DPA case 66/2026 – Complaint Upheld (Belgium, 2026)

An individual (the data subject) filed a complaint with the Belgian DPA (APD) alleging that she and her underage children were depicted in a travel blog website where the controller, the father of the children, posts images of his daily life and travels. Previously, the data subject contacted the controller asking for the deletion of the photos in which she appeared. The controller informed her that there were hardly any photos of her left on the web pages and that he did not know where they were located. The data subject subsequently requested the erasure of the remaining photos in a letter sent to the controller. Furthermore, the data subject emailed the controller about two specific blog posts in which her daughter is mentioned and asked for their removal. The controller refused to remove the posts claiming the daughter’s name was not included in the posts. The controller informed the DPA of his refusal to remove the specific blog posts citing claiming they did not violate the GDPR. The erasure of photos in which the data subject was depicted The DPA took note of the repeated requests made by the data subject to the controller for the erasure of the photos depicting her and the alleged failure of the controller to remove all such photos. Therefore, the DPA found, prima facie, that the controller may have infringed Article 6 GDPR, Article 12 GDPR and Article 17(1) GDPR. Consequently, the DPA ordered the controller to comply with the data subject’s right to erasure under Article 17 GDPR. The erasure of the children’s personal data The DPA dismissed the second part of the complaint regarding the erasure of the children’s personal data. The DPA held that the issue of the children’s personal data falls within the scope of a broader dispute relating to the scope of parental authority which must be resolved by the competent court or authority.