DPA case 03/2024 – Complaint Upheld (Belgium, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Belgian recruitment agency was found to have violated data protection rules by repeatedly contacting a person who had requested not to be contacted. The authority's decision underscores the obligation for companies to respect deletion requests and respond promptly, which is crucial for maintaining user trust.
What happened
A person requested to be deleted from a recruitment agency's database but continued to receive communications.
Who was affected
The individual who requested deletion from the recruitment agency's database was affected.
What the authority found
The authority determined that the agency failed to erase the person's data and respond to the deletion request in a timely manner.
Why this matters
This case highlights the necessity for companies to adhere strictly to deletion requests to avoid violations and maintain good relationships with users.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 1 August 2023, the data subject received a phone call from the controller: a recruitment agency. On the same day, the complainant contacted the controller requesting to be deleted from their database and to not be contacted. On 2 August 2023, the data subject received an email from an employee of the controller about new job opportunities, to which the data subject replied requesting to not be contacted again. On 4 September 2023, the data subject received another phone call from the controller and on 5 September 2023, the data subject received an email from the employee concerned confirming that their data had been erased. After receiving another phone call from the controller on 15 September 2023, the data subject lodged a complaint with the Belgian DPA. The Belgian DPA reiterated that in line with Article 17 GDPR and Article 12 GDPR, a controller is obliged to erase the personal data of a data subject upon request without delay. Furthermore, under Article 12(3) GDPR, the controller should inform the data subject as soon as possible, but at least within a month, about the action taken on his request. The DPA established based on the facts of the case as provided by the data subject that he had exercised his deletion request several times but was still contacted afterwards. Moreover, even if the controller did respond after the data subject's second request confirming that the personal data had been deleted, the data subject still received messages from the controller. Therefore, the DPA held that the controller infringed Article 12(3) GDPR, Article 12(4) GDPR and Article 17(1) GDPR and ordered the controller to deal with the data subject's request within 30 days after the decision.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 03/2024 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 03/2024 - Belgium (2024). Retrieved from cookiefines.eu
Last updated: