DPA case 91/2025 – Violation Found (Belgium, 2025)

The data subject was a customer of a group of daycare centers in Belgium (the Company). The Company entered into an agreement with a debt collection agency (the Agency) to recover outstanding debts. The Company and the Agency are controllers of personal data. In 2016, the Company sent to the data subject an invoice that remained unpaid, and then transferred it to the Agency. In February 2017, the Agency addressed the data subject to demand the payment of the outstanding invoice. The data subject responded that the Company’s claim was unfounded and therefore the Agency had no legal basis to further process his data. In June 2018, the Company acknowledged that an invoicing error is at the origin of the claim, waived the outstanding amount and informed the Agency accordingly. The data subject requested the erasure of his personal data. Then, the Agency informed the data subject that it had removed all of their data from its database. Nevertheless, the Agency pseudonymised the personal data rather than erasing them. In September 2018, the Agency sent 2 new payment requests to the data subject for the payment of the outstanding invoice. According to the Agency, the requests were sent accidentally because of a technical and a human error in the deletion process. In October 2018, the data subject filed a complaint with the DPA (Autorité de protection des données-APD/Gegevensbeschermingsautoriteit-GBA). In November 2018, the DPA initiated investigations on the matter against both controllers. For the Company: First, the DPA noted that the Company’s privacy notice did not provide information about the processing activity in the context of the collection of unpaid invoices and that information on dept collection agencies was missing from the categories of recipients. The DPA held that it could not be assumed that data subjects already had the information in question. Based on the foregoing, the DPA found that the Company violated Article 12(1) and Article 13 GDPR.