In its decision of 9 July 2019, the Belgian Data Protection Authority (“DPA”) reprimanded the Belgian Public Health Service for failing to reply to a request for access to personal data.
In the case at hand, a dentist had been nominated to a post in a commission, but this nomination was later revoked. The dentist decided to invoke his right of access to his personal data under Article 15 of the General Data Protection Regulation (“GDPR”) and asked the Public Health Service to inform him of the reasons behind the revocation. As the Public Health Service did not respond to his request, he filed a complaint with the DPA in September 2018.
In October 2018, the Litigation Chamber of the DPA ordered the Public Health Service to reply to the claimant’s request, but the Public Health Service again failed to act accordingly. The claimant then filed a second complaint with the DPA in March 2019. A hearing was held, during which the Public Health Service admitted the facts and stated that internal procedural issues were the cause for the lack of reply.
After having heard the parties, the DPA decided that the Public Health Service had been highly negligent. The DPA issued a reprimand and ordered the publication of the decision. The DPA further noted that it was of the utmost importance that the Public Health Service implements the necessary measures to comply with its obligations under the GDPR.
As Article 221, §2 of the Belgian Data Protection Act of 30 July 2018 exempts public authorities from administrative fines, the DPA could not impose a fine upon the Public Health Service (in accordance with Article 83(7) GDPR, Member States may indeed determine the rules on whether and to what extent administrative fines may be imposed on public authorities and bodies established in that Member State). In March 2019, the Belgian Federation of Enterprises already lodged an action for annulment regarding this article before the Constitutional Court, as it considers this situation to create a difference in treatment between private companies and public authorities.
This case is also a reminder of the broad scope of the concept of personal data – i.e. also including the reasons behind a certain decision with regard to a natural person – and of the effectiveness of the right of access under Article 15 of the GDPR.
Please contact Karel Janssens for further information on this matter and/or for general legal advice relating to data protection law.