APD/GBA (Belgium) – 28/2026

20 February 2026

Dt: Created page with “{{DPAdecisionBOX |Jurisdiction=Belgium |DPA-BG-Color= |DPAlogo=LogoBE.png |DPA_Abbrevation=APD/GBA |DPA_With_Country=APD/GBA (Belgium) |Case_Number_Name=28/2026 |ECLI= |Original_Source_Name_1=APD |Original_Source_Link_1=https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-28-2026.pdf |Original_Source_Language_1=French |Original_Source_Language__Code_1=FR |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Lan…”

{{DPAdecisionBOX

|Case_Number_Name=28/2026
|ECLI=

|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=

|National_Law_Name_1=
|National_Law_Link_1=
|National_Law_Name_2=
|National_Law_Link_2=

|Party_Name_1=
|Party_Link_1=
|Party_Name_2=
|Party_Link_2=

|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=Unknown
|Appeal_To_Link=

|Initial_Contributor=
|
}}

The DPA warned a laundry company to comply with an access request after failing to provide justification for several invoices issued to an alleged customer.

== English Summary ==

=== Facts ===
A parent, acting as the property administrator for his son (the data subject), received several monthly invoices from a company (the controller) for laundry services addressed to his son, amounting to €1,627.

The parent sent a letter to the controller requesting a justification for the invoices, as well as exercising the right of access in the interest of the data subject in accordance with [[Article 15 GDPR#1|Article 15(1) GDPR]].

The data subject filed a claim with the Belgian DPA (ADP) as well.

=== Holding ===
The DPA noted that the controller failed to respond to the access request. Therefore, the DPA took a prima facie decision following preliminary proceedings. The DPA did not decide on the merits of the case.

Thus, the DPA issued a warning to the controller to comply with the access request within 30 days of notification of the decision.

== Comment ==
”Share your comments here!”

== Further Resources ==
”Share blogs or news articles here!”

== English Machine Translation of the Decision ==
The decision below is a machine translation of the French original. Please refer to the French original for more details.

<pre>
1/6

Litigation Chamber

Decision 28/2026 of February 10, 2026

Case Number: DOS-2025-01453

Subject: Complaint regarding the lack of follow-up to a request to exercise the right of access

The Litigation Chamber of the Data Protection Authority;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as “GDPR”;

Having regard to the Law of December 3, 2017 establishing the Data Protection Authority, hereinafter referred to as

“LCA”;

Having regard to the internal regulations of the Data Protection Authority, as approved by the

Management Committee on 25 April 2024 and published in the Belgian Official Gazette on 31 May 2024;

Having regard to the documents in the file;

The following decision has been made concerning:

The complainant: X, property manager of X1, hereinafter referred to as “the complainant”;

The defendant: Y, Srl, whose registered office is located at […], registered under

number […], hereinafter referred to as “the defendant”. Decision 28/2026 — 2/6

I. Facts and Procedure

1. The subject of the complaint concerns the failure to follow up on a request to exercise the right of access.

2. On 8 April 2025, the complainant filed a complaint with the Data Protection Authority against the defendant.

3. At the time of the events, the complainant was acting as the administrator of the assets of X1, his son who was under
legal guardianship.

4. During 2024, the complainant received monthly invoices for various amounts

addressed to his son for laundry services provided by the
defendant. These invoices totaled 1,627 (one thousand six hundred and twenty-seven)

euros.

5. On March 12, 2025, the complainant requested, by registered mail, that the defendant provide him with the document justifying these invoices. Furthermore, the complainant formally exercised his

right of access, by registered mail, and requested that the defendant disclose the

source of his personal data, the identity of the data controller, and

any other personal data that it might be in its

possession.

6. The complainant adds evidence of non-collection of these registered mail items.

7. On May 7, 2025, the complaint is declared admissible by the First Line Service based on
Articles 58 and 60 of the LCA (Law on Consumer Protection) and the complainant is informed the same day in accordance with

Article 61 of the LCA.

8. On May 7, 2025, the Litigation Chamber is seized of the case pursuant to Article 92, 1° of
the LCA.

9. On November 20, 2025, in accordance with Article 95, §2 of the LCA, the Litigation Chamber

informally acknowledges that the present case is pending, the content of the complaint, and
the possibility of consulting and copying the file at the registry of the

Litigation Chamber. The parties are invited to submit any comments they may have to the

Litigation Chamber, no later than December 4, 2025.

10. As of December 4, 2025, the Litigation Chamber has not received a response to this
invitation.

II. Reasoning

11. The Litigation Chamber notes that the complainant did indeed exercise their right

of access on March 12, 2025, in accordance with Article 15.1 of the GDPR. As of December 4, 2025, it appears from the facts of the case that the respondent has still not responded

to this access request.

Decision 28/2026 — 3/6

12. Article 4.7 of the GDPR defines the “controller” as “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing”.

13. The Litigation Chamber reiterates that the controller must comply with the request made by the data subject pursuant to Articles 15 to 22 of the GDPR, in this case a request for access as provided for in Article 15 of the GDPR, and in compliance with the conditions set out in Article 12 of the GDPR.

14. Pursuant to Article 12.1 of the GDPR, the data controller is required to take

“appropriate measures to provide all information referred to in Articles 13 and 14 and

to make all communications under Articles 15 to 22 and Article 34 concerning

the processing to the data subject in a concise, transparent,

intelligible and easily accessible manner, using clear and plain language […].”

15. Furthermore, the Litigation Chamber also recalls that, as the presumed data controller,

the defendant is required to comply with the principles of data protection and

and must be able to demonstrate that these principles are respected. It must also

implement all necessary measures to this end (principle of

accountability – Articles 5.2 and 24 of the GDPR).

16. Finally, the Litigation Chamber reiterates that the right of access is one of the major requirements of the right to data protection; it constitutes the “gateway” that allows the exercise of the other rights that the GDPR grants to the data subject, such as the right to rectification, the right to restriction of processing, or the right to erasure.

17. It appears from the documents that the defendant failed to comply with the complainant’s request

to exercise his right of access dated December 4, 2025, even though this request was

made on March 12, 2025.

18. Consequently, the Litigation Chamber considers that, based on the aforementioned analysis,

it is necessary to conclude that the defendant may have committed a

violation of Articles 12 and 15 of the GDPR, which justifies, in this case,

a decision being made in accordance with Article 95, § 1, 5° of the LCA, more specifically,

ordering the defendant to comply with the complainant’s request to exercise his right

of access (Article 15.1 of the GDPR).

1According to Article 4(2) of the GDPR, “processing” of personal data means “any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction”. Decision 28/2026 — 4/6

19. This decision is a prima facie decision issued by the Litigation Chamber

pursuant to Article 95 of the LCA (Law on the Analysis of Consumer Protection) on the basis of the complaint filed by the complainant,

within the framework of the ‘preliminary decision proceedings’ and not a decision on the

substantive issues of the Litigation Chamber within the meaning of Article 100 of the LCA.

20. The Litigation Chamber has therefore decided, pursuant to Article 58.2.c) of the GDPR and

Article 95, § 1, 5° of the LCA, to order the respondent to comply with the request

of the complainant to exercise its rights, specifically the right of access as defined in Article

15 of the GDPR.

21. The purpose of this decision is to inform the respondent that it may

have committed a violation of the provisions of the GDPR and to allow it to still

comply with the aforementioned provisions.

22. If the defendant disagrees with the content of this prima facie decision

and believes it can provide factual and/or legal arguments that could lead to

a new decision, it may request a review by the Litigation Chamber in accordance with

the procedure established by Article 98 in conjunction with Article 99 of the LCA, known as

“procedural review” or “processing of the case on its merits”. This request must be

sent to the email address litigationchamber@apd-gba.be within 30 days of

notification of this prima facie decision. If applicable, the execution of this

decision is suspended during the aforementioned period.

23. In the event of continued processing of the case on its merits, pursuant to Article 98, 2° and 3°

Pursuant to Article 99 of the LCA, the Litigation Chamber will invite the parties to submit their

pleadings and to attach to the file all documents they deem relevant. If necessary,

this decision is definitively suspended.

24. For the sake of completeness, the Litigation Chamber further emphasizes that a hearing of

the case on its merits may lead to the imposition of the measures mentioned in Article 100 of

the LCA.

2
Section 3, Subsection 2 of the LCA (Articles 94 to 97 inclusive).

3 “Art. 100. § 1. The Litigation Chamber has the power to:

1° dismiss the complaint;

2° order a dismissal;

3° suspend the proceedings;

4° propose a settlement;

5. Issue warnings and reprimands;

6. Order compliance with the data subject’s requests to exercise their rights;

7. Order that the data subject be informed of the security issue;

8. Order the freezing, limitation, or temporary or permanent prohibition of the processing;

9. Order the processing to be brought into compliance;

10. Order the rectification, restriction, or erasure of the data and notification thereof to the data recipients;

11. Order the withdrawal of accreditation of certification bodies;

12. Impose penalty payments;

13. Impose administrative fines;

14. Order the suspension of cross-border data flows to another State or an international organization; Decision 28/2026 — 6/6

must be filed with the Registry of the Market Court in accordance with Article 1034quinquies of the

Judicial Code, or via the Justice e-Deposit computer system (Article 32ter of the Judicial Code).

(Seated). HielkeH IJMANS

Director of the Litigation Division

2. The applicant’s surname, first name, and address, as well as, where applicable, their capacity and national registration number

or company number;

3. The surname, first name, address, and, where applicable, capacity of the person to be summoned;

4. The subject matter and a summary of the grounds for the application;

5. The name of the judge seized of the application;

6. The signature of the applicant or their lawyer.

5. The application, together with its annex, is sent, in as many copies as there are parties involved, by registered letter to the clerk of the court or filed with the registry.
</pre>

AKI (Estonia) – 2.1.-4/25/1239-2660-6

AEPD (Spain) – EXP202410843