APD/GBA (Belgium) - 137/2021

From GDPRhub
APD/GBA (Belgium) - 137/2021
LogoBE.png
Authority: APD/GBA (Belgium)
Jurisdiction: Belgium
Relevant Law: Article 12(3) GDPR
Article 14 GDPR
Article 15 GDPR
Article 17(1) GDPR
Article 21(2) GDPR
Type: Complaint
Outcome: Upheld
Started:
Decided: 08.12.2021
Published:
Fine: 10000 EUR
Parties: n/a
National Case Number/Name: 137/2021
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): Dutch
Original Source: Beslissing ten gronde 137/2021 van 8 december 2021 (in NL)
Initial Contributor: Enzo Marquet

The Belgian DPA fined a company €10,000 for having bought and used a database for marketing purposes, without ensuring that this database had been gathered lawfully, and for failing to respect the rights of the data subjects, including the right to information, the right to object, and the right to erasure of personal data.

English Summary[edit | edit source]

Facts[edit | edit source]

An individual (the Complainant) received a direct marketing email from a company (the Defendant) in relation to their plans to renovate their property. The Complainant reached out to the Defendant to object to the further processing of their personal data for marketing purposes, to ask how the Defendant had obtained their personal data, and to request the erasure of their personal data. The Defendant first ignored the requests of the Complainant and later explained that it had bought the database from an external company, thinking that these data had been gathered lawfully.

Holding[edit | edit source]

The Belgian DPA first stated that this case was touching upon to the core of the GDPR. Several violations were found, as further detailed below.

Violation of the right to information (Article 14 GDPR)[edit | edit source]

In accordance with Article 14 GDPR, when personal data are not received from the data subjects directly, the data subjects must be informed by the controller at the latest within a month of receiving the personal data, or upon initiating contact. The Belgian DPA stressed that the exceptions to this obligation are to be interpreted very narrowly, as transparency is at the core of the GDPR. In this case, it was found that the Defendant had failed to inform the data subjects following the indirect collection of their personal data and the intended processing.

Violation of the right to access (Article 15 GDPR), the right to object (Article 21 GDPR) and the right to erasure (Article 17 GDPR)[edit | edit source]

In accordance with Article 15 GDPR, data subjects have the right to request access and receive information about the processing of their personal data from controllers. Under Article 21 GDPR and Article 17 GDPR, data subjects also have the right to object to the processing of their personal data, and to request the erasure of their personal data.

The Belgian DPA observed that the Complainant had exercised each of these rights by sending a request to the Defendant and that, in accordance with Article 12(3) GDPR, the Defendant should have addressed these requests timely and exhaustively. In particular, information should have been provided as to which measures the Defendant was intending to take in response of the Defendant's objection (Article 21(2) GDPR) and erasure request (Article 17 GDPR). The Belgian DPA stressed that the right to object is absolute in case of marketing-related processing and that data could only have been retained if they were processed for a different purpose with a separate legal basis (which was not the case in the situation at hand).

As a result, the Belgian DPA found that the Defendant had violated Article 15, 21 and 17 GDPR, read in combination with Article 12(3) and (4) GDPR.

Violation of the obligation to implement appropriate technical and organisational measures (Article 24 GDPR)[edit | edit source]

The DPA also held that Article 24 GDPR puts an obligation on the controller to implement adequate technical and organisational measures to ensure its processing is done in compliance with the GDPR. As such, the Defendant should have ensured that the database which it had bought was gathered in a legal and compliant manner. In this case, however, the Belgian DPA found that the Defendant had failed to conduct due diligence before buying and using the database. As a result, the Belgian DPA also found a violation of Article 24 GDPR by the Defendant.

Aggravating and mitigating factors and imposition of a fine[edit | edit source]

The Belgian DPA took into consideration the fact that the Defendant had ignored the Complainant's request twice, and considered such fact as an aggravating factor. However, the Belgian DPA also took into account the fact that the Defendant had ultimately deleted the personal data of the Complainant and had informed the latter about how it had obtained the personal data (although with some delay); this was considered as a mitigating factor.

In conclusion, taking into account all the facts of the case, including its mitigating and aggravating factors, the Belgian DPA held that the Defendant had acted in breach of Article 14(1), Article 14(2), Article 14(3), Article 15 GDPR, Article 17(1)(c) and Article 21(2) GDPR, read in combination with Article 12(3) GDPR, and decided to impose a fine of €10,000 on the Defendant. The Belgian DPA further issued an injunction against the Defendant to bring their processing practices into compliance with the GDPR within 30 days of this decision.

Comment[edit | edit source]

Share your comments here!

Further Resources[edit | edit source]

Share blogs or news articles here!

English Machine Translation of the Decision[edit | edit source]

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.