DPA case 21/2025 – Dismissed (Belgium, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A complaint about a processor's handling of survey data was dismissed by the Belgian data protection authority. The authority found that the processor had provided the necessary information to the user and acted within the law. This decision shows that not all complaints lead to violations, especially when proper procedures are followed.
What happened
A complaint was filed regarding the processor's response to a user's data access request.
Who was affected
The user who requested access to their data after participating in a survey.
What the authority found
The authority dismissed the complaint, finding that the processor had complied with legal requirements.
Why this matters
This ruling highlights that businesses can successfully defend against complaints if they follow proper data handling procedures and maintain transparency with users.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The processor conducted satisfaction surveys on behalf of the controller. The data subject responded to a survey. The data subject exercised their right of access under Article 15 GDPR to the processor. The processor responded to the complainant's access request and shared the data provided by the controller, the purpose of the processing, the categories of data subjects, the retention period and specified the rights of the data subjects. The data subject transmitted the answer to the DPA and claimed that the data processing could not be based on a legitimate interest of the controller. On 8 March 2024, the processor communicated to the data subject that their previous reply to the access request was incorrect. On 11 March 2024, the data subject requested access to their data from the controller to verify the information given by the processor. The controller responded to the data subject that only the necessary data was transmitted to the processor. On 12 September 2024, the DPA started investigating the complaint. The DPA decided to dismiss the complaint due to the following reasons. Generally, the DPA may dismiss a complaint either due to insufficiency of elements to likely to lead to a sanction; or due to the need for expediency. In this case, the DPA closed the complaint as it is manifestly unfounded. The DPA observed that information about the data sharing from controller to processor was was provided for in the controller’s privacy policy, to which the data subject consented. So, the legal basis for such processing would be Article 6(1)(a) GDPR. However, the DPA noticed that, among the data transmitted, there was also the gender of the data subject. The DPA considered that there was no need to process that information in the context of a satisfaction survey. As found by the CJEU in C-394/23 Mousse, processing of information about the data subject's gender may raise doubts as per the requirements of the GDPR. In the case at hand, the DPA found no violat
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 21/2025 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 21/2025 - Belgium (2025). Retrieved from cookiefines.eu
Last updated: