A data subject (an employee) – Complaint Upheld (Belgium, 2025)

The 10 May 2021, an employee (the data subject) sent their employer (the controller) a request to access to their personal data. The data subject specifically required a copy of a document showing their working hours. The 2 March 2023, the controller sent a letter to the data subject, offering to make an appointment to come to the firm’s head office to consult their data. The data subject did not react to the controller’s proposal. The 27 July 2023, the data subject lodged a complaint to the DPA. The DPA ordered the controller to comply with the data subject’s request for a copy. The DPA reminds that the data subject has a right to obtain confirmation of the processing and to access their personal data (Article 15(1) GDPR). In addition, the data subject has the right to obtain a copy of their personal data processed (Article 15.3). The DPA considered that the right to a copy must be understood as a way of giving the data subject access to their personal data, so that its purpose is to serve the objective of the right of access. The DPA points out that the CJEU defined the right to a copy in a previous decision Österreichische Datenschutzbehörde as the right to obtain a comprehensible and accurate reproduction of all data, whether it is a reproduction of an entire document or an extract from a data base. This is why the DPA decided that a temporary consultation could not be sufficient. What’s more, the DPA warned the controller of a potential violation of Article 12(3) and Article 12(4) GDPR. The DPA noticed that the controller should have facilitate the exercise of the right of access and answered without undue delay and within a month to the data subject request.