Belgian DPA Fines Company for Accidental Personal Data Disclosure via Email
A company in Belgium accidentally sent a data subject's personal information — including name, home address, and license plate number — to an unintended third party via email, violating GDPR's core data security and integrity principles. Compounding the breach, the company failed to respond in a timely manner to the data subject's requests for information, breaching GDPR Article 12(3)'s response obligations. This case highlights how human error in email handling, combined with poor internal processes for managing data subject requests, can result in regulatory action. It matters because even seemingly minor disclosure incidents carry significant legal and reputational consequences when organisations lack proper controls and accountability mechanisms.
Tactical Insight
Immediate actions
- Implement email Data Loss Prevention (DLP) tools to flag or block outbound emails containing personal identifiers such as names, addresses, or vehicle registration numbers.
- Establish a formal data subject request (DSR) tracking system to ensure all access, erasure, and information requests are acknowledged and resolved within GDPR's one-month deadline.
Process & Policy improvements
- Require staff to use recipient verification steps (e.g., double-entry confirmation) before sending emails containing personal data.
- Create and maintain a documented procedure for handling accidental data disclosures, including immediate notification workflows and breach assessment templates.
- Define clear ownership roles for responding to data subject requests so no request goes unassigned or unanswered.
Training & Culture
- Conduct regular security awareness training focused on safe email handling, recognising personal data, and the legal obligations under GDPR.
- Run periodic simulated 'accidental disclosure' drills to test staff readiness and reinforce correct behaviours around sensitive data handling.