- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 41/2022 – Dismissed (Belgium, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Belgian municipality was cleared of wrongdoing after volunteers claimed their email addresses were misused. The DPA found no evidence that the municipality used the emails for anything other than their intended purpose. This ruling reinforces the importance of transparency in how personal data is used.
What happened
Volunteers alleged that their email addresses were used for purposes other than organizing a distribution campaign.
Who was affected
The volunteers who registered for the campaign were the ones raising concerns about their email usage.
What the authority found
The Belgian DPA determined that the municipality did not violate GDPR as it used the emails solely for the intended campaign.
Why this matters
This decision highlights the importance of clear communication about data usage. It reassures organizations that proper data handling can protect them from unfounded claims.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Three data subjects registered as volunteers for the distribution of filtering facepieces with their email addresses. They claimed that the controller, the municipality that organised the campaign, had used their email addresses for other purposes. They did not, however specify those alleged purposes. According to the controller, the volunteers' data were only used for one purpose, namely the organisation of the distribution of the filtering facepieces. In this process, the recipients of the email were placed in "BCC" and the e-mail addresses were deleted after the invitation was sent. The DPA found no violation by the controller. There was no indication that the controller had used the emails for other purposes than the campaign. In particular, it had used the BCC function when sending out emails to the mailing list so that the recipients could not see each others contact data. According to the DPA, the controller was justified by Article 6(1)(e) GDPR which allows processing of personal data for the purposes of public interest, especially since the data had been provided by the data subjects themselves. Furthermore, the controller had complied with the principles of data minimisation (Article 5(1)(c) GDPR) and of storage limitation (Article 5(1)(e) GDPR).
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 41/2022 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 41/2022 - Belgium (2022). Retrieved from cookiefines.eu
Last updated: