APD/GBA (Belgium) - 133/2025
From GDPRhub
| APD/GBA - 133/2025 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 12(1) GDPR Article 14(1) GDPR Article 14(2) GDPR Article 15(1)(g) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 19.08.2025 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 133/2025 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | Gegevensbeschermingsautoriteit (in NL) |
| Initial Contributor: | Le |
The DPA reprimanded a politician for collecting a data subject’s email address from a public source and sending them political marketing, in violation of the principles of lawfulness, purpose limitation and transparency.
English Summary
Facts
The controller is a member of the Flemish Parliament and alderman in a municipality.
On April 2024, in the context of an election campaign, he sent by e-mail a request to the data subject for cooperation in his political campaign. On May 2024, the data subject asked the controller how he had obtained her personal data. He responded that he had collected it online in the course of his contact with OKRA, an association of seniors in Flanders and Brussels.
On 21 May 2024, the data subject lodged a complaint with the DPA (Autorité de protection des données/Gegevensbeschermingsautoriteit - APD/GBA) concerning the unlawfulness of the processing of her personal data for the purpose of sending election advertising and the insufficient compliance with her right of access.
The controller claimed that he had collected the email address from a publicly available source, the website of the municipality. The purpose of the data collection was to invite her to a tour of the Flemish Parliament, in her capacity as a representative of the Family Federation Division. Her email address was included by mistake in a mailing list for political communication.
Holding
First, the DPA held that the controller violated the principle of lawfulness (Article 5(1)(a) GDPR) for sending political marketing to the data subject without her consent. The sending of emails for the purpose of political marketing, constitutes direct marketing and can only be authorised if the data subjects have given their consent.
Second, it found that the controller violated the principle of purpose limitation (Article 5(1)(b) GDPR) for collecting data from a public source and using it for electoral purposes. The controller initially collected her email address for the purpose of inviting her to the tour, but but proceeded with using it for political marketing. The DPA highlighted that this processing was beyond the original purpose of the collection, it was incompatible with the initial data processing, and cound not rely on its own legal basis.
Third, the DPA held that the controller also failed to comply with his transparency and information obligations under Article 5(1)(a) GDPR, Article 12(1) GDPR, Article 14(1) GDPR and Article 14(2) GDPR because the information it provided to the data subject was incomplete.
Lastly, the DPA ruled that the controller violated Article 15(1)(g) GDPR for communicating incorrect information about the source of the data subject's personal data, in response to her access request. The controller did not collect her data from OKRA but from the website of the municipality.
For the above violations, the DPA decided to reprimand the controller.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/10
Dispute Resolution Chamber
Decision on the merits 133/2025 of 19 August 2025
File number: DOS-2024-02607
Subject: Processing of personal data for election advertising
The Dispute Resolution Chamber of the Data Protection Authority,
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of
personal data and on the free movement of such data, and repealing
Directive 95/46/EC (General Data Protection Regulation), hereinafter "GDPR";
Having regard to the Act of 3 December 2017 establishing the Data Protection Authority,
hereinafter "WOG"; In view of the internal rules of procedure, as approved by the House of Representatives on 20 December 2018 and published in the Belgian Official Gazette on 15 January 2019;
In view of the documents in the case;
Has made the following decision regarding:
The complainant: X, hereinafter "the complainant"
The defendant: Y, hereinafter "the defendant"
Decision on the merits 133/2025 — 2/10
I. Facts and procedure
1. The defendant is a member of the Flemish Parliament and alderman in the municipality of Z1. On 29 April 2024, as part of an election campaign, he sent an email request to the complainant for cooperation in his political campaign.
On 9 May 2024, the complainant contacted the defendant to inquire about the origin of her personal data. On May 10, 2024, the respondent responded to the complainant's request. He stated that he had collected the complainant's personal data online in the context of his contact with
OKRA1.
2. On May 21, 2024, the complainant filed a complaint with the Data Protection Authority against
the respondent. The subject of the complaint concerns the unlawful processing
of her personal data for the purpose of sending election advertising and the
inadequate compliance with her right of access.
3. On June 25, 2024, the complaint was declared admissible by the First Line Service on the basis
of Articles 58 and 60 of the Dutch Data Protection Act (WOG) and, pursuant to Article 62, § 1 of the WOG,
the complaint was transferred to the Dispute Resolution Chamber. 4. On August 13, 2024, the parties involved will be notified by registered mail of the provisions referred to in Article 95, § 2, as well as those in Article 98 of the Dutch Convention on the Protection of Judicial Conduct (WOG). They will also be notified, pursuant to Article 99 of the WOG, of the deadlines for submitting their defenses.
5. On September 4, 2024, the Dispute Resolution Chamber will receive the defendant's statement of defense. The defendant will indicate that it wishes to avail itself of the opportunity to be heard, in accordance with Article 98 of the WOG.
6. The Dispute Resolution Chamber will not receive any statements of defense from the complainant, nor any statement of reply from the defendant.
7. On May 14, 2025, the parties will be notified that a hearing will take place.
8. On July 15, 2025, the defendant will be heard by the Dispute Resolution Chamber. The complainant reports
on June 7, 2025, that she needs an apology.
9. On July 16, 2025, the minutes of the hearing are submitted to the respondent.
10. On July 16, 2025, the Dispute Resolution Chamber receives some comments from the respondent
regarding the minutes, which it decides to include in its deliberations.
1 OKRA meeting point 55+ vzw
Decision on the merits 133/2025 — 3/10
II. Reasons
11. In its letter of 13 August 2024, the Litigation Chamber determined that the scope of
this case concerns the principles of lawfulness (Articles 5.1.a) and 6.1 GDPR) and purpose limitation (Article 5.1.b GDPR), transparency and information obligations
(Articles 5.1.a), 12, 13 and 14 GDPR), the rights of access (Article 15 GDPR) and objection (Article 21.2 GDPR), and the use of email for direct marketing purposes without prior
consent (Article XII.13, §1 Code of Economic Law2).
II.1. Position of the defendant
12. In its submissions of 4 September 2024, the defendant provides further explanation
regarding the circumstances of the data processing. The defendant states that,
in the context of his duties as a Flemish Member of Parliament, he wrote to several
associations to inform them about possible subsidies and to invite them to a tour of the Flemish Parliament. He collected the relevant email addresses
from publicly accessible sources, in this case the website of the municipality of
Z2. In this context, the defendant contacted the
complainant on March 31, 2023, in her capacity as representative of the Gezinsbond Afdeling W.
13. The defendant states that the email, due to the invitation to a visit to the Flemish
Parliament, was incorrectly classified as political in nature.
Because of this classification, the complainant was added to a mailing list for political
communication. The defendant states that he has since removed the complainant from this mailing list and that he is taking measures to
avoid such errors in the future. 14. On May 9, 2024, the complainant asked the defendant for an explanation regarding the
origin of her contact details. The defendant replied that same day that he had
contacted OKRA to invite them to a visit to the Flemish
Parliament, and that he had "presumably" obtained her email address in that context. In his
subsequent submissions, the defendant acknowledges that this information was incorrect and
attributable to a mistake.
15. The defendant states that he contacted the complainant by telephone to offer his
apologies. According to the defendant, these apologies were accepted by the
complainant.
2 The letter of August 13, 2024, incorrectly referred to Article VI.110 of the Code of Economic Law, while
Article XII.13, §1, of the Code of Economic Law was intended. Decision on the merits 133/2025 — 4/10
II.2. Judgment of the Litigation Chamber
II.2.1. The principles of lawfulness (Articles 5.1.a) GDPR and 6.1 GDPR) and
purpose limitation (Article 5.1.b) GDPR) and the use of email for direct marketing purposes without prior consent
16. Article 5.1.a) GDPR stipulates that personal data must be processed
lawfully, fairly, and transparently in relation to the data subject ("lawfulness,
fairness, and transparency"). Article 6.1 GDPR specifies that processing is
lawful only if and to the extent that at least one of the conditions in Articles 6.1.a) –
f) GDPR is met.
17. Political messages directed at individuals, such as in the present case, fall under the broad
definition of "direct marketing"3. Recital 47 of the GDPR states that "The processing of personal data for direct marketing purposes may be considered to be carried out for a legitimate interest." This means that processing necessary for the purposes of the legitimate interests pursued by a political party or candidate is a priori lawful, provided that the interests or rights and freedoms of the data subject do not override these interests.
18. In the present case, however, the defendant sent the political letter by email. Consequently, additional rules apply to sending digital direct marketing, namely Article 13 of the ePrivacy Directive. In Belgium, this provision has been transposed into Article XII.13, §1 of the Code of Economic Law. Save for legal exceptions, the use of email for direct marketing purposes is only permitted if the data subjects have given their consent. This
implies that, regardless of other possible legal grounds under Article 6.1 GDPR, in the present case, only consent could be considered as a legal basis.
3 See Memorandum on elections of August 2024 (available at <
https://www.gegevensbeschermingsautoriteit.be/publications/nota-inzake-de-verwerking-van-persoonsgegevens-in-het-
kader-van-de-verkiezingen.pdf >), page 2; and Recommendation 01/2025 of 17 January 2020 on the processing of
personal data for direct marketing purposes (available at <
https://www.gegevensbeschermingsautoriteit.be/publications/aanbeveling-01-2025-over-de-verwerking-van-persoonsgegevens-bij-direct-marketing.pdf >)
4 Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 on the processing of
personal data and the protection of privacy in the electronic communications sector (Directive
on privacy and electronic communications)
5 Note on the August 2024 elections (available at <
https://www.gegevensbeschermingsautoriteit.be/publications/nota-inzake-de-verwerking-van-persoonsgegevens-in-het-
kader-van-de-verkiezingen.pdf >); Recommendation 01/2025 of 17 January 2020 on the processing of
personal data for direct marketing purposes (available at <
https://www.gegevensbeschermingsautoriteit.be/publications/aanbeveling-01-2025-over-de-verwerking-van-
persoonsgegevens-bij-direct-marketing.pdf >); Article 13.1 of Directive 2002/58/EC of the European Parliament and of the Council
of 12 July 2002 on the processing of personal data and the protection of privacy in the
electronic communications sector (Directive on privacy and electronic communications):
“1. The use of automated calling systems without human intervention (automatic calling machines), fax machines, or e-mail for the purposes of direct
marketing may only be permitted in relation to subscribers who have given their prior consent.” Decision on the merits 133/2025 — 5/10
However, the documents in the file show that no such
consent was given by the complainant.
19. In addition, Article 5.1.b) GDPR stipulates that personal data must be collected for specified,
explicit, and legitimate purposes and
may not subsequently be further processed in a way incompatible with those purposes ('purpose limitation'). Processing personal data for purposes
other than those for which the personal data were initially collected is permitted under the
GDPR only if the processing is compatible with the purposes for which the
personal data were initially collected. In this case, this means that when assessing
whether or not the intended direct marketing activity was lawful,
it had to be examined whether or not this further processing was compatible with the
original purpose for which the data were collected. There is
incompatibility between further processing and the initial data processing if
political parties or candidates consult a public source and thus
collect electronic contact details, which they then use for electoral
purposes.
20. In this case, the defendant states that he collected the complainant's email address via the website of the municipality of Z2. He initially did this to write to her on March 31, 2023, in her capacity as a representative of the Gezinsbond Afdeling W.
According to the defendant, this email was incorrectly classified as a political email. Because of this classification, the complainant was added to a mailing list for political communication. This oversight resulted in the processing of the complainant's personal data that fell outside the original purpose of the collection of the personal data and could not rely on its own legal basis. The defendant emphasizes that this processing was caused by an error. 21. The Dispute Resolution Chamber finds that the defendant violated the principle of
lawfulness (Articles 5.1.a) and 6.1 GDPR) by sending direct marketing to the
complainant without the complainant's consent, and violated
the principle of purpose limitation (Article 5.1.b GDPR) by collecting and using data from a public source
for electoral purposes.
6Note on the August 2024 elections (available at <
https://www.gegevensbeschermingsautoriteit.be/publications/nota-inzake-de-verwerking-van-persoonsgegevens-in-het-
kader-van-de-verkiezingen.pdf >)
7 See also Decision on the merits 35/2020 of 30 June 2020, paragraphs 24-25
Decision on the merits 133/2025 — 6/10
II.3. Transparency and Information Obligations (Articles 5.1.a), 12, 13, and 14 GDPR)
22. Based on the transparency obligation in Article 5.1.a) GDPR, as further specified in
Articles 13 and 14 GDPR, every person whose personal data are processed,
depending on whether the data are collected directly from them or from third parties,
must be informed of the elements listed in those articles. When the
data are collected directly from the data subject, they shall be informed
of the elements listed in Articles 13.1 and 13.2 GDPR. Similar elements are listed in Articles 14.1 and 14.2 GDPR, with the understanding that Article 14 GDPR
concerns data collected not directly from the data subject,
but from third parties. This information must be provided to the data subject pursuant to Article 13 or Article 14 of the GDPR in the manner specified in Article 12 of the GDPR.
23. In the present case, it is established that the personal data processed by the defendant were not collected directly from the complainant. Consequently, only Article 14 GDPR applies, the first two paragraphs of which set out the information to be provided to data subjects:
“1. Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:
a) the identity and contact details of the controller and, where applicable,
of the controller's representative;
b) the contact details of the data protection officer, where applicable;
c) the purposes of the processing for which the personal data are intended and the legal basis for the processing;
d) the categories of personal data concerned;
e) the recipients or categories of recipients of the personal data, where applicable;
f) where applicable, that the controller intends to transfer the personal data to a recipient in a third country or to an international
organization; the existence or absence of an adequacy decision by the Commission; or, in the case of the adequacy decision
in Article 46, Article 47 or Article 49, The transfers referred to in paragraph 1, second subparagraph, specify the appropriate or
suitable safeguards, how to obtain a copy or where they can be
accessed.
2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the
following information necessary to ensure fair and transparent processing in respect of the data subject:
a) the period for which the personal data will be stored, or, if that is not possible, the criteria used to determine that period;
b) the legitimate interests pursued by the controller or by a third party, where the
processing is based on point (f) of Article 6(1);
c) the existence of the right to request from the controller access to and
rectification or erasure of personal data or restriction of processing concerning the data subject,
Substantive decision 133/2025 — 7/10
as well as the right to object to processing and the right to
data portability.” 24. Except for the information referred to in Article 14.1.a) GDPR, the documents in the file show that the defendant has not provided any other mandatory information to the complainant.
25. The Dispute Resolution Chamber concludes that the defendant has failed to comply with its transparency and information obligations under Articles 5.1.a), 12.1, 14.1, and 14.2 of the GDPR because the information it provided to the complainant was incomplete.
II.4. Right of access (Article 15 GDPR)
26. Pursuant to Article 15 GDPR, the data subject has the right of access to the personal data collected about them. This enables the data subject to take note of the processing and verify its lawfulness. 27. On May 9, 2024, the complainant exercised her right of access by asking the
respondent how he had obtained her contact details (Article 15.1.g) GDPR). The
respondent replied that he had contacted OKRA in the context of an
invitation from this organization to visit the Flemish Parliament, and that he had "presumably" collected the
personal data in this context.
28. In his submissions of September 4, 2024, the respondent voluntarily acknowledged that the
information provided to the complainant was incorrect. In reality, the complainant's
contact details were collected via the website of the municipality of Z2, where the
complainant was listed as a representative of the Gezinsbond Afdeling W.
29. During the hearing, the respondent stated that he had since been able to
communicate the correct information to the complainant, initially by telephone, and also through the explanation in
his submissions during the current proceedings before the Dispute Resolution Chamber. 30. In view of the foregoing, the Litigation Chamber finds that the respondent has infringed
Article 15.1.g) GDPR by providing incorrect information about the source of the complainant's
personal data.
II.5. The right to object (Article 21.2 GDPR)
31. When personal data are processed for direct marketing purposes, the
data subject has the right to object at any time to the processing of their
Decision on the merits 133/2025 — 8/10
personal data for such marketing, including profiling related to direct marketing.
32. In the present case, the documents in the file do not demonstrate that the complainant has exercised
her right to object. Therefore, the Litigation Chamber finds that no infringement of
Article 21.2 GDPR can be established.
III. Measures
33. Pursuant to Article 100 of the Dutch Data Protection Act (WOG), the Dispute Resolution Chamber has the power to:
1° dismiss a complaint;
2° order a dismissal of the prosecution;
3° order a suspension of the judgment;
4° propose a settlement;
5° issue warnings and reprimands;
6° order compliance with data subject requests to exercise their rights;
7° order that the data subject be informed of the security issue;
8° order that processing be temporarily or permanently frozen, restricted, or prohibited;
9° order that processing be brought into compliance;
10° order the rectification, restriction, or erasure of data and the notification thereof to the recipients of the data;
11° order the withdrawal of the recognition of certification bodies;
12° impose penalty payments;
13° to impose administrative fines;
14° to order the suspension of cross-border data flows to another State or
an international institution;
15° to transfer the file to the Public Prosecutor's Office in Brussels, which
will inform it of the action taken on the file;
16° to decide, on a case-by-case basis, to publish its decisions on the website of
the Data Protection Authority. 34. The Dispute Resolution Chamber ruled that the defendant violated Articles 5.1.a) and 6.1 GDPR by sending direct marketing to the complainant without having read the
8Note on the August 2024 elections (available at <
https://www.gegevensbeschermingsautoriteit.be/publications/nota-inzake-de-verwerking-van-persoonsgegevens-in-het-
kader-van-de-verkiezingen.pdf >)
Decision on the merits 133/2025 — 10/10
in accordance with Article 1034quinquies of the Judicial Code, or via the e-Deposit
information system of the Ministry of Justice (Article 32ter of the Judicial Code).
(Get). Hielke HIJMANS
Director of the Litigation Chamber
10 The petition and its appendix, in as many copies as there are parties involved, shall be sent by registered mail
to the clerk of the court or filed with the court registry.
