- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case DOS-2022-00360 – Complaint Upheld (Belgium, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Belgian municipality shared a person's contact details with their ex-wife without permission during a fraud investigation. This is important because it shows that organizations must protect personal information and not share it without consent. Public bodies should be careful about how they handle sensitive information.
What happened
The municipality disclosed a person's name and email address to their ex-wife without consent during an investigation.
Who was affected
The individual whose contact details were shared without their knowledge.
What the authority found
The Belgian DPA ruled that the municipality violated GDPR by sharing the individual's personal information without consent.
Why this matters
This case highlights the need for public organizations to handle personal data with care and respect individuals' privacy rights.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 22 August 2020, the data subject sent an email to the controller, a Flemish municipality, in which he stated that he had previously received two letters from them, but suspected one to be a fraudulent letter. The data subject noticed a difference in the use of fonts and numbers between the two letters and therefore believed one to be fake. In their email of 22 August 2020, the data subject informed the controller of the letters, and asked whether the controller's templates for correspondence had been changed. The controller had not changed their letter template, therefore they considered the data subject's email to be a report of a fraud attempt and launched an investigation into the matter. As part of the fraud investigation, the controller contacted the data subject's ex-wife regarding the matter. However, in the controller's communications to the data subject's ex-wife, the controller shared the data subject's name and email address without the data subject's knowledge or consent. After, the data subject discovered that the controller had shared his contact details with his ex-wife without his consent. On 14 November 2021, the data subject lodged a complaint with controller, as a municipal public body, regarding the transmission of his contact details to his ex-wife. On 14 December 2021, one month after the original complaint, the controller informed the data subject that the investigation into his complaint could not yet be concluded and that they would provide a reply as soon as possible. On 10 January 2022, the controller communicated to the results of their fraud investigation to the data subject. However, they did not address his original clarification request regarding the transmission of his contact details to his ex-wife. Following this communication, on 31 January 2022, the data subject filed a complaint with the Belgian DPA, as the controller's response was insufficient. On 22 February 2022, the Belgian DPA before considering the complaint, tra
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case DOS-2022-00360 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case DOS-2022-00360 - Belgium (2023). Retrieved from cookiefines.eu
Last updated: