21 August 2024
If you’re facing a data protection problem in Belgium and you assess that it requires intervention from the Belgian Data Protection Authority (the “APD/GBA”), one available option (rather than lodging a complaint) is to request a mediation procedure. To be admissible, a mediation request must be written in French, Dutch or German, identify the data controller and the personal data processing that is the subject of the request. The application must be dated and signed.
Procedure
Generally, if the problem concerns the exercise of your data subject rights, you should first have unsuccessfully tried to exercise them by contacting the data controller directly. (The GDPR permits one month for the data controller’s response before you can follow-up with the APD/GBA.) You should demonstrate your interest in the mediation procedure taking place and that there are no parallel proceedings. (APD/GBA may be unable to accept mediation where parallel police or judicial proceedings are ongoing.) An online form for making a mediation request is available on the APD/GBA website.[1]
Limits of the mediation process
APD/GBA has recognised both the limits of the mediation process and the extent of its own powers in a Decision published on 24 July 2024 which is summarised below.[2]
Facts
The case arose from a neighbour dispute concerning the installation and use of surveillance cameras by Mr and Mrs Y (“Defendant”). The Complainants, X1 and X2, complained that the cameras also surveyed their garden as well as the driveway and entrance to their property.
Issues
Defendant failed to engage on two occasions with letters from the APD/GBA (one sent by registered mail) inviting them to participate in mediation proceedings. X1 and X2 therefore reformulated their request for mediation as a complaint.
Law on Cameras
The Law [on Cameras] of 21 March 2007, as amended in 2018, regulates the installation and use of CCTV and surveillance cameras. It designates the police as the body primarily competent for supervision.
Decision
The APD/GBA’s Litigation Chamber noted that the voluntary nature of mediation, which may lead to an amicable settlement of a dispute, remains at the strictest discretion of each of the parties. A party may not be forced into an ‘amicable agreement’. Neither may a refusal to engage in mediation proceedings be held against a data controller or its subcontractor. (Decision para. 37.)
Whilst emphasising the voluntary nature of mediation, a data controller may not simply ignore communications received from a data protection authority (“DPA”). When the data controller receives letters from the DPA on two occasions – once by registered mail – asking it to communicate its position on an invitation to a mediation procedure, it must reply. Although the data controller is required to reply to the DPA, the content of its reply nevertheless remains within the data controller’s complete discretion. (Decision para. 38.)
Comments
The Decision emphasises that Article 31 GDPR requires the data controller (and its data processor) to cooperate with the DPA in the performance of its tasks, when requested to do so.
Pursuant to its corrective powers the APD/GBA formally warned the Defendant that, pursuant to Article 31 of the GDPR, it was required to cooperate in future and that there is an obligation to follow-up within the period of one month provided in Articles 12.3 and 12.4 GDPR when a data-subject exercises any of the rights referred to in Articles 15 to 22 of the GDPR. (Rights of access, to rectification, to erasure (to be forgotten), restriction of processing, data portability, to object to processing including profiling, not to be subject to automatic decision making.)
Nevertheless, in the particular case under consideration, the APD/GBA’s Litigation Chamber found, in accordance with its rules of procedure, that it was entitled to dismiss the complaint without further action, because (amongst other things) the complaint was itself ancillary to a wider dispute which needed to be debated before the judicial authorities.
The right of the Defendant, Mr and Mrs Y, to appeal the findings set forth in the Decision within 30 days after notification (and the procedures available for doing so), was expressly drawn to their attention in Part III of the Decision.
[1] https://www.dataprotectionauthority.be/citizen/actions/request-a-mediation .
[2] Chambre Contentieuse Décision 98/2024 du 24 juillet 2024 N° de Dossier : DOS-2023-00957.
Share us!
