APD/GBA (Belgium) - 84/2026
| APD/GBA - 84/2026 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 12(3) GDPR Article 12(5) GDPR Article 15 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 28.07.2022 |
| Decided: | 22.04.2026 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 84/2026 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | French |
| Original Source: | APD/GBA (in FR) |
| Initial Contributor: | ds |
The DPA reprimanded a real estate agency for replying to a tenant’s access request over four years late, rejecting the argument that the mere existence of a dispute between the parties made the request manifestly unfounded or excessive.
English Summary
Facts
The controller was a real estate agency responsible for selling the property in which the data subject is a tenant. On 6 November 2021, the data subject submitted an access and information request concerning personal data allegedly processed by the controller, including their physical address, email address, IP address and data relating to a tracking cookie.
The controller replied that it did not process the data subject’s personal data and that it did not fully understand the request, which it considered to contain technical language. It also informed the data subject that it had forwarded previous email exchanges and photos relating to the property to its attorney and to the sellers of the building.
Between 7 and 11 November 2021, the data subject repeatedly reiterated their access and information request. The controller’s attorney maintained that the controller did not process the data subject’s personal data and referred them to the controller’s administrators, who were described as jointly performing the role of data protection officer. The data subject also raised questions concerning cookies, the sharing of their address with third parties and photos taken in the property.
On 13 January 2022, the data subject filed a mediation request with the DPA. As the mediation remained unanswered, the data subject asked for it to be converted into a complaint on 28 July 2022. The complaint was declared admissible. The DPA ordered the controller to comply with the access request under Article 15 GDPR. The controller then requested that the case be examined on the merits.
In August 2025, the controller finally responded to the access request, more than four years after the original request. It acknowledged that its previous responses had been incomplete, but attributed this to inadequate legal advice received at the time.
The data subject considered the response insufficient, arguing that the controller had transferred data to third parties despite claiming otherwise. The controller, by contrast, argued that the request was abusive and had been made in a context of personal dissatisfaction for retaliation purposes. It relied on Article 12(5) GDPR and invoked the CJEU judgment in Brillen Rottler (CJEU C 526/24) to argue that the request was manifestly unfounded or excessive.
Holding
The DPA noted that the controller responded to the data subject’s access request more than four years after the original request and after numerous exchanges between the parties. It therefore found that the controller had violated Article 12(3) GDPR in conjunction with Article 15 GDPR.
The DPA rejected the controller’s reliance on Article 12(5) GDPR. Referring to the CJEU judgment in Brillen Rottler, it recalled that an abuse of rights requires both an objective and a subjective element. The objective element requires circumstances showing that, despite formal compliance with EU law, the objective pursued by that law has not been achieved. The subjective element requires an intention to obtain an advantage under EU law by artificially creating the conditions for obtaining it. The controller must demonstrate unequivocally that the data subject submitted the access request for a purpose other than becoming aware of the processing of their data and verifying its lawfulness. This exception to the controller’s obligation to comply with the right of access must be interpreted restrictively.
The DPA noted that the right of access allows data subjects to verify the lawfulness of the processing of their data without having to justify their request. It held that the fact that an access request was made in a context of conflict does not, in itself, establish that the request was manifestly unfounded or excessive. Since the controller had provided no evidence of abusive intent and had merely assumed such intent, the DPA dismissed the argument.
The DPA issued a reprimand to the controller for violating Article 12(3) GDPR in conjunction with Article 15 GDPR, because it failed to facilitate the exercise of the data subject’s right of access and did not respond within the applicable time limit.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/8 Litigation Chamber Decision on the merits 84/2026 of April 22, 2026 Case number: DOS-2022-00337 Subject: Complaint concerning the incomplete response to the exercise of a right of access and information The Litigation Chamber of the Data Protection Authority; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the “GDPR”; Having regard to the Law of December 3, 2017 establishing the Data Protection Authority (hereinafter referred to as the “LCA”); Having regard to the Rules of Procedure as approved by the Chamber of Representatives on 20 December 2018 and published in the Belgian Official Gazette on 15 January 2019; Having regard to the documents in the file, including the submissions of the parties which were duly exchanged; The following decision has been taken concerning: The complainant: X, hereinafter referred to as "the complainant"; The defendant: Y, whose registered office is located at […], registered under company number […], hereinafter referred to as "the defendant". Decision on the merits 84/2026 — 2/8 I. Facts and procedure 1. The subject of the complaint concerns an incomplete response to the exercise of a right of access and right to information. 1. On November 6, 2021, the complainant exercised his right of access and his right to information with the defendant, the real estate agency in charge of selling the property in which he is a tenant. He stated that he was aware that his physical address, email address, IP address, and a tracking cookie were being processed by the defendant. He wished to know how his data was being processed and to obtain access to it. 2. On the same day, the defendant asked the complainant to contact his lawyer directly. She explained that she was forwarding the previous email exchanges and photos of the building to his lawyer and to the sellers of the property. According to her, she does not process any of the complainant's personal data. She explained that she is not a computer scientist and therefore does not understand the complainant's purpose or his supposed "computer-related" jargon. She concluded by stating that if the property description contains the slightest reference to the complainant's name, he should point it out to him. 3. On November 7, 2021, the complainant expressed surprise at the forwarding of his previous email to the defendant's lawyer and the sellers of the property. He clarified that this request concerned only the defendant and not the sale of the property itself. He reiterated his request for access and information. He also provided a link to a website containing information regarding the GDPR. 4. On November 8, 2021, the defendant's lawyer assured the complainant that none of his data was being processed by the defendant. He specified that the administrators of the defendant "jointly fulfill the role of data officer" and invited the complainant to schedule an appointment with them. 5. On the same day, the complainant replied to the defendant's lawyer. He reiterated that the defendant was collecting personal data about him through cookies. Furthermore, he would like to know what measures are in place to regulate the sharing of his address with third parties and photos taken of the interior without his consent in connection with the sale of the building where he is a tenant. He also asks the defendant's counsel to specify the identity of the administrators with whom he must make an appointment and indicates that this is not in accordance with his right to data portability. 6. On November 9, 2021, the defendant's counsel reiterates that no data is collected by the defendant on its website. He explains that the photos of the interior of the building are not intended to collect personal data. He also refers the complainant to the Belgian Official Gazette (Moniteur belge) to obtain the identity of the administrators. He also states Decision on the merits 84/2026 — 3/8 that the complainant has the right to request access but not the portability of his data. 7. On the same day, the complainant attempts to clarify the defendant's position, stating that the defendant believes that the physical address and photos of his home are not personal data and that the cookies on its website do not require his consent to be installed. He asks the defendant to confirm that this is indeed her position. 8. Also on November 9, 2021, the defendant's lawyer believes that the complainant's question has been adequately answered and refers him to the company's administrators to obtain an "ad hoc document concerning the personal information that is processed/stored within the company." 9. The complainant reiterates his request to the defendant and specifies that he will initiate mediation with the Data Protection Authority (DPA) if he receives no response. 10. On November 10, 2021, the defendant's counsel determined that the complainant's request had been fully answered and advised him to contact the company's directors to obtain the requested form. 11. On November 10, 2021, another representative of the defendant asked the complainant to explain the situation from the beginning. 12. On November 11, 2021, the complainant reiterated his requests and the ensuing exchanges. 13. On January 6, 2022, the complainant contacted the defendant again and announced that, having received no response to his exercise of rights, a request for mediation would be filed the following week with the Data Protection Authority. 14. On January 13, 2022, the complainant filed a request for mediation with the Data Protection Authority concerning the defendant. 15. On January 28, 2022, the Frontline Service invites the defendant to respond to the complainant's request. 16. On June 28, 2022, the Frontline Service sends a reminder to the defendant. 17. On July 28, 2022, the Frontline Service informs the complainant that the mediation has gone unanswered and asks if they wish to convert their mediation into a complaint. On the same day, the complainant confirms their desire to convert their mediation into a complaint. The Frontline Service informs the defendant that the mediation has been converted into a complaint. Decision on the merits 84/2026 — 4/8 18. On August 3, 2022, the complaint was declared admissible by the Frontline Service on the basis of Articles 58 and 60 of the LCA (Law on Competition Act) and the complaint was forwarded to the Litigation Chamber pursuant to Article 62, § 1 of the LCA. 19. On December 6, 2024, the Litigation Chamber informed the defendant that a complaint was pending and allowed her to submit observations. The registered letter was not claimed by the defendant. 20. On January 10, 2025, the Litigation Chamber forwarded this notification to the defendant's counsel. 21. As of April 14, 2025, no response or acknowledgment of receipt had been sent to the Litigation Chamber by either the defendant or its counsel. 22. On May 13, 2025, the Litigation Chamber adopted Order 86/2025 pursuant to Article 95, §1, 5° of the LCA. In this decision, the Litigation Chamber ruled, pursuant to Article 58.2.c) of the GDPR and 95.1. 5. of the LCA, to order the defendant to comply with the data subject's request to exercise their rights, specifically the right of access (Article 15 of the GDPR), and to provide them with a copy of the information it processes about them within 30 days of this decision; and to inform them by email of the action taken on this decision, within the same timeframe, via the email address litigationchamber@apd-gba.be. 23. On May 16, 2025, the defendant requests that the case be heard on its merits, in accordance with the option available to them in the decision and in accordance with Article 98(e) of the LCA. 24. On June 13, 2025, the Litigation Chamber decided, pursuant to Article 95, § 1, 1° and Article 98 of the LCA, that the case could be heard on its merits and, to that end, sent a invitation to the parties to file their submissions. The submissions were duly filed. 25. In August 2025, the defendant responded to the complainant's request for access. 26. On February 3, 2026, the Litigation Chamber invited the parties to a hearing. 27. On March 4, 2026, the hearing took place in the presence of the defendant. The complainant was absent. 28. On March 6, 2026, the minutes were sent to the parties. 29. On 9 March 2026, the complainant expressed his dissatisfaction with what was said during the hearing, which he did not attend. 1. Pursuant to Article 61 of the LCA (Law on Administrative Procedure), the Litigation Chamber hereby informs the parties that the complaint has been declared admissible. 2. Pursuant to Article 95, § 2 of the LCA, the Litigation Chamber hereby informs the parties that, following this complaint, the case file has been forwarded to it. Decision on the merits 84/2026 — 5/8 30. On 20 March 2026, the respondent informed the Litigation Chamber of the publication of a new judgment of the CJEU (C-526/24) concerning a point argued during the hearing. II. Reasoning II.1. Regarding the substantive review of the case after a preliminary decision 31. The Litigation Chamber issued Order 86/2025 following the complaint filed in this case. The defendant requests the Litigation Chamber that this case be reviewed on its merits in accordance with the option available to it in Order 86/2025 and Articles 98 et seq. of the LCA. 32. The Litigation Chamber agrees to review this case on its merits and considers that this decision replaces Order 86/2025. II.2. Regarding the response to the access request 33. Although the defendant initially claimed that it was not processing personal data , its position changed when it changed counsel. Her point is now that she does not deny having provided incomplete answers, but that this incomplete response resulted from “inappropriate legal advice received at the time.” She explains that she acted in good faith and has now responded to the request. 34. In his complaint, the complainant accuses the defendant of not having responded to his access request. Despite the defendant's response to his access request in August, the complainant believes that it was not handled correctly. Indeed, he believes that the defendant transferred data to third parties, which she alleges she did not do. 35. The GDPR requires the data controller to respond to a request to exercise a data subject's rights within one month of the request, subject to a possible extension of two months. 36. The Litigation Chamber notes that, in any event, the defendant's response was provided during the proceedings, more than four years after the original request and numerous exchanges between the complainant and the defendant. The one-month deadline for the response was not met. The Litigation Chamber therefore finds a violation of Article 112.3 of the GDPR, read in conjunction with Article 15 of the GDPR. 3 CJEU, 19 March 2026, C-526/24 4 Article 12.3 of the GDPR. Decision on the merits 84/2026 — 6/8 II.3. Regarding a possible abuse of rights 37. The defendant alleges that the complainant made his access request for a purpose unrelated to the GDPR and therefore made an abusive request within the meaning of Article 12.5 of the GDPR. The complainant denies having committed an abuse of rights. 38. The Litigation Chamber reiterates that the right of access allows data subjects to verify the lawfulness of the processing of their data. Exercising this right does not require the data subject to justify his request. 39. Nevertheless, Article 12.5 of the GDPR provides that “where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive nature, the controller may: charge a reasonable fee taking into account the administrative costs incurred in providing the information; carry out the communications or take the action requested; or refuse to comply with these requests.” 40. The Court of Justice of the European Union recently issued a judgment clarifying the scope of this provision. In this judgment, the Court found that an initial request to exercise a right could be considered abusive if the data controller demonstrates 7 the existence of an abuse of rights. According to the settled case law of the Court of Justice of 8 the European Union, proof of an abuse of rights can be established, firstly, by a set of objective circumstances showing that, despite formal compliance with the conditions laid down by Union regulations, the objective pursued by those regulations has not been achieved and, secondly, by a subjective element consisting of the intention of the data subject to obtain an advantage resulting from Union regulations by artificially creating the conditions required to obtain it. 41. In this case, with regard to the objective element, the complainant could exercise his right of access with the defendant. By exercising his right and thereby verifying the lawfulness of the processing of his data, the objective pursued by the GDPR was achieved. 42. With regard to the subjective element, the Court specifies that the data controller is required to demonstrate unequivocally that the data subject submitted this request for a purpose other than to become aware of the processing of this 9 data and to verify its lawfulness. In this case, the defendant alleges that the request of access was made only in a “context of personal dissatisfaction”. Recital 63 of the GDPR. 6.13 of Guidelines 01/2022 on the rights of data subjects – right of access, adopted on 28 March 2023. 7. CJEU, Brillen Rottler, 19 March 2026, C-526/24, §§31 and §§35. 8. See in particular CJEU, VK v. BMW Bank GmbH, 21 December 2023, C-38/21, C-47/21 and C-232/21, §285 and CJEU, Brillen Rottler, 19 March 2026, C-526/24, §36. 9 §40 of Guidelines 01/2022 on the rights of data subjects – right of access, adopted on 28 March 2023. Decision on the merits 84/2026 — 7/8 The complainant allegedly “opportunistically exploited the defendant’s lack of legal knowledge in order to circumvent a right for personal purposes of retaliation,” which the complainant disputes. The Litigation Chamber reiterates that the fact that a request for access may have been made in a conflictual context between the parties does not thereby establish that the request is abusive within the meaning of the case law of the CJEU. Furthermore, the Court of Justice specifies that this exception to the obligation of the right of access must be interpreted restrictively. 43. The Litigation Chamber notes that the defendant provides no evidence of the complainant's possible abusive intent. It merely assumes it. 44. Consequently, the Litigation Chamber considers that abuse of rights has not been established and dismisses this argument of the defendant. II.4. Conclusion 45. Based on the foregoing, the Litigation Chamber decides to issue a reprimand to the defendant for its violation of Article 12.3 of the GDPR, taken in conjunction with Article 15 of the GDPR, as it did not facilitate the complainant's exercise of his right of access and did not respond to his request within the time limit stipulated by the GDPR. CJEU, 19 March 2026, C-526/24, §29. Decision on the merits 84/2026 — 8/8 III. Publication of the decision 46. Given the importance of transparency regarding the decision-making process of the Litigation Chamber, this decision is published on the website of the Data Protection Authority. However, it is not necessary for this purpose that the parties' identifying data be directly communicated. FOR THESE REASONS, the Litigation Chamber of the Data Protection Authority decides, after deliberation: - Pursuant to Article 100, §1, 5° of the LCA, to issue a reprimand to the defendant because it violated Article 12.3 of the GDPR read in conjunction with Article 15 by failing to respond to the request within the time limit stipulated by the GDPR. In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged, within thirty days of its notification, with the Market Court (Brussels Court of Appeal), with the Data Protection Authority as the defendant. Such an appeal may be lodged by means of an interlocutory application, which must contain the 11 information listed in Article 1034ter of the Judicial Code. The interlocutory application must be 12 filed with the Registry of the Market Court in accordance with Article 1034quinquies of the Judicial Code, or via the e-Deposit information system of the Ministry of Justice (Article 32ter of the Judicial Code). (se). Hielke H IJMANS Director of the Litigation Chamber 11 The application must contain, under penalty of nullity: 1° the day, month, and year; 2° the applicant's surname, first name, and address, as well as, where applicable, their capacity and national registration number or company number; 3° the surname, first name, address, and, where applicable, capacity of the person to be summoned; 4. The purpose and a summary of the grounds for the application; 5. The name of the judge hearing the application; The signature of the applicant or their lawyer. 12. The application, along with its attachment, is sent, in as many copies as there are parties involved, by registered letter to the clerk of the court or filed with the court registry.
