DPA case 07/2021 (accounting provider and former notarial associate) – Processing Ban (Belgium, 2021)

On 29 January 2021 the Belgian DPA’s Litigation Chamber issued decision 07/2021, DOS-2019-06201, concerning two separately responsible anonymised controllers. An accounting provider (Y1) accidentally sent a complainant’s personal-company accounting information in an email with 32 attachments to her former notarial associate (Y2); Y2 then forwarded it to his lawyer for use in their dispute. The Chamber reprimanded Y1 for incompatible further processing, lack of a lawful basis and excessive disclosure under Articles 5(1)(b) and 6(4), 5(1)(a) and 6(1), and 5(1)(c) GDPR. It permanently prohibited Y2’s processing of the email and attachments and ordered him to notify his lawyer of that prohibition, after finding no lawful basis under Articles 5(1)(a) and 6(1). Joint controllership was not established. On the evidence in this particular case it did not establish infringements of the access right or Articles 32 and 33, and imposed no administrative fine. This merits decision followed the Market Court’s annulment of an earlier insufficiently reasoned dismissal; the original source does not establish a later appeal outcome or legal finality. The decision does not state that all disclosure to a lawyer is unlawful: the finding concerns these data, circumstances and absence of an Article 6 basis.