Belgian Municipality – Violation Found (Belgium, 2025)

The defendant is the mayor of a municipality that sent an email promoting the release of his new book that he co-authored. The email in question was sent using his professional email address and was sent to in total 992 recipients through the ‘functional mailing group’ database of the municipality. The recipients can be divided into different groups namely, external contacts, personal contacts and internal contacts. It is important to note that from November 2023 until December 2024, the DPO of the municipality was also the communication expert. The email in question was sent during this period. In April 2024, a candidate for alderman in the same municipality submitted a complaint to the DPA. Pursuant to the complaint, the case was referred to the Dispute Chamber, entailing the involvement of the Dispute Resolution Chamber. On December 4th 2024, the complainant withdrew his complaint stating that his motivations were partly politically based on the contextual setting before the submission of the complaint, referring to his election as alderman after the complaint was filed. Shortly after, the Dispute Resolution Chamber of the DPA closed the file pertaining to the complaint but decided to pursue the case. The DPA’s Resolution Chamber investigated and found violations that can be grouped in three categories. Firstly, the DPA found a violation of Article 5(1)(a) and Article 6(1) by the mayor because of the lack of valid legal basis for the further processing he performed on the data sets of the municipality. Initially, the contact details of the recipients were collected by the municipality for public interest purposes. The mayor was deemed a separate controller for the ‘further processing’ under Article 6(4), which requires an assessment of compatibility between the initial purpose of collection and the subsequent processing. The DPA concluded that the initial purpose and the further processing purpose are not compatible given the political and hierarchical relationship between the mayor and his employees or citizens; and because the processing carried out does not fall within the reasonable expectations of the vast majority of the recipients. This results in the lack of a valid legal basis for further processing the contact details of the municipality. Secondly, the DPA found that the mayor did not meet the minimum conditions for the transparent processing of the contact details of the recipients of the email in question, violating Article 5(1)(a), Article 12and Article 14 of the GDPR. That is because neither the municipality’s website nor the website related to the book the mayor co-authored mention the possibility of further processing of contact details by a third party. The municipality’s transparency requirements were deemed out of scope, since the more relevant consideration would have been the organisational and technical measures in place that would have prevented the dataset to be misused. Thirdly, the DPA found a violation of Article 38(2) because the municipality did not provide the DPO with sufficient resources in the form of time, during the period where he also served as communication expert. However, the DPA did not find a violation of Article 38(6) because there was no conflict of interest as the DPO did not hold a position that entailed a lot of responsibility in the communications department. Therefore, the DPA ordered the mayor to immediately cease and permanently prohibited the processing of the municipality’s contact details for direct marketing purposes. Additionally it reprimanded the mayor and the municipality.