DPA case 200/2025 – Complaint Upheld (Belgium, 2025)

The data subject was an employee of controller (1) between 1 June 2015 and 14 November 2016. In 2020, the data subject applied for a job at a non-profit organisation (controller 2). Controller 2 informed the data subject that the organisation was not moving forward with them as a candidate, mentioning a conversation with a manager of controller (2) about the data subject's managerial experience. Following the access request submitted by the data subject on 8 July 2020, controller (1) provided general information regarding personal data processing within the company and did not attach a copy of the requested data. Instead, it asked for further explanations regarding the access request previously submitted.   The data subject made an access request to controller (2) as well but did not receive a response within one month. The data subject lodged a complaint with the DPA against controller (1) since they were unsatisfied with the response received among other things. They also lodged a complaint against controller (2) concerning, among other things, the failure to respond in a timely manner to their access request and unlawful processing of their personal data. The DPA decided to join the complaints of the data subject against controller (1) and against controller (2).   The DPA issued a reprimand to controller (1) for the infringements of Article 6(1) GDPR, Article 12(2)-(4) GDPR, Article 15(1) and (3) GDPR. The DPA also issued a reprimand to controller (2) for the infringement of Article 12(3) GDPR. With regard to controller (1), first the DPA found that it violated Article 6(1) GDPR by processing personal data without a legal basis when providing controller (2) with information on the data subject without the data subject’s consent. The DPA pointed out that the transfer of personal data during an oral phone conversation constitutes processing of personal data (Endemol Shine Finland). Furthermore, since controller (1) knew or should have known that controlle