DPA case 11/2026 – Complaint Upheld (Belgium, 2026)

The data subject is an employee of an entity that sponsors a second division football club (the controller). The data subject obtained tickets via his employer to attend a football match. However, the data subject’s ticket was cancelled due to him being registered as a supporter of the rival football club according to the information communicated by the controller’s ticket and security manager. Following an inquiry from the data subject, the controller specified that it obtained the information from the police. The controller argued that the football match was considered high-risk and, thus, it had to submit the ticket list to the local police in order to check that no supporters of the rival football club would be seated among the home supporters for safety reasons. The controller forwarded the data subject’s name and date of birth to the local police for verification. The controller claimed that it relied on Article 6(1)(c) GDPR and Article 6(1)(e) GDPR as legal bases for the transmission of personal data. The controller invoked Article 10 §1, 4° of the Belgian Law on Safety at Football Matches of December 21, 1998. The data subject filed a complaint with the DPA regarding the transfer of his personal data to the police and from the controller to his employer. Firstly, the DPA noted that the information provided by the controller to the data subject’s employer went beyond what was necessary for informing them of the cancellation of the ticket. Therefore, the DPA found that the controller was at risk of violating Article 5(1)(c) GDPR. Secondly, the DPA pointed out that the controller must designate a single legal basis prior to the processing activity. Moreover, the DPA found that the article of the Football Act invoked as a legal obligation by the controller did not require a specific processing of personal data and cannot form a legal basis under Article 6(1)(c) GDPR. Alternatively, regarding the potential legal basis under Article 6(1)(e) GDPR, among o