APD/GBA (Belgium) - 14/2025
From GDPRhub
| APD/GBA - 14/2025 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 12(3) GDPR Article 12(4) GDPR Article 15(1) GDPR Article 15(3) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 27.07.2023 |
| Decided: | 23.01.2025 |
| Published: | 23.01.2025 |
| Fine: | n/a |
| Parties: | A data subject (an employee) A data controller (an employer) |
| National Case Number/Name: | 14/2025 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | French |
| Original Source: | APD/GBA (in FR) |
| Initial Contributor: | claratab |
The DPA held that offering to show the data subject their personal data at a meeting was not an adequate response to an access request.
English Summary
Facts
The 10 May 2021, an employee (the data subject) sent their employer (the controller) a request to access to their personal data. The data subject specifically required a copy of a document showing their working hours.
The 2 March 2023, the controller sent a letter to the data subject, offering to make an appointment to come to the firm’s head office to consult their data.
The data subject did not react to the controller’s proposal.
The 27 July 2023, the data subject lodged a complaint to the DPA.
Holding
The DPA ordered the controller to comply with the data subject’s request for a copy.
The DPA reminds that the data subject has a right to obtain confirmation of the processing and to access their personal data (Article 15(1) GDPR). In addition, the data subject has the right to obtain a copy of their personal data processed (Article 15.3).
The DPA considered that the right to a copy must be understood as a way of giving the data subject access to their personal data, so that its purpose is to serve the objective of the right of access.
The DPA points out that the CJEU defined the right to a copy in a previous decision Österreichische Datenschutzbehörde as the right to obtain a comprehensible and accurate reproduction of all data, whether it is a reproduction of an entire document or an extract from a data base. This is why the DPA decided that a temporary consultation could not be sufficient.
What’s more, the DPA warned the controller of a potential violation of Article 12(3) and Article 12(4) GDPR. The DPA noticed that the controller should have facilitate the exercise of the right of access and answered without undue delay and within a month to the data subject request.
Comment
The DPA emphasised that the data subject’s right to obtain confirmation of the processing and access to their personal data is the first step in enabling the data subject to exercise their other rights. So the right to a copy of their personal data must serve the purpose of the right of access.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/9 Litigation Chamber Decision 14/2025 of 23 January 2025 File number: DOS-2023-03100 Subject: Complaint against a company following the refusal to respond to a request for access to obtain a copy of the service sheets The Litigation Chamber of the Data Protection Authority, consisting of Mr. Hielke H IJMANS, President; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter "GDPR"; Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, hereinafter "LCA"; Having regard to the internal regulations as approved by the House of Representatives on 20 December 2018 and published in the Belgian Official Journal on 15 January 2019; 2 Having regard to the documents in the file; Has taken the following decision concerning: The complainant: X, hereinafter "the complainant"; The defendant: Y, hereinafter: "the defendant". 1The DPA recalls that the revised organic law entered into force on 01/06/2024. It only applies to complaints, mediation files, requests, inspections and procedures before the Litigation Chamber initiated from that date. Cases initiated before 01/06/2024, such as this case, are subject to the provisions of the old version of the LCA accessible here: https://www.autoriteprotectiondonnees.be/publications/loi-organique-de-l-apd.pdf 2The new internal regulations of the APD, following the amendments made by the Law of 25 December 2023 amending the law of 3 December 2017 establishing the Data Protection Authority (LCA) came into force on 01/06/2024. It only applies to complaints, mediation cases, requests, inspections and procedures before the Litigation Chamber initiated from this date. Cases initiated before 01/06/2024 are subject to the provisions of the internal regulations as they existed before this date. Decision 14/2024 — 2/9 I. Facts and procedure 1. On 27 July 2023, the complainant lodged a complaint with the Data Protection Authority (hereinafter “the DPA”) against the respondent. 2. The complaint was lodged by the complainant following the respondent’s refusal to respond to a request for access to obtain a copy of his performance sheets. 3. On 10 May 2021, the complainant requested the respondent to provide him with the corrections to all performance sheets since the date of his entry into service (hereinafter “disputed documents”). 4. In a letter dated 17 January 2022, the complainant's lawyer also allegedly requested the defendant to produce the complainant's benefit sheets so that he could verify the recording of his hours in light of the irregularities he had noted; as well as explanations regarding his salary scale qualification. 5. On 3 April 2022, after the complainant's request for access had been rejected by the defendant, the complainant contacted the social inspection of the Social Laws control of Verviers. The complainant asked the inspector to be able to consult his benefit sheets from 10 May 2016 to 10 May 2021. On 4 April 2022, the social inspector replied that he could not himself provide him with a copy of such information given the workload that this would represent. Furthermore, he does not have the benefit sheets for 2016, 2017 and 2018, because as a social inspector, he can only monitor over a period of 3 years. The inspector explains to the complainant that he can remind the defendant of its obligation to give him access to these documents on the basis of the work regulations, but that he cannot force it to do so. 6. On 20 and 27 July 2023, the complainant states in the complaint form and in an email addressed to the SPL that the defendant has repeatedly refused to provide him with a copy of his benefit sheets and adds that he has already sent several formal notices to the defendant on this subject. 7. On 13 October 2023, the complaint was declared admissible by the Front Line Service (hereinafter “FLS”) on the basis of Articles 58 and 60 of the LCA and the complaint was forwarded to the 1st Litigation Chamber pursuant to Article 62, § 1 of the LCA. 8. On 14 February 2024, the Litigation Chamber sent a letter to the complainant, requesting him to kindly provide, by 28 February 2024 at the latest, a dated copy of his exchanges with the defendant, and in particular the email(s) stating their refusal to provide a copy of his service sheets. On 27 February 2024, the complainant communicated 3Pursuant to Article 61 LCA, the Litigation Chamber informs the parties by this decision that the complaint has been declared admissible. Decision 14/2024 — 3/9 to the Litigation Chamber several documents, including a copy of its initial request for access dated 10 May 2021, but without providing a copy of the defendant’s response. 9. On 22 October 2024, the Litigation Chamber sent a letter to the parties in which it communicated several pieces of information.4 It stated that the file did not sufficiently present the defendant’s position regarding its refusal to respond to the complainant’s request for access. The Litigation Chamber considered that it was essential to have the defendant’s position in order to properly assess the arguments under Articles 15.4 and 12.5 of the GDPR. The complainant’s position was sufficiently developed. The Litigation Chamber therefore asks the defendant to provide reasons for the reasons why it considers that it does not have to respond to the complainant's request for access, based on Article 15.3 of the GDPR, seeking a copy of his service sheets since he entered service, i.e. from 10 May 2016 to 10 May 2021. It asks the defendant to send its response by 25 November 2024. 10. On 4 November 2024, the defendant replied that it disputed having refused to respond to the complainant's request for access. The defendant provided a letter dated 2 March 2023, addressed to the complainant, in which it states the following: "With regard to the (complainant's) request for the communication of his benefit sheets, I confirm to you - again and to the extent necessary - that (the complainant) may view them at the (defendant's) head office, located at XX, outside working hours and by making an appointment in advance. These documents may be consulted in electronic form since, as part of the digitalisation process in force within the (defendant), these documents are stored in electronic form". The defendant also provided a letter dated 14 April 2023 in which it reiterated its position as follows: "With regard to the consultation of the benefit sheets, I can only refer you to our previous discussions". The defendant explains that following these two letters, it has not received any reaction, either from the complainant or from his counsel. 4 Pursuant to Article 95, § 2 LCA, by this letter of 22 October 2024, the Litigation Chamber informs the parties in particular that following this complaint, the file has been forwarded to it, as well as the possibility of consulting and copying said file Decision 14/2024 — 4/9 II. Reasons 11. The Litigation Chamber recalls that in its capacity as data controller, the defendant is required to comply with the principles of data protection and must be able to demonstrate that these are complied with (principle of liability – Article 5.2. of the GDPR). It must also implement all necessary measures to this end (Article 24 of the GDPR). 12. Article 12 of the GDPR relating to the methods of exercising their rights by data persons provides in particular that the data controller must facilitate the exercise of their rights by the data subject (Article 12.2 of the GDPR) and provide them with information on the measures taken following their request as soon as possible and at the latest within one month of their request (Article 12.3 of the GDPR). When the data controller does not intend to comply with the request, they must notify their refusal within one month, accompanied by information that an appeal against this refusal may be lodged with the data protection supervisory authority (12.4 of the GDPR). 13. Pursuant to Article 15.1 of the GDPR, the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed. Where this is the case, the data subject has the right to obtain access to the said personal data as well as a series of information listed in Article 15.1 a) to h) such as the purpose of the processing of his or her data, the possible recipients of his or her data as well as information relating to the existence of his or her rights, including the right to request rectification or erasure of his or her data or the right to lodge a complaint with the DPA. 14. Pursuant to § 3 of Article 15 of the GDPR, the data subject has the right to obtain a copy of the personal data that are being processed. This provision specifies that when the data subject submits his/her request electronically, the information shall be provided in a commonly used electronic form, unless the data subject requests otherwise. Article 15(4) of the GDPR provides that this right to copy may not infringe the rights and freedoms of others. 15. With regard to the procedures that a data controller must follow following a request for access from a data subject, the Litigation Chamber recalls that the obligation to provide a copy provided for in Article 15.3 of the GDPR should not be understood as an additional right of the data subject, but as a way of providing access to the data. Therefore, access to data under Article 15.1 GDPR must include all information about all data and such access cannot therefore be understood as granting access only to a summary of the data. Decision 14/2024 — 5/9 The obligation to provide a copy serves the purposes of the right of access, namely to allow the data subject to become aware of and control the lawfulness of the processing (recital 63 GDPR). In order to achieve these purposes, it is in most cases not sufficient for the data subject to be able to temporarily consult the information. Therefore, the data subject must access the information by receiving a copy of the personal data. 16. In this regard, the Court of Justice stated in the case of Österreichische Datenschutzbehörde that "the right to obtain from the controller a copy of the personal data being processed implies that the data subject must be provided with a faithful and intelligible reproduction of all of those data. This right includes the right to obtain a copy of extracts from documents or even entire documents or extracts from databases which contain, inter alia, those data, if the provision of such a copy is essential to enable the data subject effectively to exercise the rights conferred on him by that regulation, it being emphasised that account must be taken in this regard of the rights and freedoms of others". 17. The Litigation Chamber also recalls, as it has done in the past, that the right of access is one of the essential requirements of the right to data protection, since it constitutes the "gateway" that allows the exercise of the other rights that the GDPR confers on the data subject. 18. In this case, the complainant exercised his right of access on several occasions with the defendant, requesting, in particular on 10 May 2021, the transmission of a copy of his service sheets in accordance with Article 15.3 of the GDPR. After being questioned by the Litigation Chamber on 22 October 2024 on this subject, the defendant was not able to justify why it did not provide the requested copy. The defendant did not invoke any exception on the basis of Articles 15.4 or 12.5 of the GDPR. Indeed, in response to the complainant’s request, the defendant only offered him the possibility of “examining the documents at the defendant’s registered office” and stated that it had not received any reaction from the complainant (paragraph 10). It considers that by only offering on-site consultation, it did not act incorrectly. However, the requests for access made by the complainant did not concern a simple temporary consultation of the disputed documents, but explicitly sought to obtain a copy of these documents. In its exchanges with the complainant, the defendant ignored these requests for copies. Furthermore, it provided neither the complainant nor the Chamber with any 5 CJEU, 4 May 2023, F.F. v. Austrian Data Protection Authority, C-487/21, ECLI:EU:C:2023:369, para 45 6Contempt Chamber, decision on the merits 15/2021 of 9 February 2021; decision on the merits 72/2021 of 14 June 2021; decision on the merits 27/2023 of 13 March 2023. Decision 14/2024 — 6/9 Contentious explanations justifying the impossibility of transmitting the documents by electronic means or specified the reasons why the consultation had to be limited to on-site access. The impossibility of transmitting a copy electronically is surprising, especially since the defendant claims to have initiated a process of digitisation and that the disputed documents can be consulted in electronic form (point 10). 19. The Litigation Chamber considers that on the basis of the above-mentioned facts, it is appropriate to conclude that the defendant may have violated Articles 15 and 12 of the GDPR, which justifies that in this case, a decision be taken in accordance with Article 95, § 1, 5° of the LCA, more precisely to order compliance with the complainant’s request to follow up on his request for access and copy on the basis of Article 15 of the GDPR. This also justifies addressing, in accordance with Article 95, § 1, 4° of the LCA, a warning to the defendant to respond in the future to requests for the exercise of rights and the possible breach of Articles 15, 12.3, and 12.4 of the GDPR. 20. This decision is a prima facie decision taken by the Litigation Chamber in accordance with Article 95 of the LCA on the basis of the complaint lodged by the complainant, within the framework of the “procedure prior to the substantive decision” and not a decision on the merits of the Litigation Chamber within the meaning of Article 100 of the LCA. 21. The purpose of this decision is to inform the defendant, presumed controller, of the fact that it may have committed a violation of the provisions of the GDPR, in order to enable it to still comply with the aforementioned provisions. 22. If the defendant does not agree with the content of this prima facie decision and considers that it can provide factual and/or legal arguments that could lead to a new decision, it may request a review by the Litigation Chamber in accordance with the procedure established by Articles 98juncto99 of the LCA, known as the "procedure on the merits" or "processing of the case on the merits". This request must be sent to the email address litigationchamber@apd-gba.be within 30 days of notification of this prima facie decision. Where applicable, the execution of this decision is suspended for the aforementioned period. 23. In the event of continued processing of the case on the merits, pursuant to Articles 98, 2° and 3° juncto Article 99 of the LCA, the Litigation Chamber will invite the parties to submit their submissions and to attach to the file all the documents they deem useful. Where applicable, this decision is definitively suspended. 7Section 3, Subsection 2 of the LCA (Articles 94 to 97 inclusive). Decision 14/2024 — 7/9 24. In the interests of transparency, the Litigation Chamber finally stresses that processing of the case on the merits may lead to the imposition of the measures referred to in Article 100 of the LCA. 8 25. Finally, the Litigation Chamber also draws attention to the following: In application of Article 95 § 2, 3° of the LCA as well as Article 47 of the internal rules of the APD, a copy of the file may be requested by the parties. If one of the parties wishes to make use of the possibility of consulting the file, it is required to contact the secretariat of the Litigation Chamber, preferably via the address litigationchamber@apd-gba.be. III. Publication of the decision 26. Given the importance of transparency regarding the decision-making process of the Litigation Chamber, this decision is published on the website of the Data Protection Authority. However, it is not necessary for this purpose that the parties’ identification data be directly communicated. 8 er Art. 100. § 1 . The litigation chamber has the power to 1° dismiss the complaint without further action; 2° order that there be no case to answer; 3° order the suspension of the decision; 4° propose a transaction; 5° issue warnings and reprimands; 6° order compliance with the requests of the person concerned to exercise their rights; 7° order that the person concerned be informed of the security problem; 8° order the freezing, limitation or temporary or permanent prohibition of the processing; 9° order that the processing be brought into compliance; 10° order the rectification, restriction or erasure of the data and the notification of these to the recipients of the data; 11° order the withdrawal of the accreditation of certification bodies; 12° impose periodic penalty payments; 13° impose administrative fines; 14° order the suspension of cross-border data flows to another State or an international organisation; 15° forward the file to the public prosecutor's office of the Public Prosecutor of Brussels, who will inform him of the follow-up given to the file; 16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority.[ Decision 14/2024 — 9/9 10 1034quinquies of the Judicial Code, or via the e-Deposit information system of the Ministry of Justice (Article 32ter of the Judicial Code). (sé). Hielke H IJMANS President of the Litigation Chamber 10The application, accompanied by its annex, is sent, in as many copies as there are parties involved, by registered letter to the clerk of the court or filed with the registry.
