The Belgian Supreme Court ruled in a judgment of Oct. 7, 2021
that a data subject has the right to lodge a complaint with the
Data Protection Authority against a processing practice that
violates the GDPR (in this case, the data minimization principle in
Article 6 of the GDPR), even where the data subject's
personal data were not processed.
In the underlying case, a company required customers to have
their electronic identity cards read by the company's
computer system in order to obtain a loyalty card and to enjoy
discounts on purchases. It was not possible for customers to
provide their personal data by alternative means – for
example by providing strictly necessary personal data only on a
paper form.
