DPA case 48/2024 – Complaint Upheld (Belgium, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An embassy employee accessed a person's data without permission, leading to a complaint about the slow response to a request for information. This case is significant because it emphasizes the need for organizations to respond quickly to data access requests. The embassy was reminded of its obligations under data protection rules.
What happened
An embassy employee made an unauthorized consultation of a person's data from the National Register.
Who was affected
The individual whose data was accessed without permission was affected.
What the authority found
The authority determined that the embassy did not respond to the data access request in a timely manner, violating GDPR requirements.
Why this matters
This situation highlights the importance of timely responses to data access requests. Organizations must prioritize compliance to avoid similar complaints.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 12 July 2023, one of the embassy’s (“controller”) employees made an unauthorized consultation of the National Register as they were allegedly a friend of the data subject, seeking to find out about her after 25 years. After noticing a suspicious consultation of her data, on 19 July 2023, the data subject exercised her right of access regarding this consultation and asked that the controller disclose the identity of the person who carried out the consultation. On 17 August 2023, the data subject repeated her request as she had not received a reply. On 22 August 2023, the controller’s DPO confirmed the receipt of the request and forwarded it to the relevant departments. On 13 September 2023, the DPO explained to the data subject that they needed more than a month to process the request, as external approaches to the embassy take time. On 8 November 2023, the data subject sent an email to the controller explaining that if she did not receive a reply by the end of November, she would lodge a complaint with the Belgian DPA (“APD”). On the same day, the DPO replied, stating that the investigation had revealed that the consultation had been carried out privately by a childhood friend of the data subject, who was also an embassy employee and who wished to renew contact with the data subject. The DPO indicated that any consultation for other than consular purposes was prohibited and would give rise to administrative sanctions. On 9 November 2023, the data subject lodged a complaint with the APD. Firstly, regarding the late response to the data subject’s access request, Article 12(3) GDPR establishes that that the controller must respond to a data access request without undue delay and in any event, within one month of receipt of the request. The APD held that it can be materially difficult for a data controller to respond within the one-month period provided for in the GDPR. However, the DPA considered that in the present case, the response to the access request was
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 48/2024 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 48/2024 - Belgium (2024). Retrieved from cookiefines.eu
Last updated: