APD/GBA (Belgium) - 88/2025

From GDPRhub
APD/GBA - 88/2025
Authority: APD/GBA (Belgium)
Jurisdiction: Belgium
Relevant Law: Article 15 GDPR
Article 20 GDPR
Type: Complaint
Outcome: Rejected
Started: 18.12.2024
Decided: 20.05.2025
Published:
Fine: n/a
Parties: n/a
National Case Number/Name: 88/2025
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): French
Original Source: APD/GBA (in FR)
Initial Contributor: cci

The DPA held that a customer using the free version of a screen capture software abused his right to access by requesting a copy of his personal data including existing screenshots which are only available to download in the paid version of the software.

English Summary

Facts

A company (the controller) offered a screen capture software. The controller offered both a free plan and a paid plan with additional features. In particular, free users could only view their screenshots via the controller’s website while paying users could download them.

The data subject was a user of the free version. They requested a copy of their screenshots from the controller. The controller refused on grounds that downloading screenshots was a premium feature reserved for paying users. The data subject then filed a complaint, claiming that the controller violated his right of access and his right to data portability.

Holding

The DPA did not examine the complaint on the merits[1]. Rather, it dismissed it on grounds that the data subject's request constituted an abuse of rights under the GDPR. In this regard, the DPA followed CJEU case law[2] and held that the request fulfilled both the subjective and objective elements of an abuse of rights.

Comment

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/6

Litigation Chamber

Decision 88/2025 of May 20, 2025

File number: DOS-2024-05577

Subject: Complaint regarding the refusal of a screenshot sharing software provider to provide a free copy of the photos

The Litigation Chamber of the Data Protection Authority;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the

protection of natural persons with regard to the processing of personal data and

on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter "GDPR";

Having regard to the Law of December 3, 2017, establishing the Data Protection Authority, hereinafter "LCA";

Having regard to the internal regulations of the Data Protection Authority, as approved by the

Management Committee on April 25, 2024, and published in the Belgian Official Journal on May 31, 2024;

Having considered the documents in the case file;

Has taken the following decision regarding:

The complainant: X, hereinafter "the complainant"

The defendant: Y, hereinafter "the defendant" Decision 88/2025 — 2/6

I. Facts and Procedure

1. The subject of the complaint concerns the refusal of a screenshot sharing software to provide

a free copy of the images.

2. On December 18, 2024, the complainant filed a complaint with the Data Protection Authority

(hereinafter "the DPA") against the defendant.

3. On November 25, 2024, the complainant exercised his right of access and requested a copy of his data from the defendant.

4. On December 9, 2024, the defendant provided the complainant with his personal data but specified that the screenshots the complainant had taken using his free account on the defendant's platform could not be exported under the free license. To export the images, the complainant was asked to subscribe to the paid software license. The defendant specified that the screenshots taken by the complainant were visible on the defendant's platform.

5. On the same day, the complainant alleged that this practice, requiring a paid license to export screenshots, violated his right of access and his right to data portability. 6. On December 11, 2024, the defendant responded that the complainant's personal data had already been provided to it.

7. On the same day, the complainant wished to correct the defendant's assertion and alleged that

his screenshots constitute personal data within the meaning of the GDPR. He therefore requested

the defendant to provide him with a copy of all his screenshots free of charge.

8. On December 18, 2024, the defendant maintained its position and asserted that the screenshots

are accessible to free users via a URL but can only be downloaded by paying users. 9. On January 20, 2025, the complaint was declared admissible by the Frontline Service (hereinafter "FLS") on the basis of Articles 58 and 60 of the LCA (French Commercial Code), and the complaint was forwarded to the

Litigation Division pursuant to Article 92, 1° of the LCA.

II. Reasons

10. Based on the evidence in the case file of which it is aware and the powers conferred upon it by the legislature under Article 95, § 1 of the LCA, the

Litigation Division decides on the appropriate action to be taken in the case. In this case, the Litigation Division

Decision 88/2025 — 3/6

has dismissed the complaint, in accordance with Article 95,

§ 1, 3° of the LCA, based on the following reasons.

11. When a complaint is dismissed, the Litigation Division must provide reasons for its decision in stages.

It may:

- dismiss the case on a technical basis if the case does not contain, or does not contain, sufficient evidence likely to lead to a conviction, or if there is

no sufficient prospect of a conviction due to a technical obstacle preventing it from rendering a decision;

- or dismiss the case on the grounds of opportunity, if, despite the presence

of evidence likely to lead to a sanction, further examination of the

case does not seem appropriate given the priorities of the APD as

specified and explained in the Litigation Division's dismissal policy.

12. If dismissal is based on more than one ground, the grounds for dismissal (respectively, dismissal on a technical basis and dismissal on the grounds of opportunity) must be addressed in order of importance. 3

13. In the present case, the Chamber considers it undesirable to pursue the case and therefore decides not to proceed, among other things, with a review of the merits of the case.

14. In this case, the complainant wishes to use the right of access and data portability to obtain benefits that are only provided to the defendant's customers on condition that they subscribe to a paid license.

15. The Litigation Chamber notes that the complainant's request amounts to an abuse of rights as developed by European case law. This general principle of law applies when both an objective and a subjective element are present. 16. The objective element has been described by the CJEU as "a set of objective circumstances

from which it follows that, despite formal compliance with the conditions laid down by

EU regulations, the objective pursued by those regulations has not been

achieved."

1Brussels Court of Appeal, Market Court Section, 19th Chamber A, Market Chamber, Judgment 2020/AR/329,

September 2, 2020, p. 18.
2In this regard, the Litigation Chamber refers to its policy on dismissal of cases, as detailed on the APD website: https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-
chambre-contentieuse.pdf.

3See Section 3 - In which cases is my complaint likely to be dismissed by the Litigation Chamber? of the
Litigation Chamber's policy on dismissal of cases. 4
CJEU, February 26, 2019, Joined Cases C-115/16 and C-118/16, C-119/16 and C-299/16, §139. Decision 88/2025 — 4/6

17. The rights granted to data subjects by the GDPR are intended to enable them

to exercise control over their data and verify the lawfulness of their

processing. In this case, the complainant is exercising his right of access and his right to data portability.

It appears from the documents that the complainant has access to the screenshots he

took using the defendant's tool via their URL. Consulting these screenshots is therefore possible and allows the complainant to verify the lawfulness of their

processing without any export being necessary.

18. Furthermore, the right to data portability aims to allow the data subject to transmit their data to another data controller. In this case, the complainant does not appear to wish to transfer the data to another data controller, but rather to benefit free of charge from a service otherwise charged for by the defendant.

19. The Litigation Chamber therefore notes that the complainant's objective in exercising his right of access and his right to data portability is not aligned with the objective pursued by the regulations.

20. The subjective element of the abuse of rights consists of "the desire to obtain an advantage resulting from EU regulations by artificially creating the conditions required to obtain it." » According to recent case law of the CJEU, "the existence of an abusive intention may be established when a person submits complaints without it being objectively necessary to protect the rights they derive from that regulation."7

21. In this case, the complainant wishes to use a right provided for by the GDPR to benefit from an unjustified economic advantage. Downloading the photos he wants is an advantage granted only to users who have a paid license for the defendant's software. By invoking his right of access and his right to data portability to download the photos, the complainant is distorting the essence of these rights to benefit from this functionality for free.

22. Based on the above considerations, the Litigation Chamber finds that the complainant's request amounts to an abuse of rights. The Litigation Chamber therefore decides to dismiss it.

23. As a reminder, without this constituting any sanction, the Litigation Chamber

reiterates that Article 27 of the GDPR requires data controllers that

are not established in the EU to designate a representative in writing in the EU.

5Recitals 63 and 68 of the GDPR
6
Article 20 and Recital 68 of the GDPR
7C-416/23, §50 Decision 88/2025 — 6/6

To allow the complainant to consider other possible avenues of redress,

the Litigation Chamber refers the complainant to the explanations provided in its
11
dismissal policy.

(Sé). Hielke HIJMANS

Director of the Litigation Chamber

1See Title 4 - What can I do if my complaint is dismissed? of the Litigation Chamber's dismissal policy.
  1. Belgian law (Art. 95, § 1 LCA) allows the DPA to dismiss certain on complaints over reasons of opportunity, without dealing with the merits of the case.
  2. See: CJEU, Joint Cases C-115/16 and C-118/16, C-119/16 and C-299/16, N Luxembourg1 and Others, 26 February 2019, magin number 139 (available here); CJEU, C-416/23, Österreichische Datenschutzbehörde, 9 January 2025, margin number 50 (available here).