DPA case 93/2024 – Order (Belgium, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A company failed to properly close a former employee's business email account after their contract ended, which raised privacy concerns. This situation is important because it shows that companies must manage user accounts responsibly and inform users about changes. It highlights the need for clear communication when ending business relationships.
What happened
A company did not deactivate a former employee's business email account after their contract ended, leading to privacy concerns.
Who was affected
The former employee who expected their business email account to be properly closed and managed after the end of their contract.
What the authority found
The Belgian DPA decided not to investigate further, noting that the complaint was part of a broader dispute that needed to be resolved in court.
Why this matters
This case illustrates the importance of companies managing user accounts properly and communicating effectively with users about account status. It serves as a reminder to ensure privacy practices are followed even after contracts end.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject entered into contract with a company (data controller). Under the terms of the contract, the controller created a dedicated business e-mail address for data subject. Due to a conflict that arisen between the data subject and the controller, the parties decide to end business relations. One of disputed issues was data subject’s e-mail address. The data subject expected the controller to properly close their e-mail address and inform interested parties about the cessation of collaboration and new contact data. Allegedly, the controller did not shut down the e-mail address once the collaboration was over. The e-mail address remained active. According to the data subject, the controller accessed the e-mail inbox, as well as read the incoming messages. The data subject decided to exercise his rights of access, as well as restriction of processing and deletion of data. The controller responded to the access request. Yet, by invoking the confidentiality of the data at hand, provided the data subject with data partially unreadable (data referring to third-parties). Regarding the right to deletion and right to restriction of processing, the controller rejected the request, claiming, in general, that the data may be necessary for possible legal actions. In response, the data subject lodged a complaint with the Belgian DPA (ADP/GBA). The DPA decided not to investigate and close the case, recalling the expediency of the proceedings. They emphasised the subject matter of complaint referred to a broader dispute that to be examined by a competent court. A potential decision of the DPA would not solve the dispute at hand. Because of that, the alleged violations of the GDPR (exercise of the data subject rights), and the case before the DPA, were only ancillary to the main dispute going beyond the provisions of the GDPR. Nevertheless, the DPA referred to the merits of the case. The DPA did not contest the fact the controller, in response to the access request
Outcome
Order
A binding order requiring the controller to take specific action.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 93/2024 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 93/2024 - Belgium (2024). Retrieved from cookiefines.eu
Last updated: