Can you file a complaint with the DPA to achieve other goals?

Filing a complaint with the Data Protection Authority (DPA) is a fundamental right for any citizen who believes his or her personal data is being mishandled. But what if that complaint actually serves as a strategic weapon in an entirely different conflict, such as a tax dispute? The Belgian Court of Cassation confirmed, in a ruling of 10 January 2025 that this is not possible without further ado. Filing a GDPR complaint with the main purpose of gathering information for another dispute (a ‘fishing expedition’) can be considered an abuse of law.

The facts of the case

The case revolved around an accountant who lived in Luxembourg. The Belgian tax authorities (FPS Finance) had listed her as a “front man” in various third-party tax files. The accountant disagreed and went to the FPS Finance, invoking the General Data Protection Regulation (GDPR). She asked foraccessn, rectification (correction) and erasure of the data that labeled her as front man.

FPS Finance largely refused, after which the accountant filed a complaint with the DPA. The DPA vindicated the bookkeeper, ruling in a decision of 4 June 2021 (No. 66/2021) that FPS Finance had violated the GDPR. It imposed a reprimand on the tax authority and ordered it to amend the data .

The decision: from the Market Court to Cassation

FPS Finance did not leave it at that and appealed to the Market Court (a specialised division of the Court of Appeal in Brussels) to challenge the decision of the DPA..

The judgment of the Market Court

The FPS Finance threw up a crucial argument: abuse of law. According to the tax authorities, the complainant was not at all concerned with the protection of her personal data. Her complaint was a “fishing expedition”: an attempt to use the GDPR to gather information about her own tax file and make potentially incriminating data disappear.

The Market Court followed this reasoning. It found that the complaint was indeed being used for a purpose other than that for which the right to complain under the GDPR is intended. The Court ruled that the DPA itself had also erred by violating the due diligence principle: given the clear tax context, the DPA itself should have investigated whether the complaint was not being used improperly . The Market Court therefore overturned the decision of the DPA in a ruling of 1 December 2021.

The final judgment of the Court of Cassation

The DPA in turn disagreed with the Market Court and went to the Court of Cassation, the highest court in the country. The DPA had two main arguments:

1. The absolute right to complain: The DPA stated that Article 77.1 of the GDPR is an objective right. Anyone who believes their rights have been violated may complain. The underlying motives or intentions of the complainant are irrelevant. Applying the Belgian concept of ‘abuse of rights’ would prejudice this European right.
2. The duty of care: The DPA stated that it could not be expected to investigate “ex officio” (on its own initiative) and systematically the hidden motives of a complainant, especially if the opposing party (the FPS Finance) had not itself raised that argument during the DPA proceedings.

The Court of Cassation rejected the DPA's arguments in its ruling of 10 January 2025:

• On the abuse of rights (Argument 1): The Court was very clear. A right deriving from EU law (such as the GDPR complaint right) can indeed be subject to the national law prohibition on abuse of rights. This is allowed as long as the full effect and uniform application of EU law is not compromised. The DPA's idea that motives do not matter was rejected.
• On the duty of care (Argument 2): The Court declared this part of the provisionin admissible for lack of interest. This is a legal-technical reason. The Court found that the Market Court had also based its decision (that there was a ‘fishing expedition’) on the concrete facts in the file, such as the complaint letter itself. The DPA had not criticized this factual reasoning of the Market Court in its cassation provision. Since these findings were in themselves sufficient to support the Market Court's ruling, a discussion of the DPA's duty of care no longer served any purpose.

The end result was that the provision was rejected and the ruling of the Market Court upheld: the GDPR complaint was rightly considered an abuse of law.

Legal analysis and interpretation

This ruling confirms that the right to complain under the GDPR is not an absolute, unlimited right. It is framed by the general legal principle of the prohibition of abuse of rights, which states that one may not exercise a right in a manner that “manifestly exceeds the limits of the normal exercise of that right by a prudent and concerned person”.

The crux of the ruling is that the purpose of the complaint matters. Using a legal remedy (a GDPR complaint) for a purpose other than that for which it was created (i.e., data protection) may constitute abuse.

Although the Court of Cassation did not explicitly rule on the DPA's duty of care (because that part of the cassation provision was inadmissible), the implications are clear. This ruling forces the DPA to be more alert. Where there are concrete indications that a complaint is being used strategically, the principle of due care may require the GBA to actively investigate the finality (the actual purpose) of the complaint. A purely formal check is no longer sufficient.

What this specifically means

This ruling has important practical implications for anyone coming into contact with the GDPR.

For citizens and complainants

Your motive counts. If you file a GDPR complaint, your primary purpose should be to protect your personal data. Are you using the complaint primarily as leverage in dismissal proceedings, as a means of pressure in a neighbor dispute, or as a ‘fishing expedition’ in a tax dispute? Then you risk having your complaint dismissed for abuse of rights.

For corporations and governments (the defendants)

This ruling gives you an important defense tool. When you receive a GDPR complaint that is clearly strategic and part of another conflict, you can (and must) raise the argument of abuse of rights. However, you must do so immediately in your defense to the DPA and specifically support your contention with evidence (e.g., the timing of the complaint, email traffic demonstrating the true purpose, etc.).

For the DPA

The DPA is exhorted to be more critical. It can no longer assess complaints that appear ‘strategic’ in a purely formal way. In the case of concrete indications of improper use, the DPA will have to examine the purpose of the complaint as part of its duty of care.

Frequently asked questions (FAQ)

What is abuse of law in Belgium?
Abuse of law is a general principle of law that states that you may not exercise a right in a manner that manifestly exceeds the limits of how a normal, prudent person would exercise that right. This is the case, for example, when you exercise a right with the sole intention of harming another person, or when you use a right for a completely different purpose than that for which it was intended.

Can I still file a GDPR complaint during dismissal proceedings?
Yes, you can. Just because another conflict is pending (such as a dismissal) does not mean that you lose your GDPR rights. The condition, however, is that your complaint is actually about a violation of your personal data (e.g. wrongful camera surveillance, sharing your data without consent). However, if the complaint only serves as a means of pressure to get a higher severance payment, your employer can claim abuse of law.

What is a ‘fishing expedition’ in this context?
A ‘fishing expedition’ is an English term for an attempt to ‘fish’ for information in a broad, unfocused way. In this case, it meant that the complainant used the GDPR procedure not to protect her personal data, but as a fishing rod to ‘fish’ for information in tax records, hoping to find something useful for her own tax situation.

Conclusion

The ruling of the Court of Cassation of 10 January 2025 is a clear warning: the GDPR is a shield for personal data protection, not a sword for other battles. Both complainants and defendants should be aware that the intent behind a complaint matters. The Belgian courts have confirmed that they will not hesitate to punish improper use of the right to complain as an abuse of law.