| APD/GBA - Decision 137-2022 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 12(3) GDPR Article 12(4) GDPR Article 17(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 08.08.2022 |
| Decided: | 26.09.2022 |
| Published: | 02.10.2022 |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | Decision 137-2022 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Dutch |
| Original Source: | GBA (in NL) |
| Initial Contributor: | n/a |
The Belgian DPA used Article 58(2)(c) GDPR to order a controller to comply with an erasure request of a data subject pursuant to Article 17 GDPR after it failed to reply to the initial request.
English Summary
Facts
The data subject exercised its right to be forgotten on 19 June 2022, but the controller didn’t provide an answer. On 8 August 2022, the data subject filed a complaint at the Belgium DPA for the lack of an answer to the request.
Holding
The DPA held that the data subject had exercised its right to be forgotten according to Article 17(1) GDPR and had done so in a way as described in the privacy policy of the controller. Since the controller did not provide an answer at all, the DPA held that it had violated Article 12(3) GDPR (the controller failed to answer within a month), Article 12(4) GDPR (The controller failed to provide a reason why it did not comply with the request) and Article 17(1) GDPR. The DPA held that the controller had to comply with the request of the data subject and ordered the controller to delete the personal data within 30 days, based on Article 58(2)(c) GDPR and Article 95 §1,5 WOG. The DPA also held that the controller had notify the DPA within 30 days about the result of this decision.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/5
Dispute room
Decision 137/2022 of 26 September 2022
File number : DOS-2022-03284
Subject: Exercising the right to erasure without informing the defendant
follows
The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke Hijmans,
single chairperson;
Having regard to Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 on
the protection of natural persons with regard to the processing of personal data and
on the free movement of such data and repealing Directive 95/46/EC (General
Data Protection Regulation), hereinafter GDPR;
Having regard to the law of 3 December 2017 establishing the Data Protection Authority, hereinafter WOG;
Having regard to the internal rules of procedure, as approved by the Chamber of Representatives
on December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;
Having regard to the documents in the file;
has taken the following decision regarding:
.
The complainant: Mr X, hereinafter referred to as “the complainant”; .
.
The Defendant: Y, hereinafter referred to as “the Defendant”. Decision 137/2021 - 2/5
I. Facts procedure
1. On 8 August 2022, the complainant lodged a complaint with the Data Protection Authority against
the defendant.
2. On June 19, 2022, the complainant addressed the defendant with a request for the
delete personal data pursuant to Article 17.1 GDPR, in accordance with .'s privacy policy
the defendant. On August 8, 2022, the complainant has not yet received a reply from the defendant in
in connection with the request for erasure. Following on from this, the
complainant lodged a complaint with the Data Protection Authority.
3. On April 22, 2022, the complaint will be declared admissible by the Frontline Service on the basis of the
Articles 58 and 60 WOG and the complaint on the basis of art. 62, §1 WOG transferred to the
Dispute room.
II. Justification
4. The Disputes Chamber determines on the basis of the documents that substantiate the complaint that the complainant is entitled to
exercised the erasure of data in accordance with Article 17.1 of the GDPR on June 19, 2022. From the documents accompanying
the complaint, the Disputes Chamber concludes that the complainant has submitted his request for erasure
performed as specified in the Defendant's Privacy Policy. Pursuant to Article 12.3 GDPR
the controller, in this case the defendant, must respond to the request for
to reply to the deletion of data within one month of receipt of the request. Possibly can
this period can be extended by a further two months, given the complexity of the
request. The complainant must then, within one month after the request for the erasure of data about this
extension to be notified. If the defendant decides not to comply with the
request of the complainant, it must communicate this within one month of receipt of the request
to the data subject, in accordance with Article 12.4 GDPR. It is not apparent from the file that the complainant
answer has been received about the effect that the weather has on the data erasure
is given. As a result, the controller has acted in violation of Article
12.3 and 12.4 GDPR, as well as Article 17.1 GDPR.
5. The Disputes Chamber is of the opinion that on the basis of the above analysis,
concluded that an infringement of the provisions of the GDPR was committed by the defendant,
which justifies the taking of a decision in this case on the basis of
of Article 95, §1, 5° WOG, in particular to order the defendant to comply with the
exercise by the complainant of his right to erasure (Article 17.1 GDPR).
6. The present decision is a prima facie decision taken by the Disputes Chamber
in accordance with article 95 WOG on the basis of the complaint submitted by the complainant, in the context of Decision 137/2021 - 3/5
1
the ‘procedure prior to the decision on the merits’ and not a decision on the merits of the
Dispute Chamber within the meaning of Article 100WOG. The Dispute Chamber has thus decided on the grounds
of Articles 58.2. c) and 95, §1, 5° of the law of December 3, 2017, to order the defendant
that the data subject's requests to exercise his rights are met, more
determines the right to erasure (“right to be forgotten”) as defined in Article 17 of the GDPR.
7. The purpose of this decision is to inform the defendant that it is a
has committed a breach of the provisions of the GDPR and to give them the opportunity to
to still conform with the aforementioned provisions.
8. However, if the defendant does not agree with the contents of this prima facie
decision and is of the opinion that it can assert factual and/or legal arguments that lead to
could lead to a different decision, this can be done via the e-mail address litigationchamber@apd-
gba.be submit a request for treatment on the merits of the case to the Disputes Chamber and this
within 30 days of notification of this decision. The implementation of
If necessary, this decision will be suspended during the aforementioned period.
9. In the event of a continuation of the handling of the case on the merits, the Disputes Chamber will
the parties on the basis of Articles 98, 2° and 3° in conjunction with Article 99 WOG invite their
to submit defenses and to attach to the file any documents they deem useful. The
If necessary, this decision will be definitively suspended.
10. For the sake of completeness, the Disputes Chamber points out that a treatment of the substance of the case can be
2
lead to the imposition of the measures referred to in Article 100 WOG.
11. Finally, the Disputes Chamber points out the following:
If one of the parties wishes to make use of the possibility to consult and
copyingthefile(article95,§2,3°WOG),shouldreturntothesecretariat
of the Disputes Chamber, preferably via litigationchamber@apd-gba.be, in order to make an appointment
1Section 3, Subsection 2 WOG (Articles 94 to 97).
2
1° to dismiss a complaint;
2° order the suspension of prosecution;
3° order the suspension of the judgment;
4° propose a settlement;
5° to formulate warnings and reprimands;
6° order compliance with the data subject's requests to exercise his or her rights;
7° to order that the data subject is informed of the security problem;
8° order that the processing be temporarily or permanently frozen, restricted or prohibited;
9° to order that the processing is brought into conformity;
10° the rectification, restriction or deletion of data and its notification to the recipients of the data
command;
11° order the withdrawal of the recognition of certification bodies;
12° to impose periodic penalty payments;
13° impose administrative fines;
14° order the suspension of cross-border data flows to another State or an international institution;
15° to hand over the file to the public prosecutor's office in Brussels, who will inform it of the consequence that the
file is given;
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. Decision 137/2021 - 4/5
If a copy of the file is requested, the documents will be
delivered electronically or otherwise by regular mail .3
III. Publication of the decision
12. Given the importance of transparency in the decision-making of the
Litigation Chamber, this decision is published on the website of the
Data Protection Authority. However, it is not necessary that the identification data
of the parties be published directly.
FOR THESE REASONS,
the Disputes Chamber of the Data Protection Authority decides, subject to the
submission of a request by the defendant for a hearing on the merits in accordance with Article
1
98 ff WOG , to:
- on the basis of Article 58.2, c) AVG and Article 95, §1, 5° WOG to order the defendant that
complied with the data subject's request to exercise his or her rights, in particular the right
to erasure (Article 17.1 GDPR), and proceed to erasure of the relevant data
personal data, and this within 30 days from the notification of
this decision;
- order the defendant to the Data Protection Authority (Dispute Chamber) by email
within the same period of time about the outcome of this decision by e-mail
email address litigationchamber@apd-gba.be; and
- in the absence of the timely execution of the above by the defendant, the case
to be dealt with on the merits ex officio in accordance with Articles 98 et seq. WOG.
Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the notification
appeal against this decision to the Marktenhof (Brussels Court of Appeal), with the
Data Protection Authority as Defendant.
Such an appeal may be lodged by means of an adversarial petition that the
1034terof the Judicial Code, the statements listed should contain .The application to
3Due to the extraordinary circumstances due to COVID-19, the possibility of collection at the secretariat of the
Dispute room NOT provided. In addition, all communication is in principle electronic.
4
The petition states, on pain of nullity:
1° the day, month and year;
2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
company number; Decision 137/2021 - 5/5
contradiction must be submitted to the registry of the Market Court in accordance with Article
1034quinquies of the Ger.W. , or via the Justice Deposit Information System (Article 32ter of
the Ger.W.).
(get) Hielke Hijmans
Chairman of the Disputes Chamber
3° the name, first name, place of residence and, where applicable, the capacity of the person to be summoned;
4° the subject matter and the brief summary of the grounds of the claim;
5° the court before whom the claim is brought;
6° the signature of the applicant or of his lawyer.
5 The application with its annex is sent, in as many copies as there are parties involved, by registered letter to the
clerk of the court or at the registry.
