The Belgian Data Protection Authority tightens rules on sharing personal data in the workplace

After years of legal proceedings concerning its pay structure, an employer wins its case before the Labour Appeal Court and shares the full arrest with all its employees. However, the arrest contained the personal data of several employees who had initiated the claim alongside the trade union organisations. One employee was unhappy with this and filed a complaint with the Belgian Data Protection Authority (DPA).

Cause of the complaint

In 2014, two trade unions and several employees had initiated proceedings against the employer concerning the legality of a part of its remuneration system. The employer won in appeal and shared the full arrest internally with all its employees by e-mail. The majority of the employees were placed in BCC, making it impossible to see who had received the e-mail. However, the arrest was neither anonymised nor pseudonymised, revealing the names and addresses  of the employees concerned to all recipients. One of them was an employees’ representative.

The employee served the employer with a notice and demanded compensation for the moral and professional damage she claimed to have suffered as a result of the disclosure of the arrest. According to the employee, colleagues turned against her and there was a risk of physical injury because her home address had been disclosed, and because she had previously received threats at work. After the employer disputed any infringement and refused to pay compensation, the employee filed a complaint with the DPA for unlawful processing of her personal data. In its decision of 19 September 2025, the DPA ruled on this complaint.

No abuse of the right to file a complaint

The employer argued that the employee had abused her right to file a complaint with the DPA. The employee had waited 18 months to file the complaint which, according to the employer, she did because she had not received any compensation. The DPA rejected this argument, as the employee was entitled to take other steps before filing a complaint. The DPA therefore ruled that there was no abuse of rights.

No processing of special categories of personal data

In her complaint, the employee claimed that there had been unlawful processing of personal data revealing her trade union membership. According to the employee, this could be inferred from the fact that the claim against the employer had been filed by herself, several other employees and two trade union organisations. Moreover, they were acting in the collective interest of the company's employees. 

The processing of personal data revealing trade union membership is in principle prohibited, unless one of the exceptions provided for in the GDPR can be invoked, such as the explicit consent of the person concerned or a legal obligation. In this case, there was no consent, no legal obligation or any other exception that justified sharing the judgment with all employees.

However, the DPA ruled that there was no processing of a special category of personal data. The employee had filed the claim in her own name and in the arrest , she was not described as an employees’ representative, but only as an employee. According to the DPA, the fact that some recipients of the e-mail containing the judgment were aware of her capacity does not alter this.

Excessive and unlawful processing

The DPA then assessed whether the employer could invoke its legitimate interest in sharing the arrest with all employees. In its analysis, the DPA applied the so-called three-step test:

• Purpose Test: The employer had a legitimate interest in informing its employees about the outcome of the proceedings. These proceedings concerned the remuneration system applicable to some of its employees, could have consequences for the financial health and survival of the company, and had created a tense working atmosphere among the staff.
• Necessity Test: According to the DPA, it was not necessary for employees to know who had filed the claim in order to achieve the above objective, and the employee's address should certainly not have been mentioned.
• Since the necessity test was not met, the DPA did not proceed to the balancing test and ruled that the processing was unlawful.

Use of Bcc is not necessarily improper

The employer had placed the majority of employees in BCC (blind copy) when sending the arrest. The employee claimed that this constituted an act of disloyalty because it prevented her from determining who had received her data, which she claimed was a violation of the principle of propriety.

However, the employer argued that it used the BCC function to guarantee the other recipients' right to data protection. Not all employees have a professional e-mail address, so the arrest  was sent to their private e-mail addresses.

According to the DPA, there is no question of unfair conduct on the part of the employer in this context. However, it does understand the employee's position and wonders whether the employer should use an alternative method of communication in the future (e.g. by providing a professional e-mail address for all employees).

Finally, the DPA identified some further infringements relating to the principle of transparency and information obligations. The DPA decided to reprimand the employer for the infringements identified and dismissed the complaint insofar as it related to the processing of trade union data and an infringement of the principle of propriety
 

Key message

It is allowed to inform employees about matters that may concern them, including the outcome of legal proceedings. However, if this communication contains personal data relating to other individuals, the employer must carefully assess whether it is necessary to disclose this information. If this is not the case, the employer must take appropriate measures to protect the rights of the individuals concerned. This can be achieved, for example, by sharing only a summary of the decision or by anonymising the document.