APD/GBA (Belgium) - 10/2023
From GDPRhub
| APD/GBA - 10/2023 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 12(3) GDPR Article 12(4) GDPR Article 15 GDPR Article 15(1) GDPR Article 15(1)(c) GDPR |
| Type: | Complaint |
| Outcome: | Other Outcome |
| Started: | 28.11.2022 |
| Decided: | 13.02.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 10/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | French |
| Original Source: | Gegevenbeschermingsautoriteit (in FR) |
| Initial Contributor: | Enzo Marquet |
Pursuant to Article 58(2)(c) GDPR, the Belgian DPA ordered a controller to comply with a data subject's objection and erasure requests. Additionally, the DPA determined that the controller should also order the recipients of the data subject's data to erase the data.
English Summary
Facts
The data subject had taken out loans at the two concerned controllers. On 8 June 2022, the data subject requested access to her personal data on the basis of Article 15 GDPR and requested information on the possible sharing of her personal data with collection companies. Both controllers did not respond to the access request.
Holding
The DPA established that Article 15(1) GDPR grants all data subject a right of access to their personal data and the right to know the recipients or categories of recipients is included through Article 15(1)(c) GDPR. This right is the cornerstone which allows data subject to verify the lawfulness of each processing activity and to rectify or erase their personal data.
The DPA held that the controllers could have breached Article 12(3) GDPR by not responding within one month, without notification and justification of the extension of this time limit as set out by Article 12(4) GDPR.
The DPA ordered the controller to comply with the access request pursuant Article 58(2)(c) GDPR and Article 95(1)(5) LCA (Law establishing the data protection authority).
Comment
This was a preliminary (Prima Facie) decision according to Article 95 WOG, prior to a decision on the merits.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/5
Litigation Chamber
Decision 10/2023 of February 13, 2023
File number: DOS-2022-05270
Subject: Lack of response to the exercise of the right of access
The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke
Hijmans, chairman;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and
to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the
data protection), hereinafter “GDPR”;
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, hereinafter
“ACL”;
Having regard to the internal regulations as approved by the House of Representatives on 20
December 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Made the following decision regarding:
.
The complainant: X, hereinafter “the complainant”;
.
Defendant: Y1, hereinafter: “Defendant 1”; .
Y2, hereinafter: “Defendant 2”; Decision 10/2023 – 2/5
I. Facts and procedure
1. The subject matter of the Complaint relates to the lack of response from Defendant 1 and the
Respondent 2 to Complainant's request for access.
The plaintiff contracted loans with defendant 1 and defendant 2.
On June 8, 2022, the complainant requested access to her personal data from
of the defendants on the basis of Article 15 of the GDPR. The complainant also indicated
want information on possible transfers of their personal data to
collection companies.
2. On November 28, 2022, the complainant lodged a complaint with the Protection Authority
data against defendants 1 and 2.
3. On January 24, 2023, the complaint was declared admissible by the Front Line Service on the
basis of Articles 58 and 60 of the LCA and the complaint is forwarded to the Litigation Chamber
pursuant to Article 62, § 1 of the LCA.
4. Pursuant to article 95 § 2, 3° of the LCA as well as article 47 of the rules of order
inside the DPA, a copy of the file may be requested by the parties. If one of
parties wishes to make use of the possibility of consulting the file, the latter is required to
contact the secretariat of the Litigation Chamber, preferably via the address
litigationchamber@apd-gba.be.
II. Motivation
5. Article 15.1 of the GDPR allows any data subject to access the data
kept by the data controller about it. This right also includes
know “the recipients or categories of recipients to whom the data to be
personal nature have been or will be communicated […]” (art. 15.1.c of the GDPR).
6. Under Article 12.3 of the GDPR, the controller has a maximum period
one month from receipt of the access request to provide a response. This
this period may, subject to conditions, be extended by an additional month (Art. 12.4 of the GDPR).
7. The Litigation Chamber emphasizes the importance of respecting the right of access of persons
concerned. This right allows data subjects to control the legality of each
1
Pursuant to article 61 LCA, the Litigation Chamber informs the parties by this decision, of the fact that the complaint has been
declared admissible.
2 Pursuant to Article 95, § 2 LCA, by this decision, the Litigation Division informs the parties of the fact that following
of this complaint, the file was forwarded to him. Decision 10/2023 – 3/5
processing activity and, where appropriate, to have the personal data rectified or erased
staff processed.
8. It appears from the documents in the file that Defendant 1 and Defendant 2 did not
responded to this request within the time limit of one month (art. 12.3 of the GDPR), without
notification and motivation of the extension of this period (art. 12.4 of the GDPR).
9. The Litigation Chamber considers that on the basis of the aforementioned facts, there is reason to
conclude that defendants 1 and 2 may have committed a violation of the provisions
of the GDPR, which justifies, in this case, taking a decision in accordance
to Article 95, § 1, 5° of the LCA, more specifically, to comply with the request of the
complainant to exercise his right of access (Article 15.1 of the GDPR).
This decision is based on the fact that the complainant transmitted to the Chamber the content of her
request to the defendants, without however providing proof of sending.
10. This decision is a prima facie decision taken by the Litigation Chamber
pursuant to Article 95 of the LCA on the basis of the complaint lodged by the complainant/the
complainant, in the context of the "procedure prior to the substantive decision" and not a
decision on the merits of the Litigation Chamber within the meaning of Article 100 of the LCA.
11. The purpose of this decision is to inform the defendants, allegedly responsible for the
treatment, because they may have committed a violation of the provisions of the
GDPR, in order to enable them to still comply with the aforementioned provisions.
12. If, however, one of the defendants does not agree with the content of this
prima facie decision and believes that it can make arguments of fact and/or
legal issues which could lead to another decision, it may address to the Chamber
Litigation a request for processing on the merits of the case via the e-mail address
litigationchamber@apd-gba.be, within 30 days of notification of the
this decision. If necessary, the execution of this decision is suspended.
during the aforementioned period.
13. In the event of further processing of the case on the merits, pursuant to Articles 98, 2° and 3°
juncto article 99 of the LCA, the Litigation Chamber will invite the parties to introduce their
conclusions and attach to the file all the documents they deem useful. If applicable, the
this decision is permanently suspended.
14. With a view to transparency, the Litigation Division finally emphasizes that a
dealing with the case on the merits may lead to the imposition of the measures mentioned in
section 100 of the ACL.
3
Section 3, Subsection 2 of the ACL (articles 94 to 97 inclusive).
4Art. 100. § 1. The litigation chamber has the power of Decision 10/2023 – 4/5
III. Publication of the decision
15. Given the importance of transparency regarding the decision-making process of the Chamber
Litigation, this decision is published on the website of the Protection Authority
Datas. However, it is not necessary for this purpose that the identification data
of the parties are communicated directly.
FOR THESE REASONS,
The Litigation Chamber of the Data Protection Authority decides, subject to
the introduction of a request by Defendant 1 or Defendant 2 for treatment
on the merits in accordance with articles 98 e.s. of the ACL:
- Pursuant to Article 58.2.c) of the GDPR and Article 95, §1, 5° of the LCA, to order
Defendant 1 and Defendant 2 to comply with the request of the
data subject to exercise their rights, more specifically the right of access (Article
15.1 of the GDPR), and this within 30 days from the date of notification of this
decision ;
- To order Defendant 1 and Defendant 2 to inform the Authority by e-mail
of data protection (Litigation Chamber) of the follow-up given to this
decision, within the same period, via the e-mail address litigationchamber@apd-gba.be; And
- If one of the defendants does not comply in due time with what is requested
above, the latter will automatically have their file examined on the merits, in accordance with the
articles 98 e.s. of the ACL.
1° dismiss the complaint without follow-up;
2° order the dismissal;
3° pronouncing the suspension of the pronouncement;
4° to propose a transaction;
5° issue warnings and reprimands;
6° order to comply with requests from the data subject to exercise his or her rights;
7° order that the person concerned be informed of the security problem;
8° order the freezing, limitation or temporary or permanent prohibition of processing;
9° order compliance of the processing;
10° order the rectification, restriction or erasure of the data and the notification thereof to the recipients of the
data ;
11° order the withdrawal of accreditation from certification bodies;
12° to issue periodic penalty payments;
13° to issue administrative fines;
14° order the suspension of cross-border data flows to another State or an international body;
15° forward the file to the public prosecutor's office in Brussels, who informs it of the follow-up given to the file;
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. Decision 10/2023 – 5/5
In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged,
within thirty days of its notification, to the Court of Markets (court
d'appel de Bruxelles), with the Data Protection Authority as defendant.
Such an appeal may be introduced by means of an interlocutory request which must contain the
5
information listed in article 1034ter of the Judicial Code. The interlocutory motion must be
6
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , Or
via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).
(Sr.) Hielke H IJMANS
President of the Litigation Chamber
5The request contains on pain of nullity:
(1) indication of the day, month and year;
2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
Business Number;
3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
(4) the object and summary statement of the means of the request;
(5) the indication of the judge who is seized of the application;
6° the signature of the applicant or his lawyer.
6 The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.
