DPA case 01/2024 – Complaint Upheld (Belgium, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Belgian company did not respond to a former employee's request for information about their personal data. This matters because it shows that companies must communicate clearly with former employees about their data.
What happened
The company failed to provide information to a former employee about the personal data it was still processing.
Who was affected
A former employee who requested access to their personal data after leaving the company.
What the authority found
The DPA found that the company violated GDPR by not informing the former employee about their data processing.
Why this matters
This ruling underscores the importance of transparency and communication regarding personal data, especially for companies that employ individuals.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject worked at the controller for about ten months, until 6 June 2023. During his employment, a Microsoft account was created. After the employment contract was terminated, the data subject filed an access request with the controller requesting information on which data the controller was still processing but did not receive a response. The data subject claimed that his professional mailbox was still active because when he had sent an email to this address, he had received a delivery confirmation. Thus, on 24 October 2023, the data subject filed a complaint with the Belgian DPA. The Belgian DPA held that to comply with the purpose limitation principle (Article 5(1)(b) GDPR), in combination with the principles of data minimisation (Article 5(1)(c) GDPR) and storage limitation (Article 5(1)(e) GDPR), the controller should have provided the mailbox of the data subject with an automatic notification no later than his last day and he should have been informed in advance of this. The DPA stated that this automatic message alerts all subsequent correspondents that the data subject is no longer performing his activities within the controller and should be in place for a reasonable period of time, in principle 1 month. Depending on the context and the degree of responsibility exercised by the employee, a longer period may be allowed, not exceeding 3 months. In this instance, the DPA confirmed that the period could have been between 1 and 3 months and that it should have been extended only after the data subject gave his consent. Indeed, since the data subject ended his employment on 6 June 2023, the email address should have been closed on 6 July 2023 or 6 September 2023. Meanwhile, the data subject proved that on 13 November 2023, the email was still active. Therefore, the DPA found a violation of Article 5(1)(b) GDPR, Article 5(1)(c) GDPR and Article 5(1)(e) GDPR. In terms of legal basis, the DPA acknowledged that the legal basis for this processing activity
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 01/2024 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 01/2024 - Belgium (2024). Retrieved from cookiefines.eu
Last updated: