- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 23/2026 – Complaint Upheld (Belgium, 2026)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A family complained after a company refused to delete their personal data following a failed lease agreement. The Belgian Data Protection Authority ruled that the company must erase the family's data, highlighting the right to control personal information.
What happened
The company did not respond to the family's request to erase their personal data after a lease agreement was denied.
Who was affected
A family of two parents and their child who provided personal data to the company.
What the authority found
The Belgian Data Protection Authority found that the company violated GDPR by failing to respond to the family's request for data erasure.
Why this matters
This case reinforces the importance of respecting individuals' rights to have their personal data erased when it is no longer needed, reminding companies to be responsive to such requests.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subjects are a family of two parents and their child. In 2023 the data subjects intended to enter into a lease agreement with a company (the controller). The controller requested various information from the data subjects, including identity documents, financial statements and others. Following the refusal of the controller to enter into the lease agreement with the data subjects, the latter contacted the controller and requested the erasure of their personal data provided in accordance with Article 17 GDPR. The controller failed to respond to the request for erasure. The data subjects submitted a request for mediation. However, the controller failed to respond to the request, therefore the data subjects converted the mediation request into a complaint with the DPA. The DPA noted that the controller failed to respond to the data subjects’ erasure request under Article 17 GDPR. Furthermore, the DPA pointed out that the controller has the obligation to also inform the data subjects of the measures taken to that effect in accordance with Article 12 GDPR. Therefore, the DPA ordered the controller to comply with the data subjects’ request to exercise their right to erasure under Article 17(1) GDPR, and therefore to erase their personal data within 30 days of notification of the DPA’s decision.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 23/2026 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 23/2026 - Belgium (2026). Retrieved from cookiefines.eu
Last updated: