Belgium: Privacy activists champion procedure over purpose?

Belgian Data Protection Authority rejects NOYB complaints on cookie consent, saying only data subjects or the authority itself can bring actions, under Belgian law. NOYB vows to challenge decision, highlighting tensions in GDPR enforcement activism

The Key Points On 26 June 2025, the Belgian Data Protection Authority (APD/GBA) dismissed 16 complaints filed by NOYB against several companies, finding that only data subjects or the authority itself can bring certain legal actions under Belgian law. The complaints were submitted by NOYB staff and volunteers, not actual users of the targeted websites.

Why This Matters This decision highlights ongoing tensions in GDPR enforcement, particularly regarding the standing of advocacy groups to bring complaints. The ruling may limit the ability of organisations like NOYB to pursue model cases on behalf of consumers, potentially affecting the broader landscape of data privacy activism in Europe.

What Might Happen Next NOYB has indicated it will challenge the APD/GBA decision. It is clear that they want this challenge to champion the role of advocacy groups in GDPR enforcement and the interpretation of data subject rights under Belgian and EU law.

See Cade Project article on this matter