- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 143/2022 – Complaint Upheld (Belgium, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A school in Belgium was found to have failed in responding to an employee's request for access to their personal data. The DPA ruled that the school must provide the requested information. This case highlights the importance of transparency and responsiveness in handling personal data requests.
What happened
The school did not respond adequately to an employee's request for their personal data.
Who was affected
An employee of the school who requested access to their personal data.
What the authority found
The DPA ruled that the school violated GDPR by not fulfilling the access request in a timely manner.
Why this matters
This case serves as a reminder for organizations to take access requests seriously and respond promptly. It stresses the importance of transparency in data handling.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject submitted an access request to his employer, a school, (controller) on 7 July 2022, requesting a copy of all his personal data pursuant of Article 15(3) GDPR. He also wanted to receive a copy of the emails and notes in which he was directly and indirectly identified. In particular, he wanted the following information: internal and external documents, his administrative file, his disciplinary record, emails, manual or paper-based internal notes and logs. Lastly, the data subject requested all the elements listed in Article 15(1) GDPR, such as the purpose and legal basis of each processing operation. The data subject stated that the controller did not answer this request and did not act within one month. The data subject stated that the letter he sent was returned to him, and therefore not received by the controller. The data subject filed a complaint at the DPA on 10 August 2022 because the controller failed to reply to the access request in a satisfactory way. According to the data subject. This resulted in a violation of Articles 15(1), Article 15(3) and Article 12(3) GDPR. The data subject requested that he would remain anonymous during his complaint procedure. The DPA held that the controller could not refuse to give useful effect to the request for access, simply because the formulation of the request itself was incomplete, based on an erroneous provision or based on a misunderstanding or misinterpretation of the rights invoked. Regarding the requested anonymity of the data subject, the DPA noted that the data subject had the option, provided on the form of the DPA complaint, to hide his personal data. However, the data subject was also obliged to give justification for this requested anonymity. When the data subject did not provide justification, the DPA could ask for consent to the data subject to disclose the information or close the complaint without further action. The DPA held that the data subject was entitled to his right of access. Th
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 143/2022 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 143/2022 - Belgium (2022). Retrieved from cookiefines.eu
Last updated: