- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 04/2023 – Complaint Upheld (Belgium, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Belgian company failed to remove a person's email address from its marketing list, despite a request. The DPA confirmed that the individual had the right to have his data erased. This case stresses the importance of accountability in handling personal data.
What happened
The company could not comply with a request to erase a person's email address from its marketing list.
Who was affected
The individual who kept receiving unwanted marketing emails despite requesting to have his email address removed.
What the authority found
The DPA found that the company did not fulfill its obligation to delete the individual's email address as requested.
Why this matters
This ruling highlights the need for companies to ensure they can effectively manage data erasure requests. Businesses must take accountability for their data practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject requested the controller to erase his e-mail address, because he kept receiving unwanted marketing e-mails from the controller. The nature of the controller was not specified in this decision. The data subject requested the controller to remove his e-mail address from its address list. The controller stated it was not able to do so because this e-mail address was not included in the controller's list in the first place. The controller asked the data subject if he maybe had another e-mail address, that was coupled to the one the data subject was using currently. This coupling of e-mail addresses could potentially explain the situation. When an e-mail was received by this 'middle man' email-address, it would be forwarded to the data subject's current e-mail address. That could be the reason why the data subject was receiving e-mails on his current e-mail address, despite the fact it was not registered by the controller. The data subject stated that he could not answer this question of the controller because the controller used the 'BCC' feature for sending its marketing e-mails, which made it impossible for the recipient of an e-mail to see other recipients of the same e-mail. It was therefore not possible for the data subject to verify if another of his e-mail addresses was included in the controller's list of recipients. The data subject kept receiving direct marketing messages after this exchange with the controller on his current e-mail address. The data subject filed a complaint at the Belgian DPA at 6 January 2023, because the controller could not comply with his erasure request. The DPA confirmed that the data subject correctly exercised his right to erasure. It also reiterated that the controller had explicitly stated that it had been unable to delete the e-mail address of the data subject from its address list. Thus, the DPA determined that the controller did not fulfil the principle of accountability under Article 5(2) GDPR, becau
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 04/2023 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 04/2023 - Belgium (2023). Retrieved from cookiefines.eu
Last updated: