- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 159/2022 – Complaint Upheld (Belgium, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Belgium's data protection authority upheld a complaint from a former employee who wanted her photo removed from her ex-employer's website. This ruling is significant because it shows that companies must delete personal data when it is no longer necessary. Businesses should regularly review their online content to ensure compliance.
What happened
A former employee requested her photo be removed from her previous employer's website after her dismissal.
Who was affected
The former employee whose image was still displayed on the company's website.
What the authority found
The DPA ruled that the company should have deleted the employee's photo after her employment ended, as it was no longer necessary.
Why this matters
This case highlights the need for companies to act on deletion requests promptly. Businesses should ensure they remove outdated personal data to comply with GDPR.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In September 2022, a former employee (data subject) informed her former employer (controller) that she no longer wanted to be pictured as former staff on its website, more than six months after her dismissal (February 2022). The website included both a photo of the data subject alone as well as a group photo with other staff members. The individual photo also included the title of her former position at the controller. The controller did not provide an answer to the request and the data subject filed a complaint at the Belgian DPA. The DPA stated that the controller should implement appropriate technical and organisational measures to ensure and that the processing is GDPR compliant, and it should also be able to demonstrate this. It should have regard for nature, scope, context and purposes of the processing and the risks to the rights and freedoms of individuals, which vary in probability and severity (Articles 5(2) and 24 GDPR). The DPA stated that in the present case, the purpose of the processing was no longer valid after the dismissal of the data subject. This purpose was to inform internet users about who was working at the controller and in what capacity. Consequently, the personal data had to be erased as soon as this data was no longer necessary for this purposes (Article 5(1)(b) and 5(1)(e) GDPR). The DPA stated that this data had to be deleted or anonymised by the controller on its own initiative, without the data subject asking for deletion. However, deletion or anonymization is not necessary when the controller processes the same data for another GDPR compliant purpose. The DPA stated that, ideally, an erasure request should result in the deletion of personal data within one month (Articles 12(3) and 17(1)(a) GDPR). However, the DPA stated that a distinction had to be made between the one-month reaction period for informing the data subject (Article 12(3) GDPR) and the actual deletion of personal data, which may require more time because of the com
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 159/2022 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 159/2022 - Belgium (2022). Retrieved from cookiefines.eu
Last updated: