DPA case 72/2021 – Complaint Upheld (Belgium, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A public administration in Belgium was found to have improperly shared a director's personal data without a valid reason. This matters because it shows that organizations must protect personal information and follow the rules about sharing data.
What happened
A public administration shared personal data of a director without a proper legal basis.
Who was affected
The director of the organization whose personal data was shared with third parties.
What the authority found
The Autorité de Protection des Données upheld the complaint, stating that the administration did not respect its obligation to inform and share data properly.
Why this matters
This case highlights the importance of following data protection rules when sharing personal information, reminding organizations to be cautious and transparent.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A public administration in charge of supervising the organisations hiring persons with disabilities established an audit report on the situation of the organisation after a complaint from the trade union and some members of the staff. The report mentioned some personal data of the director of the organisation (ie, the salary) and was shared with third parties (trade union representatives, social mediator). The director (the complainant) sent an access request to the administration in charge regarding his personal data in the report. The administration did not answer to the request. The administration did not respect its obligation to inform under Article 12(3), 13(1)(c) and 15(1) GDPR. The sharing of the personal data of the director cannot rely on a proper legal basis such as Article 6(1)(e) since sharing the report with the personal data was not necessary for the performance of the tasks of the administration. In addition, the administration could not rely on Article 6(1)(d) GDPR (vital interests) for communication of the personal data of the director to third parties.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 72/2021 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 72/2021 - Belgium (2021). Retrieved from cookiefines.eu
Last updated: