- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 99/2023 – Complaint Upheld (Belgium, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Belgian municipality was warned for asking too much personal information from property owners for a tourist tax. The data protection authority found that the municipality had no legal basis to collect certain data about property owners. This case emphasizes the principle of data minimization, meaning only necessary information should be collected.
What happened
The municipality required property owners to provide excessive personal information for a tourist tax form.
Who was affected
A property owner renting out to tourists who received the tax form.
What the authority found
The Belgian DPA warned the municipality for lacking a legal basis to collect unnecessary data about property owners.
Why this matters
This case serves as a reminder for organizations to collect only the data they truly need. It reinforces the importance of data minimization in data protection practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject owned properties he was renting out to tourists. He received a tourist tax form from the municipality (controller) where he was required to fill in personal information about himself and the date of birth, stay duration and full names of the renters. Considering that this processing breached the data minimization principle of Article 5(1)(c) GDPR and lacked a legal basis under Article 6 GDPR, the data subject filed a complaint with the Belgian DPA. The Belgian DPA distinguished between the collection of the data subject's data and the collection of renters' data. It held that the municipality could only rely on legal obligation under Article 6(1)(c) GDPR for the collection that concerned renters. The controller could however not rely on any legal obligation to collect data about the owner of the properties. Thus, the DPA issued a warning to the controller for lack of legal basis. Furthermore, the DPA deemed the collection of all data not strictly necessary for tourist tax purposes, excessive and contrary to the principle of data minimization under Article 5(1)(c) GDPR. The tourist tax is calculated based on the number of occupants. As such, any other information (such as data of birth, stay duration and name) is unnecessary. The DPA therefore issued a warning to the controller for breach of data minimization. The DPA added that the controller must assess whether it can retain the unlawfully processed data under Article 17(3) GDPR. If it considers that the processing does not fall under this article, it must delete the unlawfully processed data according to Article 17(1)(d) GDPR.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 99/2023 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 99/2023 - Belgium (2023). Retrieved from cookiefines.eu
Last updated: