DPA case 86/2024 – Complaint Upheld (Belgium, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Belgium's data protection authority upheld a complaint from a mother who requested access to her child's data from a school. This ruling is important because it emphasizes that schools must respond properly to requests for personal data. It shows that parents have rights regarding their children's information.
What happened
A mother requested access to her child's personal data from the school but did not receive a proper response.
Who was affected
The pupil, whose personal data was requested by their mother, was affected.
What the authority found
The authority found that the school failed to comply with data access requests and did not provide necessary information.
Why this matters
This case underscores the obligation of schools to respond to data access requests. It serves as a reminder for educational institutions to be transparent and responsive regarding personal data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 1 June 2019, the mother of a pupil (‘data subject’) exercised her right of access with the school the data subject attended (‘controller’), and specifically requested the data held by the controller regarding the data subject, the purposes for which the data were processed, and how long the data were kept. She also requested that in the event that photos of the data subject were taken during a school trip and were then published, they be deleted. On 2 June 2019, regarding the access request, the controller responded that it was subject to the control of an ad hoc person, and that it would only refer to them with regard to the processing. Regarding the deletion request, the controller replied that in the beginning of the school year, a document relating to image rights was submitted to the parents, committing them for the entire school year. This document was also published on the controller’s website. On 26 August 2019, the mother wrote to the controller explaining that she was still awaiting a reply. On the same day, the controller responded that it had already replied on 2 June 2019. The data subject decided to lodge a complaint with the Belgian DPA (‘APD’). The Litigation Department of the APD requested that the Inspection Department conduct an investigation. The latter followed these instructions and completed a report indicating that the controller (i) failed to comply with Articles 12(1), 15(1) and 15(3) GDPR by not providing the mother of the data subject with a copy of the personal data being processed and (ii) the controller failed to comply with Articles 12(1), 13 and 14 GDPR as the information relating to the data collected was absent from the documents transmitted in the beginning of the school year. This report, as well as the complaint, were forwarded to the Litigation Department. The controller argued in particular that (i) a reply was given to the data subject’s mother by telephone and the written exchanges only reveal an incomplete part of the i
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 86/2024 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 86/2024 - Belgium (2024). Retrieved from cookiefines.eu
Last updated: