Stad Antwerpen (City of Antwerp) – Reprimand (Belgium, 2023)

On 11 December 2023 the Belgian DPA’s Litigation Chamber issued decision 165/2023, DOS-2022-02499, reprimanding Stad Antwerpen (City of Antwerp) concerning the MeldJeAan school-enrolment system. The publicly downloadable school list described in the background concerned the Ghent secondary-school system; Antwerp used the application for primary-school admissions and faced the same security risk, but the Chamber did not establish an actual Antwerp data breach in this decision. Antwerp was a joint controller together with AGODI and the school boards because its funding decisions and processor agreement converged with their decisions on the system. The Chamber found failures to document and demonstrate risk-appropriate security under Articles 5(1)(f), 32(1) and 32(2), read with 5(2), 24(1) and 25(1); inadequate impact assessment under Articles 35(1), 35(2), 35(3) and 35(7); and historical failures to involve the DPO under Articles 38(1) and 39(1). It did not find that the absence of a handwritten signature alone breached those provisions, and rejected the Article 30(1) processing-register allegations. The operative order imposes a reprimand under Article 100(1)(5) WOG and dismisses the remaining allegations. It does not impose a fine or a fresh compliance order: the city had already demonstrated remedial steps, and Belgian law excluded administrative fines against the public body. MeldJeAan is the application, not a separately sanctioned legal person. The source’s appeal notice does not establish later finality or an appeal outcome.