APD/GBA (Belgium) – 23/2026

17 February 2026

Dt: Created page with “{{DPAdecisionBOX |Jurisdiction=Belgium |DPA-BG-Color= |DPAlogo=LogoBE.png |DPA_Abbrevation=APD/GBA |DPA_With_Country=APD/GBA (Belgium) |Case_Number_Name=23/2026 |ECLI= |Original_Source_Name_1=APD |Original_Source_Link_1=https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-23-2026.pdf |Original_Source_Language_1=French |Original_Source_Language__Code_1=FR |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Lan…”

{{DPAdecisionBOX

|Case_Number_Name=23/2026
|ECLI=

|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=

|National_Law_Name_1=
|National_Law_Link_1=
|National_Law_Name_2=
|National_Law_Link_2=

|Party_Name_1=
|Party_Link_1=
|Party_Name_2=
|Party_Link_2=

|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=Unknown
|Appeal_To_Link=

|Initial_Contributor=
|
}}

The DPA ordered a company to erase the data provided by potential tenants after not entering into a lease agreement with them.

== English Summary ==

=== Facts ===
The data subjects are a family of two parents and their child.

In 2023 the data subjects intended to enter into a lease agreement with a company (the controller). The controller requested various information from the data subjects, including identity documents, financial statements and others.

Following the refusal of the controller to enter into the lease agreement with the data subjects, the latter contacted the controller and requested the erasure of their personal data provided in accordance with [[Article 17 GDPR|Article 17 GDPR]].

The controller failed to respond to the request for erasure.

The data subjects submitted a request for mediation. However, the controller failed to respond to the request, therefore the data subjects converted the mediation request into a complaint with the DPA.

=== Holding ===
The DPA noted that the controller failed to respond to the data subjects’ erasure request under [[Article 17 GDPR|Article 17 GDPR]]. Furthermore, the DPA pointed out that the controller has the obligation to also inform the data subjects of the measures taken to that effect in accordance with [[Article 12 GDPR|Article 12 GDPR]].

Therefore, the DPA ordered the controller to comply with the data subjects’ request to exercise their right to erasure under [[Article 17 GDPR#1|Article 17(1) GDPR]], and therefore to erase their personal data within 30 days of notification of the DPA’s decision.

== Comment ==
”Share your comments here!”

== Further Resources ==
”Share blogs or news articles here!”

== English Machine Translation of the Decision ==
The decision below is a machine translation of the French original. Please refer to the French original for more details.

<pre>
1/7

Litigation Chamber

Decision 23/2026 of February 2, 2026

Case Number: DOS-2023-03002

Subject: Complaint regarding the lack of response to a request for erasure

The Litigation Chamber of the Data Protection Authority (“DPA”);

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and

on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”;

Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, hereinafter referred to as “the Data Protection Act”;

Having regard to the Rules of Procedure of the Data Protection Authority, as approved by the Chamber of Representatives on 20 December 2018 and published in the Belgian Official Gazette on 15 January 2019 (hereinafter referred to as “the Rules of Procedure”);

Having regard to the documents in the file;

The following decision has been taken concerning:

The complainants: X1, X2, and their daughter X3, hereinafter referred to as “the complainants”;

The defendant: Y, whose registered office is located at […], registered under company number […], hereinafter referred to as “the defendant”

1. The amendments made to the Belgian Data Protection Act (LCA) by the Law of 25 December 2023 amending the Law of 3 December 2017 establishing the Data Protection Authority (“Law of 25 December 2023”) entered into force on 1 June 2024 and apply only to complaints, mediation cases, requests, inspections, and proceedings before the Litigation Chamber initiated from that date. Cases initiated, as in this instance, before 1 June 2024 remain subject to the provisions of the LCA as it existed before that date (https://www.autoriteprotectiondonnees.be/publications/loi-organique-de-l-apd.pdf).

2. The new internal regulations (“IRR”) of the Data Protection Authority (DPA), resulting from the amendments to the Data Protection Act (DPA) by the Law of 25 December 2023, entered into force on 1 June 2024 and apply only to complaints, mediation cases, requests, inspections, and proceedings before the Litigation Chamber initiated on or after that date. Cases initiated, as in this instance, before 1 June 2024 remain subject to the provisions of the IRR as it existed before that date (https://www.autoriteprotectiondonnees.be/publications/reglement-d-ordre-interieur.pdf). Decision 23/2026 — 2/7

I. Facts and Procedure

1. The complaint concerns the failure to comply with a request to exercise the right to erasure.

2. In June 2023, Ms. X1 and Mr. X2, both plaintiffs and parents of plaintiff X3,

state that they contacted the defendant with a view to entering into a lease agreement. The defendant

allegedly asked them to provide various pieces of information, respectively as

guarantors and tenant, namely identity documents, household composition, a student card,

proof of sufficient means of subsistence for the last 6 months, their last 3

pay slips, a copy of a current lease agreement with proof of payment of the last 6

months of rent, an internship agreement, and proof of remuneration during

that period. The plaintiffs state that they provided the requested information.

3. On June 23, 2023, the defendant reportedly informed the plaintiffs that she did not wish to

enter into a lease agreement. On June 30, 2023, the plaintiffs contacted the defendant

to exercise their right to erasure of the data that had been

provided to her for the purpose of concluding the lease agreement, which ultimately did not take place.

4. On July 12, 2023, and in the absence of a response from the defendant, the complainants filed

a request for mediation, which was declared admissible on August 11, 2023, by the First Line Service (hereinafter, “FLS”) based on Articles 58 and 61 of the LCA, as well as Articles 21

and 22 of the APD’s Internal Regulations, in order to obtain a response from the
defendant regarding their request to exercise their right to erasure.

5. On August 16, 2023, the FLS sent the mediation request to the defendant. On September 8,

2023, and in the absence of a response from the defendant, the FLS sent the mediation request to the defendant a second time.

6. On November 13, 2023, the SPL informed the complainants and the defendant that the mediation request had failed due to the defendant’s lack of response.

7. On the same day, the complainants converted their mediation request into a complaint with the DPA against the defendant based on Article 62, §2, paragraph 4 of the LCA. On December 5, 2023, the complaint was deemed admissible by the SPL based on Articles 58 and 60 of the LCA, and the complainants were notified in accordance with Article 61 of the LCA.

8. On December 5, 2023, the Litigation Chamber was seized of the case pursuant to Article 92, 1° of the LCA.

9. On September 19, 2024, in accordance with Article 95, §2 of the LCA, the Litigation Chamber

informs the parties that the present case is pending, of the content of the complaint, and of

the possibility of consulting and copying the file at the Registry of the Litigation Chamber. Decision 23/2026 — 3/7

Litigation Chamber. The defendant is invited to submit any comments to the

Litigation Chamber no later than October 3, 2024.

10. As of November 8, 2025, the Litigation Chamber had not received any response from the

defendant to this invitation. The defendant was therefore invited to respond to the request

to exercise the plaintiffs’ rights on three occasions, namely on August 16 and September 8, 2023,

in the context of the attempted mediation (§5) and on September 19, 2024, in the context of the

communication from the Litigation Chamber (§9). The defendant did not submit a

response to the APD on these occasions.

II. Reasoning

11. The Litigation Chamber notes that the complainants did indeed exercise their right
to erasure with the defendant, the data controller, on June 30, 2023,

in accordance with Article 17 of the GDPR.

12. Article 4.7 of the GDPR defines the “controller” as “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data”.

13. The Litigation Chamber reiterates that the data controller must comply with the

request made by the data subject pursuant to Articles 15 to 22 of the GDPR,

in this case, a request for erasure as provided for in Article 17 of the GDPR, and this in compliance with the conditions set out in Article 12 of the GDPR.

14. The controller is also responsible for facilitating the exercise of the rights of the

data subject (Article 12.2 of the GDPR) and for providing them with information on the
measures taken in response to a request made pursuant to Articles 15 to 22 of the

GDPR, as soon as possible and in any event within one month of

receiving the request. Article 12.3 of the GDPR provides that this period may, if necessary,

be extended by two months, taking into account the complexity and number of requests.

In such a case, the controller informs the data subject of this

extension and the reasons for the delay within one month of receiving the

request.

3
According to Article 4(2) of the GDPR, “processing” of personal data means “any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction”. Decision 23/2026 — 4/7

15. Article 17.1 of the GDPR sets out six grounds which grant the data subject the right to

request the erasure of personal data held by the controller

about him/her, and oblige the controller to comply with this request, which are as follows:

(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

(b) the data subject withdraws consent on which the processing is based,

pursuant to Article 6(1)(a), or Article 9(2)(a), and

there is no other legal ground for the processing;

(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);

(d) the personal data have been unlawfully processed;

(e) the personal data have to be erased to comply with a legal obligation under Union or Member State law to which the controller is subject;

(f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

16. The Litigation Chamber further clarifies that, based on a combined reading of

Articles 12 and 17 of the GDPR, it should be understood that the data controller must

not only erase the personal data it holds about the

data subject without undue delay, and at the very least within one month from

the day on which the data subject makes the request (except in exceptional circumstances), but must

also inform the data subject of the measures taken to this end within the same timeframe.

17. Furthermore, the Litigation Chamber also recalls that, as the presumed

data controller, the defendant is required to comply with the principles of data protection

and must be able to demonstrate that these principles are respected. It must also

implement all necessary measures to this end (principle of

accountability – Articles 5.2 and 25 of the GDPR).

18. It appears from the documents that the defendant did not comply with the plaintiffs’ request

for expungement, not even in the context of the mediation request submitted

on August 16, 2023 (§§5 and 6), nor in response to the communication from the Litigation Chamber
sent on September 19, 2024 (§§9 and 10).

19. The Litigation Chamber considers that, based on the aforementioned analysis, it is necessary to

conclude that the defendant may have committed a violation of Articles 12 and 17.1 of the

GDPR, which justifies the Litigation Chamber proceeding, in this case, to issue Decision 23/2026 — 5/7

a decision in accordance with Article 95, § 1, 5° of the LCA, specifically ordering

the defendant to comply with the complainants’ request for erasure (Article 17 of the

GDPR).

20. This decision is a prima facie decision rendered by the Litigation Chamber

pursuant to Article 95 of the LCA (Law on the Analysis of Consumer Protection) on the basis of the complaint filed by the complainants,

within the framework of the “preliminary proceedings” and not a decision on the

substantive issues of the Litigation Chamber within the meaning of Article 100 of the LCA.

21. The Litigation Chamber has therefore decided, pursuant to Article 58.2.c) of the GDPR and

and
Article 95, § 1, 5° of the LCA, to order the defendant to comply with the complainants’ request

regarding the exercise of their right to erasure (“right to be forgotten”), as defined

in Article 17 of the GDPR.

22. The purpose of this decision is to inform the defendant that it may

have committed a violation of the provisions of the GDPR and to allow it to

comply with the aforementioned provisions.

23. If the defendant disagrees with the prima facie content of this decision

and believes it can provide factual and/or legal arguments that could lead to

a new decision, it may request a review by the Litigation Chamber in accordance with

the procedure established by Article 98 in conjunction with Article 99 of the LCA, known as

“procedural review on the merits” or “processing of the case on the merits”. This request must be

sent to the email address litigationchamber@apd-gba.be within 30 days of

the notification of this primary decision. If applicable, the execution of this

decision is suspended for the aforementioned period.

24. Should the case proceed on its merits, pursuant to Article 98, paragraphs 2 and 3,

in conjunction with Article 99 of the LCA, the Litigation Chamber will invite the parties to submit their

pleadings and to attach to the file all documents they deem relevant. If so,

this decision is definitively suspended.

25. For the sake of completeness, the Litigation Chamber further notes that proceeding on the

merits of the case may lead to the imposition of the measures mentioned in Article 100 of

5 of the LCA.

Section 3, Subsection 2 of the LCA (articles 94 to 97 inclusive).

5. Article 100, § 1. The Litigation Chamber has the power to:

1° dismiss the complaint;

2° order a dismissal;

3° suspend proceedings;

4° propose a settlement;

5° issue warnings and reprimands;

6° order compliance with the data subject’s requests to exercise their rights;

7° order that the data subject be informed of the security issue;

8° order the freezing, limitation, or temporary or permanent prohibition of the processing;

9° order the processing to be brought into compliance; Decision 23/2026 — 7/7

Registry of the Market Court pursuant to Article 1034quinquies of the Judicial Code, or via

the e-Deposit computer system of the Federal Public Service Justice (Article 32ter of the Judicial Code).

Furthermore, the Litigation Chamber also recalls the possibility of submitting a

request for a hearing on the merits of the case, as explained in detail in paragraph 23 of this

decision.

(Sé). HielkeH IJMANS

Director of the Litigation Chamber

7
“The application, together with its annex, is sent, in as many copies as there are parties involved, by registered letter
to the clerk of the court or filed with the registry.”
</pre>

APD/GBA (Belgium) – 25/2026

Tribunale di Roma – N. R.G. 54031/2025