APD/GBA (Belgium) - 158/2025
| APD/GBA - 158/2025 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 5(1)(b) GDPR Article 5(1)(e) GDPR Article 5(2) GDPR Article 12 GDPR Article 13 GDPR Article 17 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 07.10.2025 |
| Published: | 15.10.2025 |
| Fine: | n/a |
| Parties: | X Y |
| National Case Number/Name: | 158/2025 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Dutch |
| Original Source: | Gegevensbeschermingsautoriteit (in NL) |
| Initial Contributor: | RP |
The DPA reprimanded a company for unlawfully retaining a former employee’s email account and phone number after the employment ended.
English Summary
Facts
The data subject, formerly the managing director of the controller’s company, left their position, but the controller failed to deactivate their professional email account and company mobile number. The data subject later complained to the Belgian Data Protection Authority (GBA/APD), claiming that personal communications linked to these accounts remained accessible.
The controller argued that the phone number was company property and that the email account was due to be closed. The Litigation Chamber admitted the complaint.
Holding
The GBA/APD found that the controller violated multiple GDPR provisions by failing to deactivate the data subject’s professional email account and company phone number after the termination of employment.
Continuing to process these data without an automatic response, prior notice, or consent breached the purpose limitation principle under Article 5(1)(b) GDPR, as the data were no longer used for the professional purposes for which they were collected.
The prolonged retention also violated data minimisation and storage limitation under Articles 5(1)(c) and 5(1)(e) GDPR, as retaining the data far exceeded what was necessary.
The controller also failed to inform the data subject, contrary to Articles 12 and 13 GDPR, while ignoring his request to delete the data contained in his phone thus violating their right to erasure in Article 17 GDPR.
Finally, there was no lawful basis for continuing to process the email account or phone number after employment ended, because the contractual purpose ended with the employment and no alternative legal ground, such as consent or legitimate interest, was established, thus violating Articles 5(1)(a) and 6(1) GDPR.
Considering the controller’s cooperation and that the company was in liquidation, the GBA/APD issued a reprimand rather than a fine.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
