APD/GBA (Belgium) - 85/2026
From GDPRhub
| APD/GBA - 85/2026 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 12 GDPR Article 17 GDPR Article 21 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 27.01.2026 |
| Decided: | 22.04.2026 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 85/2026 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | APD (in NL) |
| Initial Contributor: | Ds |
The DPA found that a soccer club failed to respect a data subject’s objection and erasure request by continuing to send promotional emails even after the data subject clicked on the “unsubscribe” link.
English Summary
Facts
The data subject had season tickets for a soccer team’s (the controller’s) matches for approximately 20 years. After receiving unsolicited promotional emails in connection to the season tickets, they clicked on the “unsubscribe” option in one of these emails. The data subject has therefore exercised their right to object to the processing of their personal data for direct marketing purposes in accordance with Article 21(2) GDPR.
The data subject received an automated email confirming their objection. Nevertheless, they continued to receive promotional emails.
Following this, the data subject exercised their right to erasure in accordance with Article 17 (1) GDPR and requested that their data be completely deleted. However, the promotional emails continued.
Subsequently, the data subject filed a complaint with the DPA against the controller.
After the filing of the complaint, the controller stated taking technical and organizational measures regarding the mailing list for advertising and removing the data subject from the list, without providing any supporting documentation nor confirmation to the data subject that their request for data erasure had been complied with.
Holding
In a prima facie decision, the DPA noted that the selection of the “unsubscribe” option should have been sufficient for the promotional emails to stop. Thus, the DPA found that the controller likely violated Article 21 GDPR.
Moreover, the DPA acknowledged that although the data subject also exercised their right to data erasure, nevertheless, they continued to receive promotional emails until they filed the complaint. Therefore, the DPA considered that there was a likely violation of Article 17(1) GDPR.
In addition, the DPA pointed out that presumably the controller failed to comply with the data subject’s rights within the statutory time limit of one month of receipt of the request, and as a result it likely violated Article 12 GDPR.
Consequently, the DPA issued a warning to the controller to ensure future compliance with the right to object, ordered the deletion of all personal data of the data subject and required notification of this erasure within 30 days.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/6 Dispute Resolution Chamber Decision 85/2026 of 22 April 2026 File number: DOS-2026-00468 Concerning: failure to comply with a request for data erasure regarding electronic advertising The Dispute Resolution Chamber of the Data Protection Authority; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”; Having regard to the Act of 3 December 2017 establishing the Data Protection Authority, hereinafter “DPO”; Having regard to the Rules of Internal Order of the Data Protection Authority, as approved by the Management Committee on 25 April 2024 and published in the Belgian Official Gazette on 31 May 2024; Having regard to the documents in the file; Has taken the following decision regarding: Complainant: X, hereinafter “the complainant”; and Defendant: Club Y, with registered office at […], with enterprise number […], hereinafter “the defendant” Decision 85/2026 — 2/6 I. Facts and procedure 1. The subject matter of the complaint concerns the request for erasure of data which was presumably not granted. Twenty years ago, the complainant took out a subscription for football matches with the defendant. Subsequently, he received unwanted advertising emails. To counter this, the complainant clicked on the ‘unsubscribe’ option in one of these emails. The complainant receives confirmation via an automated email from the defendant that he has been unsubscribed. Nevertheless, he continues to receive promotional emails. On July 13, 2025, the complainant requests that his data be completely erased. However, the complainant continues to receive such emails. 2. On January 27, 2026, the complainant files a complaint with the Data Protection Authority against the defendant. 3. On January 30, 2026, the complaint is declared admissible by the Primary Care Service on the basis of Articles 58 and 60 of the WOG, and on the same day, the complainant is notified of this in accordance with Article 61 WOG. 4. On the same day, the Disputes Chamber is seized of the case pursuant to Article 92, 1° WOG. 5. On 13 March 2026, the Disputes Chamber shall notify the parties, in accordance with Article 95, §2, of the fact that the present case has been initiated, the content of the complaint, and the possibility of consulting and copying the file at the registry of the Disputes Chamber. The parties are invited to submit any comments regarding this to the Disputes Chamber no later than 30 March 2026. 6. On 25 March 2026, the Disputes Chamber shall receive comments from the defendant regarding this notification. The defendant states that he has taken technical and organizational measures regarding the mailing list for advertising. II. Reasoning II.1. Devermeend defective ‘unsubscribe’ option 7. Article 21 of the GDPR provides that a data subject may object at any time to the processing of his personal data for direct marketing purposes and that the data may no longer be processed for these purposes after this objection. Decision 85/2026 — 3/6 8. In this case, the ‘unsubscribe’ option that the complainant clicked should have sufficed in order to no longer receive advertising emails 1. The Disputes Chamber rules that the defendant has presumably violated Article 21 of the GDPR for the period from clicking the ‘unsubscribe’ option until the request for data erasure. II.2. The request for data erasure 9. Article 17.1 of the GDPR provides that the data subject has the right to obtain the erasure of personal data from the controller and this without undue delay. 10. On 13 July 2025, the complainant exercised his right to erasure. Nevertheless, he continued to receive promotional emails up until the filing of the complaint seven months later. 11. Consequently, the Dispute Resolution Chamber rules that, as of the request for erasure, there is an alleged violation of Article 17.1 GDPR. II.3. The obligations of the defendant 12. Article 12 GDPR sets out the modalities for the exercise of all GDPR rights, such as the right of objection and the right to erasure. The article obliges the controller to take appropriate measures, among other things, to inform the data subject, to facilitate the exercise of the GDPR rights and, in the event of the exercise of these rights, to give effect to this exercise. If the controller refuses to comply with the request of a data subject, the latter is obliged to inform the data subject 2 of the underlying reason within one month at the latest. 13. In the event that the complainant, after his exercise of the right of objection presumably remained without response, proceeded to a request for data erasure. The defendant presumably also failed to respond to the request within the statutory time limit. 14. After the submission of the complaint, the defendant indicated that he had taken technical and organizational measures and that he had removed the complainant from the mailing list. However, he did not substantiate this with documentary evidence. Moreover, the defendant did not indicate that he informed the complainant about the compliance with his request for data erasure. 15. Consequently, the Disputes Chamber rules that the defendant has presumably violated Article 12 GDPR. 1 See appendix p.1 2Art. 12.1, 12.2 and 12.3 GDPR. Decision 85/2026 — 4/6 16. The Disputes Chamber has thus decided, pursuant to Article 58.2 of the GDPR and Article 95, § 1, 5° of the WOG, to order the defendant to comply with the complainant's request to exercise his rights, more specifically the right to erasure of data (“right to be forgotten”) as provided for in Article 17 of the GDPR. 17. The present decision is a prima facie decision taken by the Disputes Chamber in accordance with Article 95 of the WOG on the basis of the complaint lodged by the complainant, and not a decision on the merits of the Disputes Chamber within the meaning of Article 100 of the WOG. 18. The purpose of the present decision is to notify the defendant of the fact that he has presumably committed an infringement of the provisions of the GDPR and to enable him to comply with the aforementioned provisions. 19. If the defendant does not agree with the content of the present prima facie decision and is of the opinion that he can adduce factual and/or legal arguments that could lead to a new decision, he may submit a request for reconsideration to the Disputes Chamber in accordance with the procedure established in Article 98 read in conjunction with Article 99 of the WAG, known as a “substantive review”. This request must be sent to the email address litigationchamber@apd-gba.be within a period of 30 days after notification of this prima facie decision. If applicable, the execution of this decision will be suspended for the aforementioned period. 20. In the event of a continuation of the proceedings on the merits, the Dispute Resolution Chamber will invite the parties, pursuant to Article 98, 2 and 3, read in conjunction with Article 99 of the WOG, to submit their means of defence and also to add all documents they deem useful to the file. The present decision will, where applicable, be permanently suspended. 21. Finally, for the sake of completeness, the Dispute Resolution Chamber points out that a proceedings on the merits of the case may lead to the imposition of the measures referred to in Article 100 of the WOG . 3 3Article 100. § 1. "The Disputes Chamber has the power to: 1° dismiss a complaint; 2° order a decision to drop the case; 3° order the suspension of the decision; 4° propose a settlement; 5° issue warnings and reprimands; 6° order compliance with the requests of the data subject to exercise his rights; 7° order that the data subject be notified of the security issue; 8° order that processing be temporarily or permanently frozen, restricted or prohibited; 9° order that processing be brought into compliance; 10° order the rectification, restriction or deletion of data and notification thereof to the recipients of the data; 11° order the withdrawal of the accreditation of certification bodies; 12° impose penalty payments; 13° impose administrative fines; 14° to order the suspension of cross-border data flows to another State or an international institution; 15° to transfer the file to the Public Prosecutor's Office in Brussels, which notifies it of the action taken on the file; Decision 85/2026 — 5/6 III. Publication of the decision 22. In view of the importance of transparency regarding the decision-making of the Dispute Chamber, this decision is published on the website of the Data Protection Authority. However, it is not necessary for the identification details of the parties to be disclosed directly for this purpose.FOR THESE REASONS, the Disputes Chamber of the Data Protection Authority decides, subject to the submission of a request by the defendant for a hearing on the merits in accordance with Article 98 et seq. of the WOG, to: - on the basis of Article 58.2.a) of the GDPR and Article 95, § 1, 4° of the WOG, to warn the defendant so that the latter ensures in the future that Article 21 of the GDPR is complied with. - pursuant to Article 58.2.c) of the GDPR and Article 95, § 1, 5° of the WOG, to order the defendant to comply with the complainant's request to exercise his rights, specifically the right to erasure (Article 17.1 in conjunction with Article 12 GDPR), and to proceed with the deletion of all personal data of the complainant that the defendant processes concerning him, as well as to notify the complainant of this erasure, within a period of 30 days calculated from the notification of this decision; - to order the defendant to notify the Data Protection Authority (Dispute Resolution Chamber) by email within the same period of time of the action taken in response to this decision via the email address litigationchamber@apd-gba.be. The Disputes Chamber recalls that if the defendant does not agree with the content of this prima facie decision and is of the opinion that he can adduce factual and/or legal arguments that could lead to a different decision, he may, on the one hand, submit a request for a substantive review of the case to the Disputes Chamber via the email address litigationchamber@apd-gba.be, within a period of 30 days following notification of this decision. If applicable, the execution of this decision shall be suspended during the aforementioned period. On the other hand, the defendant may lodge an appeal against this decision in accordance with Article 108, § 1 of the WOG, within a period of 30 days after notification thereof, with the Market Court (Court to decide on a case-by-case basis whether to publish its decisions on the website of the Data Protection Authority." Decision 85/2026 — 6/6 of appeal of Brussels), with the Data Protection Authority as the defendant. Such an appeal may be lodged by means of a petition in adversarial proceedings which must contain the particulars listed in Article 1034ter of the Judicial Code (Ger.W.). The petition in adversarial proceedings must be submitted to the registry of the 5 Market Court in accordance with Article 1034quinquies of the Ger.W., or via the Justice e-Deposit IT system (Article 32ter of the Ger.W.). (Get). Hielke H IJMANS Director of the Disputes Chamber 4"The petition shall state, under penalty of nullity: 1° the day, the month and the year; 2° the name, first name, domicile of the petitioner and, where applicable, his capacity and his national register or company number; 3° the name, first name, domicile and, where applicable, the capacity of the person to be summoned; 4° the subject matter and a brief summary of the grounds of the claim; 5° the judge before whom the claim is brought; 6° the signature of the petitioner or of his lawyer." 5"The petition with its annex shall be sent, in as many copies as there are parties concerned, by registered mail to the registrar of the court or deposited at the registry."
