DPA case 75/2026 – Dismissed (Belgium, 2026)

A parent (the legal representative) filed a complaint with the Belgian DPA (APD) for the alleged unlawful transfer of his children’s (the data subjects) personal data by an insurer (the controller) to another insurance provider. The controller previously informed the parent of the termination of his children’s hospitalisation insurance with a third party taking over the policy. The parent requested more information on the new provider, as well as the legal basis for the transfer and the reason for not being informed of the change via email at a later date. A representative of the controller responded that the mother of the children wished to take over the policy following a conversation with customer service which led the customer service employee to erroneously believe that both parents made the decision to terminate the policy. The parent requested the revocation of the policy cancellation and a representative of the controller informed him the same day that they reinstated the policy. During prima facie proceedings, the DPA dismissed the complaint, deciding not to proceed further with a hearing on the merits due to insufficient evidence and lack of significant social and/or personal impact. The DPA first found that the evidence was not sufficient for it to reach a decision on whether an infringement of the GDPR occurred. Subsequently, it analysed if the case raised any significant societal or personal impact issues, in line with its dismissal policy proceedings which require an assessment to identify high-risk processing operations. It held that the alleged personal data processing activity did not fall within any of the cases in Article 35(3) GDPR (cases in which a data protection impact assessment is particularly required), therefore considering that the criteria for a significant societal or personal impact did not apply in this situation. Furthermore, the DPA made note that the transfer of personal data without consent did not take place. Therefore, t