DPA case 44/2026 – Dismissed (Belgium, 2026)

An employee (the data subject) of a company (the controller) lodged a complaint with the Belgian DPA (APD) claiming that the controller failed to comply with his access request by limiting his access to certain data, such as full extracts from email correspondence. The data subject previously emailed a person within the company from a private email address. Later on, he received a message to his professional email account from a different employee asking him to confirm whether he had sent the initial email. Subsequently, the data subject requested access to his personal data, including an overview of recipients of his personal data, all reports and notifications about him, and a copy of his personnel file, among other things. Following his request, the data subject received a file containing his personal data and further information collected from a manager. However, the data subject filed a complaint with the DPA arguing that the controller failed to comply with his access request. The DPA dismissed the data subject’s complaint, noting that an in-depth investigation would not be proportionate. It held that in this case the controller complied sufficiently with the access request under Article 15(1) GDPR and Article 15(3) GDPR even if it disclosed personal data from emails through reproduction, rather than extraction.