- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 17/2023 – Complaint Upheld (Belgium, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Belgian data protection authority upheld a complaint against a city municipality for not responding to a citizen's request about their personal data. The authority found that the municipality failed to provide the requested information within the required time frame. This decision emphasizes the importance of timely responses to data access requests.
What happened
A citizen's requests for information about their personal data were ignored by the city municipality.
Who was affected
A citizen of the city municipality who sought information about their national register file.
What the authority found
The authority confirmed that the municipality violated the citizen's right to access their personal data by not responding within one month.
Why this matters
This ruling serves as a reminder that organizations must respond promptly to data access requests. Small businesses should ensure they have processes in place to handle such inquiries effectively.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The controller was a city municipality and the data subject, a citizen of that municipality. The data subject noticed that his national register file had been consulted by the controller. On the 10 November 2022, he contacted their DPO for more information on the consultation. On 16 November, the data subject noticed a new consultation and contacted the DPO again requesting an explanation. However, both requests remained unanswered. The DPA reinstated that Article 15(1)(a) GDPR grants each data subject the right to obtain information about the processing of their personal data. The DPA confirmed that the data subject exercised his right correctly and that a controller was obliged to answer such request within 1 month under Article 12(3) GDPR, which the controller did not do in this case. The DPA also suggested that controller implements appropriate security measures to protect the personal data against unauthorised access as stipulated in Article 5(1)(f) GDPR. The DPA referred to Article 32 GDPR and recommended a logging measure and to keep track of the log ins. This practice is not especially included in Article 32 but is listed in Article 17 of the national law organising a national register for natural persons. Given the above, the DPA concluded that the controller may have violated, among others, Article 15(1) GDPR by not providing an answer to the access request and ordered the controller to comply with said access request of the data subject.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 17/2023 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 17/2023 - Belgium (2023). Retrieved from cookiefines.eu
Last updated: