1/4
Litigation chamber
Decision 2019/ [number] of 15 May 2019
File number:
The Litigation chamber of the Data Protection Authority, composed of President, and
members;
Considering the Regulation (EU) 2016/679 of the European Parliament and of the Council of
27 April 2016 on the protection of individuals with regard to the processing of personal data and on
the free movement of such data and repealing Directive 95/46/EC (General data protection regulation,
hereafter GDPR);
Considering the Act of 3 December 2017 establishing the Data Protection Authority;
Considering the rules of procedure as approved by the Chamber of Representatives on
20 December 2018 and published in the Belgian Official Journal on 15 January 2019;
Considering the documents from the file;
.
.
.
decided as follows concerning:
- the complainant:
- the controller:
1. Facts and procedure
On the basis of Article 95, §2 of the Act of 3 December 2017 establishing the Data Protection Authority,
the Litigation chamber informs you that a file is pending as a result of the complaint.
The complaint concerns the failure of to comply with s request
to exercise her right of access. In the framework of her son's studies, a contract has been concluded
with the controller, which was at that time , for the rental
of a studio. For the purpose of the guarantee, a copy of the identity card as well as data on the
complainant's income were provided to that same controller. When it was reported to her son that
would now be the controller, the complainant asked to access her personal data.
She was then informed by that they didn't have any personal data about her and
that the information which had been transmitted to should
have been erased. The complainant argued that this was not possible as the contract was still in force.
The complainant urged again to provide her access to her personal data.
2. Legal basis
Art. 15 GDPR:
1. The data subject shall have the right to obtain from the controller confirmation as to whether
or not personal data concerning him or her are being processed, and, where that is the case,
access to the personal data and the following information:
(a) the purposes of the processing;
(b) the categories of personal data concerned;
(c) the recipients or categories of recipient to whom the personal data have been or will be
disclosed, in particular recipients in third countries or international organisations;
(d) where possible, the envisaged period for which the personal data will be stored, or, if not
possible, the criteria used to determine that period;
e) the existence of the right to request from the controller rectification or erasure of personal
data or restriction of processing of personal data concerning the data subject or to object to
such processing; f) the right to lodge a complaint with a supervisory authority; g) where the
personal data are not collected from the data subject, any available information as to their
source;
28/01/2022 ...
h) the existence of automated decision-making, including profiling, referred to in Article 22(1)
and (4) and, at least in those cases, meaningful information about the logic involved, as well
as the significance and the envisaged consequences of such processing for the data subject.
2. Where personal data are transferred to a third country or to an international organisation, the
data subject shall have the right to be informed of the appropriate safeguards pursuant to
Article 46 relating to the transfer.
3. The controller shall provide a copy of the personal data undergoing processing. For any further
copies requested by the data subject, the controller may charge a reasonable fee based on
administrative costs. Where the data subject makes the request by electronic means, and
unless otherwise requested by the data subject, the information shall be provided in a
commonly used electronic form.
4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and
freedoms of others.
3. Justification
Despite the complainant's query to to comply with her request to exercise her
right to access, the controller failed to react adequately.
It follows from that finding that an infringement of the abovementioned provision must be regarded
as proven.
FOR THESE REASONS,
The Litigation chamber of the Data Protection Authority decides, after deliberation, as follows:
- pursuant to Article 58.2. c) of the General Data Protection Regulation (hereafter GDPR) and
Article 95, §1, 5° of the aforementionned Act of 3 December 2017, the Litigation chamber
decides to order the controller to comply with the data subject's requests to exercise
her rights, more specifically her right of access (Article 15 of the GDPR).
- pursuant to Article 95, §1, 8° of the Act of 3 December 2017, to publish that decision on
the website of the Data Protection Authority, albeit after anonymisation.
In application of Article 60.10. of the GDPR, attention is drawn to the fact that the controller is bound
to notify to the Data Protection Authority the measures he has taken to ensure compliance with the
28/01/2022 ...
decision. Pursuant to Article 12.3 of the GDPR, the controller shall provide information on the action
taken on the decision to the Litigation chamber within one month of receipt of this decision.
This decision can be appealed to the Market Court within a period of thirty days starting from the
service of the notification (Article 108, §1 of aforementioned Act of 3 December 2017).
If the controller wishes to make use of the possibility of consulting and copying the file (Article 95, §2,
3° of the Act of 3 December 2017), he should contact the secretariat of the Litigation chamber in order
to make an appointment.
If a copy of the file is requested, the documents shall be sent by ordinary mail unless the controller
wants to pick them up on the spot at the secretariat of the Litigation chamber.
President of the Litigation chamber
28/01/2022