DPA case 32/2024 – Complaint Upheld (Belgium, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Belgian Data Protection Authority upheld a complaint from a person who was denied access to all their personal data after a credit application was refused. The authority found that the company did not fully respond to the person's request for access. This ruling is important because it reinforces individuals' rights to access their personal information.
What happened
A complaint was upheld regarding a company's failure to provide complete access to a person's personal data.
Who was affected
A person whose credit application was denied and sought access to their personal data.
What the authority found
The authority determined that the company did not adequately confirm whether all personal data had been provided to the individual.
Why this matters
This case emphasizes the importance of transparency and thoroughness in responding to data access requests, reminding businesses to be diligent in fulfilling such requests.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject’s credit application was refused by the controller. Consequently, the data subject exercised his right of access with the controller and filed a complaint with its Financial Services Ombudsman. The controller informed him that 3 files had been consulted in examining his credit application: (i) his own file, (ii) the Central Individual Credit Register file and (iii) a finance company’s file. The controller shared the full content of the data subject’s file and only the identity and contact details of the respective controllers. It also told the data subject to contact the controllers of those files to exercise his right of access regarding said documents. The data subject claimed that the information to which he had been given access to was incomplete, as the controller also had the “purpose of the credit” as well as a copy of his identity card. The data subject asked the controller to confirm that he had been given access to all his personal data. The controller responded that it had other data in its possession, namely the one it received as part of the data subject’s complaint to the Financial Services Ombudsman. Following this, the data subject lodged a complaint with the Belgian DPA (“APD”). Under Article 15(1) GDPR, the data subject has the right to obtain from the controller a confirmation as to whether or not personal data concerning him are being processed and if so, to obtain access to such personal data. The APD considered that in the present case, the controller did not respond directly to the data subject’s question asking it to confirm that he had been given access to all his personal data. Thus, the data subject did not obtain a conclusive answer or access as required by Article 15(1) GDPR. Moreover, Article 15(3) GDPR provides that the controller must provide a copy of the personal data being processed. The APD held that the controller processed an image of the data subject’s identity card and failed to provide a copy in response t
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 32/2024 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 32/2024 - Belgium (2024). Retrieved from cookiefines.eu
Last updated: