- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 146/2022 – Order (Belgium, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A person received a bill for an electricity payment they didn't owe because their identity was stolen. The Belgian data protection authority decided that the case should be handled through other legal channels rather than through them. This highlights the importance of companies keeping personal data accurate and informing users about changes in who controls their data.
What happened
A person claimed their identity was stolen and received a bill for an electricity payment they never owed.
Who was affected
The individual whose identity was stolen and who received the incorrect bill.
What the authority found
The authority determined that the case should be resolved through other legal remedies and emphasized the need for companies to inform users about changes in data control.
Why this matters
This case underscores the necessity for companies to maintain accurate records and communicate effectively with users about their data. It serves as a reminder for businesses to have clear procedures for handling identity theft and data disputes.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject had received a formal request to pay an outstanding electricity bill by controller 1 (a debtor) . Controller 1 subrogated the rights of controller 2 (electricity company) to recover the amounts due. However, the data subject claims to have never lived at the address specified in the request and claims his identity was stolen. On top of that, he demands that both controllers remove his personal data from their systems. Additionally, the data subject stated that he had filed several complaints for these facts to different entities. The DPA classifies the case without follow-up because the grievance is part of a broader dispute which can be more effectively solved through other legal remedies. The DPA specifies that even if controller 2 was being subrogated, this does not relinquish them from correctly applying the GDPR. The DPA holds that the data subject must be informed of substantial changes, especially when the identity of the controller changes. This allows the data subject to exercise their rights appropriately.
Outcome
Order
A binding order requiring the controller to take specific action.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 146/2022 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 146/2022 - Belgium (2022). Retrieved from cookiefines.eu
Last updated: