Belgian Supreme Court rules that GDPR fine may imposed even where a data subject’s personal data were not processed
The Belgian Supreme Court ruled in a judgment of Oct. 7, 2021 that a data subject has the right to lodge a complaint with the Data Protection Authority against a processing practice that violates the GDPR (in this case, the data minimization principle in Article 6 of the GDPR), even where the data subject’s personal data were not processed.
In the underlying case, a company required customers to have their electronic identity cards read by the company’s computer system in order to obtain a loyalty card and to enjoy discounts on purchases. It was not possible for customers to provide their personal data by alternative means – for example by providing strictly necessary personal data only on a paper form.
