- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case DOS-2022-01864 – Complaint Upheld (Belgium, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Belgian data protection authority upheld a complaint against a public institution for collecting unnecessary personal information in a job application. The authority ordered the institution to publish contact details for their data protection officer and respond to inquiries. This case highlights the importance of data minimization and transparency in handling personal information.
What happened
A public institution collected excessive personal information in a job application and failed to provide contact details for their data protection officer.
Who was affected
The individual who applied for a job at the institution and sought clarification on data protection.
What the authority found
The authority found that the institution violated GDPR principles by collecting unnecessary data and not providing required contact information.
Why this matters
This case underscores the need for organizations to limit data collection to what is necessary and to be transparent about their data protection practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 18 October 2026.
Processing notes: national law identified, date discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject wanted to apply online for a job at the controller. The data subject found many of the required information (such as nationality or postal address) unnecessary for the purpose of identifying the best candidate for the job. The data subject wanted to get in touch with the controller, but could not find any contact information of the DPO. There was only an online form available. They wrote an email to the controller and asked to reveal the contact details of their DPO on 24 March 2022 which remained unanswered. On 25 April 2022 the data subject lodged a complaint with the Data Protection Authority which was declared admissible on 26 April 2022. First, the DPA held that collecting unnecessary data which is not required to fulfil the purpose violated Article 5(1)(b) GDPR (purpose limitation) as well as Article 5(1)(c) GDPR (data minimisation). Since the controller edited the application form in the meantime and deleted the unnecessary requests, the form was in compliance with GDPR at the time of the decision and the DPA did not impose any further orders. Second, the DPA held that according to Article 13(1)(b) GDPR the controller must state the contact details of the DPO on their website. There is a similar obligation under Article 37(7) GDPR. The DPA ordered the controller to comply with his obligations under Article 13(1)(b) GDPR and Article 37(7) GDPR and to publish the contact details of their DPO. Third, the DPA held that the controller violated the data subjects right to information as enshrined in Article 13(1)(a) GDPR when they did not answer the data subjects request for the contact details of the DPO. The DPA ordered the controller to reply to the data subjects request.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case DOS-2022-01864 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case DOS-2022-01864 - Belgium (2022). Retrieved from cookiefines.eu
Last updated: