Privacy & Information Security Law Blog

On June 16, 2020, the Litigation Chamber of the Belgian Data Protection Authority (the “Belgian DPA”) imposed a fine on a company (the “defendant”) for unlawful and incorrect processing of personal data and non-compliance with the EU General Data Protection Regulation’s (the “GDPR”) data subject rights provisions.

Background

The defendant had mistakenly sent marketing communications to the claimant, who was not part of the defendant’s customer database; the claimant only received the marketing communications because his name and surname were the same as another individual in the defendant’s customer database. Following the receipt of the first marketing communication, the claimant contacted the defendant, requesting more information on how his data had been collected, the legal basis used by the defendant to process his data and what data the defendant maintained on the claimant. The claimant never received a clear answer from the defendant. After receiving a second marketing communication, the claimant exercised his right of access. In the absence of a response from the defendant within the deadline set forth under the GDPR, the claimant informed the defendant of his intention to file a claim before the Belgian DPA.

The Decision

• Lawfulness: According to the claim, the claimant alleged that his personal data was processed unlawfully. While the Litigation Chamber understood that the first marketing communication was sent due to a manual mistake, the Litigation Chamber considered this fact to not automatically exclude the liability of the defendant, especially given that a second marketing communication was sent despite the first complaint sent by the claimant. Accordingly, the Litigation Chamber confirmed that the defendant unlawfully processed the personal data of the claimant.
• Data Minimization and Accuracy: According to the Litigation Chamber, the defendant infringed the GDPR principles of data minimization and accuracy, as the defendant should not have sent a second marketing communication using inaccurate data and instead should have erased or corrected the data in its system.
• Transparency, Communication and Modalities for the Exercise of Data Subject Rights: According to the Litigation Chamber, the defendant failed to respond without undue delay to the claimant’s access request or, alternatively, ask for an extension, thereby infringing Articles 12(1) and (3) of the GDPR. Pursuant to the GDPR, the defendant should have responded to the request within a month.
• Access Rights: According to the Litigation Chamber, the defendant did not adequately provide the claimant with an overview of the personal data it processes about him or a copy of the data it maintains, thereby infringing Article 15 of the GDPR.
• Responsibility of the Data Controller: The Litigation Chamber concluded that the defendant did not take sufficient technical and organizational measures to ensure and be able to demonstrate that the processing of the claimant’s personal data complied with the GDPR.
• Anonymization or Pseudonymization of the Decision for Publication: The Litigation Chamber stressed the importance of publishing its decision for the purpose of transparency. However, it assented to the defendant’s request to anonymize the decision to prevent damage to the defendant’s reputation.

In determining the amount of the fine, the Belgian DPA took into account (1) the seriousness of the infringements and the fact that the infringements relate, among other things, to data subject rights; (2) the fact that the defendant was negligent and provided insufficient answers to the claimant following the access request; (3) the limited impact of the infringements, which only affected one individual; (4) the lack of measures taken by the defendant to comply with the GDPR, despite it being applicable for more than a year and a half at the time of the infringements; and (5) the duration of the infringements. According to the Litigation Chamber, the fine is fairly low in comparison with the annual turnover of the defendant.