CNPD
^ iniuiSoouis
Commission Resolution No 15/2025 of 31 January 2025
IQiOOOllOOHO
Ol.
iiouctioiinuoio:
OHOiOOOlUOO
COMMISSION national for data protection in training
iUX
K'tOOOlOKiona
: 3uiiiioiouoiio:
NATIONAL
FOR THE
plenary on Complaint File No 3.375 lodged at
against the company ‘ ’
PROTECTION
SUPERVISOR
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April
2016 on the protection of natural persons with regard to the processing of personal data and on the free
movement of such data, and repealing Directive 95/46/EC (‘ GDPR’);
Having regard to the Law of1 August 2018 on the organisation of the National Data Protection
Commission and the General Data Protection Scheme (‘the Law of 1August 2018’);
Having regard to the Rules of Procedure of the National Data Protection Commission adopted by Decision
No 3AD/2020 of 22 January 2020 (hereinafter ‘the ROI’);
Having regard to the procedure relating to complaints before the National Data Protection Commission
adopted on 16 October 2020 (‘the procedure relating to complaints before the CNPD’);
Having regard to:
I. Facts and procedure
1. On 22 June 2019, the National Data Protection Commission (hereinafter: the CNPD) received a
complaint from , residing at
(hereinafter: the complainant).
2. The complaint was lodged against , established at
(‘ ’).
3. The complainant claims that:
• he made a request to to erase his personal data, after terminating his
customer relationship and cancelling his subscription to the ;
• confirmed to him on the same day that his personal data had been deleted
from his database;
• however, the complainant continued to receive marketing emails and e-mails more than
a month after the confirmation of erasure.
4. In essence, the complainant asks the CNPD to order to grant his request
for erasure.
1
TCNPD
mtnoiw-. .louousoouio
Commission Resolution No 15/2025 of 31 January 2025
national for data protection in training
.tuiccs.tsrur-v 110: 1000 uniitnoi OîlOlOOOO’JOOllCl lOUOJOljlOlWl des iotiioiououo: o < oinioiîowuiow
COMMISSION
NATIONAL
FOR THE
PROTECTION
plenary on Complaint File No 3.375 lodged at
against the company ‘ ’
SUPERVISOR
5. The complaint is therefore based on Article 17 GDPR.
6. On the basis of that complaint and pursuant to Article 57(1) (f) of the GDPR, the CNPD asked
to:
• specify which entity would be considered as controller in relation to ’s customer
database; and
• in the event that this entity is , to take a position on the facts
reported by the complainant.
7. The company ‘ .’, established in
(‘ ’), replied:
• whereas it is to be considered as controller in relation to the personalisation and sending
of prospection communications of in Belgium and Luxembourg;
• the complainant’s request for erasure has been successfully processed; and
• concerning the sending of emails after confirmation of the deletion of the complainant’s
data:
i. its various databases are automatically synchronised, allowing all changes made
to the data contained in them to be taken into account;
ii. the sending of the survey email after the deletion confirmation is due to a problem
of synchronisation between the database in which the erasure was carried out
and the database used for sending marketing emails;
iii. it analysed the causes of that problem and took steps to remedy it.
• concerning the sending of mail after confirmation of the erasure of the complainant’s data:
i. it works with third parties, to whom it gives instructions, to send such letters;
ii. this would involve significant planning including a selection of the group of
customers targeted by the sending of letters, the transmission of those
customers’ data to the third party responsible for sending the mail, and the actual
sending;
iii. this planning time would explain that there is a mismatch between the
database and the third-party shipment database;
iv. in the present case, the selection of the group of customers targeted by the letter
at issue took place before the complainant’s request for erasure;
2
CNPD Commission Resolution No 15/2025 of 31 January 2025
COMMISSION
NATIONAL
national for data protection in training
FOR THE
PROTECTION plenary on Complaint File No 3.375 lodged at
against the company ‘ ’
SUPERVISOR
llOHOOiOTUOl
Oi
ÜUOJOWIUOOI
UX
lotiouoimoioiu’
JiouinionoitOKX
otoiiouooiioin-.
v. it would revise its procedure for sending marketing mail, with a view to reducing the
synchronisation time between its database and that of the third party to 10 days
before the mail was delivered to the post office.
8. In an email of 23 August 2019, the CNPD informed the complainant of the follow-up given to his
complaint by (1) informing him of the information referred to in paragraph 7 above, (2) informing
him that it considered his intervention to have been completed in the light of those elements, unless
he received new marketing communications from the end of July 2019 indicating that his data might
not have been properly deleted, and (3) informing him that, in the latter case, the investigation of
his complaint would continue in collaboration with the Belgian Data Protection Authority (DPA), on
account of the fact that the controller is located in Belgium.
By two emails of 23 August 2019, the complainant informed the CNPD that he had received a new
prospection email from on the same day, and requested further processing of his
9. complaint, since his request for erasure had still not been granted.
10. On 5 September 2019, the CNPD submitted the complaint to the DPA under the European
cooperation procedure under Chapter VII of the GDPR on IMI (procedure number Article 56-75987).
11. The DPA handled the complaint as lead authority by assigning it the national reference number
DOS-2019-05424.
