APD/GBA (Belgium) - 03/2024

APD/GBA - 03/2024
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 12 GDPR Article 17 GDPR
Type:	Complaint
Outcome:	Upheld
Started:	15.09.2023
Decided:	09.01.2024
Published:	09.01.2024
Fine:	n/a
Parties:	n/a
National Case Number/Name:	03/2024
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Dutch
Original Source:	APD/GBA (in NL)
Initial Contributor:	Matthias Vandamme

The DPA found a recruitment agency to have breached Article 12 GDPR and Article 17 GDPR for contacting the data subject even after a deletion was confirmed to the data subject.

English Summary

Facts

On 1 August 2023, the data subject received a phone call from the controller: a recruitment agency. On the same day, the complainant contacted the controller requesting to be deleted from their database and to not be contacted.

On 2 August 2023, the data subject received an email from an employee of the controller about new job opportunities, to which the data subject replied requesting to not be contacted again. On 4 September 2023, the data subject received another phone call from the controller and on 5 September 2023, the data subject received an email from the employee concerned confirming that their data had been erased.

After receiving another phone call from the controller on 15 September 2023, the data subject lodged a complaint with the Belgian DPA.

Holding

The Belgian DPA reiterated that in line with Article 17 GDPR and Article 12 GDPR, a controller is obliged to erase the personal data of a data subject upon request without delay. Furthermore, under Article 12(3) GDPR, the controller should inform the data subject as soon as possible, but at least within a month, about the action taken on his request.

The DPA established based on the facts of the case as provided by the data subject that he had exercised his deletion request several times but was still contacted afterwards. Moreover, even if the controller did respond after the data subject's second request confirming that the personal data had been deleted, the data subject still received messages from the controller.

Therefore, the DPA held that the controller infringed Article 12(3) GDPR, Article 12(4) GDPR and Article 17(1) GDPR and ordered the controller to deal with the data subject's request within 30 days after the decision.

Comment

As this is a 'prima facie' decision, not much information is available. The Litigation Chamber of the DPA has ruled solely based on the complaint without having a procedure. The controller could demand for a procedure within 30 days after the decision.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

1/6



                                                                          Dispute Chamber


                                                   Decision 03/2024 of January 9, 2024


File number: DOS-2023-03819


Subject: Complaint due to no response to the request to exercise the right to

data erasure



The Disputes Chamber of the Data Protection Authority, composed of Mr

Hielke HIJMANS, sole chairman;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

on the protection of natural persons with regard to the processing of

personal data and regarding the free movement of such data and to the revocation of

Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”;


Having regard to the law of 3 December 2017 establishing the Data Protection Authority,
hereinafter “WOG”;


In view of the internal rules of order, as approved by the House of Representatives

Representatives on December 20, 2018 and published in the Belgian Official Gazette on

January 15, 2019;


Considering the documents in the file;


Has made the following decision regarding:


Complainant: X, hereinafter “the complainant”;



The defendant: Y, hereinafter “the defendant”. Decision 03/2024 – 2/6



I. Facts and procedure


    1. The subject of the complaint concerns the fact that the complainant continues to communicate by telephone and via

        email is contacted by the defendant, being a recruitment agency, despite
        repeated requests for data deletion from the complainant.


    2. On August 1, 2023, the complainant received a call from the defendant. That same day, the

        Complaintsent an email to the defendant's local office with the question no longer

        be contacted and her details removed from the database “according to the

        GDPR Guidelines”. On August 2, 2023, the complainant receives an email from an employee

        from the defendant's local office regarding job opportunities. The complainant answers

        tells the employee that she no longer wants to be contacted and asks her again

        delete data. According to the complainant, neither email was answered by
        the defendant.


    3. On September 4, 2023, the complainant was called again by the defendant. The complainer

        sends an email to the same employee of the defendant's local office with

        again the question not to be contacted again. On 5 September 2023 the replied

        employee concerned with the message that all data has been removed from the file. The

        concerned employee also recommends the application form for exercising

        rights via the website, which the complainant says he does.

    4. On September 15, 2023, the complainant will be called again by the defendant.


    5. On September 15, 2023, the complainant submits a complaint to the

        Data Protection Authority against the defendant.

    6. On September 18, 2023, the complaint will be declared admissible by the First Line Service on

        on the basis of Articles 58 and 60 of the WOG and the complaint is filed on the basis of Article 62,

        § 1 of the WOG transferred to the Disputes Chamber. 2


    7. In accordance with Article 95, § 2, 3° of the WOG as well as Article 47 of the internal regulations

        order of the GBA, the parties can request a copy of the file. If one
        both parties wish to make use of the opportunity to consult and

        copying the file, he or she must contact the secretariat of the

        Disputes Chamber, preferably via litigationchamber@apd-gba.be.










1In accordance with Article 61 of the WOG, the Disputes Chamber hereby informs the parties that the complaint is admissible
declared.
2In accordance with Article 95, § 2 of the WOG, the Disputes Chamber hereby informs the parties that the file will be sent to
has been transferred to her as a result of this complaint. Decision 03/2024 – 3/6


II. Justification


 8. Article 17.1 GDPR provides that the data subject has the right from the controller

       has, without unreasonable delay, erased the personal data concerning him

       to acquire. The controller is obliged to process personal data without
       unreasonable delay when the personal data is no longer necessary for

       the purposes for which they were collected or otherwise processed.


 9. In accordance with Article 12.3 GDPR, the controller provides the
       person concerned without delay and in any case within one month of receipt of the request

       pursuant to Articles 15 to 22 GDPR information about the outcome of the request

       is given. Depending on the complexity of the requests and the number of requests

       that period may be extended by a further two months if necessary. The

       the controller shall inform the data subject within one month of receipt of the

       request of such extension. If the defendant decides not to
       to comply with the complainant's request, it must do so within one month after the

       communicate receipt of the request to the data subject, in accordance with Article 12.4 GDPR


 10. The Disputes Chamber states on the basis of the documents that support the complaint, consisting of a
      screenshot of the calls received from the defendant's phone number and

      from various emails between the complainant and the defendant, it is established that the complainant is entitled to

      erasure of data has been carried out. The Disputes Chamber cannot determine on the basis of

      the file that the complainant may have received any answer about the consequences caused by this

      defendant is given the request for data erasure after the first request of
      the complainant dd. August 1, 2023. The Disputes Chamber, on the other hand, notes that the

      defendant, after the complainant's second request for data deletion dated. September 4

      2023, on 5 September 2023, she confirmed that her data had been deleted.

      However, the complainant points out that even after this confirmation she was still contacted by the

      defendant. As a result, the defendant would potentially have acted in violation of Article
      12.3 and 12.4 GDPR, as well as Article 17.1 GDPR.


 11. The above suggests to the Disputes Chamber that it should be concluded that

      the defendant may have committed an infringement of the provisions of the GDPR,

      which justifies taking a decision in this case
      pursuant to Article 95, § 1, 5° of the WOG, more specifically to order the defendant to take action

      to indicate the complainant's exercise of his right to erasure of data and this in the

      particularly in view of the documents that the complainant has provided showing that the complainant has the

      the defendant has repeatedly requested that her data be deleted,

      without appropriate action being taken by the defendant. Decision 03/2024 – 4/6


  12. This decision is a prima facie decision taken by the Disputes Chamber

       in accordance with Article 95 of the WOG on the basis of the complaint submitted by the complainant

       the context of the “procedure prior to the decision on the merits” and not a decision

       on the merits of the Disputes Chamber within the meaning of Article 100 of the WOG.


        The Disputes Chamber has thus decided, on the basis of Article 58.2 c) GDPR and

        Article 95, § 1, 5° of the WOG, to order the defendant to comply with the request

        of the data subject to exercise his rights, in particular the right to

        erasure (“right to be forgotten”) as provided for in Article 17 GDPR.


     13. The purpose of this decision is to inform the defendant of the fact that

         it has committed an infringement of the provisions of the GDPR and this is possible

         to still comply with the aforementioned provisions.


     14. However, if the defendant does not agree with the contents of this fine

         facie decision and is of the opinion that it may allow factual and/or legal arguments

         funds that could lead to a different decision can be made via the e-mail address

         litigationchamber@apd-gba.beeenrequesttohandlethesubstancesofthecase

         to the Disputes Chamber and this within the period of 30 days after notification of this

         decision. The implementation of this decision will be carried out if necessary

         suspended for the aforementioned period.


     15. In the event of a continuation of the merits of the case, the

         Dispute Chamber the parties on the basis of Articles 98, 2° and 3° in conjunction with Article 99 WOG

         invite them to submit their defenses as well as any documents they deem useful

         file to add. If necessary, the present decision will be permanently suspended.


     16. Finally, for the sake of completeness, the Disputes Chamber points out that a substantive hearing

         of the case may lead to the imposition of the measures stated in Article 100 of the WOG. 4





3Section 3, Subsection 2 of the WOG (Articles 94 to 97).
4
 Article 100. § 1. The Disputes Chamber has the authority to:
 1° to dismiss a complaint;
 2° to order the dismissal of prosecution;
 3° order the suspension of the ruling;
 4° to propose a settlement;
 5° formulate warnings and reprimands;
 6° order that the data subject's requests to exercise his rights be complied with;

 7° to order that the person concerned is informed of the security problem;
 8° order that processing be temporarily or permanently frozen, restricted or prohibited;
 9° to order that the processing be brought into compliance;
 10°the rectification, limitation or deletion of data and its notification to the recipients of the data
     recommend data;
 11° order the withdrawal of the recognition of certification bodies;
 12° to impose penalty payments;
 13° to impose administrative fines;
 14° the suspension of cross-border data flows to another State or an international institution

     command;
 15° to transfer the file to the public prosecutor's office in Brussels, who will inform it of the
     follow-up given to the file; Decision 03/2024 – 5/6



III. Publication of the decision

    17. Considering the importance of transparency with regard to decision-making

        Dispute Chamber, this decision will be published on the website of the

        Data Protection Authority. However, it is not necessary that the

        identification details of the parties are disclosed directly.



    FOR THESE REASONS   ,


    the Disputes Chamber of the Data Protection Authority decides, with reservations

    from the submission of a request by the defendant for a hearing on the merits

    in accordance with Article 98 et seq. of the WOG, to:

       - on the basis of Article 58.2.c) of the GDPR and Article 95, § 1, 5° of the WOG the

           order the defendant to comply with the data subject's request

           to exercise his rights, in particular the right to erasure of data (Article 17.1

           GDPR), and to delete the relevant personal data from the

           complainant within 30 days of notification

           this decision;

       - order the defendant to contact the Data Protection Authority (Dispute Chamber)

           by e-mail within the same period of the consequences

           this decision will be given via the email address litigationchamber@apd-gba.be;

           and


       - in the absence of timely implementation of the above by the defendant,

           to consider the merits of the case ex officio in accordance with Articles 98 et seq.
           of the WOG.




Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the

notice, an appeal against this decision will be filed with the Market Court (court of

appeal Brussels), with the Data Protection Authority as defendant.

Such an appeal can be lodged by means of an inter partes petition

must contain statements listed in Article 1034ter of the Judicial Code. It



 16° decide on a case-by-case basis to publish its decisions on the website of the
    Data Protection Authority.
5The petition states, under penalty of nullity:
 1° the day, month and year;
 2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
    company number;
 3° the surname, first name, place of residence and, where applicable, the capacity of the person to be
    summoned;
 4° the subject matter and brief summary of the grounds of the claim;
 5° the judge before whom the claim is brought; Decision 03/2024 – 6/6


an objection petition must be submitted to the registry of the Market Court

in accordance with Article 1034quinquies of the Dutch Civil Code. , 6 or via e-Deposit

IT system of Justice (Article 32ter of the Judicial Code).






(get). Hielke IJMANS


Chairman of the Disputes Chamber




























































 6° the signature of the applicant or his lawyer.
6
 The petition with its attachment will be sent by registered letter, in as many copies as there are parties involved.
deposited with the clerk of the court or at the registry.