- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
A data subject (an employee) – Complaint Upheld (Belgium, 2025)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An employee in Belgium asked their employer for a copy of their working hours but didn't get a proper response. The data protection authority ruled that the employer must provide the employee with access to their personal data. This decision emphasizes the importance of companies responding promptly to data access requests.
What happened
The data protection authority ordered the employer to provide the employee with a copy of their personal data upon request.
Who was affected
The employee, who requested access to their personal data from their employer.
What the authority found
The authority found that the employer failed to comply with the employee's request for access to their personal data as required by GDPR.
Why this matters
This ruling highlights that companies must take data access requests seriously and respond without unnecessary delays. It sets a precedent for ensuring that employees can access their personal data easily.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Entities Involved
Source checks
Linked-source text retrieved.
Automated check recorded — 20 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The 10 May 2021, an employee (the data subject) sent their employer (the controller) a request to access to their personal data. The data subject specifically required a copy of a document showing their working hours. The 2 March 2023, the controller sent a letter to the data subject, offering to make an appointment to come to the firm’s head office to consult their data. The data subject did not react to the controller’s proposal. The 27 July 2023, the data subject lodged a complaint to the DPA. The DPA ordered the controller to comply with the data subject’s request for a copy. The DPA reminds that the data subject has a right to obtain confirmation of the processing and to access their personal data (Article 15(1) GDPR). In addition, the data subject has the right to obtain a copy of their personal data processed (Article 15.3). The DPA considered that the right to a copy must be understood as a way of giving the data subject access to their personal data, so that its purpose is to serve the objective of the right of access. The DPA points out that the CJEU defined the right to a copy in a previous decision Österreichische Datenschutzbehörde as the right to obtain a comprehensible and accurate reproduction of all data, whether it is a reproduction of an entire document or an extract from a data base. This is why the DPA decided that a temporary consultation could not be sufficient. What’s more, the DPA warned the controller of a potential violation of Article 12(3) and Article 12(4) GDPR. The DPA noticed that the controller should have facilitate the exercise of the right of access and answered without undue delay and within a month to the data subject request.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for A data subject (an employee) in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. A data subject (an employee) - Belgium (2025). Retrieved from cookiefines.eu
Last updated: