DPA case 63/2024 – Dismissed (Belgium, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Belgian authority dismissed a complaint from a person who wanted more information about their data from a software platform. The authority found that the platform's administrator was acting only as a processor and provided sufficient information. This case illustrates the complexities of data access rights.
What happened
The Belgian data protection authority dismissed a complaint regarding insufficient data access from a software platform administrator.
Who was affected
The person who filed a complaint seeking more information about their personal data from the software platform.
What the authority found
The authority determined that the platform administrator was not responsible for the data processing in a way that warranted further information.
Why this matters
This ruling clarifies the roles of data processors and controllers, reminding users that not all requests for data can be fulfilled if the processor is not responsible for the data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject exercised their right of access with the administrator of the software platform for an app and website (‘administrator’). This app and website allowed patients to browse medical practices, identify themselves, choose the doctor with whom they want the appointment, choose the desired time slot and confirm the appointment. The administrator of the platform indicated that they were merely acting as a processor and processing personal data on behalf of the health providers. It also provided the data subject with a list of doctors with whom the data subject is in the database. The data subject considered this response insufficient and claimed that the administrator was indeed responsible for the processing. They therefore lodged a complaint with the Belgian DPA ('GBA'). Firstly, regarding controllership, the GBA indicated that the GDPR defines a 'controller' as the person who determines the purposes and means of the processing of personal data. The DPA added that the CJEU held that the concept of ‘controller’ should be interpreted broadly ([https://gdprhub.eu/index.php?title=CJEU_-_C-25/17_-_Jehovan_todistajat CJEU, 10 July 2018, Jehovan todistajat, C-25/17]). Additionally, the [https://www.edpb.europa.eu/system/files/2023-10/EDPB_guidelines_202007_controllerprocessor_final_en.pdf EDPB Guidelines on the concepts of controller and processor in the GDPR] indicate that the controller is not necessarily someone who actually has access to the data being processed. For example, someone who outsources a processing activity and has a determinative influence on the purpose and essential means of the processing is to be regarded as a controller (§45 of the [https://www.edpb.europa.eu/system/files/2023-10/EDPB_guidelines_202007_controllerprocessor_final_en.pdf EDPB Guidelines]). In the present case, the GBA found that the purpose of the app and website was to have an online scheduling system, exchange data with other apps and make fully automated appointments. The
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 63/2024 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 63/2024 - Belgium (2024). Retrieved from cookiefines.eu
Last updated: