DPA case 11/2023 – Complaint Upheld (Belgium, 2023)

The data subject was a client of the controller until December 2021. Afterwards, the controller kept calling him, from numerous phone numbers, to sell its services. The data subject requested, orally, to delete his personal data. The controller never followed-up on this request. In April 2022, the data subject contacted the controller's DPO with a request of erasure. The DPO confirmed that his personal data would only be processed for legal obligations (e.g. tax purposes) and that his phone number and mail address had been deleted from the customer database. Despite this, the data subject would still receive calls from the controller through different phone numbers. He therefore filed a complaint with the Belgian DPA. The DPA determined that using the phone number (or email address) of a data subject to send him promotional materials constituted direct marketing in the sense of Article 21(2) GDPR. The same article grants the right to object to direct marketing, meaning that the personal data can no longer be processed for direct marketing purposes pursuant Article 21(3) GDPR. As such, in line with Article 17(1)(c) GDPR, the controller was obliged to delete, as soon as possible and within one month, the phone number of the data subject unless the controller had another legal basis to process it. On top of that, the controller is obliged to inform all recipients of the phone number to delete it according to Article 19 GDPR. The DPA held that the controllers could have breached Article 21(2) GDPR, Article 21(3) GDPR and Article 17(1)(c) GDPR in combination with Article 12(3) GDPR by still processing the personal data for direct marketing purposes and by not erasing it. The controllers could as well be breaching Article 19 GDPR by not ordering to recipients of the personal data to erase it. The DPA ordered the controller to comply with the objection and erasure request pursuant Article 58(2)(c) GDPR and Article 95(1)(5) LCA (Law establishing the data protection au