- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case DOS-2019-04346 – No Violation (Belgium, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Belgium's data protection authority investigated a data leak but found no violations by the company involved. This is important because it shows that even when data leaks occur, companies can sometimes meet their legal obligations. Small businesses should ensure they have proper data protection measures in place to avoid potential issues.
What happened
The Belgian data protection authority concluded there was no violation after investigating a data leak involving a platform.
Who was affected
Approximately 89,429 users whose data was potentially leaked were affected by the incident.
What the authority found
The authority found that the company had acted in accordance with data protection laws and had informed users about the data leak.
Why this matters
This ruling indicates that companies can avoid penalties if they take appropriate measures after a data breach. It emphasizes the importance of having strong data protection practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
An investigation was started on 20 December 2019 over the practices of the controller. The controller owned a platform which allowed data subjects to access their data and loyalty points and use them to benefit from promotions offered by different shops that posted their offers on the platform. The investigation was suggested after a data leak occurred on the platform of the processor, which was notified, in accordance with Article 33 GDPR to the Belgian DPA. Nonetheless, there were suspicions that the controller did not comply with Article 32 GDPR. Especially considering the high number of data subjects, 89,429 data subjects, and the nature of the data disclosed, including the card number, e-mail address and telephone number. The DPA held a hearing on the matter on 1 December 2023. The DPA commented that the information provided by the controller following the data leak indicated that the controller’s practices could have been not complying with the GDPR. In this context, the DPA affirmed that it was important to consider not only the impact of the data leak on the large number of people involved but also the nature of the data, which potentially consisted of financial data. According to the DPA, in fact, there could have been a risk for the payment details to have been leaked as well. However, based on the information provided by the controller, the DPA noted that in the circumstances of the data leak, the incident was limited and did not impact the payment details of the data subjects. Moreover, the DPA acknowledged that the controller had also, out of prudence, informed the data subjects concerned on 22 August 2019 of the data leak so that they could take possible precautionary measures, if necessary. Thus, the controller acted in accordance with Article 33 GDPR and Article 34 GDPR. In addition, considering that the controller did not present a history of repeated data breaches indicating systematic failures on the part of the controller, it also fulfilled its
Outcome
No Violation
The DPA investigated and found no violation.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case DOS-2019-04346 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case DOS-2019-04346 - Belgium (2023). Retrieved from cookiefines.eu
Last updated: