Privacy-friendly analytics: dismissal of personal data complaint

Privacy-friendly analytics: dismissal of complaint for lack of evidence of processing of personal data. Reasoning of the Belgian DPA’s Inspection Service, quoting SRB and Breyer & confirming our arguments:

1. Insufficient evidence of a GDPR infringement

The complainant did not provide concrete evidence demonstrating that his personal data had actually been processed by the provider (or its partners). The alleged infringement was inferred primarily from publicly available information gathered online, and the complaint included a few screenshots from websites – but that was insufficient to establish any processing in violation of the GDPR.
 
2. Territorial scope of the GDPR

The complainant contacted several partners, most of whom confirmed that they do not currently use the provider’s technology, or at least not on the Belgian market.
The websites on which the technology was allegedly used are operated by companies established in the UK. Their accessibility from Belgium is not sufficient to trigger the applicability of the GDPR.
 
3. Lack of personal interest

The complainant failed to demonstrate any direct personal impact arising from the alleged processing. The Inspection Service concluded that the complaint pursued a general public interest “actio popularis” (= public interest claim) which is not sufficient to render a complaint admissible or well-founded.
 
4. Technical assessment of IP address processing

The provider acknowledged the processing of IP addresses (as also indicated in its privacy statement), but maintained that these do not constitute personal data in this context, as it would not be reasonably possible for the provider to identify an individual based solely on an IP address.
 
The Inspection Service refers extensively to two judgments of the EU Court of Justice (Breyer [C-582/14, 19 October 2016] and SRB [C-413/23P, 4 September 2025]) and states in essence that:
 
In order to assess whether the specific processing of the IP address in this case by [the provider] constitutes processing of personal data within the meaning of the GDPR, account must be taken of the reasonable means available to enable identification. It cannot reasonably be expected that identification is possible if, given the time, costs and manpower required, this would require an excessive effort on the part of [the provider]. It should be noted that [the provider] is based in the United States and that it would have to obtain the information behind the IP address of a Belgian website visitor from a Belgian Internet Service Provider.” (rough translation)
 
Based on its discretionary power, the Inspection Service decided not to further investigate whether the provider could realistically obtain identifying information from a Belgian ISP (noting however that it did not exclude future investigation “should new admissible and/or substantiated complaints be submitted”).

Pretty glad with this result!

Machine translation attached.

Data protection privacy