DPA case 101/2024 – Complaint Upheld (Belgium, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Belgian company received a complaint after it failed to respond to employees' requests for information about unsolicited advertising emails. The data protection authority upheld the complaint, stating the company violated privacy laws by not addressing the requests. This ruling highlights the need for companies to be responsive to privacy inquiries.
What happened
A company was found to have violated privacy laws by not responding to access requests from its employees regarding unsolicited emails.
Who was affected
Employees of the company who received unsolicited advertising emails.
What the authority found
The authority ruled that the company did not properly respond to requests for information under privacy laws.
Why this matters
This case serves as a reminder for companies to be diligent in responding to privacy inquiries and to ensure compliance with data protection regulations.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Employees of company A, including a DPO, received an advertising e-mail. The e-mail was sent to the professional e-mail address, promoting an auction organised by the company B (data controller). Later on, the employees received other unsolicited, advertising e-mails. The DPO, acting on behalf of the company’s A employees and themselves, exercised the right of access under Article 15 GDPR, asking for explanation how the controller got access to the list of employees’ e-mail addresses. The controller did not respond to the request. Hence, the DPO lodged a complaint with the Belgian DPA (APD/BGA) on behalf one of the employees and themselves. The DPA upheld the complaint. The DPA held the controller violated Article 12 GDPR because it did not react to the request made under Article 15 GDPR in a proper manner. Also, the DPA emphasised that Article 15 GDPR had to be treated as a "gateway" allowing the data subject to exercise other rights conferred on them by the GDPR. Consequently, the DPA found the violation of Article 12(3) GDPR, Article 12(4) GDPR and Article 15 GDPR. The DPA issued a prima facie decision under [https://etaamb.openjustice.be/fr/loi-du-03-decembre-2017_n2017031916.html Article 95 of Act establishing the Data Protection Authority] (Loi du 3 décembre 2017 portant création de l'Autorité de protection des données), ordering the controller to comply with the data subjects request within 30 days.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 101/2024 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 101/2024 - Belgium (2024). Retrieved from cookiefines.eu
Last updated: