Administrative fine of €100,000 imposed by the Belgian Data Protection Authority on a telecommunications controller for a 14-month delay in responding to a request for access to personal data

The National Center for the Protection of Personal Data (NCPDP), for information and enforcement purposes, communicates about the administrative fine of 100 000 euro imposed by the Belgian Data Protection Authority for violation of Article 12 Transparent information, communication and modalities for the exercise of the rights of the data subject and Article 15 Right of access by the data subject of the GDPR.

The complainant, a customer of a telecommunications controller, following a contractual incident, followed a mediation procedure with the controller. The controller admitted his fault, but the complainant nevertheless exercised his right of access to his personal data. He requested, inter alia, to know the identity of the employees who processed his personal data and the purposes of the processing. The request was sent via the controller’s messenger channel with the express request that it be forwarded to the Data Protection Officer (DPO). However, despite the fact that his request has been handled by two employees, it has not been satisfied, nor transferred to the DPO. The complainant subsequently lodged a complaint with the Belgian SA and received a response from the controller 14 months after his request for access to personal data.

Following the investigations, the Belgian DPA considered that the complainant’s request was largely satisfied. At the same time, the controller was found to have breached certain provisions of the GDPR because of the 14-month delay in responding and because the controller failed to forward the complainant’s request to its DPO. However, the penalty, amounting to €100 000, is based solely on the breach of Article 15 of the GDPR. The decision is not final and can be challenged by the parties.

The NCPDP, as the national supervisory authority for the processing of personal data, emphasizes the responsibility of personal data controllers to comply with the provisions of the legislative framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.