- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case DOS-2024-01344 – Complaint Upheld (Belgium, 2025)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Belgian data protection authority found that a company mishandled an employee's personal data during a disciplinary investigation. This matters because it shows that companies must have a valid reason to process personal data and must protect it from unauthorized access.
What happened
The company processed an employee's personal data without a valid legal basis and shared it with unauthorized parties.
Who was affected
The employee whose personal data was mishandled during a disciplinary investigation.
What the authority found
The authority ruled that the company violated multiple GDPR rules by failing to protect personal data and not having a valid reason for processing it.
Why this matters
This case highlights the importance of having proper data protection measures in place. Companies must ensure they have a valid reason for processing personal data and protect it from unauthorized access.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On January 19, 2023, the controller’s security officer requested the Belgian National Security Authority (NSA) to extend the security clearance of one of their employees (the data subject), which was rejected by means of a reasoned decision on July 7, 2023 and communicated back to the controller’s security officer. The data subject and the governing body of the controller received the reasoned decision, which was then forwarded to the data subject’s hierarchical superior by the governing body of the controller. This triggered disciplinary investigations of the data subject in connection to allegations of indecent assault on a minor. On March 5, 2024, the data subject filed a complaint with the Belgian Data Protection Authority (APD/GBA) concerning the unlawful processing of their personal data by their employer, the controller. On March 27, 2024, the DPA declared the complaint admissible, leading to the DPA delivering a decision on the substance of the case. The Contentious Chamber found multiple GDPR violations by the controller. Article 5(1)(a) GDPR was breached by processing the NSA's reasoned decision without a valid legal basis, Article 5(1)(b) GDPR by sharing it with unauthorised parties contrary to its originally intended purpose, and Article 5(1)(f) GDPR by failing to ensure confidentiality of the personal data. Since the processing of personal data related to criminal offences, the controller additionally violated Article 10 GDPR. The lack of necessity for processing under both a legal obligation to which the controller is subject and public interest grounds breached Articles 6(1)(c) and 6(1)(e) GDPR. Furthermore, the controller violated Articles 12(1), (3), and (4) GDPR by failing to inform the data subject, delaying access requests, and improperly invoking judicial secrecy, along with Article 15 GDPR for denying a legitimate access request by the data subject. Finally, breaches of Articles 24(1), 25(1), and 32 GDPR were found due to the controlle
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case DOS-2024-01344 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case DOS-2024-01344 - Belgium (2025). Retrieved from cookiefines.eu
Last updated: