APD/GBA (Belgium) - 06/2023
From GDPRhub
| APD/GBA - 06/2023 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 15(1)(a) GDPR Article 15(1)(c) GDPR |
| Type: | Complaint |
| Outcome: | Partly Upheld |
| Started: | |
| Decided: | 02.02.2023 |
| Published: | 06.02.2023 |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 06/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | French |
| Original Source: | GBA (in FR) |
| Initial Contributor: | n/a |
The Belgian DPA ordered a controller to comply with an access request pursuant to Article 58(2)(c) GDPR. The DPA determined that the controller was responsible for not receiving the data subject's request due to technical problems with its email inbox.
English Summary
Facts
In an unspecified point in time, the data subject noticed that his 'national register file' had been accessed by a third party on 12 September 2022. On 25 September 2022, he sent an email to the controller, whose nature was also not specified, asking to provide information about such access, its reason as well as the identity of the person or entity who had consulted the data. The data subject received an automatic reply from the controller informing him that the recipient's e-mail box was full and that no new messages could be received. The data subject continued sending messages with his inquiries, which all resulted in the same outcome. On 21 October 2022, he filed a complaint at the Belgian DPA.
Holding
The DPA confirmed that the data subject was exercising his right of access in order to get information regarding the purpose of the consultation of his national register (Article 15(1)(a) GDPR) and the identity of the person(s) who consulted the register (Article 15(1)(c) GDPR). The DPA stated that it looked like that the controller never received the e-mail and did therefore not comply with the one-month deadline of Article 12(3) GDPR to provide an answer to the request.
The DPA concluded that the controller may have violated Article 15 GDPR by not providing an answer to the access request and ordered the controller to comply with the access request of the data subject. The DPA especially noted that the e-mail address provided by the controller was not functional to let data subjects exercise their rights, which is a requirement pursuant to Article 12(2) GDPR.
The DPA ordered the controller to comply with the access request pursuant to Article 58(2)(c) GDPR and Article 95(1)(5) LCA (Law establishing the data protection authority).
Comment
This is a preliminary decision pursuant to Article 95 LCA, prior to the decision on the merits.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/5
Litigation Chamber
Decision 06/2023 of February 2, 2023
File number: DOS-2022-04347
Subject: consultation of the national register and lack of response to the exercise of the right
access
The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke
Hijmans, chairman;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and
to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the
data protection), hereinafter “GDPR”;
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, hereinafter
“ACL”;
Having regard to the internal regulations as approved by the House of Representatives on 20
December 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Made the following decision regarding:
The plaintiff: X, hereinafter “the plaintiff”; .
.
.
The defendant: Y, hereinafter: “the defendant”. Decision 06/2023 – 2/5
I. Facts and procedure
1. The subject of the complaint concerns the consultation of the national register of the complainant by Y and
failure to respond to the access request.
The complainant noted that his national registry file had been consulted by Y on 12
September 2022. On September 25, 2022, he wrote to the address […] requesting
information on this consultation and in particular the reason for the consultation and the identity of
the person who viewed it. He receives the same day an automated response in Dutch
indicating that the mailbox is full and no new messages can be received. THE
complainant seems to have made new sending attempts in the following days, which
all led to the same result.
2. On October 21, 2022, the complainant lodged a complaint with the Data Protection Authority
given against the defendant.
3. On October 28, 2022, the complaint was declared admissible by the Front Line Service on
the basis of Articles 58 and 60 of the LCA and the complaint is forwarded to the Litigation Chamber
pursuant to Article 62, § 1 of the LCA.
4. Pursuant to article 95 § 2, 3° of the LCA as well as article 47 of the rules of order
inside the DPA, a copy of the file may be requested by the parties. If one of
parties wishes to make use of the possibility of consulting the file, the latter is required to
contact the secretariat of the Litigation Chamber, preferably via the address
litigationchamber@apd-gba.be.
II. Motivation
5. Article 15.1.a) of the GDPR provides that the data subject can contact the controller
processing in order to achieve the purpose of the processing. Article 15.1.c) provides that it may
also ask “the recipients or categories of recipients to whom the
personal data have been or will be communicated”.
6. Under Article 12.3 of the GDPR, the controller has a maximum period
one month from the request for access to provide a response. This period may, under
conditions, be extended for an additional month.
7. In addition, article 12.2 of the GDPR provides that the controller facilitates the exercise
of the rights granted to the data subject.
1
Pursuant to article 61 LCA, the Litigation Chamber informs the parties by this decision, of the fact that the complaint has been
declared admissible.
2 Pursuant to Article 95, § 2 LCA, by this decision, the Litigation Division informs the parties of the fact that following
of this complaint, the file was forwarded to him. Decision 06/2023 – 3/5
8. In this case, it appears from the email that the complainant sent to the Y, that the latter was exercising his right
of access concerning the purpose of the consultation of its national register (article 15.1a) of the
GDPR) and the identity of the persons having consulted the register (article 15.1.c) of the GDPR).
9. Y provides data subjects with an email address entitled […] so that data subjects can
data subjects can exercise their rights. It appears that due to a problem
full mailbox, Y never received this email and therefore did not respond to it within
the period of one month.
10. The Litigation Chamber considers that on the basis of the aforementioned facts, there is reason to
conclude that the defendant may have breached the provisions of the GDPR, which
which justifies that in this case, it is making a decision in accordance with Article
er
95, § 1, 5° of the LCA, more specifically, to order compliance with the request of the
complainant of the complainant to exercise his right of access (article 15.1 of the GDPR) and this in
particular seen:
- The evidence provided by the complainant demonstrating that there was indeed consultation with
its national registry file by the defendant;
- Copies of emails sent by the complainant and automatic responses received,
which demonstrate that he has attempted, through an official email address, to exercise his
right of access provided for in Articles 15.1.a) and 15.b) of the GDPR;
- That the email address provided by the defendant so that the persons concerned
can exercise the rights granted to them by the GDPR is not functional,
which would indicate that the defendant did not facilitate the exercise of rights conferred on the
data subject as required by article 12.2 of the GDPR.
11. This decision is a prima facie decision taken by the Litigation Chamber
pursuant to Article 95 of the LCA on the basis of the complaint lodged by the complainant/the
complainant, in the context of the "procedure prior to the substantive decision" and not a
decision on the merits of the Litigation Chamber within the meaning of Article 100 of the LCA.
12. The purpose of this decision is to inform the defendant, allegedly responsible for the
processing, because it may have violated the provisions of the GDPR,
in order to enable it to still comply with the aforementioned provisions.
13. If, however, the defendant does not agree with the content of this decision
prima facie and believes that it can make factual and/or legal arguments that
3Section 3, Subsection 2 of the ACL (articles 94 to 97 inclusive). Decision 06/2023 – 4/5
could lead to another decision, it may send the Litigation Chamber a
request for treatment on the merits of the case via the e-mail address litigationchamber@apd-
gba.be, within 30 days of notification of this decision. The case
applicable, the execution of this decision is suspended for the period
aforementioned.
14. In the event of further processing of the case on the merits, pursuant to Articles 98, 2° and 3°
juncto article 99 of the LCA, the Litigation Chamber will invite the parties to introduce their
conclusions and attach to the file all the documents they deem useful. If applicable, the
this decision is permanently suspended.
15. With a view to transparency, the Litigation Division finally emphasizes that a
dealing with the case on the merits may lead to the imposition of the measures mentioned in
section 100 of the ACL. 4
III. Publication of the decision
16. Given the importance of transparency regarding the decision-making process of the Chamber
Litigation, this decision is published on the website of the Protection Authority
Datas. However, it is not necessary for this purpose that the identification data
of the parties are communicated directly.
4Art. 100. § 1. The litigation chamber has the power to
1° dismiss the complaint without follow-up;
2° order the dismissal;
3° pronouncing the suspension of the pronouncement;
4° to propose a transaction;
5° issue warnings and reprimands;
6° order to comply with requests from the data subject to exercise his or her rights;
7° order that the person concerned be informed of the security problem;
8° order the freezing, limitation or temporary or permanent prohibition of processing;
9° order compliance of the processing;
10° order the rectification, restriction or erasure of the data and the notification thereof to the recipients of the
data ;
11° order the withdrawal of accreditation from certification bodies;
12° to issue periodic penalty payments;
13° to issue administrative fines;
14° order the suspension of cross-border data flows to another State or an international body;
15° forward the file to the public prosecutor's office in Brussels, who informs it of the follow-up given to the file;
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. Decision 06/2023 – 5/5
FOR THESE REASONS,
the Litigation Chamber of the Data Protection Authority decides, subject to
the introduction of a request by the defendant for treatment on the merits in accordance with
to articles 98 e.s. of the ACL:
- pursuant to Article 58.2.c) of the GDPR and Article 95, §1, 5° of the LCA, to order
the defendant to comply with the request of the person concerned to exercise
his right of access (article 15.1 of the GDPR) regarding the consultation of his register
national level, and to send the information to the complainant within the time limit
30 days from the notification of this decision;
- to order the defendant to inform by e-mail the Data Protection Authority
data (Litigation Chamber) of the follow-up given to this decision, in the
same deadline, via the e-mail address litigationchamber@apd-gba.be; And
- if the defendant does not comply in good time with what is requested of it
above, to deal ex officio with the case on the merits, in accordance with articles 98 e.s. of
the ACL.
In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged,
within thirty days of its notification, to the Court of Markets (court
d'appel de Bruxelles), with the Data Protection Authority as defendant.
Such an appeal may be introduced by means of an interlocutory request which must contain the
information listed in article 1034ter of the Judicial Code. The interlocutory motion must be
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 6
via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).
(se). Hielke H IJMANS
President of the Litigation Chamber
5
The request contains on pain of nullity:
(1) indication of the day, month and year;
2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
Business Number;
3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
(4) the object and summary statement of the means of the request;
(5) the indication of the judge who is seized of the application;
6° the signature of the applicant or his lawyer.
6The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.
