1/4
Litigation Chamber
Decision 02/ 2019 of 15 May 2019
File number: DOS-2019-01171
Subject: Cross-border complaint for non-compliance by the controller with a request to
exercise the right to erasure
The Litigation Chamber of the Data Protection Authority, composed of president, and
and members;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April
2016 on the protection of natural persons with regard to the processing of personal data and on the
free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),
hereinafter GDPR;
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority ;
Having regard to the internal rules of procedure as approved by the House of Representatives on 20
December 2018 and published in the Belgian Official Gazette on 15 January 2019;
Having regard to the documents in the file;
.
.
.
Decision 02/2019 - 2/4
has decided as follows in the matter of:
- the plaintiff:
- the controller:
1. Facts and procedure
On the basis of Article 95, §2 of the Law of 3 December 2017 establishing the Data Protection
Authority, the Litigation Chamber informs the controller of the fact that a file is pending as a result of
the complaint.
The complaint concerns the non-compliance of with the request by
to exercise his right to erasure ("the right to be forgotten"). He filled in the web form
twice in order to excercise his right to erasure and received no answer. He also sent an email with the
same request on 28 June 2018 to , as well as to
, asking to have his data erased. Nor to this did the data subject
receive any answer, although Article 12.3. of the General Data Protection Regulation provides for the
controller to inform the data subject about action taken on the request, without undue delay and in
any event within one month of receipt of the request. If needed that period may be extended by
another two months, depending on the complexity and number of the requests.
2. Legal basis
- Article 12.3. General Data Protection Regulation
"The controller shall provide information on action taken on a request under Articles 15 to 22 to the
data subject without undue delay and in any event within one month of receipt of the request. That
period may be extended by two further months where necessary, taking into account the complexity
and number of the requests. The controller shall inform the data subject of any such extension within
one month of receipt of the request, together with the reasons for the delay. Where the data subject
makes the request by electronic form means, the information shall be provided by electronic means
where possible, unless otherwise requested by the data subject."
- Article 17. General Data Protection Regulation
"1. The data subject shall have the right to obtain from the controller the erasure of personal data
concerning him or her without undue delay and the controller shall have the obligation to erase
personal data without undue delay where one of the following grounds applies:
Decision 02/2019 - 3/4
a) the personal data are no longer necessary in relation to the purposes for which they were collected
or otherwise processed;
b) the data subject withdraws consent on which the processing is based according to point (a) of
Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding
legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article
21(2);
d) the personal data have been unlawfully processed;
e) the personal data have to be erased for compliance with a legal obligation in Union or Member
State law to which the controller is subject;
f) the personal data have been collected in relation to the offer of information society services referred
to in Article 8(1).
2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to
erase the personal data, the controller, taking account of available technology and the cost of
implementation, shall take reasonable steps, including technical measures, to inform controllers which
are processing the personal data that the data subject has requested the erasure by such controllers
of any links to, or copy or replication of, those personal data.
3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: a) for exercising the
right of freedom of expression and information; b) for compliance with a legal obligation which requires
processing by Union or Member State law to which the controller is subject or for the performance of
a task carried out in the public interest or in the exercise of official authority vested in the controller;
c) for reasons of public interest in the area of public health in accordance with points (h) and (i) of
Article 9(2) as well as Article 9(3); d) for archiving purposes in the public interest, scientific or historical
research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred
to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives
of that processing; or e) for the establishment, exercise or defence of legal claims."
3. Justification
Despite the plaintiff repeatedly asking to comply with his request to exercise
his right to erasure, the controller did not respond. It appears clearly from the facts that the deadline
for responding to the plaintiff's request has been exceeded in every respect.
Decision 02/2019 - 4/4
As a result of these findings an infringement of the aforementioned provisions must be regarded as
proven.
ON THESE GROUNDS,
the Litigation Chamber of the Data Protection Authority decides, after deliberation:
- by virtue of Article 58.2. c) of the GDPR and Article 95, §1, 5° of the Law of 3 December 2017,
to order the controller to comply with the plaintiff's requests to exercise his rights,
in particular the right to erasure ("the right to be forgotten") (Article 17 of the GDPR);
- by virtue of Article 95, §1, 8° of the Law of 3 December 2017, to publish that decision on
the website of the Data Protection Authority, albeit after anonymisation.
In application of Article 60.10. of the GDPR, attention is drawn to the fact that the controller is required
to communicate the measures he has taken to comply with the decision to the Data Protection
Authority. Having regard to Article 12.3. of the GDPR, the controller shall provide information on action
taken on the decision to the Litigation Chamber within one month of receipt of this decision.
This decision may be appealed within thirty days after service of the notice 1 at the Markets Court2
(Article 108, §1 of the aforementioned Law of 3 December 2017).
If the controller wishes to make use of the possibility of consulting and copying the file (Article 95, §2,
3° of the Law of 3 December 2017), he should contact the secretariat of the Litigation Chamber in
order to make an appointment.
If a copy of the file is requested, the documents shall be sent by ordinary mail, unless the controller
wishes to pick them up at the premises of the secretariat of the Litigation Chamber.
(signed)
1
The date of this letter shall serve as the date of service of the notice.
2
Court of Appeal of Brussels.