APD/GBA (Belgium) - 39/2022
|APD/GBA (Belgium) - 39/2022|
|Relevant Law:||Article 12(3) GDPR|
Article 17(1) GDPR
Article 13 ePrivacy Directive
|National Case Number/Name:||39/2022|
|European Case Law Identifier:||n/a|
|Original Source:||APD/GBA (in FR)|
The Belgian DPA reprimanded a controller for failing to delete a former client's personal data in violation of Article 17(1) GDPR, and for not handling the erasure request within the one-month period under Article 12(3) GDPR.
English Summary[edit | edit source]
Facts[edit | edit source]
The data subject is a former client of the controller.
In June 2019, the data subject requested the deletion of their customer account and their personal data from the controller. They sent their request from their current email address [email address 2] and mentioned their old email address [email address 1] in the request. The controller acknowledged the receipt of the request and sent the data subject several messages assuring them that a follow-up was in progress.
However, in September 2019, the data subject received a new advertising email to email address 1, and subsequently sent a new request for deletion of their data to the controller. The controller's customer service department acknowledged the receipt of the request and announced a response within seven working days.
In October 2019, the data subject lodged a complaint with the DPA because they had not received any follow-up after their latest request. They claimed that their right to erasure (Article 17(1) GDPR) and their right to access (Article 15(1)(b) GDPR and Article 15(1)(d) GDPR) had been violated.
In February 2020, following several hearings of the parties, the controller sent a letter to the data subject, informed them about the deletion of the account linked to email address 1 and the date of deletion. Furthermore, the controller told the data subject that their request for deletion of the data related to email address 2 had been taken into account. The email addresses were stored in two seperate databases of the controller as "prospect" and "client".
The controller claimed that the data subject's request did not concern a request for access under Article 15(1)(b) GDPR and Article 15(1)(d) GDPR, but a request for information on the erasure of data by the controller.
Holding[edit | edit source]
The DPA reprimanded the controller for several violations of the GDPR.
First, the DPA found that the controller had violated Article 17(1) GDPR. Due to the superficial examination of the data subject's claim, the controller had not deleted both email addresses even though that would have been its responsibility. The fact that the two email addresses were recorded in separate databases and were not subject to the same processing was not sufficient justification to rule out a violation of Article 17(1) GDPR, especially since the data subject provided in their initial request the old email address 1. The DPA noted that the controllers procedure for managing requests has been reviewed and adapted in a way that such errors should not happen again.
Second, the DPA agreed with the controller that the data subject had not made a request for access under Article 15(1)(b) GDPR and Article 15(1)(d) GDPR, but a request for information on the erasure of data by the controller. It noted that, while the incomplete or inaccurate formulation of a request to exercise a right, in this case, the right of access, cannot be a reason not to act on it, the data subjects request objectively related to the deletion of the data and not their access. Therefore, the DPA dealt with this issue in accordance with Article 12(3) GDPR and not Article 15(1) GDPR.
Since the controller had not provided the data subject with the information on the measures taken following their request, the DPA found a violation of Article 12(3) GDPR. This provision sets a maximum period of one month to respont to such a request.
Lastly, the DPA briefly discussed the issue of the legal basis of data processing relating to direct marketing purposes, but did not reopen the proceedings at this stage in this regard.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the French original. Please refer to the French original for more details.