DPA case 87/2024 – €172,431 Fine (Belgium, 2024)

On 30 June 2022, the data subject purchased a product from the controller and discovered an unexpected charge of €1,50 relating to an ‘energy contribution’ on his bill of May 2022. The data subject asked to be reimbursed of this surcharge and that all his personal data be deleted. The controller refused to reimburse this surcharge but acknowledged receipt of the deletion request and confirmed it would be dealt with promptly. The data subject continued to receive advertising communications from the controller. On 18 November 2022, the data subject requested mediation from the Belgian DPA (‘APD’). On 14 February 2023, in the absence of any response from the controller, the Mediation Service of the APD informed the data subject that he could convert his request for mediation into a complaint. The data subject did so on the same day. During the hearing, the controller explained that regarding the erasure of the data subject’s data, the process took place in several stages: the data subject initially complained about an excessive energy charge but this complaint evolved into an erasure request to terminate the customer relationship. The former DPO misunderstood that this was a GDPR issue. They then ordered their German processor to delete the data subject’s data using ‘code 43’. However, this code was used to restrict the processing rather than delete the personal data. The controller acknowledged this mistake made by the former DPO and also explained that (i) the absence of response to the DPA during the mediation was due to the former DPO, and that neither the current DPO, nor the management were aware of these problems and (ii) the former DPO did not process correspondence with the DPA or the data subject, nor did they share this information internally. They took measures to limit the processing of the data subject’s data without communicating with the latter, or with the DPA. Despite the use of ‘code 43’ to limit the processing and the cessation of commercial calls