Document access and the right to information

When do contracts have to be provided in response to a data subject access request? And should a controller maintain a copy thereof to enable data subject requests? A new Belgian DPA decision deals with this issue, applying the EU Court of Justice’s CRIF judgment to the issue of bank account contracts.

Article 15 GDPR requires the provision of the personal data itself, but as we know from CRIF (4 May 2023, C-487/21), sometimes (excerpts of) documents must be provided “to enable the data subject to exercise effectively the rights conferred” by the GDPR.

In its decision of 26 January 2026, the Belgian DPA found that bank account opening contracts were “the basis on which the processing of the complainant’s data is justified” and that “verifying the lawfulness of the processing is an objective of the right of access, which in this case is carried out on the basis of the missing contracts”. Therefore, “the disclosure of these contracts would have been essential to enable the complainant to carry out this verification and, where appropriate, exercise his other rights, such as the right to restriction of processing”. [para. 34]
As a result: “35. […] the contracts for the opening of account 1 and the related bank cards form an integral part of the complainant’s request for access.

But what about evidence thereof? The controller no longer had a copy of the actual (paper) contracts. Art. 5(2) GDPR on accountability requires being able to demonstrate that a contract exists, though. The Belgian Supreme Court confirmed on 10 January 2025 that the Belgian DPA can validly assess whether a contract with a data subject exists, and in this new decision the Belgian DPA found that the evidence provided by the controller was sufficient to support “the conclusion that there is a contractual relationship between the complainant and the [controller]” (§44).

Shouldn’t it have maintained digital archives? Yes, according to the Belgian DPA, based on Art. 5(1)(f), 25(1) & 32 GDPR: “the Litigation Chamber considers that the [controller] should have had appropriate mechanisms in place to assess, in a structured manner, the necessity and possibility of recovering lost paper contracts, given that they constitute the corpus on which the processing of data by a signatory party is justified, as in the present case” (§54).

Conclusion: violation of Articles 5(1)(f), 25(1) & 32 GDPR. No fine, only a reprimand.

At first glance that seems balanced: contracts unavailable but sufficient evidence that they existed, so no violation of Art. 6 GDPR, yet that unavailability means there is a violation of other GDPR provisions.
Yet that last bit could be misused: does it mean *ALL* documents, including IT system logs, need to be maintained for several years? Or just those underlying a legal ground?

This could be a very slippery slope towards excessive documentational obligations.
Expect more litigation on this!

Link (in French): https://lnkd.in/egTz8Vjc
Data protection privacy