- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 33/2022 – Complaint Upheld (Belgium, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
After a car dealership was hacked, a customer asked for information about their personal data but received no response. The Belgian Data Protection Authority ruled that the dealership must answer such requests and improve their data security. This case serves as a warning for businesses to take data protection seriously.
What happened
A customer requested information about their personal data after a cyberattack on a car dealership.
Who was affected
The customer whose data may have been compromised in the cyberattack.
What the authority found
The DPA ruled that the dealership failed to respond to the customer's access request and must improve data security measures.
Why this matters
This ruling highlights the obligation for businesses to respond to data requests and ensure robust security against cyber threats.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
After contracting for the purchase of a vehicle, the data subject received two consecutive emails from an employee of the controller, a car dealership. The first email contained the amount that the data subject still had to pay, as well as the bank account number that the transaction had to be issued to. The second email, sent from the same email address, contained a rectification, giving another bank account number to issue the transaction to. It was only after the data subject issued the transaction to the bank account number given in the second email, that the data subject found out that the computer system of the controller had been hacked, and that the they had been the victim of a fraud, due to the usurping of the employee’s email address. The data subject reported the fraud to the police, whilst the controller also filed a report with the police for fraud and computer hacking. On 4 May 2021, the data subject sent a subject access request to the controller, in order to know which of their personal data was being processed by the controller, and which personal data had been subjected to the computer hacking. The controller ignored the request and left it unanswered. Hence, on 8 July 2021, the data subject lodged a complaint with the Belgium DPA, for the lack of response to the access request, and for a violation of the obligation of security after a hack. Some weeks after the events, the data subject received the report from a hired sworn-in expert stating that the server system used by the controller had indeed been subject to a cyberattack. The DPA stated that, in order to establish the existence of this cyberattack with full certainty, a judicial warrant would be necessary. However, in the opinion of the DPA, the police complaint filed by the controller for computer hacking suggests that the controller implicitly acknowledged having been a victim of a computer hacking. The DPA noted that the data subject filed a subject access request under Article 15 GD
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 33/2022 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 33/2022 - Belgium (2022). Retrieved from cookiefines.eu
Last updated: