- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 45/2023 – Complaint Upheld (Belgium, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Belgian data protection authority upheld a complaint from a person who wanted their data transferred to a new mutuality. The authority found that the mutual insurance company did not meet the legal requirements for data portability. This is significant because it shows that companies must comply with data rights requests properly.
What happened
A person complained that their mutual insurance company failed to transfer their data to a new mutuality.
Who was affected
A person seeking to transfer their personal data to a new mutuality.
What the authority found
The authority ruled that the mutual insurance company was not obligated to transfer the data because it was fulfilling a legal obligation, not a contractual one.
Why this matters
This case highlights the importance of understanding the conditions under which data portability requests can be made. Companies should ensure they know the legal basis for processing personal data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The complainant wishes to change mutuality and asks the controller to transfer his data to the new mutuality. After several times unsuccessfully addressing the controller about this, he submits a complaint to the DPA in order to enforce a response from the controller to his request to send over the data to the new mutuality within the framework of the exercise of the right to data portability 3 cumulative conditions: The exercise of the right to data portability is subject to three conditions that must be fulfilled cumulatively. 1. The data processing must be based on the consent of the data subject (Article 6(1)(a) GDPR and Article 9(2)(a) GDPR) or must be part of the performance of a contract (Article 6( 1)(b) GDPR) 2. According to the [https://ec.europa.eu/newsroom/document.cfm?doc_id=44099 guidelines of working group 29 on data portability], the processed personal data must be obtained directly from the data subject. Derived or indirectly obtained data fall outside the scope of the right to data portability. 3. the processing is carried out using automated processes. Conclusion of the DPA: the DPA notes that the data processing carried out by the mutual insurance company is part of a legal obligation that rests on the controller, [https://www.ejustice.just.fgov.be/cgi_loi/loi_a1.pl?language=nl&la=N&cn=1996070337&table_name=wet&&caller=list&N&fromtab=wet&tri=dd+AS+RANK&rech=1&numero=1&sql=(text+contains+(%27%27))#LNK0147 namely Article 254 of the Royal Decree 3 July 1996], which states that "every insurance institution must keep a file in the name of each beneficiary with at least the data specified in this provision". In other words, the processing is an extension of a legal obligation, rather than the performance of a contract and thus explicitly excluded from the right to data portability (Article 20(3) GDPR). It is found that the first of the cumulative conditions has not been met. In addition, it has also been established that the file of the data subject
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 45/2023 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 45/2023 - Belgium (2023). Retrieved from cookiefines.eu
Last updated: