DPA case 54/2021 – Complaint Upheld (Belgium, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Belgian data authority upheld a complaint against a family allowance entity for accessing a child's household data without a valid reason. The authority found that the entity did not have a legitimate basis for the data access. This ruling emphasizes the importance of having a clear legal basis for accessing personal data.
What happened
A family allowance entity accessed a child's household data without a valid legal basis.
Who was affected
The complainant, who is the parent of the child whose data was accessed.
What the authority found
The Belgian data authority concluded that the entity violated privacy rules by accessing personal data without proper justification.
Why this matters
This decision highlights the need for organizations to ensure they have a valid reason for accessing personal data, particularly in sensitive contexts like family allowances.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In July 2019, an entity (voluntary intervener in the proceedings, hereinafter "the voluntary intervener") in charge of paying family allowances to its affiliates who have children consulted the data of the complainant's son in the National Register, in particular the "household composition" data and its history. This consultation took place in order to manage the family allowance file of the complainant's son, one of its affiliates, and to determine the amount of family allowance that he would be entitled to receive. This consultation was carried out via the TRIVIA application, developed by the BCSS, made available to the family allowance funds. This consultation was done on the basis of the National Register number of the affiliated person, son of the complainant. It is this consultation of the history of the composition of the complainant's son's household that is the subject of the complaint. During this consultation, the volunteer intervener was given access to the information that the complainant had been part of her son's household at one time in his life. The complainant complains that this consultation of personal data concerning him had no basis of valid legitimacy within the meaning of Article 6 of the GDPR. On 24 September 2019, the Supervisory Authority of the family allowance funds for the Brussels-Capital Region (IRISCARE/FAMIFED) received a request for information from the complainant via the contact form on its website. With this request for information, the complainant asked the Supervisory Authority about the consultation of his data on 9 and 17 July 2019. Following several unsuccessful exchanges, and in the absence of a satisfactory response, the dispute was brought before the Belgian Data Protection Authority’s dispute chamber. In this case, the defendant is the shared service center of the voluntary intervening entity. In this respect, the defendant was responsible for monitoring the personal data protection of all the family allow
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 54/2021 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 54/2021 - Belgium (2021). Retrieved from cookiefines.eu
Last updated: