X (the data subject) – Complaint Upheld (Belgium, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Belgian service provider published a person's invoice on Facebook, revealing their name and address, without a valid reason. The Belgian data protection authority upheld the complaint, noting the company didn't have a legal basis to share this personal information. This case shows the importance of respecting privacy when sharing customer data online.
What happened
A service provider published an invoice with a person's name and address on its Facebook page without a valid legal basis.
Who was affected
The individual whose invoice, including their name and address, was posted on Facebook by the service provider.
What the authority found
The Belgian DPA found that the service provider lacked a valid legal basis for publishing the invoice with personal information.
Why this matters
This decision emphasizes the need for businesses to ensure they have a lawful reason before sharing personal data online. It serves as a warning to companies to carefully consider privacy implications when posting customer information on social media.
GDPR Articles Cited
Entities Involved
A service provider (controller) published an invoice on its Facebook page which contained the data subject's first, last name, and address. Although it was not clearly specified in this preliminary decision, it seemed like there was a dispute between the data subject and the controller regarding payment(s), where the controller published the invoice to illustrate the tariffs it applied. The data subject filed, among the others, a complaint with the local police office claiming GDPR violations. Following this, the controller only removed the postal address on the invoice, but did not delete the last name and first name. The controller also blocked the data subject from accessing the Facebook page of the controller. On 19 July 2022, the data subject filed a complaint with the Belgian DPA to raise the refusal of the controller to comply with her erasure request. The DPA stated that an invoice obliges the controller to collect certain basic information about the data subject. The invoice has to include first names, surnames, e-mail, billing address, delivery address as well as the content of the purchases and/or the service (Article 4(1) GDPR). It also stated that the controller was a service provider and had to comply with requests made by data subjects under Articles 15 to 22 GDPR. The DPA also determined that even after the data subject previous complaint, one at the police and one at the Conseil Régional Francophone, the first name and last name of the data subject were still visible on the Facebook page on 3 October 2022. The invoice itself was still published on the controller’s Facebook page. The name of the data subject also still appeared in some of controller’s commentary included with this Facebook post. The DPA considered that for the processing in question (the publication of the invoice with the name of the data subject) the controller did not meet any of the conditions for lawfulness of processing (Article 6 GDPR). For the sake of completeness, the DPA
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for X (the data subject) in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. X (the data subject) - Belgium (2022). Retrieved from cookiefines.eu
Last updated: