DPA case 49/2024 – Dismissed (Belgium, 2024)

A data subject requested access to and erasure of their personal data. A fear of a “major negative personal impact”, including possible defamation was indicated as a reason for the request to erase the data. The data controller rejected the erasure request, because the data subject gave consent to the data processing and, afterwards, the controller needed to keep the data for an overriding public interest. The data subject filed a complaint with the Belgian DPA (APD/GBA). During the examination proceedings, the controller argued that the decision to reject the erasure request was based on Article 10 (1)(1) and Article 10 (1)(3) of the [https://etaamb.openjustice.be/nl/wet-van-30-juli-2018_n2018040581.html Dutch Personal Data Protection Law] (Wet betreffende de bescherming van natuurlijke personen met betrekking tot de verwerking van persoonsgegevens). This law authorized the controller to process the data contrary to data subject’s request, since the data subject would potentially be accused of criminal offences and the controller would be involved in the proceedings. Hence, as a party to the proceedings, the controller could provide the authority with necessary evidence. In addition, the data controller explained that an overriding public interest referred to a type of potential proceedings. The DPA considered that the compliant consisted of two separate issues, namely the refusal answer the access request and the refusal to fulfil the erasure request. The DPA rejected the alleged refusal to act on the access request. According to the DPA, the controller did not respond to data subject access request, but during the proceedings the controller confirmed their readiness to do so. On the allegation of the erasure request refusal, the DPA found it manifestly unfounded. The DPA referred to the wording of Article 17(3)(e) GDPR, which excluded the application of right to erasure in cases where data are necessary “for the establishment, exercise or defence of lega