DPA case 154/2025 – Complaint Upheld (Belgium, 2025)

In February 2025, the data subject received an email from the controller regarding a satisfaction survey. The data subject discovered that the e-mail addresses of approximately 450 individuals and companies, as well as his own e-mail address, were visible in the "cc" field of the e-mail. The controller performed a risk analysis and concluded that a notification to the DPA was not required but informed the affected data subjects by email. The data subject then lodged a complaint with the DPA complaining about this data breach. The controller claimed that even though it had an appropriate program for sending such emails and had established procedures for its employees to follow but the e-mail giving rise to the complaint was sent without regard to internally established procedures. According to the controller, this incident was the result of an individual error by an employee who did not follow internal procedures. The DPA held that the fact that such a personal data breach occurred implies that the technical and organisational measures that the controller had in place may have been insufficient to avoid such a breach. Nevertheless, it found that this breach did not meet the criteria of high general or personal impact to the affected data subjects. It issued a warning to the controller for the violation of Article 5(1)(f), Article 25 GDPR and Article 32 GDPR. The DPA issued a prima facie decision according to a procedure prior to the decision on the merits, in order to inform the controller that it may have committed a breach of the provisions of the GDPR and to give it the opportunity to comply with the aforementioned provisions.