12. On 23 November 2020, the DPA contacted the CNPD by email with a view to informing it of the
developments in the file following its handling, namely:
• The email address to which the prospection email of 23 August 2019 was sent was not linked
to his name or other email address to the controller, so it was not possible for the controller
to link the email address to which the marketing email of 23 August 2019 was sent to his
request for erasure;
• A request for opposition has been made from the email address to which the prospection
email of 23 August 2019 was sent and that request has been granted, no further prospection
email having been sent by to that address since that date;
The DPA also communicated that it intended to submit a decision to take no further action on that
basis, with the consequence that Article 60(8) of the GDPR would apply and that it would therefore
be for the CNPD to adopt that decision.
13. On 30 July 2021, the CNPD informed the complainant of the developments referred to in
paragraph 11 above, inviting him to submit any reactions by 30 August 2021 at the latest so that
3
CNPD Commission Resolution No 15/2025 of 31 January 2025
Siowi COMMISSION
NATIONAL
national for data protection in training
FOR THE
PROTECTION plenary on Complaint File No 3.375 lodged at
against the company ‘ ’
SUPERVISOR
the DPA could take them into account when concluding his complaint.
14. In the absence of the complainant’s return on 30 August 2021, the CNPD informed the DPA by
email on 6 September 2021 that no new elements were to be taken into account in the
continuation of its decision-making process.
15. On 25 October 2023, the DPA submitted on IMI (procedure number Article 60-570893) a draft
decision rejecting the complaint within the meaning of Article 60(8) GDPR, pursuant to Article
60(3) GDPR (see Annex).
11. The law
1. Applicable law
16. Article 77 of the GDPR provides that “Without prejudice to any other administrative or judicial
remedy, every data subject shall have the right to lodge a complaint with a supervisory authority,
J, if it considers that the processing of personal data relating to him or her infringes this
Regulation.’;
17. According to Article 57(1) (f) GDPR, each supervisory authority within its territory “shall handle
complaints lodged by a data subject or a body, organisation or association in accordance with
Article 80, shall examine the subject matter of the complaint, to the extent appropriate, and shall
inform the complainant of the progress and the outcome of the investigation within a reasonable
period of time. .J’;
18. Article 56(1) GDPR provides that “(...) the supervisory authority of the main establishment or
single establishment of the controller or processor shall be competent to act as lead supervisory
authority in relation to the cross-border processing carried out by that controller or processor in
accordance with the procedure laid down in Article 60”;
19. According to Article 60(1) GDPR "The lead supervisory authority shall cooperate with the other
supervisory authorities concerned in accordance with this
4
T CNPD! Commission Resolution No 15/2025 of 31 January 2025
IISS COMMISSION I OHOJOOIUOOHJIX H
national for data protection in training
NATIONAL I 01011011000111010: FOR THE
DATAPROTECTIO
N plenary on Complaint File No 3.375 lodged at
against the company ‘ ’
Article by striving to reach consensus. The lead supervisory authority and the supervisory
authorities concerned shall exchange all relevant information’;
20. Under Article 60(3) of the GDPR, ‘the lead supervisory authority shall, without delay,
communicate relevant information on the matter to the other supervisory authorities concerned.
It shall without delay submit a draft decision to the other supervisory authorities concerned for
their opinion and shall take due account of their views’;
21. According to Article 60(6) GDPR, “where none of the other CSAs has objected to the draft
decision submitted by the LSA (...), the LSA and the CSAs shall be deemed to approve and are
bound by that draft decision”;
22. Article 60(8) GDPR provides that “where a complaint is refused or rejected, the supervisory
authority with which the complaint has been lodged shall adopt the decision, notify it to the
complainant and inform the controller thereof”.
2. In the present case
23. The Plenary Training notes that the draft decision rejecting the complaint within the meaning of
Article 60(8) of the GDPR submitted by the DPA has not been the subject of any objection by the
supervisory authorities concerned, including the CNPD.
24. Therefore, in accordance with Article 60(8) GDPR, the Plenary Training adopts this decision,
notifies it to the complainant and informs the controller.
25. Pursuant to paragraph 239 of EDPB Guidelines 02/2022 on the application of Article 60 GDPR,
the NCO requests the DPA to inform the controller of this decision on its behalf.
26. The CNPD has investigated the complaint in accordance with Article 57(1) (f) GDPR, with due
diligence, and hereby informs the complainant of the follow-up given to his complaint, in
accordance with Articles 57 (1) (f) and 77 (2) GDPR.
5
CNPD Commission Resolution No 15/2025 of 31 January 2025
national for data protection in training
plenary on Complaint File No 3.375 lodged at
.Il Cu IOCU ^ J
iioiioooiuiuaioi
OJtOJOOOlUO
OlUX iuut > ooio
COMMISSION against the company ‘ ’
> oww > i NATIONAL
cuntoucooiuoia-.
.loioouuaeie-’ FOR THE
ICU
PROTECTION
SUPERVISOR
In the light of the above, the CNPD, sitting in plenary formation and voting unanimously,
decided:
— adopt the attached draft decision rejecting the DPA, submitted on IMI under procedure
number Article 60-570893; and consequently
reject Complaint File 3.375, pursuant to Article 60(8) GDPR.
So decided in Belvaux on 31 January 2025.
The National Data Protection Commission
President Commissioner Commissioner
Reference to appeal possibilities
This administrative decision may be the subject of an appeal for alteration within three months of its
notification. That action must be brought by the interested party before the Administrative Court and must
be brought by a lawyer at the Court of one of the Bar Associations.
Appendix: draft decision to reject the DPA submitted on IMI under procedure number Article 60-
570893
6