The Belgian Supervisory Authority sanctions telecom operator for 14 months late reply to a right to access request

Background information

• Date of final decision: 23 August 2024 (the legal 30-day appeal period has not yet expired)
• National case
• Legal Reference (s): Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 15 (Right to access by the data subject)
• Decision: Administrative fine
• Key words: telecommunications, right to access

Summary of the Decision

Origin of the case  

The plaintiff was a customer of the defendant (a telecom operator). Successive to a contractual incident, the complainant followed a mediation procedure with the defendant. The defendant has admitted to a fault. The plaintiff was however not satisfied. He then exercised his right to access. He wanted, among others things, to know the identity of the employees who had processed his personal data, and the purposes of the processing. He made his request via the defendant’s Messenger channel, but specifically asked his demand to be transferred to the Data Protection Officer (DPO). However, despite the fact that his request has been handled by two employees, it has not been satisfied, nor transferred to the DPO. The plaintiff has later filed a complaint with the Belgian Supervisory Authority (SA). The defendant gave an answer to the plaintiff during the exchange of the conclusions, i.e. 14 months after his access request. 

Key Findings 

Concerning the right to access, on the one hand, the Litigation Chamber of the Belgian SA considered that the plaintiff’s demand concerning the purposes of the defendant processing was satisfied. On the other hand, it considered that the plaintiff had no right to access to the identity of the defendant’s employees. Thus, the right to access of the plaintiff is now answered. Concerning the modalities of the right to access, the defendant has breached the articles 12.2, 12.3 et 15 GDPR because of the 14 month late reply and because the defendant has not transferred the request of the plaintiff to his DPO. However, the sanction is based only on the infringement of article 15 GDPR, since both articles 12.2 et 12.3 were not in the framework for discussions. 

Decision 

The Belgian SA imposed an administrative fine of 100.000 EUR. The parties have 30 days to appeal the decision.
 

For further information:  

• decision in national language: Plainte relative à une réponse octroyée avec un retard de plus de 14 mois à
  compter de l’exercice du droit d’accès du plaignant (FR)