DPA case 69/2024 – Dismissed (Belgium, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A bank employee accessed a customer's personal data without permission, leading the customer to file a complaint. The authority found that the bank took appropriate actions to address the breach, so the complaint was dismissed.
What happened
An employee at a bank accessed a customer's data for personal reasons without following the bank's rules.
Who was affected
The customer whose personal data was accessed by the bank employee.
What the authority found
The authority concluded that the bank acted properly by implementing measures to prevent future breaches after being notified.
Why this matters
This case shows that companies need to respond effectively to data breaches and protect customer information. It also highlights the importance of having clear policies for employee access to data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A bank’s employee, an ex-girlfriend of data subject, allegedly consulted data subject's personal data for one and a half of a year. The data subject contacted the bank (controller) twice, claiming that the controller’s employee (his ex-girlfriend) breached the confidentiality of the data, as she consulted the data outside controller's instructions, namely to stalk the data subject. Also, the data subject asked about the measures taken by the controller against the employee. Later on, the data subject decided to file a complaint with the police against his ex-girlfriend on charge of stalking. In response, the controller explained that the employee processed the data subject's data outside of her professional capacity and without controller's instruction. Additionally, the controller, implemented necessary and proportionate measures, as well as reported the breach with the Belgian DPA (APD/GBA). The data subject did not share the views of the controller and, consequently, filed a complaint with the DPA and [https://www.nationaleombudsman.nl/ the National Ombudsman] (Nationale ombudsman), claiming a breach of confidentiality by the controller. The DPA dismissed the data subject's complaint. Firstly, the actions taken by the controller after data subject’s notification were sufficient in the situation at hand. The controller implemented measures which adequately dealt with the breach of confidentiality. As a result, the DPA found no evidence that the measures were ineffective, especially they did not stop the employee from further unlawful conduct. At the same time, the controller acted proactively, preventing similar breaches to occur in the future. Therefore, the subject matter of the case was obsolete. Secondly, the DPA stated the complaint brought by the data subject also covered the criminal offence of stalking. However, the DPA had no jurisdiction over criminal cases of that kind, which made this part of compliant inadmissible.
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 69/2024 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 69/2024 - Belgium (2024). Retrieved from cookiefines.eu
Last updated: