DPA case 09/2023 – Complaint Upheld (Belgium, 2023)

As a result of receiving unsolicited advertising by e-mail sent by the controller, the data subject requested the controller on 9 November 2022 and 2 weeks later again to remove his e-mail address from its address list. Notwithstanding the controller's answer announcing necessary steps would have been taken in order to remove the e-mail address from the list, the data subject received unsolicited advertising by e-mail on 16 January 2023. The data subject filed a complaint with the Belgian Data Protection Authority claiming lack of appropriate action following receipt of the erasure request. The complaint showed that the data subject had correctly exercised his right to erasure. Despite the controller's announcement, according to which appropriate measure would have been taken to remove the data subject's email address from its marketing list, no concrete follow-up action had been taken. In fact, the data subject had received another marketing email. The DPA concluded the controller violated Article 12(3) GDPR, 12(4) GDPR and Article 17(1) GDPR and ordered it to comply with the erasure request within a timeframe of 30 days from the notification of its decision pursuant of Article 58(2)(c) GDPR.