APD/GBA (Belgium) - 47/2024
From GDPRhub
| APD/GBA - 47/2024 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 57(4) GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | 23.11.2023 |
| Decided: | 19.03.2024 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 47/2024 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | French |
| Original Source: | APD (in FR) |
| Initial Contributor: | nzm |
The DPA closed a case considering, among other things, that the complaint was manifestly excessive as it was filed almost 2 years and 9 months after the events took place.
English Summary
Facts
The controller, a bank (“controller 1”), decided to block the data subject’s bank account for an overdraft of €1,400. The data subject also made an access request, asked the controller to justify its action, asked for the erasure of their personal data and explained that the debt had been transferred to a debt collecting agency (“controller 2”) and had been repaid shortly after their account had been blocked.
The data subject received no response to their telephone calls nor emails and the controller even blocked their email address. The data subject also contacted controller 2 to ask for the erasure of their personal data. Controller 2 indicated that it was able to retain the data subject’s personal data for a period of 10 years. The data subject questioned the legality of such a practice and therefore lodged a complaint with the Belgian DPA (“APD”) against controller 1 for not responding to the data subject access request and the erasure request and against controller 2 for not taking into account their deletion request.
Holding
Firstly, the APD considered that the complaint did not present the necessary details to assess whether there was a breach of the GDPR.
Regarding the complaint against controller 1, the APD found that the data subject submitted a copy of a single email, which does not authenticate the information provided, nor does it constitute conclusive evidence.
Regarding the complaint against controller 2, the APD held that the data subject did not provide any evidence of exchanges with the defendant concerning his erasure request.
Secondly, the APD pointed out the events took place between December 2020 and February 2021. However, the data subject lodged a complaint with the DPA in November 2023 which represents a delay of more than 2 years and 9 months since the last exchanges with the controllers. The APD also pointed out that no valid justification had been provided to explain this significant lapse of time. Therefore, the APD held that the complaint was manifestly excessive pursuant to Article 57(4) GDPR. Thus, the APD closed the case with no further action.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/7
Litigation Chamber
Decision 47/2024 of March 19, 2024
File number: DOS-2023-04810
Subject: Complaint relating to the lack of response from a bank to the exercise of the right of access
and a request for erasure; as well as the refusal by a collection office of
comply with an erasure request
The Litigation Chamber of the Data Protection Authority, made up of Mr.
Hielke HIJMANS, president, sitting alone;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the
protection of natural persons with regard to the processing of personal data and
to the free movement of these data, and repealing Directive 95/46/EC (general regulation on the
data protection), hereinafter “GDPR”;
Having regard to the Law of December 3, 2017 establishing the Data Protection Authority, hereinafter
“ACL”;
Having regard to the Law of July 30, 2018 relating to the protection of individuals with regard to
processing of personal data, hereinafter “LTD”;
Having regard to the Internal Regulations as approved by the House of Representatives on
December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Has taken the following decision regarding:
The complainant: X, hereinafter “the complainant”;
Defendant 1: Y1, hereinafter “defendant 1”;
Defendant2: Y2, hereinafter “defendant 2”. Decision 47/2024 — 2/7
I. Facts and procedure
1. On November 22, 2023, the complainant filed a complaint with the Protection Authority
data (hereinafter “the DPA”) against defendant 1, (hereinafter “the
defendant 1”) and defendant 2, (hereinafter “defendant 2”).
2. The subject of the complaint concerns the lack of response by defendant 1 to the exercise of the
right of access and request for erasure; as well as the refusal by defendant 2 to
comply with an erasure request.
3. In the complaint form, the complainant explained that in December 2020, the defendant
1decided, without notice, to block his bank accounts because of an overdraft of 1400
euros. The complainant also specified that this debt had been transferred to an office
recovery, namely defendant 2.
4. On February 5, 2021, the plaintiff contacted defendant 1 to request the
deletion of personal data. In this same email, the complainant explains
that he would have repaid the debt in question shortly after his accounts had been blocked, and
he asks defendant 1 to justify her action. The complainant also criticizes
defendant 1 for not answering his questions during their telephone exchanges.
5. As part of the complaint form, the complainant reported that he had still not received
response from defendant 1 regarding its request for access. He added that he
would also have asked defendant 1 to provide all the information she
holds towards him. The plaintiff explained that defendant 1 did not respond to these
questions by telephone and had even blocked his email address.
Furthermore, the complainant allegedly, on an unknown date, contacted defendant 2 to
also request the deletion of their personal data. However, the
Defendant 2 would have responded by indicating that she was able to keep the
personal data of the complainant for a period of 10 years. Faced with this response, the
complainant questions the legality of such a practice.
6. On November 23, 2023, the complaint was declared admissible by the Front Line Service
1
(hereinafter “SPL”) on the basis of articles 58 and 60 of the LCA and the complaint was transmitted to
st 2
the Litigation Chamber under article 62, § 1 of the LCA.
1Pursuant to article 61 LCA, the Litigation Chamber informs the parties by this decision of the fact that the complaint has been declared
admissible.
2Pursuant to article 95, § 2 LCA, by this decision, the Litigation Chamber informs the parties of the fact that following this complaint,
the file was sent to him. Decision 47/2024 — 3/7
II. Motivation
7. Pursuant to Article 4, §1 of the LCA, the AP is responsible for controlling the principles
data protection contained in the GDPR and other laws containing
provisions relating to the protection of the processing of personal data.
8. Pursuant to article 33, §1 of the LCA, the Litigation Chamber is the body of
administrative litigation of the APD. It receives complaints that the SPL sends to it in
application of article 62, § 1 of the LCA, or admissible complaints. In accordance with
Article 60, paragraph 2 of the LCA, complaints are admissible if they are drawn up in one
national languages, contain a statement of the facts and the necessary indications for
identify the processing of personal data to which they relate and which
fall under the jurisdiction of the APD.
9. Based on the facts described in the complaint file as summarized above, and on the
basis of the powers assigned to it by the legislator under article 95,
er
§ 1 of the LCA, the Litigation Chamber decides on the follow-up to be given to the file; in
occurrence, the Litigation Chamber decides to proceed with the classification without further action of the
complaint, in accordance with article 95, § 1, 3° of the LCA, for the reasons set out below.
10. In matters of dismissal, the Litigation Chamber is required to provide reasons for its decision.
3
decision by step and to:
- pronounce a classification without technical follow-up if the file does not contain or not
sufficient evidence likely to lead to a sanction or if it includes a
technical obstacle preventing it from rendering a decision;
- or pronounce a classification without further opportunity, if despite the presence
of elements likely to lead to a sanction, the continuation of the examination of the
file does not seem appropriate given the priorities of the Authority of
data protection as specified and illustrated in the Privacy Policy
classification without further action by the Litigation Chamber. 4
11. In the event of dismissal based on several grounds for dismissal, these
last (respectively, classification without technical follow-up and classification without follow-up
opportunity) must be treated in order of importance. 5
3Market Court (Brussels Court of Appeal), September 2, 2020, judgment 2020/AR/329, p. 18.
4In this regard, the Litigation Chamber refers to its policy of classification without further action as developed and published on the Authority’s website
of data protection, available at https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-
the-chamber-contentious.pdf.
5APD, “Disclosure policy of the Litigation Chamber: 3. – In what cases is my complaint likely to be closed
sanssuiteparlaChambreContentieuse?”, June 18, 2021, available at https://www.autoriteprotectiondonnees.be/publications/politique-de-
classification-without-suite-of-the-contentious-chamber.pdf. Decision 47/2024 — 4/7
12. The Litigation Chamber notes that the complainant raises two complaints against the
defendant 1, namely the lack of response to his request for erasure and his request
access. Furthermore, it notes that the complainant raises a grievance against the
defendant 2, namely the failure to take into account her request for erasure.
13. The Litigation Chamber decides to proceed with a classification without further action on the complaint for
reason of opportunity. The decision of the Litigation Chamber is based more precisely on
two reasons why it considers it inappropriate to continue monitoring the
file, and therefore decides not to proceed, among other things, with an examination of
the case on the merits.
14. Firstly, the Litigation Chamber notes that, on the one hand, the complaint presents
not have the necessary details or evidence required to assess the existence
a violation of the GDPR; on the other hand, it does not seem to have a societal impact
and/or high staff; consequently, the Litigation Chamber decides to classify the
complaint without action for reasons of expediency (criterion B.5).
15. On the one hand, the Litigation Chamber notes that the grievances raised by the complainant do not
do not meet the criteria of high general or personal impact, as defined by
7
the APD in its note on the classification policy of June 18, 2021.
16. On the other hand, if the criteria of high general or personal impact do not apply, the
Litigation Chamber weighs the personal impact of the circumstances of the complaint
for the rights and fundamental freedoms of the complainant, and the efficiency of his intervention,
to decide whether it considers it appropriate to deal with the complaint in depth.
17. In the present case, the Litigation Chamber notes that it does not have sufficient
evidence that would make it possible to verify whether the complainant's allegations
constitute a potential violation of GDPR and data protection laws. In
Indeed, the Litigation Chamber notes that it cannot comment on a possible
lack of response from defendant 1 to the plaintiff's request for erasure, fault
sufficient evidence provided by the latter. The copy of a single email presented by the
complainant does not authenticate the information provided or constitute a
conclusive proof. Furthermore, this single email appears to be part of a series of
correspondence between the complainant and the defendant 1 of which the complainant failed to
provide the copy. With regard to the request for access mentioned in the form
complaint, the Litigation Chamber notes that it has no proof of
the submission of such a prior request to defendant 1 (see point 5).
6APD, “Disclosure policy of the Litigation Chamber: 3. – In what cases is my complaint likely to be closed
sanssuiteparlaChambreContentieuse?”, June 18, 2021, available at https://www.autoriteprotectiondonnees.be/publications/politique-de-
classification-without-suite-of-the-contentious-chamber.pdf.
7Ibidem. Decision 47/2024 — 5/7
18. Likewise, the Litigation Chamber notes that it does not have any
sufficient evidence regarding the allegations regarding the
defendant 2. The Litigation Chamber notes that the plaintiff provides no evidence
exchanges with defendant 2, mentioning only in the form of
complaint that he contacted her to request the erasure of her data, without
support your statements with factual support (see point 5).
19. The Litigation Chamber recalls that it evaluates the efficiency of its intervention and the
means necessary to deal with the complaint thoroughly. In this case, without
minimize the importance of the reported incident, a thorough investigation would require
disproportionate means of gathering additional evidence, interviewing
parties involved and assess the circumstances surrounding the allegations.
20. Finally, the Litigation Chamber notes that the complaint is clearly
excessive within the meaning of article 57.4 of the GDPR; and decides to close the complaint without further action
8
for reasons of opportunity (criterion B.4).
21. The Litigation Chamber may classify a complaint as manifestly excessive by
9
under article 57.4 of the GDPR in cases where it considers that the complaint is judged
manifestly abusive, particularly if a significant period of time has elapsed between the
alleged facts and the filing of the complaint, without any valid justification, such as
unless an attempt at mediation is provided. The APD, including the Litigation Chamber,
can therefore decide not to follow up on such complaints to preserve the effectiveness of the
personal data protection mechanisms.
22. In the present case, the Litigation Chamber notes that the facts took place between December
2020 and February 2021 (see points 3 to 5). However, the complainant did not file his complaint with
of ODA until November 23, 2023, which represents a delay of more than 2 years and 9 months
since the last exchanges with defendants 1 and 2. The Litigation Chamber
underlines that no valid justification has been provided to explain this lapse of time
important between the facts in dispute and the filing of the complaint.
23. To the extent that it appears from the documents in the file that the efficiency of the intervention of the
Litigation Chamber is, in this case, not demonstrated and only the means to be implemented
work to support the complaint are potentially excessive, the Litigation Chamber does not
8A dismissal for reasons of expediency does not mean that the Litigation Chamber legally notes that no
violation has occurred, but the resources required to substantiate the complaint are potentially excessive. ; APD, “Policy of
classification without further action by the Litigation Chamber", June 18, 2021, available on
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-contentieuse.pdf.
9Article 57.4 of the GDPR provides: “When requests are manifestly unfounded or excessive, due, in particular, to their
repetitive nature, the supervisory authority may require payment of reasonable fees based on administrative costs or refuse to provide
Following the request. It is the responsibility of the supervisory authority to demonstrate that the request is manifestly unfounded or excessive.” Decision 47/2024 — 7/7
14
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , Or
via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. judic.).
To enable it to consider any other possible course of action, the Litigation Chamber refers
the complainant to the explanations provided in its classification policy without further action. 15
(sé). Hielke HIJMANS
President of the Litigation Chamber
14The request, accompanied by its annex, is sent, in as many copies as there are parties involved, by registered letter to
clerk of the court or filed with the registry.
15APD, “Discontinuation policy of the Litigation Chamber: Title 4 – What can I do if my complaint is dismissed? ",
June 18, 2021, available at https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
litigation.pdf.
