- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
CIBES vs Vivalia – Court Ruling (Belgium, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
CIBES challenged Vivalia's decision to award a contract for processing patient data. The Council of State ruled that Vivalia must verify proposals to ensure they meet GDPR standards. This ruling emphasizes the importance of proper checks before awarding public contracts involving personal data.
What happened
CIBES contested Vivalia's contract award for processing patient data due to concerns over data protection compliance.
Who was affected
Patients whose data would be processed by the contractor selected by Vivalia.
What the authority found
The Council of State decided that Vivalia needed to verify that the selected contractor could process data in compliance with GDPR before awarding the contract.
Why this matters
This case highlights the need for public authorities to conduct thorough checks on contractors handling sensitive data. It sets a precedent for ensuring compliance with data protection regulations in public procurement.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 21 March 2026.
Processing notes: articles corrected, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
VIVALIA, a public network of hospitals, launched a call for proposals to find a contractor to process patient data of hospitals for statistical purposes. The public contract was awarded to 3M Belgium, a Belgian company that had been in the news for allegedly transferring data to the US and Russia without appropriate safeguards. On this basis, a spin-off of the UC Louvain (CIBES), which also took part in the public procurement procedure, challenged VIVALIA's decision before the Council of State. The Council of State considered that, before awarding a public contract, the public authority ought to make the necessary verifications regarding the submitted proposals and to correctly motivate the reasons why it could consider that the selected proposal presented the "sufficient guarantees" to consider that the entrusted data and information would be processed in compliance with the GDPR. The decision to award the contract was suspended, without the Council of State examining whether or not the two bidders (CIBES & 3M) complied with the GDPR.
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for CIBES vs Vivalia in BE
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
6 May 2022
Authority
DPA CouncilofState
About this data
Cite as: Cookie Fines. CIBES vs Vivalia - Belgium (2022). Retrieved from cookiefines.eu
Last updated: