DPA case 130/2021 – Complaint Upheld (Belgium, 2021)

On 19 August 2021, a data subject (the Complainant) reported illegal dumping to the competent municipal services. An official report identifying four suspects was drafted by the competent police force. This official report, including its non-anonymised annexes, was then submitted to the competent authority (the Authority) in the framework of a municipal administrative sanction procedure (Gemeentelijke Administratieve Sanctie or 'GAS' procedure). The fine, including its non-anonymised annexes, was then passed on from the Authority to the four suspects. As a result, the four suspects were informed about the identity of the Complainant. On 16 September 2021, the Complainant was approached by one of the four suspects; the latter confronted her about her initial complaint on the illegal dumping. Because of this, the Complainant realised that her identity had been revealed by the Authority to the four suspects in the context of the GAS procedure. On 20 September 2021, the Complainant therefore filed a complaint with the Belgian DPA against the Authority, on the ground that the latter had unlawfully disclosed her personal data to the four suspects without her consent within the framework of the GAS procedure. The Belgian DPA found that the Authority had obtained the personal data of the Complainant for a specific purpose, namely to investigate and impose a fine for illegal dumping in the context of the GAS procedure. The Belgian DPA stressed that the Authority did not need to reveal the identity of the Complainant to the four suspects to be able to investigate the illegal dumping and impose a fine. In other words, the four suspects were not part of the category of recipients to whom the personal data should have been disclosed for the purpose of the processing to be achieved. As a consequence, the Belgian DPA found that there had been a breach of the principle of purpose limitation pursuant to Article 5(1)(b) GDPR, since the disclosure of the Complainant's personal dat