DPA case 26/2024 – Dismissed (Belgium, 2024)

A data subject filed a complaint against a controller concerning the lack of appropriate action regarding his several requests for erasure of his personal data under Article 17(1) GDPR, in particular his e-mail address which was used by the controller to send unsolicited advertising to the data subject. The controller indicated that necessary action would be taken, however, the data subject received unsolicited advertising again. The data subject had 2 accounts with 2 different e-mail addresses and the second e-mail address had not been deleted as (i) it was not the subject of the first request and (ii) the controller only used the e-mail address as a unique identifier to distinguish the different profiles in their database. The controller notified the Belgian DPA (“APD”) that the data subject’s email address had been deleted, but the data subject still received unsolicited advertising, which led to this complaint. The APD considered that the controller was not expected to search of its own accord for a second or even multiple accounts with a similar or different email address(es) that might belong to the data subject without the identity of the data subject. Furthermore, the APD added that in this case, there were no elements for the controller to doubt the data subject’s identity so there was no reason for the controller to request additional information to confirm its identity under Article 12(6) GDPR. The APD therefore indicated that the controller made every effort to clarify the situation for the data subject and proceeded to remove the e-mail address as soon as it was established that the second account with another e-mail address belonged to the data subject and thus, there was no breach of Articles 12(3) and 12(4) in conjunction with Article 17(1) GDPR.