DPA case 40/2024 – Order (Belgium, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Belgian company was ordered to delete a user's data after ignoring their request. This is significant because it reinforces users' rights to have their personal information erased when they ask for it.
What happened
The company failed to respond to a request to delete a user's personal data.
Who was affected
The user who requested the deletion of their personal data.
What the authority found
The authority found that the company violated several GDPR articles by not responding to the deletion request.
Why this matters
This case underscores the importance of companies responding promptly to user requests for data deletion. Businesses must have clear processes to handle such requests to comply with privacy laws.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject received unsolicited letters from the controller on a regular basis. On 27 July 2023, the data subject requested the controller that his data be deleted and to stop the communications. The data subject alleged that the influx of letters increased after these communications. The data subject lodged a complaint with the Belgian DPA (“APD”) asking them to force the controller to delete their data. Article 17(1) GDPR establishes that under certain conditions, a data subject may obtain the erasure of personal data without undue delay. Article 12(3) GDPR specifies this period by indicating that the controller provides information on action taken under a request regarding the data subject’s rights, without undue delay and in any event within one month of receipt of the request. This period may be extended by two months if necessary. Article 12(4) GDPR adds that if the controller does not take action, it must inform the data subject without delay and at the latest within one month of receiving the request of the reasons for not taking action and on the possibility of lodging a complaint with the DPA. In the present case, the APD found that the controller did not respond to the erasure request. Therefore, the DPA concluded that there was a breach of Articles 12(3), 12(4) and 17(1) GDPR and ordered the controller to proceed with the deletion of the data subject’s data.
Outcome
Order
A binding order requiring the controller to take specific action.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 40/2024 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 40/2024 - Belgium (2024). Retrieved from cookiefines.eu
Last updated: