Redacted – Complaint Upheld (Belgium, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Belgian Data Protection Authority found that a company failed to fully delete a person's data from its website, even after confirming it had done so. This matters because it shows that businesses must ensure they completely fulfill data deletion requests. The ruling emphasizes the importance of verifying data removal to comply with privacy laws.
What happened
A company did not fully erase a person's data from its website despite confirming the deletion.
Who was affected
The person who requested the deletion of their personal data from the company's website.
What the authority found
The Belgian Data Protection Authority ruled that the company did not comply with the person's request to erase their data as required by privacy laws.
Why this matters
This case highlights the need for businesses to thoroughly check that data deletion requests are fully executed. It serves as a reminder that confirming deletion isn't enough; companies must ensure data is actually removed from all sources.
GDPR Articles Cited
On 4 September 2021, and again on 19 September 2021, the data subject contacted the controller requesting erasure of her personal data under Article 17 GDPR. On 21 September 2021, the controller confirmed the deletion, as required by Article 12(3) and (4) GDPR. However, the complainant found that her name still appeared on the controller's website. On 21 October 2021 the data subject filed a complaint with the Slovak DPA (Office for Personal Data Protection of the Slovak Republic - UOOU). It referred the case to the Belgian DPA (Belgian Data Protection Authority - APD/GBA) which on 23 November 2021 confirmed that it would act as Lead Supervisory Authority (LSA). During the proceedings the following supervisory authorities confirmed that they would act as Concerned Supervisory Authorities (CSA) next to the Slovak DPA: Ireland (Irish Data Protection Commissioner -DPC), Sweden (Integritetsskyddsmyndigheten - IMY), Estonia (Estonian Data Protection Inspectorate - AKI) and Italy (Garante per la protezione dei dati personali). Under Article 60 GDPR the Belgian DPA (LSA) and other concerned authorities ordered the controller to comply with a data subject's request to erasure according to Article 58(2)(c) GDPR. Based on the documents supporting the complaint, the Beglian DPA found that controller did not comply with the data subject's request to erasure under Article 17(1) GDPR, as the data subject's name was still listed on the data controller's website.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Redacted in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Redacted - Belgium (2022). Retrieved from cookiefines.eu
Last updated: