- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 02/2023 – Order (Belgium, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A person in Belgium asked a company to delete his personal data but received no response. The DPA found that the company failed to acknowledge the request and even sent promotional emails afterward. This case highlights the importance of companies responding to data erasure requests promptly.
What happened
A data subject's request to erase his personal data was ignored by the company.
Who was affected
The individual who requested the deletion of his personal data from the company's records.
What the authority found
The DPA determined that the company violated regulations by not responding to the erasure request in a timely manner.
Why this matters
This case serves as a reminder for businesses to have clear processes for handling data erasure requests. Companies must respect users' rights to control their personal information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 1 December 2022, the data subject requested the controller to erase his personal data under Article 17(1) GDPR. In order to do so, he followed the instructions provided in the controller's privacy policy. However, the controller did not acknowledge receipt, not even after the data subject sent a reminder on 19 December 2022. On the 28 December 2022, almost a month after the data subject had submitted his erasure request, the controller sent him a promotional e-mail. The data subject filed a complaint at the Belgian DPA on 3 January 2023 for the lack of a response by the controller. The DPA first confirmed that the data subject correctly exercised his right to erasure. The DPA held that the controller breached Articles 12(3) GDPR, 12(4) GDPR and 17(1) GDPR because it did not respond in time to the erasure request and even sent a promotional e-mail after the request had been submitted. The DPA ordered the controller to comply with the erasure request and ordered the controller to provide the DPA with an update within 30 days on which action it had taken.
Outcome
Order
A binding order requiring the controller to take specific action.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 02/2023 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 02/2023 - Belgium (2023). Retrieved from cookiefines.eu
Last updated: