DPA case 63/2023 – Complaint Upheld (Belgium, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Belgian employer sent an email to staff about the dismissal of two employees without explaining the reasons. The data protection authority found this was not necessary, but the employer still breached rules about minimizing personal data. This case highlights the importance of being careful with how much personal information is shared in workplace communications.
What happened
An employer informed staff about the dismissal of two employees without specifying the reasons.
Who was affected
The two employees who were dismissed and their colleagues who received the email.
What the authority found
The authority ruled that the employer did not need to specify the reasons for dismissal, but still violated GDPR's principle of data minimization.
Why this matters
This case shows that employers should be cautious about sharing personal information, even in dismissal communications. It emphasizes the need for transparency while respecting privacy.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 15 January 2023, an employer (controller) sent an email to his staff concerning the dismissal of two employees (data subjects). The email stated that the data subjects were being dismissed for serious misconduct. Believing that it was not necessary to specify why they were being dismissed, especially as their job was to look after children and this could give the impression that they had committed a fault in relation to the children, the data subjects each lodged a complaint with the Belgian DPA. As the two complaints concerned the same controller and the same facts, the DPA joined the complaints together. The DPA recalled that, according to the principle of minimisation, personal data must be adequate, relevant and limited to what is necessary for the purposes for which it is processed. In this case, the DPA considered that the controller did not have to specify the reason for the dismissal in order to inform the staff that the data subjects were no longer part of the team. The controller thus breached Article 5(1)(c) GDPR. The DPA therefore issued a warning.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 63/2023 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 63/2023 - Belgium (2023). Retrieved from cookiefines.eu
Last updated: