DPA case 99/2024 – Dismissed (Belgium, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Belgian employee complained that their company did not respond to their request for access to their email account during a disciplinary process. The data protection authority dismissed the case, stating the complaint was made too early for a violation to occur. This situation underscores the importance of timely responses to access requests.
What happened
An employee's complaint about their company's failure to respond to an access request was dismissed.
Who was affected
The employee who was involved in disciplinary proceedings and requested access to their email logs.
What the authority found
The authority found that the complaint was premature since the company had not yet had time to respond to the access request.
Why this matters
This case illustrates the need for employees to be patient during access requests and for companies to ensure they respond within the required timeframes.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject was an employee of a company (the controller). Due to a conflict between the data subject and their manager disciplinary proceedings against the data subject were initiated. The data subject was asked not to work onsite; their laptop was confiscated and the mailbox blocked. The data subject received a document concerning the disciplinary proceedings from the controller to review and comment within 10 days. The document was sent via mail and e-mail. The controller provided the instruction on the remote access to the data subject’s mailbox. The data subject was unable to access their mailbox and asked the controller for help. The controller forwarded the request to its IT department. Also, the controller informed the data subject they were entitled to use a computer within the company premises to access the mailbox. After few days, the data subject found out their e-mail account password was changed without their consent or notification. Then, the data subject requested access from the controller to their mailbox’s logs and explanation of the situation at stake. The controller didn’t answer the access request. The data subject filed a complaint with the Belgian DPA (ADP/GBA). The data subject claimed the controller failed to answer the access request and suspended their mailbox access. The DPA dismissed the case on the grounds of expediency (understood as ineffectiveness of potential proceedings before the DPA). According to the DPA, the subject matter of the case referred to the failure to answer the data subject's access request. The DPA explained the data subject lodged the complaint too early, i.e. three days after the access request was made. Hence, the controller was unable to react within the time frame under Article 12 GDPR. Thus, the violation of the GDPR didn’t occur yet. Moreover, for the DPA the complaint covered a broader dispute, related to the disciplinary proceedings. Because of that, potential investigation of the DPA was inappro
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 99/2024 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 99/2024 - Belgium (2024). Retrieved from cookiefines.eu
Last updated: