DPA case 145/2022 – Complaint Upheld (Belgium, 2022)

The controller sent out a newsletter as part of its marketing activity. The data subject in this case stated they had never signed up for it in the first place and wished to unsubscribe. The data subject exercised their right of access, which the controller complied with. After this, the data subject wanted to exercise their right of erasure. However, the controller asked for the identification card (ID) of the data subject in order to move on with the request. The controller's privacy policy stated that a written letter with proof of identity was required for exercising rights. The data subject requested information about how the controller received their personal data. The controller stated that the data subject consented to the processing of their personal data by taking part in a campaign. However, the data subject denied this and filed a complaint before the Belgian DPA. The DPA recalled that under Article 12(2) GDPR the controller was not allowed to refuse a data subject the possibility to exercise their rights unless the controller could prove that it was not able to identify the data subject. The DPA held that this was not the case, because the controller had complied with an access request of the data subject without requiring any further identification. The DPA held that the controller violated Article 5(1)(c) GDPR by requiring an ID for exercising data subject rights, such as the right of access (Article 15 GDPR) and the right of erasure (Article 17 GDPR). The controller had to prevent processing too much personal data for the purpose of identifying a data subject, who wanted to exercise their rights. The DPA stated that the e-mail address of the data subject, used to send the direct marketing, was sufficient for identification purposes. The DPA stated that the controller should adjust his practises to prevent similar facts and possibly new complaints in the future. Moreover, the DPA warned the controller pursuant to Article 58(2)(c) GDPR and Article