parent – Complaint Upheld (Belgium, 2025)

A complaint was filed on May 18, 2022, by a parent (the complainant) against a school (the respondent) for conducting an online survey about drug and alcohol use, gaming, and gambling among minor students. The complainant argued that the data was not processed anonymously and that his daughter's data was processed without the required free, informed consent. Parents were informed that their children would participate in an online survey about drug and alcohol. In case parent did not want their children to participate they could opt out. One of the parents requested more information and was invited to the school for a meeting. The school claimed that as the survey was anonymously GDPR was not applicable. Additionally the school claimed they were not organizing the survey but the knowledge center Z was On May 18, 2022 the parent filed a complaint with the DPA against the school and the knowledge center for following Consent: The complainant claimed that the data of his daughter was processed without obtaining the required free, informed consent. This was particularly concerning because the survey involved processing sensitive health information, which requires explicit consent. Controller identification: The school was the data controller and failed to ensure anonymous data processing and proper consent, the knowledge center was a joint controller. Lack of Anonymity: The complainant argued that the data collected was not processed anonymously. This, according to the complainant, violated the principle of minimal data processing. The DPA only proceeded with action against the school not the knowledge center. The school argued that the data was anonymous and thus GDPR was not applicable. If GDPR would be applicable they (the school) were not the data controller, but rather the expertise center Z was responsible. The litigation chamber determined that the school was indeed the data controller as per the Codex Secondary Education. The school was responsible for ensuri