Cybersecurity Policy Report, Belgian DPA Issues Fine Over GDPR Violations, (Jun 5, 2024)

By Tony Foley

The Belgian data protection authority has issued a decision in which it fined an unnamed company 172,000 euros ($187,000) for its violation of consumer rights to object to processing and to request erasure of personal data under the European Union’s General Data Protection Regulation (GDPR).

The decision is available only in French but, based on a machine translation of the text, is based on a complaint related to the regular unsolicited commercial e-mail messages from the company, despite the complainant’s attempts to request erasure of the data after being charged for an “energy contribution.” The company acknowledged the complainant’s request almost immediately, but despite assurance that it would process them rapidly, the complainant continued to receive unsolicited e-mails from the company, according to the DPA.

The Belgian DPA concluded that the company failed to comply with the complainant’s requests to object to processing and to erase the data at issue. Specifically, the agency found that article 21(2) of the GDPR, which provides for the right to object to processing for direct marketing purposes, grants an unconditional right to a data subject to object at any time to the processing of his or her personal data. In addition, pursuant to GDPR article 17, to the extent that the complainant exercised the right to erasure by revoking consent, the company should have granted the erasure request and deleted all of the complainant’s personal data but failed to do so within the time frames required under the GDPR.

In addition to the fine the DPA ordered the company to satisfy the complainant’s opposition and erasure requests within 30 days of notification of the decision and to align its processing operations with GDPR requirements.

News: LitigationEnforcement DataPrivacy GDPR