DPA case 115/2023 – Dismissed (Belgium, 2023)

The complaint concerned an alleged data breach. The data subject tried to submit a document to his personal profile on the controller's platform twice but it was submitted to his employer's company account instead. The data subject argued that the information incorrectly registered included payment details and the data subject's power of attorney. On 4 July 2023, the data subject submitted a complaint to the Belgian DPA. The Belgian DPA dismissed the case on "policy grounds", mainly on the basis that no personal or social impact was caused as a result of the GDPR violations. The DPA notes that "in order to evaluate the foregoing [complaint] ... the [DPA] ... takes into account the criteria that European Data Protection Authorities handle processing operations with a 'high risk' within the meaning of Article 35 GDPR." Firstly, the Belgian DPA created a test of "major social and/or personal impact" as a criteria for evaluating complaints. Moreover, the DPA takes the concept of high risk processing from Article 35 GDPR, which is an article directed at controllers and uses it as a basis for evaluating the admissibility of complaints. Article 35 GDPR imposes an obligation upon controllers to conduct a risk assessment of their processing activities, where the processing is likely to result in a high risk to the rights and freedoms of natural persons (Data protection impact assessment or DPIA). The Belgian DPA has taken the concept of high risk processing and has extended it to its criteria used in evaluating complaints. Secondly, the Belgian DPA read Article 35 GDPR in line with Article 77 GDPR. The DPA interpreted the right to lodge a complaint with a supervisory authority under Article 77 GDPR , concluding that the right to lodge a complaint is not absolute. On this point, the Belgian DPA stated that: "However, this objective right of complaint does not imply that every complaint can and will be thoroughly investigated by the competent authority, g