- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 189/2022 – Complaint Upheld (Belgium, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A human resources provider did not adequately respond to a person's request for access to their personal data. The Belgian Data Protection Authority found that the company failed to provide sufficient information as required by GDPR. This case highlights the importance of transparency in handling personal data requests.
What happened
The human resources provider did not fully answer a person's access request regarding their personal data.
Who was affected
The individual who requested access to their personal data from the human resources provider.
What the authority found
The Belgian Data Protection Authority ruled that the company violated GDPR by not providing a complete response to the access request.
Why this matters
This case emphasizes the need for companies to be thorough and transparent when responding to data access requests. Businesses should ensure they have clear protocols in place to handle such inquiries.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject was contacted on 24 August 2022 by the controller, a human resources provider. The controller stated that it possessed the data subjects file and wanted to provide assistance for job hunting. Wanting to find out more, the data subject sent an access request where she requested among the others the source of personal data, the purpose of processing, the storage period and the legal basis. On 25 August 2022, the controller replied providing guidance on the right of erasure. The data subject responded that she did not request erasure, but merely wanted access at this point in time. The controller provided its privacy policy as a response and stated that the data subject could look for an answer therein. The data subject replied that the answer was not in the privacy policy and that she was still unable to determine the source of personal data, the purpose of processing, the storage period and the legal bases. On 29 August 2022, the controller did provide some information regarding the source of the data: It received the data subject's data from another service (nature and name of the service undisclosed), which worked together with employers to find suitable jobs for potential employees. The data subject filed a complaint at the Belgian DPA on 14 December 2022, because the controller did not provide a substantive enough answer within one month to the access request (Article 12(3) GDPR) nor any extension under Article 12(4) GDPR had ever been communicated. The DPA deemed the controllers answer to the access request inadequate, because it had only provided the name of the source of personal data while the data subject requested more information described in Article 15(1) GDPR. Therefore, the controller violated Articles 12(3), 12(4) and 15(1) GDPR. The DPA went into further detail regarding the source of the personal data. The DPA specified that the controller had the obligation to provide certain basic information to the data subject because o
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 189/2022 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 189/2022 - Belgium (2022). Retrieved from cookiefines.eu
Last updated: