1/5
Litigation Chamber
Decision XX/2021 of 17 January 2022
File number: DOS-2021-06120
Subject matter: Complaint regarding lack of response to request for access
The Litigation Chamber of the Data Protection Authority, composed
Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on
the protection of individuals with regard to the processing of personal data and on the free movement of
such data and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to
as the GDPR;
Pursuant to the Act of 3 December 2017 establishing the Data Protection Authority, hereinafter referred
to as DPAA;
Pursuant to the Internal Rules of Procedure, as approved by the Chamber of Representatives on 20
December 2018 and published in the Belgian Official Gazette on 15 January 2019;
Pursuant to the documents in the file
has taken the following decision regarding:
.
The complainant: residing at hereinafter
.
"the complainant"; .
The data controller: with its registered office at ,
ereinafter "the data controller"
Decision XX/2021 - 2/5
I. Facts and procedure
1. On 4 July 2020, the complainant filed a complaint against the data controller with the Irish Data
Protection Commission. This is a cross-border complaint within the meaning of Article 60 of the
GDPR, which was referred from the Irish supervisory authority to the Belgian Data Protection
Authority. On 23 November, the [Belgian] Data Protection Authority (DPA) confirmed that it would
act as Lead Supervisory Authority (hereinafter LSA) in this case, as the data controller's registered
office is in Belgium. The supervisory authorities of the following EU Member States confirmed that
they would act as Concerned Supervisory Authorities (CSA): Sweden, Estonia, Poland, Norway and
the Netherlands. As the complaint was lodged with the Irish authority, the latter is also a CSA.
2. The complaint concerns the failure of the data controller to comply with the complainant's request
to exercise his rights of access and information. On 13 July 2020, the complainant addressed his
request to the controller by e-mail. The complainant also sent a request for access on 14, 15, 16, 20
and 21 July 2020 via the website of the data controller. The complainant sent the controller a
reminder e-mail on 31 August 2020. The complainant did not receive an answer from the controller
to any of these requests.
3. This complaint is the subject of the procedure provided for in Article 60 GDPR (Cooperation
between the Lead Supervisory Authority and the other Concerned Supervisory Authorities). This
procedure provides that the Litigation Chamber as LSA submits a draft decision to the CSAs for
their consideration. The CSAs may submit relevant and substantiated objections, which the
Litigation Chamber should take into account within a period of 4 weeks. If no objection has been
lodged within the prescribed period, the LSA and the CSAs are deemed to agree to the draft
decision and shall be bound by it.
II. Reasoning
4. It is apparent from the documents in the file that the complainant, in accordance with Article 15 of
the GDPR1, addressed a request to the data controller to access his personal data. Pursuant to
1
Article 15 GDPR: 1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him
or her are being processed, and, where that is the case, access to the personal data and the following information:
(a) the purposes of the processing;
(b) the categories of personal data concerned;
(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipie nts in third countries or
international organisations;
(d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
(e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data
concerning the data subject or to object to such processing;
(f) the right to lodge a complaint with a supervisory authority;
(g) where the personal data are not collected from the data subject, any available information as to their source;
(h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information
about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
2. Where personal data are transferred to a third country or to an international organisation, the data subject shall have th e right to be informed of the
appropriate safeguards pursuant to Article 46 relating to the transfer.
3. The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the da ta subject, the controller
may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise
requested by the data subject, the information shall be provided in a commonly used electronic form.
4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others."
Decision XX/2021 - 3/5
Article 12.3 of the GDPR2, the data controller was obliged to inform the complainant without delay,
and in any event within one month of receipt of the request, of the action taken concerning the
request. That period may be extended by a further two months if necessary, depending on the
complexity of the requests and the number of requests. The data controller did not respond despite
several requests from the complainant to the controller to comply with his request to exercise his
rights of access and information. It is clear from the facts that the deadline for responding to the
complainant's request was exceeded in every respect.
5. The Litigation Chamber is of the opinion that, on the basis of the above analysis, it must be
concluded that the data controller committed an infringement of the provisions of the GDPR, which
justifies the adoption of a decision in this case on the basis of Article 95, § 1, 5° DPAA; more
specifically, to order the data controller to comply with the complainant's exercise of his right to
access the data (Article 15 GDPR), particularly in view of the documents submitted by the
complainant which show that the data controller did not respond to the complainant's request in
this sense.
6. The present decision is a prima facie decision taken by the Litigation Chamber in accordance with
Article 95 DPAA on the basis of the complaint lodged by the complainant, within the framework of
the "procedure preceding the decision on the merits"3 and not a decision on the merits of the
Litigation Chamber within the meaning of Article 100 DPAA. The Litigation Chamber has thus
decided to rule on the basis of art. 58.2. c) GDPR and Art. 95, §1, 5° of the Act of 3 December 2017,
and thus order the data controller to comply with the data subject's requests to exercise his rights,
in particular the right of access (Art. 15 GDPR).
7. The purpose of this decision is to inform the data controller that it has breached the provisions of
the GDPR and to give it the opportunity to comply with the aforementioned provisions.
8. However, if the data controller does not agree with the contents of the present prima facie decision
and considers that it has factual and/or legal arguments which could lead to a different decision,
they may send an e-mail to [email protected] to submit a request to the Litigation
Chamber to examine the merits of the case within 14 days of service of this decision. If necessary,
the enforcement of this decision shall be suspended for the aforementioned period.
9. In the event of a continuation of the proceedings on the merits, pursuant to Articles 98, 2° and 3°
in conjunction with Article 99 of the DPAA, the Litigation Chamber shall invite the parties to submit
their defences and to attach any documents they deem useful to the file. This decision shall be
permanently suspended if necessary.
2
Article 12.3 GDPR: The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay
and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account
the complexity and number of the requests The controller shall inform the data subject of any such extension within one month of receipt of the request,
together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information s hall be provided by
electronic means where possible, unless otherwise requested by the data subject.'
3
Section 3, Subsection 2 DPAA (Articles 94 to 97).
Decision XX/2021 - 4/5
10. For the sake of completeness, the Litigation Chamber points out that a hearing on the merits of the
case may lead to the imposition of the measures mentioned in Article 100 DPAA 4.
11. Finally, the Litigation Chamber points out the following:
If either party wishes to make use of the possibility to consult and copy the file (art. 95, §2, 3° DPAA),
they should apply to the secretariat of the Litigation Chamber, preferably via
[email protected], in order to schedule an appointment. If a copy of the file is
requested, the documents shall be delivered electronically if possible or otherwise by ordinary
mail5.
III. Publication of the decision
12. Given the importance of transparency in relation to the decision of the Litigation Chamber, this
decision will be published on the website of the Data Protection Authority. However, it is not
necessary for the defendant's identification data to be disclosed directly for that purpose.
4
1° to close a complaint; 2° to order the dismissal of a complaint; 3° to order the suspension of the judgment; 4° to propose a settlement;
5° to issue warnings and reprimands; 6° to order compliance with the requests of the data subject to exercise their rights; 7° to order the
notification of the security problem to the data subject; 8° to order the temporary or definitive freezing, restriction or prohibition of the
processing; 9° to order the bringing into compliance of the processing; 10° to order the rectification, restriction or erasure of data and the
notification thereof to the recipients of the data; 11° to order the withdrawal of the accreditation of certification bodies; 12° to impose
periodic penalty payments 13° to impose administrative fines; 14° to order the suspension of cross-border data flows to another State or
international institution; 15° to transfer the file to the public prosecutor's office in Brussels, which will inform it of the action taken; 16° to
decide, on a case-by-case basis, to publish its decisions on the website of the Data Protection Authority.
5
Due to the exceptional circumstances arising due to COVID-19, the option of collection from the secretariat of the Litigation Chamber is
NOT available. Moreover, all communication is in principle electronic.
Decision XX/2021 - 5/5
ON THESE GROUNDS,
the Litigation Chamber of the Data Protection Authority rules, subject to the lodging of a request by
the data controller, on the merits in accordance with Article 98 et seq. DPAA, to:
- pursuant to Article 58.2(c) of the GDPR and Article 95(1)(5) of the DPAA , to order the data
controller to comply with the data subject's request to exercise their rights, in particular the right
of access (Article 15 of the GDPR), and to proceed to the transmission of the requested
information within a period of 14 days from the service of this decision;
- order the Data Controller to inform the Data Protection Authority (Litigation Chamber) of the
result of this decision by e-mail within the same period of time, at the e-mail address
[email protected]
- in the absence of timely implementation of the above by the data controller, to rule on the merits
of the case ex officio in accordance with Articles 98 et seq. DPAA.
This decision may be challenged pursuant to art. 108, §1 DPAA; an appeal may be lodged with the
Market Court within a period of thirty days from the service, with the Data Protection Authority as
defendant.
Hielke Hijmans
President of the Litigation Chamber