DPA case 27/2023 – Complaint Upheld (Belgium, 2023)

This decision concerned a landlord (controller) who did not respond to an access request of a tenant (data subject). On 2 December 2019, the data subject filed an access request with the controller. On 31 December 2019, almost one month later, the controller notified the data subject that it would use the possibility in Article 12(3) GDPR to extend the normal deadline of one month with two additional months. On 3 March 2020, the data subject filed a complaint with the Belgian DPA against the controller because no answer had been provided at that point. On 2 September 2020, almost 10 months after the data subject had filed the original access request, the controller provided a reply. However, the data subject complained that the controller had not answered all the questions of the data subject. These questions concerned the existence of possible leaks of personal data, the security protocols of the controller and, lastly, the security and organisational measures relating to processing by the controller's employees or contractors. The controller refused to answer these questions, stating that these would not fall within the scope of Article 15(1) GDPR and the controller was therefore not obligated to answer these questions. On 29 September 2020, the controller clarified its position to the DPA. The controller acknowledged that no timely answer had been provided to the data subject because the controller's employee in charge of the data subjects file had been on a long term sick leave. The access request was then simply forgotten, according to the controller. The DPA first reiterated the legal requirements of Article 15 GDPR. In particular, the DPA stressed the importance of the right of access under Article 15 GDPR, since this right allowed data subjects to check the lawfulness of each processing activity and, if necessary, to have the processed personal data rectified or deleted. Assessing the facts of the case, the DPA confirmed that the controller did not r