Enforcement · APD/GBA ·DOS-2026-00228 EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Belgian DPA warns company that CC leak and failure to answer rights request likely

Status Not cited by any decision here yet

Original title: APD/GBA (Belgium) - DOS-2026-00228

Belgium
Recipient Controllers Personal Data Supervisory Authorities
GDPRhub page Oct 12, 2026 Source gdprhub.eu

Full text

Machine translation of the decision, via GDPRhub — not the official text.

The DPA warned a company in a prima facie decision that accidentally sending emails relating to debt collection cases concerning a data subject to a third party in the cc field, and the failure to respond to the data subject’s request to exercise their rights, likely infringes Article 12(3) GDPR and Article 32 GDPR. English Summary. Facts. A company (controller) sent a data subject an email with a formal notice attached to it. The email was sent to the data subject’s work email address, with a third-party email address listed as recipient in the cc field. The data subject asked the controller for the identity of the third party. The controller answered that the request would be addressed as soon as possible. On another occasion, the controller sent the data subject an email with a payment notice via the data subject’s work email address. Again, the third-party email address was listed as recipient. The data subject asked again for the disclosure of the third party’s identity, and, for

How it connects

Related across sources

C-154/21 RW v Österreichische Post AG The Court of Justice of the European Union (First Chamber), in response to a preliminary reference from the Oberster Gerichtshof (Austrian Supreme Court), interpreted Article… First Chamber Jan 12, 2023 Personal Data Right of Access Right to Restriction
C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… Fifth Chamber May 4, 2023 Right to Restriction Controllers Personal Data
C-169/23 Nemzeti Adatvédelmi és Információszabadság Hatóság v UC In Case C-169/23, the Court of Justice of the European Union (Third Chamber) ruled on a preliminary reference from the Kúria (Hungary) concerning whether the Budapest Metropolitan… Third Chamber Nov 28, 2024 Personal Data Legitimate Interest Fairness & Transparency
C-579/21 Proceedings brought by J.M In Case C-579/21, the Court of Justice of the European Union ruled on a preliminary reference from the Itä-Suomen hallinto-oikeus (Administrative Court of Eastern Finland)… First Chamber Jun 22, 2023 Personal Data Right of Access IP Address
C-46/23 Budapest Főváros IV. Kerület Újpest Önkormányzat Polgármesteri Hivatala v Nemzeti Adatvédelmi és Információszabadság Hatóság In a preliminary ruling requested by the Budapest High Court, the Court of Justice interpreted whether Article 58(2)(d) and (g) of the GDPR permits a national supervisory… Fifth Chamber Mar 14, 2024 Right to be Forgotten Personal Data Right to Restriction
C-757/22 Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V In a preliminary ruling requested by the German Federal Court of Justice (Bundesgerichtshof), the Court of Justice of the European Union interpreted Article 80(2) GDPR in the… Fourth Chamber Jul 11, 2024 Personal Data Transparency Fairness & Transparency
Related documents