DPA case 81/2024 (educational institution) – Warning (Belgium, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An anonymised school received a preliminary warning after a job applicant’s confidential correspondence was exposed on its Smartschool system. Possible unlawful sharing of his application was also examined. No fine or final merits finding was issued.
What happened
The complaint concerned publication of a rejection decision and suspected onward sharing of an application; the director’s exact selection role was not yet verified.
Who was affected
The respondent was an anonymised educational institution. The applicant was the complainant; Smartschool was the system used.
What the authority found
The Chamber warned of possible breaches of Articles 6(1), 5(1)(f) and 25. The order was prima facie and subject to merits reconsideration or appeal.
Why this matters
A preliminary warning must retain its provisional status and must not identify a software platform as the sanctioned controller merely because the school used it.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Review needed — 18 October 2026.
Processing notes: articles corrected, national law identified, date discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 24 May 2024 the Belgian DPA’s Litigation Chamber issued decision 81/2024, DOS-2023-04145, issuing a prima facie warning to an anonymised educational institution. A rejected job applicant complained that confidential rejection correspondence was published on the school’s Smartschool system, allegedly accessible to about 150 staff, and that his motivation letter or CV was shared with a director outside the selection committee. The director’s exact involvement could not yet be verified. On the initial record the Chamber identified possible lack of an Article 6(1) lawful basis, breach of confidentiality under Article 5(1)(f), and insufficient safeguards under Article 25. The operative box on page 6 warns under Article 58(2)(a) GDPR and Article 95(1)(4) WOG; it is expressly a preliminary decision, not a decision on the merits or a fine. The institution could request merits reconsideration within 30 days of notification, or appeal. The school is the respondent; Smartschool is the system used, not an identified sanctioned platform provider. No later finality or appeal outcome is established.
Outcome
Warning
A formal warning issued by a DPA without a monetary penalty.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 81/2024 (educational institution) in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 81/2024 (educational institution) - Belgium (2024). Retrieved from cookiefines.eu
Last updated: