- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 03/2021 – Complaint Upheld (Belgium, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A school mistakenly shared parents' email addresses with each other instead of keeping them private. The Belgian DPA found that this practice violated data protection rules, as parents did not expect their information to be shared this way. This case serves as a reminder for organizations to protect personal information.
What happened
The school sent a newsletter revealing all parents' email addresses in the CC field instead of BCC.
Who was affected
Parents of students at the school whose email addresses were exposed to other parents.
What the authority found
The DPA ruled that the school unlawfully processed personal data by not keeping email addresses confidential.
Why this matters
This ruling emphasizes the need for schools and organizations to handle personal data carefully. It highlights the importance of using proper methods to protect individuals' privacy.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A school sent a newsletter to all parents with all email addresses of those parents visible in Carbon Copy (cc) as opposed to Blind Carbon Copy (BCC). The school said that internal policies dictate that sending in BCC is mandatory in such cases. They also added that the time to unsend a email has been changed from 5 seconds to 30 seconds. The school also apologises. The complainant later adds that even after the school said they implemented those measures, they still continue to send out emails with the email addresses in CC. Can email addresses of parents of children of a school be made public under Article 5(1)(b) if this was not the initial purpose for which the personal data was collected? If not, can the school rely on legitimate interest under Article 6(1)(f)? The school communicates with the parents on ground of contractual necessity based on Article 6(1). Without the contact details, it is impossible for the school to communicate with the parents. As such, there is no free choice. Article 5 GDPR The DPA then states that it is possible to process the contact details for other purpose than initially processed if the purpose is compatible with the original purpose and that it will assess whether it is possible to rely on Article 5(1)(b) in this case. However, the DPA states that this is not within the reasonable expectations of the parents, as they only provided their contact details relative to the school. The other parents are not included in this relationship. As such, these purposes are incompatible. As every processing of personal data needs to rely on a legal basis from Article 6(1), this processing is unlawful. Article 6 GDPR The DPA then assesses whether the school could rely on the legal basis of legitimate interest under Article 6(1)(f). It confirms earlier case law of the CJEU in which three requirements have to be fulfilled, cumulatively; legitimate interest pursued by controller, necessity of the processing and fundamental rights and freedoms
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 03/2021 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 03/2021 - Belgium (2021). Retrieved from cookiefines.eu
Last updated: