The Belgian DPA issues a 100k EUR fine for ignoring an access request

Belgian DPA: 100k EUR fine for a controller for not responding during 14 months to a data subject access request. [Decision of 23 August 2024; fine: <0.01% of turnover] Summary of the facts: - After some subscription modifications carried out by Controller (a telecom company) *not* requested by the data subject (= Complainant), there is a mediation procedure before the telco ombudsman [a specific mediator for telco-consumer relations in Belgium] - Afterwards, Complainant contacts Controller in January 2022 via its Messenger channel, and exercises his data subject access right [DSAR]. (Apparently, it didn't have a dedicated DPO e-mail address then.) Controller customer rep asks for clarifications. Then, no news. - Complainant reminds Controller of his request nearly two months later, in March 2022, and then files a complaint before the Belgian DPA. - Complaint is declared admissible by the Belgian DPA in June 2022 and goes to the Litigation Chamber. - Controller is informed of the proceedings end February 2023, and responds to Complainant one month later. Findings of Belgian DPA: - Having information before exercise of DSAR (= by way of mediation before telco ombudsman) doesn't discharge the controller from obligation to respond to DSAR, especially if the controller doesn't invoke one of the exceptions under Art. 12(5) GDPR - which should have been mentioned to Complainant anyway (12(4) GDPR) - "By responding to [Complainant's DSAR] well beyond the deadline set by Article 12.3 of the RGPD, [Controller] was guilty of a continuous violation of the complainant's right of access for 14 months. I have mixed feelings about this one: - On the one hand, some DSARs *can* and *do* get forgotten - many teams dealing with DSARs are just overwhelmed, in particular in sectors where data subjects ask frequently because they are aware of how data-intensive the processing can be. Plus, two human errors don't mean "gross negligence" in all cases. - On the other hand, there had been a very clear reminder, and this particular request doesn't seem to have been complex (while some can really be complex). Plus, the request wasn't a nuisance request - it seems to stem from an actual processing issue, and it wasn't the Nth request in a fishing expedition. Decision (in French): https://lnkd.in/esE8tPaU