DPA case Decision 136-2022 – Complaint Upheld (Belgium, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A car company denied a customer access to their vehicle's diagnostic report, citing internal policy. The Belgian DPA ruled that the company must provide access to the data, showing that internal rules cannot override user rights.
What happened
A customer requested access to their vehicle's diagnostic report, but the car company refused based on internal policy.
Who was affected
The customer who sought access to their vehicle's diagnostic data.
What the authority found
The DPA found that the car company violated GDPR by denying the customer's right to access their personal data without a valid legal reason.
Why this matters
This case highlights that companies must respect user rights under GDPR and cannot deny access based solely on internal policies.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject made an access request for a full diagnosis report with freeze frame data regarding his vehicle to the car company (controller). Freeze frame data is information which can be extracted from a vehicle, usually in addition with an error code. This data can be used to diagnose issues. It can provide additional insight from build-in sensors when an error occurs. The data subject stated that he had requested access to the diagnosis report to conduct an expertise (not specified). The controller answered this request within the term of one month (Article 12(3) GDPR), but stated that the requested data could not be transferred to the data subject. This was because of the ban on sharing internal documents with third parties outside the car brand network. This ban was internal company policy. The DPA stated that it is possible for a controller to reject an access request but that it must provide a reason why it didn’t comply with the request to the extent that there is a legal ground for restricting the right of access (Article 12(4) GDPR). The DPA held that data concerning the vehicle of the complainant is personal data (Article 4(1) GDPR), since the data subject can be identified on the basis of his vehicle. The DPA held that solely on the basis of the internal company policy, the controller cannot deny the right of access of a data subject to its personal data. The data subject is a customer of the controller and has the right to a copy of the personal data being processed, if necessary in electronic form (Article 15(3) GDPR). The internal company policy wasn’t sufficient enough justification for the controller to deny the data subject the information it requested. The DPA held that the controller unilaterally limited the data subjects right to access his own personal data. The DPA held that the controller violated Article 15(1) GDPR and Article 15(3) GDPR and held that the controller had to make a decision regarding the access request within 14 d
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case Decision 136-2022 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case Decision 136-2022 - Belgium (2022). Retrieved from cookiefines.eu
Last updated: