- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 01/2026 – Complaint Upheld (Belgium, 2026)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A former employee found that their work email addresses were still active nearly two years after leaving the job. The Belgian Data Protection Authority ruled that the company had no valid reason to keep processing this personal data, which is important for protecting people's privacy after they leave a job.
What happened
The company continued to process the former employee's professional email addresses without a valid legal reason.
Who was affected
The former employee whose professional email addresses were still active after leaving the company.
What the authority found
The Belgian Data Protection Authority decided that the company violated GDPR by processing the former employee's data without a legitimate interest.
Why this matters
This case highlights the importance of properly deleting personal data when it is no longer needed. Companies should ensure they have a valid reason for keeping any personal data, especially after an employee leaves.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A former employee (the data subject) discovered in 2021 that their two professional email addresses were still active almost two years after leaving their former place of work (the controller). The controller specified that the measure was necessary for the technical functioning of the email infrastructure and that it took sufficient technical measures to ensure to protection of the data subject's personal data. Moreover, the controller rejected the data subject’s request to access the email accounts. The data subject filed a complaint with the Belgian DPA. The DPA found that the controller violated Article 5(1)(a) GDPR and Article 6(1)(f) GDPR by processing the data subject’s professional email addresses without a legitimate interest, and, therefore, also without a legal basis. The DPA noted that for a reasonable period of time the controller had an interest in this processing in order to ensure the functioning of the company. However, after that point in time, the DPA found that the controller based its processing on a new legitimate interest, specifically the avoidance of cluttering up its servers. However, the DPA considered the processing unnecessary in this case. Furthermore, the DPA found that the controller violated Article 15 GDPR by not allowing the data subject to access the email addresses while they were still active. Finally, the DPA found a violation of Article 17(1) GDPR due to the failure of the controller to delete all of the data subject’s personal data. Therefore, the DPA issue a reprimand to the controller.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 01/2026 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 01/2026 - Belgium (2026). Retrieved from cookiefines.eu
Last updated: