APD/GBA (Belgium) - 44/2026
From GDPRhub
| APD/GBA - 44/2026 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 15(1) GDPR Article 15(3) GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 04.03.2026 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 44/2026 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | APD (in NL) |
| Initial Contributor: | dt |
The DPA held that an employer sufficiently complied with an employee’s access request by providing personal data through reproduction rather than extraction of complete emails.
English Summary
Facts
An employee (the data subject) of a company (the controller) lodged a complaint with the Belgian DPA (APD) claiming that the controller failed to comply with his access request by limiting his access to certain data, such as full extracts from email correspondence.
The data subject previously emailed a person within the company from a private email address. Later on, he received a message to his professional email account from a different employee asking him to confirm whether he had sent the initial email.
Subsequently, the data subject requested access to his personal data, including an overview of recipients of his personal data, all reports and notifications about him, and a copy of his personnel file, among other things.
Following his request, the data subject received a file containing his personal data and further information collected from a manager.
However, the data subject filed a complaint with the DPA arguing that the controller failed to comply with his access request.
Holding
The DPA dismissed the data subject’s complaint, noting that an in-depth investigation would not be proportionate. It held that in this case the controller complied sufficiently with the access request under Article 15(1) GDPR and Article 15(3) GDPR even if it disclosed personal data from emails through reproduction, rather than extraction.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/7 Dispute Resolution Chamber Decision 44/2026 of 4 March 2026 File number: DOS-2022-02152 Subject: A request for access to email correspondence The Dispute Resolution Chamber of the Data Protection Authority; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter "GDPR"; Having regard to the Act of 3 December 2017 establishing the Data Protection Authority, hereinafter "WOG"; Considering the internal rules of procedure, as approved by the House of Representatives on 20 December 2018 and published in the Belgian Official Gazette on 15 January 2019; Considering the documents in the dossier; Issued the following decision regarding: Complainant: X, hereinafter "the complainant" Defendant: Y, with registered office [...], with company number [...], hereinafter "the defendant" Decision 44/2026 — 2/7 I. Facts and procedure 1. The complainant is an employee of Y. On November 6, 2021, he submitted a question regarding Y to Z via his private email address. A few days later, on November 9, 2021, the complainant received an email from an employee of Y at his professional email address, asking him to confirm whether he had sent the email of November 6, 2021. On June 20, 2022, the complainant contacted Y's Data Protection Officer (hereinafter "DPO"). He requested an overview of all recipients to whom his personal data had been sent, a correction of inaccuracies in his personal data, an overview of all reports and notifications about him maintained by Y, and an annual copy of his personnel file. On July 1, 2022, Y's DPO referred the complainant to the appropriate email address to submit his requests. On July 13, 2022, and October 7, 2022, the complainant reiterated his requests to this email address. On October 18, 2022, he received a file containing his personal data. On February 8, 2023, he received further personal data that the respondent collected from the complainant's manager after he had given his consent. 2. On April 10, 2023, the complainant submitted a request for mediation. 3. On August 8, 2023, the complainant filed a complaint with the Data Protection Authority against the defendant. 4. On August 8, 2023, the complaint was declared admissible by the First Line Service pursuant to Articles 58 and 60 of the Dutch Data Protection Act (WOG) and, pursuant to Article 62, § 1 of the WOG, the complaint was transferred to the Dispute Resolution Chamber. 5. On January 7, 2025, the complainant requested information about the status of the case. He repeated this request several times. The Dispute Resolution Chamber concluded from this that the complainant wishes to maintain his complaint. II. Reasons II.1. Regarding the "request for information" regarding Z 6. The Dispute Resolution Chamber notes that the complainant refers to data processing by the office of the then Z. However, he does not formally file a complaint or mediation request against this party, but rather a "request for information." The Dispute Resolution Chamber thus determines that this party falls outside the scope of this complaint, and the associated data processing is not addressed in this decision. Decision 44/2026 — 3/7 II.2. Regarding the request for access to Y 7. The complainant states that the respondent refuses to comply with his right of access. The complainant allegedly requested access to his professional file, but the respondent allegedly did not sufficiently comply with his request by limiting access to certain data instead of providing a copy of the complete file. The complainant specifically requested complete extracts of documents such as email correspondence. 8. In the context of the mediation procedure, the respondent stated that, when exercising the right of access, it provides the processed personal data without systematically providing a full copy of that data unless this is necessary for the exercise of other rights under the GDPR. According to the respondent, all processed personal data, including data from the email correspondence within his hierarchical line, were provided to the complainant, so that transferring the complete emails was not required for the exercise of his rights to rectification, erasure, or restriction. Furthermore, the respondent considers that providing a full copy of the email correspondence would disproportionately harm the fundamental rights and freedoms of the authors and other data subjects. In this context, the Board examined whether a balance could be struck between the access request and the rights of third parties, and concluded that anonymizing the sender and recipient would not provide sufficient protection given the contextual identifiability. Finally, the defendant's DPO confirmed that he had taken note of the email correspondence in question and that the information provided to the complainant consistent with it. 9. Based on the elements in the file known to the Dispute Resolution Chamber and based on the powers conferred on it by the legislator pursuant to Article 95, § 1 of the Dutch Data Protection Act (WOG), the Dispute Resolution Chamber decides on the further follow-up of the file; in this case, the Dispute Resolution Chamber dismisses the complaint in accordance with Article 95, § 1, 3° of the WOG, based on the following reasoning. 10. When a complaint is dismissed, the Litigation Chamber must gradually justify its decision and: - issue a technical dismissal if the case file contains no or insufficient elements that could lead to a conviction, or if there is insufficient prospect of a conviction due to a technical impediment, preventing it from reaching a decision; 1 Brussels Court of Appeal, Market Court Section, 19 Chamber A, Market Chamber, judgment 2020/AR/329, 2 September 2020, p. 18. Decision 44/2026 — 4/7 - or issue a policy dismissal if, despite the presence of elements that could lead to a sanction, continuing the investigation of the case file does not seem appropriate in light of the priorities of the Data Protection Authority, as specified and explained in the dismissal policy of the Litigation Chamber. 2 11. If the case is dismissed on more than one ground, the grounds for dismissal (respectively technical dismissal and policy dismissal) must be dealt with in order of importance. 3 12. In the present case, the Dispute Resolution Chamber will dismiss the complaint on the grounds of expediency. There are two reasons underlying the decision of the Dispute Resolution Chamber as to why it considers it undesirable to pursue the case further and therefore decides not to proceed, inter alia, with a hearing on the merits. 13. The Dispute Resolution Chamber finds that an in-depth investigation of the complaint would not be proportionate, taking into account the resources required to investigate the complaint and the likelihood of success. 4 14. The complaint concerns the scope of the right of access, and more specifically whether the right of access entails that the complainant has the right to receive a copy of full excerpts from their personnel file, and more specifically whether they have the right to receive a copy of emails concerning them. 15. Article 15.1 GDPR stipulates that the data subject has the right to obtain confirmation from the controller as to whether or not personal data concerning them are being processed and, where that is the case, to access that personal data and the information included in Article 15.1(a) – (h) GDPR. Furthermore, Article 15.3 GDPR stipulates that the complainant has the right to receive a copy of the personal data undergoing processing. In accordance with Article 15.4 GDPR, this may not impair the rights and freedoms of others. 16. The Court of Justice ruled that Article 15.3 of the GDPR grants the data subject the right to obtain a faithful reproduction of his or her personal data—broadly defined—that have been processed by the controller in a way that must be considered processing. The term “copy” does not refer to a document as such, but to the personal data it contains, which must be complete. The copy must therefore contain all 2 In this regard, the Dispute Resolution Chamber refers to its dismissal policy, as set out in detail on the GBA website: https://www.gegevensbeschermingsautoriteit.be/publications/sepotbeleid-van-de-geschillenkamer.pdf 3Cf. Title 3 – In which cases will my complaint likely be dismissed by the Dispute Resolution Chamber? of the Dispute Resolution Chamber’s dismissal policy. 4 Cf. criterion B.7 in the dismissal policy of the Litigation Chamber. 5 ECJ 4 May 2023, C-487/21, ECLI:EU:C:2023:369, ‘Österreichische Datenschutzbehörde’, para. 28 Decision 44/2026 — 5/7 6 contains personal data that are being processed. It follows that the copy of the personal data being processed that the controller must provide pursuant to the first sentence of Article 15.3 of the GDPR must display all the necessary characteristics to enable the data subject to effectively exercise the rights they derive from this Regulation. This copy must therefore reproduce these data completely and 7 faithfully. 17. The right to obtain from the controller a copy of the personal data being processed means that the data subject must be given a faithful and intelligible reproduction of all such data. This right includes the right to obtain a copy of extracts from documents, or even of complete documents or database extracts containing, inter alia, such data, where the provision of such a copy is indispensable to enable the data subject to effectively exercise the rights granted to them under this Regulation, while emphasizing that the rights and freedoms of others must also be taken into account. 8 18. In the present case, the defendant provided a copy of the complainant's personal data, but decided to transmit certain personal data by means of a reproduction and not extracts of the documents. This concerned, in particular, email correspondence. The defendant states that it weighed the complainant's right of access against the rights and freedoms of the authors of the email correspondence. Furthermore, it concluded that anonymizing the sender and recipient of the emails in question would not provide sufficient protection, given their contextual identifiability. Finally, the defendant's DPO confirms that he has taken note of the email exchange in question, and that the information provided to the complainant is consistent with it. 19. The Dispute Resolution Chamber finds that providing extracts of the email correspondence in this case would not have been indispensable to enable the data subject to effectively exercise the rights granted to him under this regulation. It would also infringe the rights and freedoms of the authors of the emails in question, so that the defendant has a priori sufficiently complied with the complainant's right of access. Therefore, the Litigation Chamber finds that an in-depth investigation of the complaint would be disproportionate, taking into account the resources required to investigate the complaint and the likelihood of success. 9 6 ECJ 4 May 2023, C-487/21, ECLI:EU:C:2023:369, ‘ÖsterreichischeDatenschutzbehörde’, para. 32 7ECJ 4 May 2023, C-487/21, ECLI:EU:C:2023:369, ‘ÖsterreichischeDatenschutzbehörde’, para. 39 8 ECJ 4 May 2023, C-487/21, ECLI:EU:C:2023:369, ‘ÖsterreichischeDatenschutzbehörde’, para. 45 9Cf. criterion B.7 in the dismissal policy of the Litigation Chamber. Decision 44/2026 — 7/7 in accordance with Article 1034quinquies of the Judicial Code, or via the e-Deposit information system of the Ministry of Justice (Article 32ter of the Judicial Code). To enable the complainant to consider other possible remedies, the Dispute Chamber refers the complainant to the explanation in its dismissal policy. 14 (Gov.). Hielke H IJMANS Director of the Dispute Chamber 13 The application and its appendix, in as many copies as there are parties involved, are sent by registered mail to the clerk of the court or deposited at the registry. 14 See Title 4 – What can I do if my complaint is closed? of the Dispute Chamber's dismissal policy.
