DPA case DOS-2023-02597 – Violation Found (Belgium, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Belgian data protection authority found that a company failed to respond to a visitor's request for information about who accessed their personal data. This ruling highlights the importance of timely and transparent communication from companies regarding data access requests.
What happened
A visitor's request for information about access to their personal data went unanswered for too long by the company.
Who was affected
The visitor whose personal data was accessed was affected.
What the authority found
The authority concluded that the company did not comply with the legal timeframes for responding to the visitor's access request.
Why this matters
This decision reinforces the necessity for companies to respond promptly to data access requests to avoid violations and maintain compliance.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 23 March 2023, an employee of the controller consulted an extract of the data subject's personal data stored in the Belgian National Register, which refers to the information processing system that records, memorizes and communicates information relating to the identification of Belgian citizens. After that, the data subjectfiled an access request with the controller, requesting clarification into who accessed their data and for what purpose. Due to not receiving any response regarding the access request, the data subject filed a complaint with the Belgian DPA on 14 June 2023. On 7 August 2023, the controller replied to the access request, acknowledging that it consulted the National Register records of the data subject and that the processing was performed by a professional with specific authorization. However, due to professional secrecy, the controller could not disclose the professional's identity or assess whether the consultation complied with legal and ethical obligations. The Belgian DPA stressed that the controller, in its capacity, must comply with a request made by a data subject pursuant to Articles 15 to 22 GDPR, in compliance with the conditions set out in Article 12 GDPR, and to provide the data subject with information on the measures taken, as soon as possible and in any event within one month of receipt of the request. Furthermore, the DPA noted that pursuant to Article 5(2) GDPR and Article 24 GDPR, the controller should be able to demonstrate its compliance with the data protection principles. In light of the facts of the case, considering that the complainant clearly exercised their right to access under Article 15 GDPR, that on 14 June 2023, the data subject complained to have not received any answer and that the controller only replied on 7 August 2023, the controller exceeded the deadline established in Article 12(3) and (4) GDPR. Therefore, the Belgian DPA found the controller to have breached Article 15 GDPR in conjunction with
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case DOS-2023-02597 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case DOS-2023-02597 - Belgium (2024). Retrieved from cookiefines.eu
Last updated: