A data subject (an employee) – Complaint Upheld (Belgium, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An employee in Belgium asked their employer for a copy of their work hours but didn't respond to an offer to see the data at the office. The data protection authority ruled that the employer must provide a copy of the requested data. This decision highlights the importance of companies promptly fulfilling employees' requests for personal data.
What happened
The data protection authority ordered the employer to provide the employee with a copy of their personal data.
Who was affected
The employee who requested access to their personal data was affected.
What the authority found
The authority found that the employer failed to comply with the employee's request for access to their personal data as required by GDPR.
Why this matters
This ruling emphasizes that employers must take employee data requests seriously and respond without unnecessary delays. Companies should ensure they have clear processes for handling such requests.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
Entities Involved
The 10 May 2021, an employee (the data subject) sent their employer (the controller) a request to access to their personal data. The data subject specifically required a copy of a document showing their working hours. The 2 March 2023, the controller sent a letter to the data subject, offering to make an appointment to come to the firm’s head office to consult their data. The data subject did not react to the controller’s proposal. The 27 July 2023, the data subject lodged a complaint to the DPA. The DPA ordered the controller to comply with the data subject’s request for a copy. The DPA reminds that the data subject has a right to obtain confirmation of the processing and to access their personal data (Article 15(1) GDPR). In addition, the data subject has the right to obtain a copy of their personal data processed (Article 15.3). The DPA considered that the right to a copy must be understood as a way of giving the data subject access to their personal data, so that its purpose is to serve the objective of the right of access. The DPA points out that the CJEU defined the right to a copy in a previous decision Österreichische Datenschutzbehörde as the right to obtain a comprehensible and accurate reproduction of all data, whether it is a reproduction of an entire document or an extract from a data base. This is why the DPA decided that a temporary consultation could not be sufficient. What’s more, the DPA warned the controller of a potential violation of Article 12(3) and Article 12(4) GDPR. The DPA noticed that the controller should have facilitate the exercise of the right of access and answered without undue delay and within a month to the data subject request.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for A data subject (an employee) in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. A data subject (an employee) - Belgium (2025). Retrieved from cookiefines.eu
Last updated: