- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
A company associate (plaintiff) – Complaint Upheld (Belgium, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A company associate won a complaint against the Belgian federal public service for refusing to erase unnecessary personal data. The notary mistakenly published private information, and the public service argued it couldn't be erased due to legal obligations. This case shows that even legal requirements must respect individuals' privacy rights.
What happened
A complaint was upheld against the Belgian federal public service for not erasing unnecessary personal data published by a notary.
Who was affected
The company associate whose personal bank account number was published without consent.
What the authority found
The Belgian data protection authority ruled that the public service could be held accountable for processing unnecessary data.
Why this matters
This case reinforces that legal obligations do not exempt organizations from protecting individuals' privacy. Companies must ensure that only necessary data is processed, even when required by law.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Entities Involved
Source checks
Linked-source text retrieved.
Automated check recorded — 23 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The plaintiff, an associate in a limited company, had decided with their co-associate to reduce their company's capital, for which a publication in the Belgian State Journal (Moniteur belge) is an obligation under the Belgian corporate law. The notary mandated by the associates to do the publication in their name not only informed about the reduction of capital but also mistakenly indicated the amount reimbursed to the associates as well as their personal bank account number. The plaintiff asked the notary to proceed to the erasure of these complementary and in their eyes unnecessary information. Following this, the notary requested that the Belgian federal public service (SPF, the defendant), responsible for the journal, erased the plaintiff's data of whom he acted on behalf of. The request was met with a refusal, the SPF mostly arguing that whatever the data published, since they were linked to publication required by the law, they could not be erased. After further exchanges and with the SPF still refusing to erase the concerned data, the plaintiff lodged a complaint with the Belgian DPA, mainly claiming that the SPF had no actual legal basis pursuant to Article 6 GDPR for processing the litigious data. Can a legal obligation under national law justify the processing of data that may be unnecessary for the intended purposes of the processing? Before giving its decision on the question in dispute, the Belgian DPA reminded the defendant that the plaintiff's notary's mistake of publishing unnecessary data, was no reason for justifying that the defendant should not be held liable for a possible unlawful processing, as the SPF argued. A data controller always being accountable for the data they process, no matter in what way obtained, the liability of the defendant could indeed also be sought in this case. Thereupon, the DPA states that even if the publication was an obligation under the applicable corporate law and the data processing herewith found its legal
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for A company associate (plaintiff) in BE
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
23 March 2021
Authority
Autorité de Protection des Données
About this data
Cite as: Cookie Fines. A company associate (plaintiff) - Belgium (2021). Retrieved from cookiefines.eu
Last updated: