# Belgian DPA warns company that CC leak and failure to answer rights request likely

- Type: Enforcement
- Source: APD/GBA
- Date: 2026-10-12
- Original: https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_DOS-2026-00228
- Canonical: https://overview.legal/posts/595692
- Topics: Recipient, Controllers, Personal Data, Supervisory Authorities

## Summary

The DPA warned a company in a prima facie decision that accidentally sending emails relating to debt collection cases concerning a data subject to a third party in the cc field, and the failure to respond to the data subject’s request to exercise their rights, likely infringes Article 12(3) GDPR and Article 32 GDPR. English Summary. Facts. A company (controller) sent a data subject an email with a formal notice attached to it. The email was sent to the data subject’s work email address, with a t

## Full text

The DPA warned a company in a prima facie decision that accidentally sending emails relating to debt collection cases concerning a data subject to a third party in the cc field, and the failure to respond to the data subject’s request to exercise their rights, likely infringes Article 12(3) GDPR and Article 32 GDPR. English Summary. Facts. A company (controller) sent a data subject an email with a formal notice attached to it. The email was sent to the data subject’s work email address, with a third-party email address listed as recipient in the cc field. The data subject asked the controller for the identity of the third party. The controller answered that the request would be addressed as soon as possible. On another occasion, the controller sent the data subject an email with a payment notice via the data subject’s work email address. Again, the third-party email address was listed as recipient. The data subject asked again for the disclosure of the third party’s identity, and, for

---
Generated by overview.legal · https://overview.legal/posts/595692 · 2026-10-12