Mister X (the data subject) – Complaint Upheld (Belgium, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Belgian data protection authority upheld a complaint against a real estate agency for keeping a house advertisement online after the sale. This case highlights the importance of respecting individuals' requests to remove personal information. Businesses should ensure they have a legal basis for processing data.
What happened
The Belgian DPA found a real estate agency failed to remove a house advertisement containing personal data after the sale, despite the buyer's request.
Who was affected
The buyer of a house whose personal data remained online in a real estate advertisement.
What the authority found
The DPA ruled that the real estate agency did not have a legal basis for processing the data and failed to comply with the buyer's request for erasure.
Why this matters
This decision highlights the need for businesses to promptly address data removal requests and ensure they have a valid legal basis for processing personal information. It serves as a reminder to review compliance with data protection laws.
GDPR Articles Cited
Entities Involved
On 27 July 2022, the data subject bought a house with a real estate agency (controller), acting as an intermediary between the data subject and the seller. However, pictures of the house, the postal address and other information were still available on the controller’s website in an advertisement. This advertisement included, amongst other information, the address of the property and identification numbers of the cadastral parcels. On 24 June, the data subject requested the erasure of this data and objected to the processing by the controller. The controller refused to comply with these requests for marketing purposes, specifically for the controller’s commercial activity as a real estate agency. The data subject also contacted the host of the controller’s website (processor) to delete the information, without apparent success. On 6 July 2022, the data subject filed a complaint at the Belgian DPA because the controller refused to comply with the requests. The DPA found that the advertisement, including the displayed information and pictures, was still online on the website on 12 October 2022. The DPA held that the controller failed to comply with Articles 12, 13, 17(1) and 21(1) GDPR, because the controller did not respond to the data subject's objection request and erasure request within one month. Moreover, the DPA held that the controller did not have a legal basis for the processing on the controller’s website. The DPA determined that the controller was not able to use the legal basis of contract (Article 6(1)(b) GDPR), because the data subject was not a party to the contract between the controller and the seller of the property. The publication of the advertisement could therefore not be based on Article 6(1)(b) GDPR, especially not after the sale of the property. The DPA continued by stating that the controller did not meet any of the lawfulness requirements of Article 6 GDPR, but examined nevertheless if the controller could rely on legitimate interest
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Mister X (the data subject) in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Mister X (the data subject) - Belgium (2022). Retrieved from cookiefines.eu
Last updated: