DPA case 133/2024 – Dismissed (Belgium, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Belgian DPA dismissed a complaint from an employee who was depicted in promotional materials without consent. The DPA found that the employee did not provide enough evidence of their attempts to have their images removed. This case highlights the need for clear processes for individuals to exercise their rights regarding personal data.
What happened
An employee complained that their image was used without consent in materials from their former employer.
Who was affected
An employee whose image was used in brochures and training materials without their permission.
What the authority found
The DPA found the complaint inadmissible due to insufficient evidence of the employee's attempts to exercise their rights under GDPR.
Why this matters
This ruling emphasizes the importance of documenting efforts to exercise data rights. Companies should have clear policies for handling such requests to avoid disputes.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
An employee, the data subject, was depicted, against their will, in brochures, mailings and training sessions of their former employer, a security company, the controller. On 5 March 2024, the data subject files a complaint with the Belgian DPA for an alleged infringement of Article 17 GDPR. The complaint is found admissible on the basis of Article 58 and 60 GDPR and subsequently transferred to the Belgian DPA. The DPA dismissed the complaint on the ground of policy considerations. First, it held that the data subject failed to demonstrate that it had exercised its rights vis-à-vis the controller as they did not provide sufficient evidence about attempts to exercise their right to erasure as per Article 17 GDPR. Second, the data subject did not provide sufficient evidence about an unlawful processing of personal data, i.e. the photographs in the brochure, mailings and training sessions.
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 133/2024 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 133/2024 - Belgium (2024). Retrieved from cookiefines.eu
Last updated: