DPA case 158/2025 – Complaint Upheld (Belgium, 2025)

The data subject, formerly the managing director of the controller’s company, left their position, but the controller failed to deactivate their professional email account and company mobile number. The data subject later complained to the Belgian Data Protection Authority (GBA/APD), claiming that personal communications linked to these accounts remained accessible. The controller argued that the phone number was company property and that the email account was due to be closed. The Litigation Chamber admitted the complaint. The GBA/APD found that the controller violated multiple GDPR provisions by failing to deactivate the data subject’s professional email account and company phone number after the termination of employment. Continuing to process these data without an automatic response, prior notice, or consent breached the purpose limitation principle under Article 5(1)(b) GDPR, as the data were no longer used for the professional purposes for which they were collected. The prolonged retention also violated data minimisation and storage limitation under Articles 5(1)(c) and 5(1)(e) GDPR, as retaining the data far exceeded what was necessary. The controller also failed to inform the data subject, contrary to Articles 12 and 13 GDPR, while ignoring his request to delete the data contained in his phone thus violating their right to erasure in Article 17 GDPR. Finally, there was no lawful basis for continuing to process the email account or phone number after employment ended, because the contractual purpose ended with the employment and no alternative legal ground, such as consent or legitimate interest, was established, thus violating Articles 5(1)(a) and 6(1) GDPR. Considering the controller’s cooperation and that the company was in liquidation, the GBA/APD issued a reprimand rather than a fine.