In a judgment of the Court of Cassation of 14 February 2013, the Court confirmed that the data controller’s obligation to file a privacy notification with the Belgian Privacy Commission (BPC) does not relieve the data controller of its duty to answer to a data subjects’ request to access its data.
The present case was introduced by a claimant who never received a formal answer on his request to access his personal data according to Article 10 of the Belgian Data Protection Act (BDPA). In an earlier phase of the proceedings, the claimant had invoked the infringement of his right of access and had asked for the forced communication of his data. Although the Court acknowledged that the claimant had never received a formal answer, the Court held that the communication of the privacy notification (17 BDPA) to the lawyer of the claimant at the beginning of the proceedings was sufficient.
The Court of Cassation recently quashed this judgment of the Court of Appeal. The highest court held that, even if the data subject had actually received the requested information through the communication of the privacy notification during the proceedings before the court of first instance, there is still a violation of the data subject’s right of access.
The Court considered that the requirement of Article 17 BDPA to file a privacy notification is meant to allow the BPC to verify prior to the processing of the data whether the principles of the BDPA are respected. This requirement is different from the requirement of Article 10 BDPA which imposes an obligation upon the data controller to provide the data subject with certain information relating inter alia to the categories of the data processed and the personal data being subject to the processing. Therefore, only the communication of the information provided for in Article 10 BDPA would relieve the data controller from his duties under the BDPA
