Madame X1 and Monsieur X2 – Complaint Upheld (Belgium, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Madame X1 and Monsieur X2 faced a complaint for not responding to a user's request to delete her account and personal data on their platform. This matters because it highlights the importance of companies promptly addressing user requests for data deletion. The case shows that even if no fine was imposed, companies must still follow data protection rules.
What happened
The Belgian DPA upheld a complaint against Madame X1 and Monsieur X2 for failing to respond to a user's request to delete her account and personal data.
Who was affected
The complaint involved a user of the platform who wanted her account and personal data deleted but received no response.
What the authority found
The DPA found that the company did not comply with the user's request, indicating a serious breach of data protection principles.
Why this matters
This case emphasizes that companies must take user requests seriously and respond promptly. It serves as a reminder for all businesses to ensure they have proper processes in place for handling data deletion requests.
GDPR Articles Cited
National Law Articles
Entities Involved
To book an appointment with a dentist through 'Platform Z' (the platform), which aims to facilitate contact with healthcare professionals and doctors, complainant n.1 had to make an account. After the account creation, complainant n.1 requested the platform to delete her account and her personal data, to which she did not receive any reply. Thus, on 4 December 2020, complainant n.1 lodged a complaint with the Belgian DPA against the company that created the platform and a shareholder company, which she claimed to be joint-controllers, for not taking any action to comply with her request. On 31 July 2021, complainant n.2 also informed the Belgian DPA that to create an account on the platform, he had to provide his National Register Number (NRN). Complainant n.2 explained to have emailed the company stating that their request was illegal, to which the platform explained that the NRN was needed as a security measure. Consequently, complainant n.2 did not create an account. On 2 August 2023, complainants n.1 and no.2 were informed that the hearing would take place on 15 September 2023. In response to the invitation to the hearing, complainant n.2 indicated that he had no intention of filing a complaint other than to point out a potential violation to the DPA. The DPA still found itself able to continue the proceedings since it considered the alleged breach to be sufficiently serious and to be revealing the existence of a practice likely to infringe the data protection principles. In light of this, the DPA also conducted an ex officio investigation into the legal basis of the data processing of the non-registered health professionals carried out by the controller for its platform. The Belgian DPA decided to join the two complaints as it considered them closely related and to ensure consistency in its decisions. Firstly, concerning the complaint of complainant n.1, the DPA addressed whether the company that created the platform and the shareholder company could be con
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Madame X1 and Monsieur X2 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Madame X1 and Monsieur X2 - Belgium (2023). Retrieved from cookiefines.eu
Last updated: