Onderwijsgroep Zusters der Christelijke Scholen Zuid-Kempen VZW – CJEU Judgment (European Union, 2026)

In July 2019, the father of a pupil filed a complaint with the Dutch DPA, against Onderwijsgroep Zusters der Christelijke Scholen Zuid-Kempen VZW (OZCS), the controller, a non-profit organisation operating a subsidised independent educational establishment. The complaint concerned a survey on pupils' well-being which was distributed to pupils through a digital platform. According to the complaint, the controller had not informed the parents beforehand, had not obtained their consent, had collected more personal data than necessary and had failed to comply with its obligations regarding the processing of the pupils' personal data. On 16 June 2020, the DPA found that the controller infringed Article 6(1) GDPR, Article 8 GDPR, the data minimisation principle under Article 5(1)(c) GDPR and the transparency principle under Article 5(1)(a) GDPR in conjunction with Articles 12(1) and 13 GDPR. The DPA ordered the controller to bring the processing into compliance and imposed a €2,000 administrative fine. Article 83(7) GDPR allows Member States to determine whether and to what extent administrative fines may be imposed on public authorities and bodies established in that Member State. Belgium made use of this possibility in [https://www.belgium.be/en/personal_data Article 221(2) of its Data Protection Law], which excludes the application of Article 83 GDPR to public authorities and their employees or agents, except for legal persons governed by public law that offer goods or services on a market. The dispute therefore concerned whether the controller, despite being a legal person governed by private law, could fall within that exemption because it provided publicly subsidised education. The controller appealed. A court held that the DPA had not sufficiently justified whether the controller benefited from the exemption from administrative fines provided under [https://www.belgium.be/en/personal_data Article 221(2) of the Belgian Data Protection Law]. The DPA subsequently adop