APD/GBA (Belgium) - 72/2026
From GDPRhub
| APD/GBA - 72/2026 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 2(1) GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 31.03.2026 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 72/2026 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | APD (in NL) |
| Initial Contributor: | dt |
The DPA dismissed a customer's complaint claiming they received invoices addressed to other customers of the controller. The DPA held that it was impossible to verify the facts of the case, as the customer had destroyed all invoices.
English Summary
Facts
A customer (the data subject) of a company (the controller) filed a complaint with the Belgian DPA (APD) claiming that the controller sent them via postal mail several unpaid invoices pertaining to other customers.
The data subject destroyed the invoices that were intended for other customers.
Holding
Firstly, the DPA held that in the absence of the invoices, it was unable to verify if the data subject actually received the invoices intended for other customers.
Secondly, the DPA noted that it was not possible to verify whether those invoices related to natural persons. Therefore, the DPA was unable to conclude if the processing of personal data fell within the application of Article 2(1) GDPR.
Finally, the DPA accepted the controller’s claim that this was a one-time human error and noted that there was no evidence of a recurring issue with the controller’s mailings.
Therefore, the DPA dismissed the complaint.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/5 Dispute Resolution Chamber Decision 72/2026 of 31 March 2026 File number: DOS-2025-05053 Subject: Complaint regarding the receipt by post of unpaid invoices concerning other Y customers The Dispute Resolution Chamber of the Data Protection Authority; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”; Having regard to the Act of 3 December 2017 establishing the Data Protection Authority, hereinafter “DPO”; Having regard to the Rules of Internal Order of the Data Protection Authority, as approved by the Management Committee on 25 April 2024 and published in the Belgian Official Gazette on 31 May 2024; Having regard to the documents in the file; Has taken the following decision regarding: Complainant: X, hereinafter “the complainant”; and The defendant: Y, with registered office at [...], with enterprise number [...], hereinafter “the defendant”. Decision 72/2026 — 2/5 I. Facts and procedure 1. On 15 December 2025, the complainant lodged a complaint with the Data Protection Authority (hereinafter "the DPA") against the defendant. 2. The subject matter of the complaint concerns the receipt by post of unpaid invoices relating to other Y customers. The complainant reports that on November 14, 2025, he not only received his own invoice pursuant to an ongoing leasing contract, but also found reminder invoices for approximately ten of the defendant's customers in the same postal shipment. The complainant claims that, as a result, he unintentionally obtained access to the personal data of these third parties. 3. On December 23, 2025, the complaint is declared admissible by the First Line Service on the basis of Articles 58 and 60 of the WOG, and the complainant is notified of this in accordance with Article 61 WOG. 4. On December 23, 2025, the Disputes Chamber is seized on the basis of Article 92, 1° of the WOG. II. Reasoning 5. Based on the elements in the file known to the Disputes Chamber, and based on the powers assigned to it by the legislature pursuant to Article 95, § 1 WOG, the Disputes Chamber decides on the further handling of the file; in this case, the Disputes Chamber proceeds to dismiss the complaint in accordance with Article 95, § 1, 3° WOG, based on the reasoning below. 6. When a complaint is dismissed, the Disputes Chamber must motivate its decision in stages and: - issue a technical dismissal if the file contains no or insufficient elements that could lead to a conviction, or if there is insufficient prospect of a conviction due to a technical impediment, which prevents it from reaching a decision; - or to issue a policy dismissal if, despite the presence of elements that could lead to a sanction, the continuation of the investigation of the file does not appear opportune in light of the priorities of the GBA, as specified and explained in the dismissal policy of the Disputes Chamber . 2 1 the Brussels Court of Appeal, Markets Section, 19th Chamber A, Market Affairs Chamber, judgment 2020/AR/329, 2 September 2020, p. 18. 2In this regard, the Disputes Chamber refers to its dismissal policy as set out in detail on the website of the GBA: https://www.gegevensbeschermingsautoriteit.be/publications/sepotbeleid-van-de-geschillenkamer.pdf Decision 72/2026 — 3/5 7. In the event that the case is dismissed on more than one ground, the grounds for dismissal (respectively technical dismissal and policy dismissal) must be dealt with in order of importance. 3 8. In the present case, the Disputes Chamber proceeds to dismiss the complaint, on the basis of technical considerations (A.1 of the Disputes Chamber's dismissal policy) 4 and policy considerations (B.5 of the Disputes Chamber's dismissal policy). There are, namely, two motives underlying the decision of the Disputes Chamber as to why it considers it undesirable to pursue the case further and therefore decides not to proceed to, inter alia, a substantive hearing. 9. The Disputes Chamber points out that the complaint is not substantiated by any evidence of a breach of the GDPR or of legislation regarding the protection of personal data and it is clearly not possible to gather such evidence (A.1 dismissal policy). 10. First of all, the complainant himself indicates that the invoices he received, which were delivered to him by post by the defendant and which were intended for third parties, were destroyed by him personally. This means that the Disputes Chamber does not have the possibility to verify whether the complainant actually received the invoices from a dozen other customers of the defendant. 11. Moreover, it cannot be verified whether the invoices in question intended for other customers relate to natural persons and consequently it cannot be established whether there is processing of personal data of natural persons to which the GDPR applies within the meaning of Article 2.1 GDPR. 6 After all, leasing contracts are often concluded by undertakings within a business context, such that only the data of the undertaking is processed. the processing of undertaking data does not apply to. the processing of undertaking data. In the absence of the reminder invoices, it cannot be verified whether these related to personal data or to undertaking data. 12. Furthermore, in response to the complainant's notification that he had received reminder invoices intended for third parties, the defendant responded with the statement that it concerns a human error, the recurrence of which will be prevented by tailored GDPR training for the relevant functions regarding incoming and outgoing 3 Cf. Title 3 – In which cases will my complaint likely be dismissed by the Disputes Chamber? of the Disputes Chamber's dismissal policy. 4https://www.gegevensbeschermingsautoriteit.be/publications/sepotbeleid-van-de-geschillenkamer.pdf A.1 Your complaint is insufficiently substantiated by evidence regarding the existence of a breach of the GDPR or of data protection laws and it is clearly not possible to obtain such evidence 5 B.5 Your complaint is not sufficiently detailed or is not supported by evidence that would enable the Disputes Chamber to decide whether or not there is a breach of the GDPR AND your complaint does not have a major societal and/or personal impact 6 Article 2.1. GDPR. This Regulation applies to the wholly or partially automated processing as well as to the processing of personal data contained in a file or intended to be contained therein. Decision 72/2026 — 4/5 handling postal items. Since there is no indication in the file that can refute the defendant's claim that it concerns a one-off human error and there is also no evidence available that supports the claims in the complaint, the Disputes Chamber is unable to decide whether or not there has been a breach of the GDPR. The Disputes Chamber also takes into account the fact that there are no elements present in the file indicating that there is a regularly recurring problem regarding the sending of mail items by the defendant. The complaint concerns a single fact without any supporting evidence. Consequently, the complaint has no major societal or personal impact (B.5 dismissal policy). III. Publication and communication of the decision 13. In view of the importance of transparency regarding the decision-making of the Disputes Chamber, this decision is published on the website of the GBA. However, it is not necessary for the identification details of the parties to be disclosed directly for this purpose. 14. In accordance with its dismissal policy, the Disputes Chamber will transmit the decision to the defendant. After all, the Disputes Chamber has decided to notify defendants of its dismissal decisions ex officio. However, the Disputes Chamber refrains from such notification when the complainant has requested anonymity with respect to the defendant and the notification of the decision to the defendant, even if it is pseudonymized, nevertheless makes it possible to (re)identify the complainant. However, this is not the case in the present matter. FOR THESE REASONS, the Disputes Chamber of the Data Protection Authority decides, after deliberation, to dismiss the present complaint on the basis of Article 95, § 1, 3° of the WOG.An appeal may be lodged against this decision in accordance with Article 108, § 1 of the WOG, within a period of 30 days after notification thereof, with the Market Court (Court of Appeal of Brussels), with the Data Protection Authority as the defendant. Such an appeal may 7 Cf. Title 5 – Will the dismissal of my complaint be published? Will the opposing party be informed of this? of the Dispute Resolution Chamber's dismissal policy. 8 Ibidem. Decision 72/2026 — 5/5 be lodged by means of a petition in opposition which must contain the particulars listed in Article 1034ter of 9 the Judicial Code (Ger.W.). The petition in opposition must be submitted to the registry of the Market Court 10 in accordance with Article 1034quinquies of the Ger.W. , or via the e-Deposit information system of the Ministry of Justice (Article 32ter of the Judicial Code). In order to enable the complainant to consider other possible legal remedies, the Dispute Resolution Chamber refers the complainant to the explanatory notes in its dismissal policy. 11 (Get). Hielke H IJMANS Director of the Disputes Chamber 9"The petition shall state, under penalty of nullity: 1° the day, the month and the year; 2° the name, first name, domicile of the petitioner and, where applicable, his capacity and his national register or company number; 3° the name, first name, domicile and, where applicable, the capacity of the person to be summoned; 4° the subject matter and a brief summary of the grounds of the claim; 5° the judge before whom the claim is brought; 6° the signature of the petitioner or of his lawyer." 10 "The petition with its annex shall be sent by registered mail to the registrar of the court or filed with the registry, in as many copies as there are parties involved." 1Cf. Title 4 – What can I do if my complaint is closed? of the Disputes Chamber's dismissal policy.
