DPA case 125/2021 – Complaint Upheld (Belgium, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A fitness club shared a member's personal information with another member without permission. This breach of privacy matters because it shows how important it is for businesses to protect their customers' data. The Belgian DPA ruled that the fitness club violated data processing principles by disclosing personal data without a valid reason.
What happened
The fitness club shared a member's personal data, including their name and contact details, with another member due to a payment issue.
Who was affected
The member whose personal data was shared without consent was affected.
What the authority found
The Belgian DPA found that the fitness club violated data processing principles by disclosing personal data without a valid legal basis.
Why this matters
This case highlights the importance of protecting customer data and not sharing it without proper consent. Businesses should ensure they have clear policies on data sharing to avoid similar issues.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A member of a fitness club (the Complainant) was contacted by another member of the same fitness club (the Third Party). The Third Party informed the Complainant that he had been paying the membership fee of the Complainant because of an error, and that in the context of this payment issue, the fitness club had shared with him personal data relating to the Complainant. These personal data included the name, mobile phone number, e-mail address, date of birth of the Complainant, as well as the dates of the Complaint's last visits to the fitness club. The Complainant considered that the fitness club had breached the principle of purpose limitation set in Article 5(1)(b) GDPR because these personal data were initially collected for the performance of the contract between the Complainant and the fitness club. According to the Complainant, the fitness club should not have shared these data with another member of the club because of a payment issue. The Complainant therefore filed a complaint with the Belgian DPA against the fitness club. The fitness club argued for its part that the disclosure of the Complainant's personal data to the Third Party was lawful because compatible with the purpose for which the data were initially collected (i.e. the performance of the contract), and/or based on the legitimate interests of the fitness club to inform the Third Party about a payment issue in order to solve it. The Belgian DPA considered that the disclosure of the personal data of the Complainant to the Third Party was made in breach of the principles of data processing. The Belgian DPA saw no reason why the disclosure of personal data should have been allowed under Article 6(4) GDPR, which provides that the processing of personal data for another purpose than the one for which it was initially collected can be allowed if that other purpose is compatible with the initial purpose. In particular, the Belgian DPA found that disclosing the Complainant's name, data of birth, etc., t
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 125/2021 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 125/2021 - Belgium (2021). Retrieved from cookiefines.eu
Last updated: