DPA case Decision 135/2022 – Violation Found (Belgium, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Belgian company mistakenly deleted a user's personal data instead of providing access to it, after the user requested to see their information. This incident shows how important it is for companies to properly handle data requests from users.
What happened
A user requested access to their personal data, but the company deleted it instead of providing it.
Who was affected
The user who requested access to their personal data from the company.
What the authority found
The Belgian DPA ruled that the company violated several GDPR articles by not providing the requested access and deleting the user's data.
Why this matters
This ruling serves as a reminder for companies to train their staff properly on handling data requests to avoid costly mistakes and ensure compliance with data protection laws.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject submitted an access request Article 15 GDPR for his two accounts to the controller’s customer service department. The controller verified the data subject’s identity and informed him that his request would be followed up with a view to obtaining a copy of his personal data within one month. These initial exchanges of e-mails took place with the controller using a .be (Belgium) e-mail address. The data subject sent a reminder to the controller on 4 November 2019 after he hadn’t heard back from the controller. The Data subject received an email on 7 November 2019 from the privacy team of the controller using a privacy@[...].uk (United Kingdom) e-mail address. In this e-mail, it was stated that all the personal data of the data subject had been deleted following its request for deletion. On the same day, 7 November 2019, the data subject objected by e-mail that he had not requested the deletion of personal data but access to personal data. According to the data subject, the controller didn't answer this e-mail. After the data subject filed his complaint which was deemed admissible by the Belgian DPA, the DPA ordered an investigation into the matter. In its investigation report, it held the following: The controller's Belgian company was jointly responsible for the processing with the controllers UK company. This joint responsibility results from the privacy policy, available on the website of the Belgian company of the controller. The investigation unit also held that the controller violated Article 12(1) GDPR, Article 12(2) GDPR, Article 15(1) GDPR and Article 15(3) GDPR. The controller had deleted the data of the data subject instead of providing access to the data. The controller stated that this was most likely caused by human error. To prevent the problem from occurring in the future, the controller started putting in place additional training and automated processed to handle requests of data subjects under the GDPR in a better way. The DP
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case Decision 135/2022 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case Decision 135/2022 - Belgium (2022). Retrieved from cookiefines.eu
Last updated: