APD/GBA (Belgium) - 140/2022
|APD/GBA - Decision 140-2022|
|Relevant Law:||Article 16 GDPR|
Article 12(3) GDPR
|National Case Number/Name:||Decision 140-2022|
|European Case Law Identifier:||n/a|
|Original Source:||GBA (in NL)|
The Belgian DPA held that, pursuant to Article 16 GDPR, a controller had to comply with a rectification request concerning incorrect contact information which prevented the data subject from receiving his daughter's progress reports.
English Summary[edit | edit source]
Facts[edit | edit source]
The data subject requested the rectification of certain contact information about himself and his daughter (Article 16 GDPR). The daughter had problems which were not further specified. The controller had passed on information to another entity to follow up on these problems. A document (Motivatiedocument) was produced to pass on information from the controller to this other entity. However, the data subject claimed that certain contact-information in this document was incorrect, such as address details and e-mail of the data subject and address details of both the daughter (living with the data subject) and her mother. The data subject stated that he didn't receive letters or e-mails regarding his daughters progress because of the incorrect contact details.
The data subject stated that the controller didn’t reply to his requests for rectification in a sufficient enough manner. The data subject made 5 requests in total. He made one request in person at 5 February 2020. He followed this up with three more requests in writing at 10 February 2020, 20 March 2020 and 6 April 2020. The last request was made by phone at 7 April 2020.
The controller stated that it had answered the request in person already (5 February 2020). The data subject objected to this because the contact information was still incorrect accoriding to the data subject. At 7 April 2020, the data subject received a letter from the controller that one of the written requests of the data subject (6 April 2020) had been well received by the controller. At 24 November 2020, the data subject filed a complaint at the DPA.
Holding[edit | edit source]
The DPA acknowledged that it had taken almost two years to make a decision, despite multiple requests of the data subject to receive more information about the circumstances of this case. The DPA stated that this was caused by the large workload of the DPA.
The DPA held that the controller must provide the data subject without delay and, in any case, within at least within one month of receiving the request, information on the follow-up given to the request, or inform the data subject that the period of one month, given the complexity of the request, is extended by two months (Article 12(3) GDPR).
The DPA held that the controller didn’t answer the data subject in a sufficient enough manner and that more than two months had passed since the data subject had made his first request. The DPA held that the controller violated Article 16 GDPR and held that the controller had to comply with the request of the data subject. The DPA didn’t sanction the controller.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/6 Dispute room Decision 140/2022 of 29 September 2022 File number : DOS-2020-06006 Subject: Complaint for failing to comply with a request for rectification The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke Hijmans, single chairperson; Having regard to Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter GDPR; Having regard to the law of 3 December 2017 establishing the Data Protection Authority, hereinafter WOG; Having regard to the internal rules of procedure, as approved by the Chamber of Representatives on December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019; Having regard to the documents in the file; has taken the following decision regarding: The complainant: Mr X, hereinafter: the complainant. The defendant: Y, hereinafter referred to as “the controller”. Decision 140/2022 - 2/6 I. Facts procedure 1. On 24 November 2020, the complainant lodged a complaint with the Data Protection Authority against the controller. Due to a certain problem of the (then minor) daughter of the complainant, the daughter followed up by the controller. The controller however, has passed this data on to another body for further follow-up. In the As part of this further follow-up, an electronic Motivation Document was drawn up. the complainant has determined, however, that it contains incorrect personal data of his daughter and himself recorded by the controller. More specifically, the following are data incorrect: a residence address of the complainant, the surname of the complainant and his daughter, the domicile details of the complainant, the e-mail address of the complainant, the domicile details of the mother and the domicile details of the daughter who resides with her father. As a result of this incorrect information, the complainant has sent certain emails and letters about the progress of his daughter not received. The complainant argues in his complaint that he submitted to the controller on 5 February 2020 in person and then on February 10, 2020 and April 6, 2020 in writing and on April 7, 2020 has telephoned the controller to provide this incorrect data to fit. However, the complainant has not been allowed a sufficient substantive answer to these requests receive. 2. On January 21, 2021, the complaint will be declared admissible by the Frontline Service on the basis of Articles 58 and 60 of the WOG and the complaint pursuant to Article 62, §1 of the WOG will be forwarded to the Disputes Chamber. II. Justification 3. The Disputes Chamber is aware that it took almost two years to resolve this complaint despite the complainant's repeated requests for more information on the status of cases on file. This is the result of the large workload at the Disputes Chamber as a result of which files have a (too) long processing time. In view of the above the complainant's repeated requests to the Disputes Chamber show that the object of the complaint has not yet been resolved in the meantime, as a result of which the Disputes Chamber proceeds to the handling the complaint. Decision 140/2022 - 3/6 II.1. Correction of data 4. The Disputes Chamber is of the opinion that the requests of the complainant, both personally dated. February 5 2020, if in writing dated. February 10, 2020, March 10, 2020, April 6, 2020, if by phone on April 7 2020 constitute an exercise of his right to rectification, as referred to in Article 16 of the GDPR. 5. Pursuant to Article 12.3 GDPR, the controller must inform the data subject without undue delay and in in any case within one month of receipt of the request, provide information regarding the follow-up given to the request, or must inform the data subject that the term of one month – given the complexity of the request – is extended by two months extended. 6. The controller replied on March 10, 2020 that the complainant already would have received answers to his questions during a personal meeting on February 5, 2020, which, according to the complainant, is incorrect because the data is still incorrect. On April 7th 2020, the complainant received a letter from the controller informing them that the letter from the complainant dated 6 April 2020 was well received and delivered to the concerned employee within the controller. 7. It does not appear from the file that the controller adequately responded to these requests on the date of the complaint, i.e. more than two months after the complainant had sent his first request. 8. The Disputes Chamber is of the opinion that on the basis of the above analysis, concluded that the controller has violated the provisions of the GDPR. 9. More specifically, the violation concerns the failure to respond to the requests of the complainant to exercise his right to rectification (Article 16 of the GDPR) and this in particular considering: - the extracts of the electronic Motivation Document from which the incorrect personal data to turn out; and - the written requests dated. February 10, 2020, March 10, 2020 and April 6, 2020 until rectification of the personal data of himself and his daughter. 10. This justifies that in the present case a decision must be taken to in accordance with Article 95, § 1, 5°, of the WOG, compliance with the complainant's request to order. 11. The present decision is a prima facie decision taken by the Disputes Chamber in accordance with article 95 WOG on the basis of the complaint submitted by the complainant, in the context of the “procedure prior to the decision on the merits and not a decision on the merits of the” Dispute Chamber within the meaning of Article 100WOG. The Dispute Chamber has thus decided on the grounds of Articles 58.2.c) and 95, §1, 5° of the Law of 3 December 2017, Decree 140/2022 - 4/6 order the controller to comply with the data subject's requests to exercise its rights, in particular the right to rectification as defined in article 16 of the GDPR. 12. The purpose of this decision is to inform the defendant that it is a has committed a breach of the provisions of the GDPR and to give them the opportunity to to still conform with the aforementioned provisions. 13. However, if the defendant does not agree with the contents of this prima facie decision and is of the opinion that it can assert factual and/or legal arguments that lead to could lead to a different decision, this can be done via the e-mail address litigationchamber@apd- gba.be submit a request for treatment on the merits of the case to the Disputes Chamber and this within 30 days of notification of this decision. 14. In the event of a continuation of the handling of the case on the merits, the Disputes Chamber will the parties on the basis of Articles 98, 2° and 3° in conjunction with Article 99 WOG invite their to submit defenses and to attach to the file any documents they deem useful. The If necessary, this decision will be definitively suspended. 15. For the sake of completeness, the Disputes Chamber points out that a hearing of the merits of the case can be lead to the imposition of the measures referred to in Article 100 WOG. 1 16. Finally, the Disputes Chamber points out the following: If one of the parties wishes to make use of the possibility to consult and copyingthefile(article95,§2,3°WOG),shouldreturntothesecretariat of the Disputes Chamber, preferably via firstname.lastname@example.org, in order to make an appointment If a copy of the file is requested, the documents will be 2 delivered electronically or otherwise by regular mail. 11° to dismiss a complaint; 2° order the suspension of prosecution; 3° order the suspension of the judgment; 4° propose a settlement; 5° to formulate warnings and reprimands; 6° order compliance with the data subject's requests to exercise his or her rights; 7° to order that the data subject is informed of the security problem; 8° order that the processing be temporarily or permanently frozen, restricted or prohibited; 9° to order that the processing is brought into conformity; 10° the rectification, restriction or deletion of data and notification thereof to the recipients of the data to command; 11° order the withdrawal of the recognition of certification bodies; 12° to impose periodic penalty payments; 13° impose administrative fines; 14° order the suspension of cross-border data flows to another State or an international institution; 15° to transfer the file to the public prosecutor's office of the Public Prosecutor in Brussels, who will inform it of the consequence that the file is given; 16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. 2Due to the extraordinary circumstances due to COVID-19, the possibility of collection at the secretariat of the Disputes Chamber is NOT provided. Moreover, in principle all communication takes place electronically. Decision 140/2022 - 5/6 III. Publication of the decision 17. Given the importance of transparency in the decision-making of the Litigation Chamber, this decision is published on the website of the Data Protection Authority. However, it is not necessary that the identification data of the parties be published directly. FOR THESE REASONS, the Disputes Chamber of the Data Protection Authority also decides, subject to the submission of a request by the controller for processing on the merits in accordance with Article 98 et seq. WOG, to: - on the basis of Article 58.2.c) GDPR and Article 95, §1, 5° WOG to the controller order that the complainant's request to exercise his rights is complied with, in particular the right to rectification (Article 16 GDPR) within the period of 30 days from the date notification of this decision; - to order the controller to the Data Protection Authority (Dispute Chamber) by e-mail within the same period of the result of this decision via the e-mail address email@example.com; and - in the absence of timely implementation of the above by the controller, the to handle the case on the merits ex officio in accordance with Articles 98 et seq. WOG. The Disputes Chamber will send a copy of the present decision to the controller To deliver. Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the notification appeal against this decision to the Marktenhof (Brussels Court of Appeal), with the Data Protection Authority as Defendant. Such an appeal may be lodged by means of an adversarial petition that the 3 1034terof the Judicial Code, the statements listed should contain .The application to 3The petition states, on pain of nullity: 1° the day, month and year; 2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or company number; 3° the surname, first name, place of residence and, where appropriate, the capacity of the person to be summoned; 4° the subject matter and the brief summary of the grounds of the claim; Decision 140/2022 - 6/6 contradiction must be submitted to the registry of the Market Court in accordance with Article 1034quinquiesof the Ger.W. , or via the Justice Deposit Information System (Article 32ter of the Ger.W.). (get). Hielke H IJMANS Chairman of the Disputes Chamber 5° the court before whom the claim is brought; 6° the signature of the applicant or of his lawyer. 4The application with its annex is sent by registered letter, in as many copies as there are parties involved, to the clerk of the court or at the registry.