DPA case DOS-2026-00228 – Violation Found (Belgium, 2026)

A company (controller) sent a data subject an email with a formal notice attached to it. The email was sent to the data subject’s work email address, with a third-party email address listed as recipient in the cc field. The data subject asked the controller for the identity of the third party. The controller answered that the request would be addressed as soon as possible. On another occasion, the controller sent the data subject an email with a payment notice via the data subject’s work email address. Again, the third-party email address was listed as recipient. The data subject asked again for the disclosure of the third party’s identity, and, for an explanation as to where the controller has obtained the data subject’s work email address from. The controller did not respond. The controller sent another two emails with a reminder concerning non-compliance with a payment plan and a pre-seizure statement of account to the data subject and, again, to the third-party email address. The controller started an internal investigation into the matter and deleted the third-party email address. In the course of the communication, amongst other data, the data subject’s name, home address and car licence plate number were revealed to the third party. The data subject lodged a complaint with the DPA on the grounds of improper use of their work email address and the disclosure of their personal data to the third-party recipient. Moreover, they requested information regarding the third party involved in their communication, the erasure of their work email address and that none of their personal data be transmitted to the third party. The controller demonstrated that the data subject has initiated contact with them via their work email address. The disclosure of the data subject’s data to the third party resulted from an erroneous manual data entry that led to the data subject being associated with the third-party email address in the controller’s debtor record. Th