- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 06/2023 – Complaint Upheld (Belgium, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A person discovered that their national register file was accessed by a third party without their knowledge. They asked the company for information about this access but received no response. The Belgian Data Protection Authority ruled that the company failed to answer the request, which is important because it shows that companies must respond to access requests from users.
What happened
A person requested information about unauthorized access to their national register file but received no response from the company.
Who was affected
The person whose national register file was accessed without their consent.
What the authority found
The Belgian Data Protection Authority found that the company did not comply with the requirement to respond to the access request within one month.
Why this matters
This case highlights the importance of companies responding to user requests for information. It sets a precedent that companies must ensure their communication channels are functional for users to exercise their rights.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In an unspecified point in time, the data subject noticed that his 'national register file' had been accessed by a third party on 12 September 2022. On 25 September 2022, he sent an email to the controller, whose nature was also not specified, asking to provide information about such access, its reason as well as the identity of the person or entity who had consulted the data. The data subject received an automatic reply from the controller informing him that the recipient's e-mail box was full and that no new messages could be received. The data subject continued sending messages with his inquiries, which all resulted in the same outcome. On 21 October 2022, he filed a complaint at the Belgian DPA. The DPA confirmed that the data subject was exercising his right of access in order to get information regarding the purpose of the consultation of his national register (Article 15(1)(a) GDPR) and the identity of the person(s) who consulted the register (Article 15(1)(c) GDPR). The DPA stated that it looked like that the controller never received the e-mail and did therefore not comply with the one-month deadline of Article 12(3) GDPR to provide an answer to the request. The DPA concluded that the controller may have violated Article 15 GDPR by not providing an answer to the access request and ordered the controller to comply with the access request of the data subject. The DPA especially noted that the e-mail address provided by the controller was not functional to let data subjects exercise their rights, which is a requirement pursuant to Article 12(2) GDPR. The DPA ordered the controller to comply with the access request pursuant to Article 58(2)(c) GDPR and Article 95(1)(5) LCA (Law establishing the data protection authority).
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 06/2023 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 06/2023 - Belgium (2023). Retrieved from cookiefines.eu
Last updated: