APD/GBA (Belgium) - 06/2023
|APD/GBA - 06/2023|
|Relevant Law:||Article 15(1)(a) GDPR|
Article 15(1)(c) GDPR
|National Case Number/Name:||06/2023|
|European Case Law Identifier:||n/a|
|Original Source:||GBA (in FR)|
The Belgian DPA ordered a controller to comply with an access request pursuant to Article 58(2)(c) GDPR. The DPA determined that the controller was responsible for not receiving the data subject's request due to technical problems with its email inbox.
English Summary[edit | edit source]
Facts[edit | edit source]
In an unspecified point in time, the data subject noticed that his 'national register file' had been accessed by a third party on 12 September 2022. On 25 September 2022, he sent an email to the controller, whose nature was also not specified, asking to provide information about such access, its reason as well as the identity of the person or entity who had consulted the data. The data subject received an automatic reply from the controller informing him that the recipient's e-mail box was full and that no new messages could be received. The data subject continued sending messages with his inquiries, which all resulted in the same outcome. On 21 October 2022, he filed a complaint at the Belgian DPA.
Holding[edit | edit source]
The DPA confirmed that the data subject was exercising his right of access in order to get information regarding the purpose of the consultation of his national register (Article 15(1)(a) GDPR) and the identity of the person(s) who consulted the register (Article 15(1)(c) GDPR). The DPA stated that it looked like that the controller never received the e-mail and did therefore not comply with the one-month deadline of Article 12(3) GDPR to provide an answer to the request.
The DPA concluded that the controller may have violated Article 15 GDPR by not providing an answer to the access request and ordered the controller to comply with the access request of the data subject. The DPA especially noted that the e-mail address provided by the controller was not functional to let data subjects exercise their rights, which is a requirement pursuant to Article 12(2) GDPR.
The DPA ordered the controller to comply with the access request pursuant to Article 58(2)(c) GDPR and Article 95(1)(5) LCA (Law establishing the data protection authority).
Comment[edit | edit source]
This is a preliminary decision pursuant to Article 95 LCA, prior to the decision on the merits.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/5 Litigation Chamber Decision 06/2023 of February 2, 2023 File number: DOS-2022-04347 Subject: consultation of the national register and lack of response to the exercise of the right access The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke Hijmans, chairman; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the data protection), hereinafter “GDPR”; Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, hereinafter “ACL”; Having regard to the internal regulations as approved by the House of Representatives on 20 December 2018 and published in the Belgian Official Gazette on January 15, 2019; Considering the documents in the file; Made the following decision regarding: The plaintiff: X, hereinafter “the plaintiff”; . . . The defendant: Y, hereinafter: “the defendant”. Decision 06/2023 – 2/5 I. Facts and procedure 1. The subject of the complaint concerns the consultation of the national register of the complainant by Y and failure to respond to the access request. The complainant noted that his national registry file had been consulted by Y on 12 September 2022. On September 25, 2022, he wrote to the address […] requesting information on this consultation and in particular the reason for the consultation and the identity of the person who viewed it. He receives the same day an automated response in Dutch indicating that the mailbox is full and no new messages can be received. THE complainant seems to have made new sending attempts in the following days, which all led to the same result. 2. On October 21, 2022, the complainant lodged a complaint with the Data Protection Authority given against the defendant. 3. On October 28, 2022, the complaint was declared admissible by the Front Line Service on the basis of Articles 58 and 60 of the LCA and the complaint is forwarded to the Litigation Chamber pursuant to Article 62, § 1 of the LCA. 4. Pursuant to article 95 § 2, 3° of the LCA as well as article 47 of the rules of order inside the DPA, a copy of the file may be requested by the parties. If one of parties wishes to make use of the possibility of consulting the file, the latter is required to contact the secretariat of the Litigation Chamber, preferably via the address firstname.lastname@example.org. II. Motivation 5. Article 15.1.a) of the GDPR provides that the data subject can contact the controller processing in order to achieve the purpose of the processing. Article 15.1.c) provides that it may also ask “the recipients or categories of recipients to whom the personal data have been or will be communicated”. 6. Under Article 12.3 of the GDPR, the controller has a maximum period one month from the request for access to provide a response. This period may, under conditions, be extended for an additional month. 7. In addition, article 12.2 of the GDPR provides that the controller facilitates the exercise of the rights granted to the data subject. 1 Pursuant to article 61 LCA, the Litigation Chamber informs the parties by this decision, of the fact that the complaint has been declared admissible. 2 Pursuant to Article 95, § 2 LCA, by this decision, the Litigation Division informs the parties of the fact that following of this complaint, the file was forwarded to him. Decision 06/2023 – 3/5 8. In this case, it appears from the email that the complainant sent to the Y, that the latter was exercising his right of access concerning the purpose of the consultation of its national register (article 15.1a) of the GDPR) and the identity of the persons having consulted the register (article 15.1.c) of the GDPR). 9. Y provides data subjects with an email address entitled […] so that data subjects can data subjects can exercise their rights. It appears that due to a problem full mailbox, Y never received this email and therefore did not respond to it within the period of one month. 10. The Litigation Chamber considers that on the basis of the aforementioned facts, there is reason to conclude that the defendant may have breached the provisions of the GDPR, which which justifies that in this case, it is making a decision in accordance with Article er 95, § 1, 5° of the LCA, more specifically, to order compliance with the request of the complainant of the complainant to exercise his right of access (article 15.1 of the GDPR) and this in particular seen: - The evidence provided by the complainant demonstrating that there was indeed consultation with its national registry file by the defendant; - Copies of emails sent by the complainant and automatic responses received, which demonstrate that he has attempted, through an official email address, to exercise his right of access provided for in Articles 15.1.a) and 15.b) of the GDPR; - That the email address provided by the defendant so that the persons concerned can exercise the rights granted to them by the GDPR is not functional, which would indicate that the defendant did not facilitate the exercise of rights conferred on the data subject as required by article 12.2 of the GDPR. 11. This decision is a prima facie decision taken by the Litigation Chamber pursuant to Article 95 of the LCA on the basis of the complaint lodged by the complainant/the complainant, in the context of the "procedure prior to the substantive decision" and not a decision on the merits of the Litigation Chamber within the meaning of Article 100 of the LCA. 12. The purpose of this decision is to inform the defendant, allegedly responsible for the processing, because it may have violated the provisions of the GDPR, in order to enable it to still comply with the aforementioned provisions. 13. If, however, the defendant does not agree with the content of this decision prima facie and believes that it can make factual and/or legal arguments that 3Section 3, Subsection 2 of the ACL (articles 94 to 97 inclusive). Decision 06/2023 – 4/5 could lead to another decision, it may send the Litigation Chamber a request for treatment on the merits of the case via the e-mail address litigationchamber@apd- gba.be, within 30 days of notification of this decision. The case applicable, the execution of this decision is suspended for the period aforementioned. 14. In the event of further processing of the case on the merits, pursuant to Articles 98, 2° and 3° juncto article 99 of the LCA, the Litigation Chamber will invite the parties to introduce their conclusions and attach to the file all the documents they deem useful. If applicable, the this decision is permanently suspended. 15. With a view to transparency, the Litigation Division finally emphasizes that a dealing with the case on the merits may lead to the imposition of the measures mentioned in section 100 of the ACL. 4 III. Publication of the decision 16. Given the importance of transparency regarding the decision-making process of the Chamber Litigation, this decision is published on the website of the Protection Authority Datas. However, it is not necessary for this purpose that the identification data of the parties are communicated directly. 4Art. 100. § 1. The litigation chamber has the power to 1° dismiss the complaint without follow-up; 2° order the dismissal; 3° pronouncing the suspension of the pronouncement; 4° to propose a transaction; 5° issue warnings and reprimands; 6° order to comply with requests from the data subject to exercise his or her rights; 7° order that the person concerned be informed of the security problem; 8° order the freezing, limitation or temporary or permanent prohibition of processing; 9° order compliance of the processing; 10° order the rectification, restriction or erasure of the data and the notification thereof to the recipients of the data ; 11° order the withdrawal of accreditation from certification bodies; 12° to issue periodic penalty payments; 13° to issue administrative fines; 14° order the suspension of cross-border data flows to another State or an international body; 15° forward the file to the public prosecutor's office in Brussels, who informs it of the follow-up given to the file; 16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. Decision 06/2023 – 5/5 FOR THESE REASONS, the Litigation Chamber of the Data Protection Authority decides, subject to the introduction of a request by the defendant for treatment on the merits in accordance with to articles 98 e.s. of the ACL: - pursuant to Article 58.2.c) of the GDPR and Article 95, §1, 5° of the LCA, to order the defendant to comply with the request of the person concerned to exercise his right of access (article 15.1 of the GDPR) regarding the consultation of his register national level, and to send the information to the complainant within the time limit 30 days from the notification of this decision; - to order the defendant to inform by e-mail the Data Protection Authority data (Litigation Chamber) of the follow-up given to this decision, in the same deadline, via the e-mail address email@example.com; And - if the defendant does not comply in good time with what is requested of it above, to deal ex officio with the case on the merits, in accordance with articles 98 e.s. of the ACL. In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged, within thirty days of its notification, to the Court of Markets (court d'appel de Bruxelles), with the Data Protection Authority as defendant. Such an appeal may be introduced by means of an interlocutory request which must contain the information listed in article 1034ter of the Judicial Code. The interlocutory motion must be filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 6 via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.). (se). Hielke H IJMANS President of the Litigation Chamber 5 The request contains on pain of nullity: (1) indication of the day, month and year; 2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or Business Number; 3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned; (4) the object and summary statement of the means of the request; (5) the indication of the judge who is seized of the application; 6° the signature of the applicant or his lawyer. 6The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter recommended to the court clerk or filed with the court office.