DPA case DOS-2019-05837 – Dismissed (Belgium, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A bank used a customer's personal data to create models for a discount service without proper consent. The customer complained, but the bank argued that it had stopped using the data after the complaint. This case highlights the importance of clear consent when using personal data.
What happened
The bank used a customer's personal data for model building related to discounts without valid consent.
Who was affected
The customer whose personal data was used by the bank for creating discount models.
What the authority found
The Belgian DPA dismissed the complaint, stating the bank had stopped processing the data after the customer's objection.
Why this matters
This case emphasizes that companies must ensure they have valid consent for using personal data, especially when creating models for services. It serves as a reminder for businesses to be transparent about how they use customer data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A bank ('controller') used the data subject's personal data, including the content of payment transactions, to build models for their 'personalised discounts' service. The data subject objected to the use of his data to build models which offered the personalised discounts. The controller responded that his request was registered and that his data would no longer be used for model building. The data subject filed a complaint with the Belgian DPA ('GBA') on 10 January 2020. First, the controller argued that it relied on consent for the activation of the personalised discounts service. However, to build the models on which the service is based, the controller invoked legitimate interest. It also explained that building these models constitutes further processing. Therefore, the controller distinguished between 'tailored information' which was based on the data subject's consent which he could withdraw and the 'model building', which was based on legitimate interest with the data subject's right to object. Second, the controller argued that the data subject did not have an interest in the case as he never activated the personalised discounts service. The controller also explained that the data subject's right to objection was granted before the complaint was filed and thus, his personal data was no longer processed for the model building. The controller considered that this rendered the complaint inadmissible. The data subject argued that the processing of personal data in data models was done for a completely different purpose than that for which the personal data was initially collected, namely the handling of transactions in the performance of the agreement between the controller and the data subject. The data subject also explained that the controller's privacy policy of 2 February 2017 stated that the controller used its customers' transaction data to better know and serve its customers for all marketing and commercial purposes as listed in the privacy policy
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case DOS-2019-05837 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case DOS-2019-05837 - Belgium (2024). Retrieved from cookiefines.eu
Last updated: