for its inaction and the possibility
to lodge a complaint with a supervisory authority and to lodge an appeal
10
jurisdictional.
17. In this case, the Litigation Division – based on the definition of “responsible for
treatment” included in Article 4.7) of the GDPR – declares the real estate agency as the
controller and company Z as the processor since the latter has,
it seems, created the website on behalf of and according to the instructions of the said agency
real estate .11
18. In addition, the Litigation Division notes that the controller did not give
following requests to exercise the right to erasure and opposition made by the
complainant, therefore the controller has not complied with the requirements of Articles 12,
17.1 and 21.1 GDPR.
19. Secondly, on the basis of the documents supporting the complaint, the Litigation Chamber finds
that :
- the complainant indicated to the SPL – in his email of July 8, 2022 sent at 6:16 p.m. – that
his name, unlike his postal address, is not mentioned on the publication
disputed and attached a screenshot taken at 6:11 p.m. to support his complaint;
- the ad in dispute is still published on the website of the real estate agency – in
date of September 12, 2022 at 10:05 a.m. (Belgian time) and October 12, 2022 at 11:30 a.m. (Belgian time)
Belgian) – at the following URL (…)
- the postal address of the property, namely "..." is mentioned in the published announcement
by the controller on its website.
Figure 1 - Screenshot from September 12, 2022 at 10:05 a.m. (Belgian time – following URL address (…)
[Screenshot]
Figure 2 - Screenshot from October 12, 2022 at 11:30 a.m. (Belgian time – following URL address (…
10 GDPR, art. 12.4.
11The data processor processes the personal data only on behalf of the data controller.
processing. The data processor is generally a third party outside the company. ;GDPR,art.4.7),4.8),24,26,28,
29; GDPR, recitals 74, 79 and 81; EDPB, “Guidelines 07/2020 concerning the notions of data controller
GDPR”, adopted on July 7, 2021. Decision 172/2022 - 6/13
[Screenshot]
20. Article 4(1) of the GDPR defines “personal data” as “any
information relating to an identified or identifiable natural person (hereinafter
referred to as the "data subject"); is deemed to be an "identifiable natural person"
a natural person who can be identified, directly or indirectly, in particular
by reference to an identifier, such as a name, an identification number, data of
location, an online identifier, or to one or more specific elements specific to its
physical, physiological, genetic, psychological, economic, cultural or
social”.
21. The Litigation Chamber emphasizes that the processing is "lawful only if, and to the extent
where at least one of the following conditions is met:
a) the data subject has consented to the processing of his or her personal data
for one or more specific purposes;
b) the processing is necessary for the performance of a contract to which the data subject is
party or the execution of pre-contractual measures taken at the latter's request;
c) processing is necessary for compliance with a legal obligation to which the controller
processing is submitted;
d) the processing is necessary to safeguard the vital interests of the data subject
or another natural person;
e) processing is necessary for the performance of a task carried out in the public interest or falling within the
the exercise of official authority vested in the controller;
f) processing is necessary for the purposes of the legitimate interests pursued by the controller
processing or by a third party, unless the interests or freedoms and rights
fundamentals of the data subject which require data protection to be
13
personal nature, in particular when the person concerned is a child. [...] » .
22. In this case, the Litigation Chamber recalls that the publication of an image – in concreto
images of a house published with the postal address of the person concerned and a
image with identification numbers of cadastral parcels – is a processing of
personal data within the meaning of Article 4.1) of the GDPR. 14
12 GDPR, Art. 4, 1). ; Opinion 4/2007 of the “article 29” working group on data protection on the concept of personal data
personal character, adopted on 20 June 2007, available at https://cnpd.public.lu/dam-assets/fr/publications/groupe-
art29/wp136_en.pdf. ; See the judgments Nowak (CJEU, 20 December 2017, C-434/16, ECLI:EU:C:2017:994) and Breyer (CUJE, 19
October 2016, C-582/14, ECLI: EU: C:2016:779).
13 GDPR, Art. 6.1.
14
Opinion 4/2007 of the “article 29” working group on data protection on the concept of personal data
personnel, adopted on 20 June 2007, available at https://cnpd.public.lu/dam-assets/fr/publications/groupe-
art29/wp136_en.pdf. ; See the judgments Nowak (CJEU, 20 December 2017, C-434/16, ECLI:EU:C:2017:994) and Breyer (CUJE, 19
October 2016, C-582/14, ECLI: EU: C:2016:779). ; Data Protection Authority, Litigation Chamber, October 30 Decision 172/2022 - 7/13
23. The Litigation Chamber understands that processing such as the publication of images of a
building is necessary for the performance of a contract between a real estate agency and a
owner of real estate. A real estate agency can establish the legality of this
processing on the basis of Article 6.1, b) of the GDPR: the processing is necessary for
the fulfillment of the mission of intermediary with which it is invested, namely to rent or
sell the property of an owner to a third party. A real estate agency could not
achieve the purpose of the contract without the specific data processing being implemented
work (for example, the publication of photos of a property on the website).
However, the Litigation Chamber understands that the complainant is the new owner
of the real estate (purchaser) and that he is not a party to the contract which binds the real estate agency
and the previous owner (seller). Therefore, the publication of the announcement on the site
Internet of the controller cannot, in principle, be based on the contract ((article
6.1, b) of the GDPR), even less after the sale of June 27, 2022.
24. The Contentious Chamber considers that the controller does not respond to any of the
conditions of lawfulness provided for in Article 6 of the GDPR. The Chamber nevertheless examines whether the
data processing could be based on the legal basis of “legitimate interest”
provided for in Article 6.1, f) of the GDPR. Indeed, to prove the lawfulness of the publication of
the announcement on the website with the postal address of the complainant and the numbers
identification of cadastral parcels, the controller could – in
lack of complainant or contract consent – rely on “legitimate interest”
provided for in Article 6.1, f) of the GDPR.
25. In accordance with Article 6.1, f) of the GDPR and the case law of the Court of Justice of the Union
European Union (hereinafter “the Court”), three cumulative conditions must be met in order to
that a data controller can validly invoke this basis of lawfulness, "to
namely, firstly, the pursuit of a legitimate interest by the controller or
by or third parties to whom the data is communicated, secondly, the need for the
processing of personal data for the fulfillment of the legitimate interest
pursued and, thirdly, the condition that the fundamental rights and freedoms of the
16
person concerned by data protection do not prevail”
2020, decision on the merits 71/2020 (§56), available at
https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-71-2020.pdf.
15CJEU, 4 May 2017, C-13/16, Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde v Rīgas pašvaldības
SIA „Rīgas satiksme”, recital 28. See also CJEU, 11 December 2019, C-708/18, TK v Asociaţia de Proprietari
blockM5AScaraA,considering40. ;Data Protection Authority,Litigation Chamber,October 30,2020,decision
on the merits 71/2020 (§68), available at https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-
fund-n-71-2020.pdf.
16
CJEU, 4 May 2017, C-13/16, Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde v Rīgas pašvaldības
SIA „Rīgas satiksme”, recital 28. See also CJEU, 11 December 2019, C-708/18, TK v Asociaţia de Proprietari
blockM5AScaraA,considering40. ;Data Protection Authority,Litigation Chamber,October 30,2020,decision
on the merits 71/2020 (§68), available at https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-
fund-n-71-2020.pdf. Decision 172/2022 - 8/13
26. In other words, in order to be able to invoke the basis of lawfulness of “legitimate interest”
in accordance with Article 6.1, f) of the GDPR, the controller must demonstrate that:
1) the interests it pursues with the processing can be recognized as legitimate (the “
finality test”);
2) the envisaged processing is necessary to achieve those interests (the “necessity test”);
and
3) the weighing of these interests against the fundamental interests, freedoms and rights
data subjects weighs in favor of the data controller (the “test of
weighting”).
27. With regard to the first condition (the "finality test"), the Litigation Chamber
considers that the purpose of publishing announcements of immovable property sold by
a real estate agency for commercial purposes to display the professional qualities
and also attract the attention of potential buyers or future sellers by allowing them
to get a more precise idea of the type of goods that have already been marketed must be
considered to be made for a legitimate interest. In accordance with
recital 47 of the GDPR, the interest that the defendant pursued as responsible for the
processing can in itself be considered legitimate. The first condition repeated in
Article 6, §1, f) of the GDPR is therefore fulfilled.
28. With respect to the second condition (the “necessity test”), the head of the
processing must demonstrate that the processing is necessary for the achievement of the purposes
pursued. This means more precisely that one must ask oneself if the same result
not be achieved by other means, without processing personal data or
without unnecessary substantial processing for data subjects.
29. Based on the purpose, namely the publication on the website of images of the goods sold
with detailed descriptions, and this for commercial purposes to promote the work, the
seriously, the qualities of enhancement of the buildings, or even the experiences
the agency's past commercial activities, it is therefore necessary to check whether the publication of images
showing the house with indication of the postal address of the person concerned and/or the
cadastral parcel identification numbers may or may not contribute to the promotion of
the real estate agency.
30. The Litigation Chamber understands that the publication of images of goods sold by
a real estate agency is a practice that may be deemed necessary to display the
professional qualities and also attract the attention of potential or future buyers
sellers allowing them to get a more precise idea of the type of goods that have already
17Data Protection Authority, Litigation Chamber, 30 October 2020, substantive decision 71/2020 (§69),
available at https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-71-2020.pdf.
18 Data Protection Authority, Litigation Chamber, October 30, 2020, substantive decision 71/2020 (§70 to 72),
available at https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-71-2020.pdf. Decision 172/2022 - 9/13
been marketed. However, the Litigation Division considers that this purpose may
also be achieved without publication of the images with the identification data of the
complainant. The second condition is therefore not satisfied because the principle of
data minimization (Article 5.1, c) of the GDPR) has not been complied with.
31. With regard to the third condition (the “weighting test”), one must first take
account of the reasonable expectations of the person concerned, in accordance with recital
47 GDPR. In particular, it must be assessed whether "the data subject can
reasonably expect, at the time and in the context of data collection, to
personal character, that they are processed for a given purpose”.
32. The Litigation Chamber finds that the plaintiff could not at any time have expected
that images of his new home be published with his mailing address and/or
cadastral parcel identification numbers for commercial purposes. Moreover, the
er
controller does not appear to have requested, under Article 6, §1, a) of the
GDPR, the consent of the complainant to publish the images of the goods sold with his
postal address and/or the identification numbers of the cadastral parcels The third
condition is therefore not met.
33. The Litigation Chamber concludes that all of the elements set out above demonstrate
that the controller cannot invoke article 6.1, f) of the GDPR to qualify
the publication of the announcement with the postal address of the complainant and/or the numbers
identification of legal cadastral parcels. Therefore, the controller
seems not to comply with the requirements of article 6 of the GDPR. Thus, the manager of
treatment must respond favorably to the request to exercise the right to
the erasure and opposition of the complainant: he has the obligation to erase, as soon as possible,
the complainant's personal data (Art. 17.1 GDPR) and must no longer process them
(Art. 21.1 GDPR).
34. In addition, the data controller is required, under Article 19 of the GDPR, to
the notification obligation with regard to the erasure of personal data
complainant's staff: he must notify each recipient to whom the personal data
complainant's staff were communicated, in this case the director and the host of the
website of the real estate agency, any erasure of personal data
made in accordance with Article 17.1 of the GDPR, unless such communication is
proves impossible or requires disproportionate effort. The Litigation Chamber is
of the opinion that such communication does not prove impossible since, in this case, it suffices to
19 GDPR, Recital 47. ;CJEU,11 December 2019,C-708/18,TKc/AsociaţiadeProprietariblocM5A-ScaraA,considering
58.; Data Protection Authority, Litigation Chamber, October 30, 2020, substantive decision 71/2020 (§73 to
75), available at https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-71-2020.pdf.
20 GDPR, art. 19. Decision 172/2022 - 10/13
communicate with, at most, two recipients, namely the director/creator of the site
Internet and/or the host.
35. In conclusion, in view of the aforementioned examination, the Litigation Chamber considers that
the data controller has not, prima facie, complied with Articles 12.3 and 12.4 of the GDPR,
as well as Articles 17.1, 19 and 21.1 of the GDPR, which in this case justifies proceeding with the
making a decision on the basis of Article 95, § 1, 5° of the LCA, more specifically
to order the controller to comply with the complainant's request
to exercise their right to erasure (art. 17.1 of the GDPR) and their right to object (art. 21.1 of the
GDPR); to erase the personal data in question (namely
the postal address of the property, including Google MAPS, and the numbers
identification of the cadastral plots of the person concerned on the website of
the real estate agency) ; to comply, under article 19 of the GDPR, with its obligation to
notification regarding the erasure of personal data of the complainant
; and to no longer process this data.
36. The Litigation Chamber also concludes that the controller did not,
prima facie, complied with Article 6 of the GDPR, which in this case justifies taking
a decision on the basis of Article 95, § 1, 4° of the LCA, more specifically to address the
responsible for processing a warning within the meaning of Article 58.2.a) of the GDPR so that
the latter ensures, in the future, to respond to requests for the exercise of human rights
concerned and delete, in the absence of the consent of the person concerned, the address
postal address (including Google MAPS), and other identifying data such as
identification numbers of the cadastral plots of future real estate that would be
sold and published on the website.
37. This decision is a prima facie decision taken by the Litigation Chamber
pursuant to Article 95 of the LCA on the basis of the complaint submitted by the complainant,
21
within the framework of the “procedure prior to the substantive decision” and not a decision on the
merits of the Litigation Chamber within the meaning of Article 100 of the LCA.
38. The purpose of this decision is to inform the defendant, allegedly responsible for the
processing, because it may have violated the provisions of the GDPR,
in order to enable it to still comply with the aforementioned provisions.
If, however, the controller does not agree with the content of this
prima facie decision and believes that he can make factual and/or legal arguments
which could lead to another decision, the latter may address to the House
Litigation a request for processing on the merits of the case via the e-mail address
litigationchamber@apd-gba.be, within 30 days of notification of the
21Section 3, Subsection 2 of the LCA (arts. 94 to 97 inclusive). Decision 172/2022 - 11/13
this decision. If necessary, the execution of this decision will be suspended.
during the aforementioned period.
39. In the event of further processing of the case on the merits, pursuant to Articles 98, 2° and 3°
juncto article 99 of the LCA, the Litigation Chamber will invite the parties to introduce their
conclusions and attach to the file all the documents they deem useful. If applicable, the
this decision is permanently suspended.
40. In the interests of transparency, the Litigation Chamber finally emphasizes that a
dealing with the case on the merits may lead to the imposition of the measures mentioned in
22
section 100 of the ACL.
III. Publication of the decision
41. Given the importance of transparency regarding the decision-making process of the Chamber
Litigation, this decision is published on the website of the Protection Authority
Datas. However, it is not necessary for this purpose that the identification data
of the parties are communicated directly.
22 st
Art. 100. § 1. The litigation chamber has the power to
1° dismiss the complaint without follow-up;
2° order the dismissal;
3° pronouncing the suspension of the pronouncement;
4° to propose a transaction;
5° issue warnings and reprimands;
6° order to comply with requests from the data subject to exercise his or her rights;
7° order that the person concerned be informed of the security problem;
8° order the freezing, limitation or temporary or permanent prohibition of processing;
9° order compliance of the processing;
10° order the rectification, restriction or erasure of the data and the notification thereof to the recipients
Datas ;
11° order the withdrawal of the approval of the certification bodies;
12° to issue periodic penalty payments;
13° to issue administrative fines;
14° order the suspension of cross-border data flows to another State or an international body;
15° forward the file to the public prosecutor's office in Brussels, who informs it of the follow-up given to the file;
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. Decision 172/2022 - 12/13
FOR THESE REASONS,
the Litigation Chamber of the Data Protection Authority decides, under
subject to the introduction of a request by the controller of a
treatment on the merits in accordance with articles 98 e.s. of the ACL:
- under article 58.2.c) of the GDPR and article 95, §1, 5° of the ACL,
to order the controller to comply with the request
of the data subject to exercise their rights, more specifically to
comply with the complainant's request to exercise his right to erasure
(Art. 17.1 GDPR) and his right to object (Art. 21.1 GDPR); of
delete the personal data in question
(i.e. the postal address of the property, including Google MAPS,
and the identification numbers of the cadastral plots of the person
concerned on the website of the real estate agency); to comply with
its obligation to notify with regard to the erasure of data
personal nature of the complainant; to no longer process this data; And this
within 30 days of notification of this decision;
- pursuant to Article 58.2.a) of the GDPR and Article 95, §1, 4° of the LCA,
issue a warning against the controller
so that the latter ensures, in the future, to respond to requests for exercise
of the rights of the person concerned and delete, in the absence of
consent of the person concerned, the postal address (including
GoogleMAPS), and other identification data such as phone numbers
identification of the cadastral plots of future real estate which
would be sold and published on the website;
- to order the controller to inform the Authority by email
of data protection (Litigation Chamber) of the suite which is
given to this decision, within the same period, via the e-mail address
litigationchamber@apd-gba.be; and
- if the controller does not comply in due time with what
it is asked above, to deal ex officio with the case on the merits,
in accordance with articles 98 e.s. of the ACL. Decision 172/2022 - 13/13
In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged,
within thirty days of its notification, to the Court of Markets (court
d'appel de Bruxelles), with the Data Protection Authority as defendant.
Such an appeal may be introduced by means of an interlocutory request which must contain the
23
information listed in article 1034ter of the Judicial Code. The interlocutory motion must be
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 24
via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).
(se).Hielke H IJMANS
President of the Litigation Chamber
23
The request contains on pain of nullity:
1° indication of the day, month and year;
2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
Business Number ;
3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
4° the object and the brief statement of the means of the request;
5° the indication of the judge who is seized of the application;
6° the signature of the applicant or his lawyer.
24The request, accompanied by its annex, shall be sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.
