DPA case 85/2026 – Complaint Upheld (Belgium, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A person who had season tickets for a soccer team complained after receiving unwanted promotional emails even after trying to unsubscribe. The data protection authority found that the company likely violated rules by not stopping the emails and not deleting the person's data as requested. This case highlights the importance of respecting user choices in marketing communications.
What happened
The data subject received unsolicited promotional emails despite unsubscribing and requesting data deletion.
Who was affected
The person who held season tickets for the soccer team's matches and received unwanted emails.
What the authority found
The authority noted that the company likely violated rules by not honoring the unsubscribe request and failing to delete the person's data in a timely manner.
Why this matters
This case emphasizes that companies must respect user requests regarding marketing communications. It serves as a reminder for businesses to ensure they have proper systems in place to handle unsubscribe and data deletion requests.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject had season tickets for a soccer team’s (the controller’s) matches for approximately 20 years. After receiving unsolicited promotional emails in connection to the season tickets, they clicked on the “unsubscribe” option in one of these emails. The data subject has therefore exercised their right to object to the processing of their personal data for direct marketing purposes in accordance with Article 21(2) GDPR. The data subject received an automated email confirming their objection. Nevertheless, they continued to receive promotional emails. Following this, the data subject exercised their right to erasure in accordance with Article 17 (1) GDPR and requested that their data be completely deleted. However, the promotional emails continued. Subsequently, the data subject filed a complaint with the DPA against the controller. After the filing of the complaint, the controller stated taking technical and organizational measures regarding the mailing list for advertising and removing the data subject from the list, without providing any supporting documentation nor confirmation to the data subject that their request for data erasure had been complied with. In a prima facie decision, the DPA noted that the selection of the “unsubscribe” option should have been sufficient for the promotional emails to stop. Thus, the DPA found that the controller likely violated Article 21 GDPR. Moreover, the DPA acknowledged that although the data subject also exercised their right to data erasure, nevertheless, they continued to receive promotional emails until they filed the complaint. Therefore, the DPA considered that there was a likely violation of Article 17(1) GDPR. In addition, the DPA pointed out that presumably the controller failed to comply with the data subject’s rights within the statutory time limit of one month of receipt of the request, and as a result it likely violated Article 12 GDPR. Consequently, the DPA issued a warning to the controller to ens
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 85/2026 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 85/2026 - Belgium (2026). Retrieved from cookiefines.eu
Last updated: