DPA case 62/2022 – Complaint Upheld (Belgium, 2022)

The data subjects are mother and son. The controller is a public institution for youth care with a focus on children with a difficult family background. On 23 July 2018, the Belgian DPA received a complaint from the mother containing three alleged violations of the controller. First, it was alleged that the controller took photographs of the complainant’s minor son for the purpose of external publication, without the necessary parental consent. Second, it was alleged that the controller sent a group e-mail (16 recipients) and put all of them in CC instead of BCC. This revealed the e-mail addresses of all recipients to one another. Third, it was argued that the controller was sending out a newsletter which, among others, invited the recipients to donate to the controller without having a legal basis for such communications. The controller argued that the newsletter does not qualify as direct marketing but is an essential tool for the controller to keep the parents of the children involved. In its investigation the Belgian DPA established that the first allegation was not supported by evidence and that the email incident was not communicated to the DPA by the controller. The DPA also found that the newsletter was only received by the parents if they had previously subscribed to it on the controller's website. Moreover, the newsletter also contained an unsubscribe button. The DPA found that the complaint did not provide sufficient evidence to establish a violation of the controller in relation to the taking of photographs of the son, however it discussed the hypothetical situation that visual material of juveniles would have been made public by the controller. The DPA decided that in such a case prior consent, or at least specific permission of the parents or the legal guardian is indispensable in the absence of a legitimate interest or legal obligation for the publication of pictures. It further noted that the controller can as a public authority not invoke le