APD/GBA (Belgium) · 13 January 2021
School
Name not published.
About: Accountability, Data principles, Unlawful processing
- Regulator
- APD/GBA (Belgium)
- Decided
- 13 January 2021
- Country
- Belgium
- Sector
- Not given
- Regulator’s reference
- 03/2021
- Fino case number
- 2021/BE/009
What happened
The Belgian DPA (APD/GBA) held that sending a newsletter to the parents of school children with all email addresses visible in CC was a breach of the Article 5(1)(b), as this was not within the reasonable expectations of the parents to have their email address distributed. Furthermore, the school cannot rely on legitimate interest (Article 6(1)(f)) as other measures exist to not share the contact details with the other parents (BCC) and the parents do not expect their personal data from being further processed. As such, the school does not comply with their responsibilities as controller nor does uphold the principles of data protection by design and default (Articles 24 and 25).
Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.
Rules involved
- Art. 5Principles relating to processing of personal data5(1)(b)Read →
- Art. 6Lawfulness of processing6(1)(f) · 6(4)Read →
- Art. 24Responsibility of the controller24(1) · 24(2)Read →
- Art. 25Data protection by design and by default25(1) · 25(2)Read →
- Accountability
- Data principles
- Unlawful processing
Sources
The facts on this page come from the sources above, as they recorded them. Nothing has been estimated or filled in. Not legal advice.
Spotted a mistake? Write to angelillolorenzo@gmail.com and quote 2021/BE/009.