APD/GBA (Belgium) - 146/2022

From GDPRhub
APD/GBA - 146/2022
LogoBE.png
Authority: APD/GBA (Belgium)
Jurisdiction: Belgium
Relevant Law: Article 5(1) GDPR
Article 5(1)(c) GDPR
Article 5(1)(e) GDPR
Type: Complaint
Outcome: Other Outcome
Started: 29.06.2022
Decided: 13.10.2022
Published:
Fine: n/a
Parties: n/a
National Case Number/Name: 146/2022
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): French
Original Source: Gegevensbeschermingsautoriteit (in FR)
Initial Contributor: Enzo Marquet

The DPA classifies a case without follow-up because the grievance is part of a broader dispute which can be more effectively solved through other legal remedies.

English Summary

Facts

The data subject had received a formal request to pay an outstanding electricity bill by controller 1 (a debtor) . Controller 1 subrogated the rights of controller 2 (electricity company) to recover the amounts due.

However, the data subject claims to have never lived at the address specified in the request and claims his identity was stolen. On top of that, he demands that both controllers remove his personal data from their systems. Additionally, the data subject stated that he had filed several complaints for these facts to different entities.

Holding

The DPA classifies the case without follow-up because the grievance is part of a broader dispute which can be more effectively solved through other legal remedies.

The DPA specifies that even if controller 2 was being subrogated, this does not relinquish them from correctly applying the GDPR. The DPA holds that the data subject must be informed of substantial changes, especially when the identity of the controller changes. This allows the data subject to exercise their rights appropriately.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/7








                                                                        Litigation Chamber




                                                     Decision 146/2022 of October 13, 2022





File number: DOS-2022-02818



Subject: Complaint relating to the exercise of a right to erasure – main dispute of a nature
commercial - suspicion of identity theft - dismissal




The Litigation Chamber of the Data Protection Authority, made up of Mr Hielke

Hijmans, President, sitting alone;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and

to the free movement of such data, and repealing Directive 95/46/EC (general regulation on the

data protection), hereinafter GDPR;

Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter

ACL);


Having regard to the Law of 30 July 2018 relating to the protection of natural persons with regard to
processing of personal data (hereinafter LTD);


Having regard to the Rules of Procedure as approved by the House of Representatives on 20

December 2018 and published in the Belgian Official Gazette on January 15, 2019;

Considering the documents in the file;





Made the following decision regarding:
The plaintiff: Mr. X; Hereinafter “the complainant”;


The defendant: Y1, Hereinafter “the first defendant”;


                       Y2, Hereinafter “the second defendant”;

                       Hereinafter referred to together as “the defendants”. Decision 146-22/7


I. Facts and procedure


    1. The complainant filed a complaint with the Data Protection Authority (DPA) on 29

        June 2022 against the defendants.



    2. Under the terms of his complaint, the complainant reports that he He was sent during 2022, a-

        mail of formal notice to pay the sum of [….] euros for electricity bills
        unpaid by the second defendant to whom the first defendant had assigned its

        claim, the second defendant being therefore subrogated in the rights of the first

        defendant to recover the amounts due. The plaintiff was notified of this transfer

        of debt by the aforementioned e-mail.



    3. Questioned by the plaintiff, the first defendant told the plaintiff that the
        energy consumption bill covered the period from […..] to an address at [….] to

        which the complainant indicated in response to the aforementioned email that he had never lived. There's

        also requests the deletion of his e-mail address from the database of the

        first defendant.



    4. The complainant added that it had never been provided by the first defendant, was not
        therefore not a client and therefore could not be liable for any sum for its benefit

        nor to that of the second defendant subrogated in the rights of the first.



    5. The complainant alleges identity theft and, according to the complaint form

        filed, requests the deletion of his e-mail address from the database of both the

        first than of the second defendants.


    6. According to the complaint form submitted, the complainant also indicates that he has filed

        Complaint to different authorities for the same facts:

        - Complaint to the first defendant for the unauthorized use of one email

            as of his name;

        - Complaint to the second defendant;

        - Complaint to the police for identity theft;
        - Complaint to the FPS Economy against the second defendant regarding

            amicable collection;

        - Complaint to the CWAPE (Walloon Energy Commission), either to the

            Walloon regulator for the electricity and gas market, contrary to the first

            defendant. Decision 146/2-3/7



    7. On July 4, 2022, the Front Line Service (SPL) of the APD declared the complaint of the

         admissible complainant and forwarded it to the Litigation Chamber.




II. Motivation



    8. Based on the facts described in the complaint file as summarized above, and on the

         basis of the powers attributed to it by the legislator under Article 95.1.

         LCA, the Litigation Chamber decides to proceed with the filing of the complaint without follow-up,

         in accordance with article 95.1, 3° LCA, for the reasons set out below.



    9. In terms of classification without further action, the Litigation Chamber must give reasons for its decision by

         step and:


         - to pronounce a classification without technical continuation if the file does not contain or not

                 sufficient elements likely to lead to a sanction or if it includes a

                 technical obstacle preventing him from rendering a decision;


         - or pronounce a classification without further opportunity, if despite the presence

                 elements likely to lead to a sanction, the continuation of the examination of the

                 file does not seem to him to be appropriate given the priorities of ODA such as

                 specified and illustrated in the Chamber's Discontinued Classification Policy

                 Litigation. 2


    10. In the event of dismissal on the basis of several reasons (respectively,

         classification without technical and/or opportunity follow-up), the reasons for the classification without follow-up

         should be addressed in order of importance. 3



    11. In this case, the Litigation Chamber decides to proceed with a classification without follow-up

         of the complaint for the reason of opportunity explained below (points 16 et seq.).




    12. Beforehand, however, the Litigation Chamber wishes to specify that if the second

         defendant certainly claims to be subrogated in the rights of the first defendant, it does not

         remains, however, that the latter remains bound to apply all the provisions




1Cour des marchés (Brussels Court of Appeal), 2 September 2020, 2020/AR/329, p. 18.

2https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
litigation.pdf

3 Discontinued policy of the Litigation Chamber, 06/18/2021, point 3 (“In which cases is my complaint

likely to be dismissed by the Litigation Chamber?”), available on
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
litigation.pdf Decision 146/-4/7


        relevant to the GDPR to the complainant's data that it processes, including therefore those

        that it would consider it could legitimately keep.



    13. Similarly, if the second defendant came into possession of data at

        personal character of the plaintiff, even by the assignment of debt between the

        defendants, it is, in its capacity as data controller in this case

        (quality which it also claims in the terms of the letter sent to the current complainant

        2022) also required to apply the relevant provisions of the GDPR.



    14. More generally, the person concerned must be informed of a change of

        data controller when, as in the present case, such a change occurs. The

        Guidelines of the European Data Protection Board (EDPB) on the

        transparency specify in this regard that the responsibility for transparency
        applies not only at the time of collection of personal data,

        but also throughout the life cycle of their treatment. The person concerned must be

        informed of any substantial modification. The factors that those responsible for the

        treatment should take into account when assessing what constitutes a

        substantial change include the impact on the data subject

        (including his ability to exercise his rights) and the unexpected or surprising nature of the

        change. Changes to the privacy policy that should always be

        communicated to the person concerned are, in particular, a modification of the purpose

        processing; a change in the identity of the controller; or a

        change in the way data subjects can exercise their rights
                                            4
        concerning processing (point 29) .



    15. In the present case, it appears from the documents in the file that in the email by which the second
        defendant informs the plaintiff (alleged debtor) of the assignment of debt that has taken place,

        the second defendant adds that it now acts as the person responsible for

        processing with regard to the data linked to this debt and refers the complainant to its policy

        confidentiality.



    16. With regard to the classification without further opportunity that it decides, the Litigation Chamber

        is based on criterion B.3. of its Discontinued Classification Policy Note, the case of which

        of species is an illustration.




4During the inaugural meeting of 25 May 2018, the European Data Protection Board (EDPS) took on its own account
theGuidelinesadoptedon29November2017byGroup29ontransparencywithinthemeaningoftheEURegulation
679/2016: https://edpb.europa.eu/our-work-tools/our-documents/guidelines/transparenThis is the Chamber
Litigation that stresses. Decision 146-5/72


    17. Under this criterion, the Litigation Division states that complaints incidental to

        a broader dispute that can be more effectively argued in other forums

        more directly competent are likely to be dismissed. 5



    18. In this regard, the Litigation Division notes that the issue of data protection

        raised by the complainant in this case (i.e. the request to delete his e-mail address

        databases of the defendants) is incidental to the contestation of the debt that he

        would have (or not) initially contracted with respect to the first defendant, which

        assigned its (alleged) claim to the second defendant. The complainant indicates in this sense

        have filed a complaint both with these two companies and with the energy regulator
        (CWaPE) and the FPS Economy. Likewise, this disputed debt would be the

        consequence of identity theft for which the complainant mentions having seized

        police services.



    19. The Litigation Chamber therefore concludes that in this case, the complaint addressed to the DPA is

        incidental to a commercial dispute between the parties. It is certainly not excluded

        that the outcome of this dispute has consequences in terms of the protection of

        data. However, the Litigation Chamber is neither able nor authorized to prejudge this.

        It is therefore limited to recalling, with regard to the specific case, and without prejudice to its decision

        to close the complaint without follow-up, that under the terms of the principle of minimization devoted to
        Article 5.1c) of the GDPR, the data processed must be adequate, relevant and limited

        to what is necessary in relation to the purposes for which they are processed. Likewise,

        in application of the principle of limitation of storage set out in Article 5.1. e) from

        GDPR, the data cannot be kept in a form allowing identification

        data subjects only for a period not exceeding that necessary for the

        with regard to the purposes for which they are processed.



    20. In conclusion, as explained in point 11 above, the Litigation Chamber classifies

        the complaint dismissed for reasons of opportunity.



III. Publication and communication of the decision



    21. Given the importance of transparency with regard to the decision-making process and the
        decisions of the Litigation Chamber, this decision will be published on the website of

        ODA. However, it is not necessary for this purpose that the identification data of the

        parties are directly mentioned.


5Idem footnote 4. The Litigation Chamber specifies in its note that if the complaint presents a societal interest
importantly, it can of course decide to deal with the complaint further. For all practical purposes, the Litigation Chamber does not
does not conclude that this is the case with the Complainant's complaint. Decision 146/20-26/7





     22. As set out in its Discontinued Classification Policy, the Litigation Chamber

         generally communicates its classification decisions without follow-up to the game

                           6
         defendant. Indeed, the Litigation Chamber has decided to communicate to him its

         classification decisions with no follow-up by default. The Litigation Chamber abstains

         however, of such communication when the complainant has requested anonymity vis-à-vis

         the defendant and when the communication of the decision to the latter, even

         pseudonymised, may nevertheless allow its re-identification. In this case, the 7

         complainant requested under the terms of the complaint form that his data be masked.

         The Litigation Chamber therefore refrains in this case from communicating this

         decision to the defendants.





    FOR THESE REASONS,

    the Litigation Chamber of the Data Protection Authority decides, after

    deliberation:

    - to close the present complaint without further action in application of article 95. 1.3° of the Law of3


         December 2017 establishing the Data Protection Authority (hereinafter, the

         ACL).







Under Article 108.1 LCA, this decision may be appealed to the Court of

contracts (Brussels Court of Appeal) within 30 days of its notification, with

DPA as respondent.


Such an appeal may be introduced by means of an interlocutory request which must contain the
                                                                                       8
information listed in article 1034ter of the Judicial Code (C. jud.) . The interlocutory motion





6
 See Discontinued classification policy of the Litigation Chamber, 06/18/2021, title 5 ("The discontinued classification will be
he publishes? will the opposing party be informed?”), available at
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
litigation.pdf.

7 https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
contentieuse.pdf (title 5 Will the classification without follow-up be published? Will the opposing party be informed?)


8
 The request contains on pain of nullity:
 (1) indication of the day, month and year;
 2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
     Business Number;
 3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
 (4) the object and summary of the grounds of the application;

 (5) the indication of the judge who is seized of the application;
 6° the signature of the applicant or his lawyer. Decision 146/20-27/7




must be filed with the registry of the Market Court in accordance with article 1034quinquies of the C.
    9
jud. , or via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).







(se). Hielke Hijmans


President of the Litigation Chamber


































































9The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.