DPA case 50/2024 – Dismissed (Belgium, 2024)

On 13 October 2023, the data subject submitted a request for access and subsequent erasure of his personal data, as he feared a “major negative personal impact” in the form of defamation. The controller responded that it would not act on the data erasure request because (i) the data subject had given consent to the processing of this personal data in a prior agreement and (ii) the controller needed to retain the personal data due to an overriding public interest. On 30 December 2023, the data subject filed a complaint with the Belgian DPA (“APD”). On 23 February 2024, the APD asked the controller to clarify 3 points: firstly, the APD asked the controller on what exception they relied on to refuse to grant the data subject access to his personal data. The controller explained that it had not allowed access to the document as it could pose a possible threat to the privacy of others, partly because a file against the data subject was opened by the police in June 2023. Secondly, the APD asked clarifications regarding the “prior agreement” the controller relied on to refuse the access and erasure requests. The controller responded that the data subject signed a privacy notice. Thirdly, the APD asked additional information concerning the “substantial public interest” that the controller relied on. The controller explained that the data subject was accused of criminal offences in which the controller could contribute evidence for the benefit of the public interest. In its responses, the controller also indicated that it was willing to give the data subject access to the file, and that it would make the necessary practical arrangements to this end. Regarding the failure to respond to the access request, the APD considered that although the controller did not respond to access request submitted in October 2023, the controller expressed its willingness to grant inspection to the data subject in its reply in March 2024. Regarding the failure to erase the data on compelling