DPA case 19/2023 – Complaint Upheld (Belgium, 2023)

On 7 September 2022, a data subject sent a request of access to his data and requested a copy of it, pursuant to Article 15 GDPR. The data subject then proceeded to send a second email after not receiving any response from the controller. His email received no response yet again. On 22 November 2022, the data subject lodged a complaint with the Belgian DPA. Following the Belgian DPA’s recommendations, the data subject sent an email to another of the controller’s email addresses on 19 January 2023. One month later, there was still no reply. The Belgian DPA held that the controller may have violated Article 12 GDPR and Article 15 GDPR for having failed to facilitate the exercise of the data subject’s right of access in a timely manner and no later than one month from the time the request was received, or to give the data subject a reason for its impossibility to do so. Thus, the Belgian DPA ordered the controller to comply with the data subject’s request of access and to provide him with a copy of his data. It ordered the controller to respond to future requests of data subjects to exercise their rights, and finally ordered the controller to inform the DPA by e-mail of the outcome of this decision.