- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
DPA case 72/2023 – Order (Belgium, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A woman complained to the Belgian data protection authority after her new lawyer did not return her legal files. The authority determined that her complaint did not relate to GDPR rules, as it was about professional conduct rather than data protection. This case illustrates the limits of data protection authorities in handling certain legal disputes.
What happened
A woman requested her legal files from her new lawyer but did not receive them.
Who was affected
The woman who sought her legal files and her new lawyer.
What the authority found
The authority ruled that it lacked the competence to address the complaint since it was not based on GDPR.
Why this matters
This case shows that not all legal issues fall under data protection laws, highlighting the need for clarity on the authority's scope.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In the context of a legal proceedings, a data subject was attributed a new lawyer after the death of her previous one. She then requested from her new lawyer to return her the legal files but he didn't, claiming that he hadn't had the time to go through all the files of the deceased lawyer yet. The data subject contacted the bar association to intervene but it concluded that it could not issue any injunctions to the lawyer. She therefore filed a complaint with the Belgian DPA The Belgian DPA stated that the data subject did not complain on the basis on the GDPR. The DPA referred the EDPB Guidelines 01/2022 on data subject rights - right of access, where it is stated that "if the data subjects clarify that their request is based on sectoral legislation or on national legislation regulating the specific issue of access to certain categories of data, and not on the GDPR, such a request shall be examined by the controller in accordance with such sectoral or national rules, where applicable". The DPA considered that it is clear from the facts that this matter concerned lawyers professional conduct and that it had, in any case, no competence to order the restitution of the file. The DPA added that the right of access under Article 15 would unlikely result in the retrieval of the file, it would only grant access to the communication of the personal data relating to the data subject.
Outcome
Order
A binding order requiring the controller to take specific action.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 72/2023 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 72/2023 - Belgium (2023). Retrieved from cookiefines.eu
Last updated: