APD/GBA (Belgium) - 32/2024
From GDPRhub
| APD/GBA - 32/2024 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 15(1) GDPR Article 15(3) GDPR |
| Type: | Complaint |
| Outcome: | Partly Upheld |
| Started: | 26.12.2023 |
| Decided: | 13.02.2024 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 32/2024 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Dutch |
| Original Source: | GBA (in NL) |
| Initial Contributor: | nzm |
The DPA held that a controller must give access to all the documents consulted when examining a data subject’s credit application, even if these documents were created by third entities for independent purposes
English Summary
Facts
A data subject’s credit application was refused by the controller. Consequently, the data subject exercised his right of access with the controller and filed a complaint with its Financial Services Ombudsman. The controller informed him that 3 files had been consulted in examining his credit application: (i) his own file, (ii) the Central Individual Credit Register file and (iii) a finance company’s file. The controller shared the full content of the data subject’s file and only the identity and contact details of the respective controllers. It also told the data subject to contact the controllers of those files to exercise his right of access regarding said documents.
The data subject claimed that the information to which he had been given access to was incomplete, as the controller also had the “purpose of the credit” as well as a copy of his identity card. The data subject asked the controller to confirm that he had been given access to all his personal data. The controller responded that it had other data in its possession, namely the one it received as part of the data subject’s complaint to the Financial Services Ombudsman.
Following this, the data subject lodged a complaint with the Belgian DPA (“APD”).
Holding
Under Article 15(1) GDPR, the data subject has the right to obtain from the controller a confirmation as to whether or not personal data concerning him are being processed and if so, to obtain access to such personal data. The APD considered that in the present case, the controller did not respond directly to the data subject’s question asking it to confirm that he had been given access to all his personal data. Thus, the data subject did not obtain a conclusive answer or access as required by Article 15(1) GDPR.
Moreover, Article 15(3) GDPR provides that the controller must provide a copy of the personal data being processed. The APD held that the controller processed an image of the data subject’s identity card and failed to provide a copy in response to the request. Therefore, the controller violated Article 15(3) GDPR.
Finally, the APD pointed out that the purpose of the right of access is to “to be aware of, and verify, the lawfulness of the processing” (Recital 63 GDPR). The right of access therefore supports the right to rectification. Regarding the 2 other files the controller consulted, the APD considered that the controller determined the means and purposes of the processing of the personal data in question. Without access to these 2 files, the data subject could not determine whether it was necessary to contact the controllers of those files in order to exercise his right to rectification.
The APD therefore ordered the controller to comply with the data subject’s access request by granting him access to all the personal data concerning him, as well as a copy of the data in question.
Comment
As this was a prima facie decision, if the controller does not agree with the contents of the decision or believes that it has factual and/or legal arguments that could lead to a different decision, it may submit a request for a hearing to the APD within 30 days of the notification of the decision.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/7
Dispute Chamber
Decision 32/2024 of February 13, 2024
File number: DOS-2024-00078
Subject: Complaint due to insufficient response to a request for access
The Disputes Chamber of the Data Protection Authority, composed of Mr
Hielke HIJMANS, sole chairman;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of
personal data and regarding the free movement of such data and to the revocation of
Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”;
Having regard to the law of 3 December 2017 establishing the Data Protection Authority,
hereinafter “WOG”;
In view of the internal rules of order, as approved by the House of Representatives
Representatives on December 20, 2018 and published in the Belgian Official Gazette on
January 15, 2019;
Considering the documents in the file;
Has made the following decision regarding:
Complainant: X, hereinafter “the complainant”
The defendant: Y, hereinafter “the defendant” Decision 32/2024 — 2/7
I. Facts and procedure
1. On December 26, 2023, the complainant will submit a complaint to the Data Protection Authority
against the defendant.
2. The subject of the complaint concerns the exercise of the right of access by the complainant
without receiving an adequate response from the controller.
The complainant had exercised his right of access after his credit application was refused
by the defendant. As a result, the defendant informed the complainant that there were three
files were consulted in examining his credit application, namely that
from the defendant itself, the Central Office for Credit to Private Individuals, and a
financing company. The defendant sent “a complete content of the data
that are in our files” to the complainant. Of the data in the remaining
two files, the defendant shared only the identity and contact information of the
respective controllers.
The complainant disputed that the data he was given access to was complete. He asked
namely that the defendant also had the “purpose of the credit” and an image
of his identity card. He once again requested the defendant “to provide the files you as
lender [sic] has in your possession, as you inform me, to transfer to me.” The complainer
had also filed a complaint with the defendant's financial services ombudsman, and
the documents available to the Disputes Chamber show that communication between the
defendant and the complainant focused mainly on the rest for a certain period of time
investigating the substantive reasons for the refusal of the credit, which is outside the
scope of this decision. After some time, the complainant made contact again
contacted the defendant to ask for confirmation that he had been given access to all
his personal data. The defendant responded as follows:
"Dear,
We have other data in our possession, namely the one we received in the context
of your complaint to the financial services ombudsman.
3. On January 8, 2024, the complaint will be declared admissible by the First Line Service on the grounds
of Articles 58 and 60 of the WOG and the complaint is filed on the basis of Article 62, § 1 of
the WOG has been transferred to the Disputes Chamber.
4. In accordance with Article 95, § 2, 3° of the WOG as well as Article 47 of the internal regulations
order of the GBA, the parties can request a copy of the file. If one
both parties wish to make use of the opportunity to consult and
copying the file, he or she must contact the secretariat of the
Disputes Chamber, preferably via litigationchamber@apd-gba.be. Decision 32/2024 — 3/7
II. Justification
5. According to Article 15.1 GDPR, the data subject has the right to obtain from the
controller to obtain clarity about whether or not to process
personal data concerning him and, if applicable, to obtain access to it
those personal data and the information referred to in Article 15.1.a) to h), GDPR.
In accordance with Article 12.1 GDPR, read in conjunction with recital 58 hereof
Regulation, the controller must take appropriate measures to ensure that
the data subject the communications referred to in Article 15 GDPR in connection with the processing
in a concise, transparent, understandable and easily accessible form and in
receives clear and simple language”. Article 12.2 GDPR also stipulates that the
controller must exercise the data subject's rights
facilitate.
6. The Disputes Chamber notes that the complainant submitted his request for access on 6
October 2023.
7. On October 17, 2023, the defendant informed the complainant that in the investigation of his
file, three files were consulted. These files were those of (1) the
defendant itself, (2) the Central Office for Credit to Private Individuals, and (3) a
financing company. The same email contained, according to the defendant, “a complete
content of the data contained in our files”. However, the complainant disputed
that this information was complete. In particular, he stated that the defendant would also
have the “purpose of the credit”.
On December 26, 2023, the complainant asked the defendant to confirm that he had access
had received in all his personal data. The defendant responded that also “other
data” were processed, and referred to the data provided by the complainant
provides financial services in the context of his complaint to the Ombudsman
defendant. Since the defendant did not directly answer the question of the
complainant whether he had been given access to all his personal data, the complainant did not obtain any
clear information about whether or not certain personal data are processed.
Consequently, the complainant has not been provided with sufficient clarity or insight as required in Article
15.1 GDPR.
8. Furthermore, the complainant states that the defendant has an image of his identity card
processed, and failed to provide a copy of it in response to the
request for inspection. In this context, the Disputes Chamber recalls that Article 15.3 GDPR
provides that the controller “a copy of the personal data that
are processed” must be provided to the data subject. If the defendant indeed Decision 32/2024 — 4/7
processes an image of the complainant's identity card, the defendant must also have one
provide a copy of this image to satisfy the complainant's right of inspection.
9. Regarding the two other files that the defendant consulted, communicated
the defendant only the identification details and addresses of the respective
controllers. The results of the consultations by the defendant –
namely the contents of the files – the defendant did not communicate this to the complainant. At
the latter was told to contact the administrators of that
files to exercise his right of access. To the extent that the defendant
determines the purposes and means of the processing of the personal data concerned
However, he is a data controller and is therefore obliged to follow up himself
the complainant's right of access in accordance with Article 15.1 GDPR. In this respect it is
appropriate to recall that the aim of the right of access is to ensure that
the data subject “can inform himself of the processing and its lawfulness
can check this” (recital 63 GDPR). The right of access thus supports it
right to the protection of personal data, and facilitates the exercise of others
rights included in the GDPR, and in particular the right to rectification. Without
access to the data that the defendant did or did not consult with the two parties involved
files, the complainant is unable to determine whether it is necessary to contact them
with those responsible for those files to assert his right to rectification.
Furthermore, it should be noted that Article VII.79 of the Code of Economic Law
stipulates that the “lender shall immediately provide the consumer with the result of the loan free of charge
consultation [communicates] as well as the identity and address of the person responsible for the
processing the files he consulted” (emphasis added).
10. The Disputes Chamber is of the opinion that based on the above analysis
concluded that the defendant may have violated the provisions of the GDPR
was committed, which justifies taking one in this case
decision on the basis of Article 95, § 1, 5° of the WOG, more specifically the
order the controller to comply with the exercise by the
complainant of his right of access (Article 15.1 GDPR).
11. This decision is a prima facie decision taken by the Disputes Chamber
in accordance with Article 95 of the WOG on the basis of the complaint submitted by the complainant,
2
in the context of the “procedure prior to the decision on the merits” and none
decision on the merits of the Disputes Chamber within the meaning of Article 100 of the WOG.
1CJEU December 20, 2017, Peter Nowak v. Data Protection Commissioner, C-434/16, ECLI:EU:C:2017:994
2Section 3, Subsection 2 of the WOG (Articles 94 to 97). Decision 32/2024 – 5/7
The Disputes Chamber has thus decided, on the basis of Article 58.2.c) GDPR and
Article 95, § 1, 5° of the WOG, to order the defendant to comply with the request
of the data subject to exercise his rights, in particular the right of access such as
determined in Article 15 GDPR.
12. The purpose of this decision is to inform the defendant of the fact that this
may have committed an infringement of the provisions of the GDPR and this in the
the opportunity to still comply with the aforementioned provisions.
13. If the defendant does not agree with the content of the present primafacie
decision and is of the opinion that it can apply factual and/or legal arguments
that could lead to a different decision, this can be done via the e-mail address
litigationchamber@apd-gba.be send a request to hear the merits of the case
to the Disputes Chamber within 30 days after notification of this
decision. The implementation of this decision will, if necessary, continue for a period of time
suspended for the aforementioned period.
14. In the event of a continuation of the merits of the case, the
Dispute Chamber the parties on the basis of Articles 98, 2° and 3° in conjunction with Article 99 WOG
invite them to submit their defenses as well as any documents they consider useful in the case
file to add. If necessary, the present decision will be permanently suspended.
15. Finally, for the sake of completeness, the Disputes Chamber points out that a hearing on the merits
of the case may lead to the imposition of the measures stated in Article 100 of the WOG. 3
16. In accordance with Article 57WOG, and with regard to the language in which the complaint is submitted,
Dutch is used as the procedural language.
3Article 100. § 1. The Disputes Chamber has the authority to:
1° to dismiss a complaint;
2° to order the dismissal of prosecution;
3° order the suspension of the ruling;
4° to propose a settlement;
5° formulate warnings and reprimands;
6° order that the data subject's requests to exercise his rights be complied with;
7° to order that the person concerned is informed of the security problem;
8° order that processing be temporarily or permanently frozen, restricted or prohibited;
9° to order that the processing be brought into compliance;
10°the rectification, limitation or deletion of data and its notification to the recipients of the data
recommend data;
11° order the withdrawal of the recognition of certification bodies;
12° to impose penalty payments;
13° to impose administrative fines;
14° the suspension of cross-border data flows to another State or an international institution
command;
15° to transfer the file to the public prosecutor's office in Brussels, who will inform it of the
follow-up given to the file;
16° decide on a case-by-case basis to publish its decisions on the website of the
Data Protection Authority. Decision 32/2024 — 6/7
III. Publication of the decision
17. Considering the importance of transparency with regard to decision-making
Dispute Chamber, this decision will be published on the website of the
Data Protection Authority. However, it is not necessary that the
identification details of the parties are disclosed directly.
FOR THESE REASONS ,
the Disputes Chamber of the Data Protection Authority decides, with reservations
from the submission of a request by the defendant for a hearing on the merits
in accordance with Article 98 et seq. of the WOG, to:
- on the basis of Article 58.2.c) of the GDPR and Article 95, § 1, 5° of the WOG the
order the defendant to comply with the data subject's request
to exercise its rights, in particular the right of access (Article 15 GDPR), by
to grant the complainant access to all personal data relating to him
processed by the defendant, as well as a copy of the data concerned
provided, and this within a period of 30 days from the
notification of this decision;
- order the defendant to contact the Data Protection Authority (Dispute Chamber)
by e-mail within the same period of the consequences
this decision will be given via the email address litigationchamber@apd-gba.be;
and
- in the absence of timely implementation of the above by the defendant,
to consider the merits of the case ex officio in accordance with Articles 98 et seq.
of the WOG.
Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the
notice, an appeal against this decision will be filed with the Market Court (court of
appeal Brussels), with the Data Protection Authority as defendant.
Such an appeal can be lodged by means of an inter partes petition
4
must contain statements listed in Article 1034ter of the Judicial Code. It
4The petition states, under penalty of nullity:
1° the day, month and year;
2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
company number;
3° the surname, first name, place of residence and, where applicable, the capacity of the person to be
summoned;
4° the subject matter and brief summary of the grounds of the claim;
5° the judge before whom the claim is brought; Decision 32/2024 — 7/7
an objection petition must be submitted to the registry of the Market Court
in accordance with Article 1034quinquies of the Dutch Civil Code. , 5 or via e-Deposit
IT system of Justice (Article 32ter of the Judicial Code).
(get). Hielke IJMANS
Chairman of the Disputes Chamber
6° the signature of the applicant or his lawyer.
5
The petition with its attachment will be sent by registered letter, in as many copies as there are parties involved.
deposited with the clerk of the court or at the registry.
