DPA case 10/2023 – Order (Belgium, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A person asked two companies for access to their personal data but didn't get a response. The Belgian data protection authority found that the companies may have broken the rules by not replying in time. This case highlights the importance of companies responding to access requests from individuals.
What happened
The person requested access to their personal data from two companies but received no response.
Who was affected
The person who requested access to their personal data from the two companies.
What the authority found
The authority ruled that the companies likely violated the rules by not responding to the access request within the required time frame.
Why this matters
This case emphasizes that companies must take access requests seriously and respond promptly. It serves as a reminder for businesses to have clear processes in place for handling such requests.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject had taken out loans at the two concerned controllers. On 8 June 2022, the data subject requested access to her personal data on the basis of Article 15 GDPR and requested information on the possible sharing of her personal data with collection companies. Both controllers did not respond to the access request. The DPA established that Article 15(1) GDPR grants all data subject a right of access to their personal data and the right to know the recipients or categories of recipients is included through Article 15(1)(c) GDPR. This right is the cornerstone which allows data subject to verify the lawfulness of each processing activity and to rectify or erase their personal data. The DPA held that the controllers could have breached Article 12(3) GDPR by not responding within one month, without notification and justification of the extension of this time limit as set out by Article 12(4) GDPR. The DPA ordered the controller to comply with the access request pursuant Article 58(2)(c) GDPR and Article 95(1)(5) LCA (Law establishing the data protection authority).
Outcome
Order
A binding order requiring the controller to take specific action.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 10/2023 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 10/2023 - Belgium (2023). Retrieved from cookiefines.eu
Last updated: