DPA case 47/2024 – Dismissed (Belgium, 2024)

The controller, a bank (“controller 1”), decided to block the data subject’s bank account for an overdraft of €1,400. The data subject made an access request, asked the controller to justify its action, asked for the erasure of their personal data and explained that the debt had been transferred to a debt collecting agency (“controller 2”) and had been repaid shortly after their account had been blocked. The data subject received no response to their telephone calls nor emails and the controller even blocked their email address. The data subject also contacted controller 2 to ask for the erasure of their personal data. Controller 2 indicated that it was able to retain the data subject’s personal data for a period of 10 years. The data subject questioned the legality of such a practice and therefore lodged a complaint with the Belgian DPA (“APD”) against controller 1 for not responding to the data subject access request and the erasure request and against controller 2 for not taking into account their deletion request. Firstly, the APD considered that the complaint did not present the necessary details to assess whether there was a breach of the GDPR. Regarding the complaint against controller 1, the APD found that the data subject submitted a copy of a single email, which does not authenticate the information provided, nor does it constitute conclusive evidence. Regarding the complaint against controller 2, the APD held that the data subject did not provide any evidence of exchanges with the defendant concerning his erasure request. Secondly, the APD pointed out the events took place between December 2020 and February 2021. However, the data subject lodged a complaint with the DPA in November 2023 which represents a delay of more than 2 years and 9 months since the last exchanges with the controllers. The APD also pointed out that no valid justification had been provided to explain this significant lapse of time. Therefore, the APD held that the complaint was