DPA case 188/2025 – Complaint Upheld (Belgium, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A municipality was found to have accessed personal data from the National Register without proper justification. The Belgian Data Protection Authority upheld a complaint regarding this unauthorized access. This case highlights the need for public institutions to follow strict data access protocols.
What happened
A municipality accessed personal data from the National Register without a valid reason.
Who was affected
The personal data of individuals, including the complainant and their mother, was affected by the municipality's actions.
What the authority found
The DPA upheld the complaint, indicating that the municipality's actions were not justified under data protection rules.
Why this matters
This case serves as a reminder for public authorities to adhere to data protection standards. It emphasizes the importance of having clear protocols for accessing personal data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 4 February 2020, the data subject filed a complaint with the Belgian DPA (APD) on their own behalf and on behalf of their mother, against a municipality (the controller) for the alleged unlawful consultation of their personal data from the National Register by employees of the controller. The Belgian National Register contains information relating to over 11 million individuals. The first consultation of the National Register took place on 3 December 2019 and concerned personal data relating to the data subject’s mother. The controller informed the data subject that it was considering disciplinary proceedings against the employee who consulted the data for private purposes. The second consultation took place on 16 December 2019. The employee who carried out this consultation allegedly intended to check the passport photo of the data subject in order to recognise them if they visited the municipal administration. The controller informed the data subject of these facts and mentioned that it was considering disciplinary proceedings against the employee once the employee was identified. Furthermore, the controller assured the data subject that further measures would be put in place to prevent such incidents from repeating. At the time of the consultations, one of the relevant applications used by the controller in its activity, SAPHIR, provided only for the possibility to record a generic reason for consultations of the National Register. A requirement to record specific reasons for carrying out such consultations was introduced following the events of the case. No other control mechanism over the consultations carried out by employees was in place at the time of the events. Moreover, according to the controller’s DPO, another application, Belpic (used for the purpose of issuing identity documents), did not require the indication of the purpose of the consultation and did not allow the municipal authority to control access to it. The data subject filed a compla
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 188/2025 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 188/2025 - Belgium (2025). Retrieved from cookiefines.eu
Last updated: