Can a school be fined for violating the GDPR?

A school seeking to measure the well-being of its students through a digital survey, a concerned parent sounding the alarm about privacy, and a legal joust culminating in an important question before the European Court of Justice. A recent case, which started with a complaint to the Data Protection Authority (DPA), perfectly illustrates the complexity of the GDPR in the Belgian educational context. The key question: can a free subsidized school, considered a "government" in Belgium, escape an administrative fine for violations of the data protection legislation? Our lawyers, specialized in education and data protection law, are closely following this case and explain the history and stakes for you.

It all started in 2019 with a parent's complaint against a free secondary school. The school had used the digital platform Smartschool to administer a survey on "well-being" to underage students. According to the complainant, this was done without valid parental consent, too much information was requested and there was a lack of transparency.

The GBA's decision: school at fault and a fine

The Disputes Chamber of the GBA examined the case and stated on June 16, 2020 various violations of the General Data Protection Regulation (AVG, better known as the GDPR) fixed. The main findings were:

• No valid legal basis (Art. 6.1 AVG): The school relied on a decree obligation regarding student guidance. However, the GBA ruled that this general obligation did not justify the concrete, non-anonymous survey. The cooperation of pupils required active consent.
• Misunderstanding children's consent rules (Art. 8 AVG): Since the survey was offered through Smartschool, an "information society service," to children under 13, the explicit consent of parents or legal representatives was required. This was not requested.
• Violation of minimum data processing (Art. 5.1.c AVG): The survey was not anonymous and collected more data than strictly necessary for the purpose. The GBA argued that the purpose could also be achieved with anonymous data.
• Lack of transparency (Art. 12 and 13 AVG): Students and parents were not sufficiently clear and fully informed.

The Disputes Chamber imposed an administrative fine of €2,000 on the school.

The saga before the Belgian courts: can the government be fined?

The school did not resign itself to this decision and went to the Market Court, the competent appellate body for decisions of the GBA. Here begins a complex legal discussion that goes to the heart of the matter.

The Belgian Act of July 30, 2018 on the protection of natural persons with regard to the processing of personal data implements Article 83.7 of the GDPR. This article allows member states to determine whether and to what extent "public authorities and public bodies" may be subject to administrative fines. The Belgian legislature has provided in Article 221, §2 that "public authorities" are in principle exempt from fines, unless it is a "legal entity governed by public law that offers goods or services on a market."

The legal jousting proceeded as follows:

1. First Market Court Judgment (Nov. 18, 2020): The court largely followed the GBA on the violations, but ruled that the GBA had failed to provide sufficient reasoning as to why it could still impose a fine on the school, which could be considered "a governmental entity." The decision was overturned in part and sent back to the GBA for better reasoning.
2. Second decision GBA (March 15, 2021): The GBA reviewed the case, gave detailed reasons why, in its view, a free subsidized school could indeed be fined and imposed a fine of €1,000. The GBA argued that although the school falls under the broad Belgian definition of 'government', it still offers a service on the education 'market' where private schools also operate and thus falls under the exception of Article 221, §2, Data Protection Act.
3. Second judgment Market Court (Oct. 6, 2021): The school appealed again. This time the Markets Court overturned the fine in its entirety. The court ruled that offering legally subsidized education was not economic activity and could not be equated with offering a "service on a market." Consequently, the exemption applied and no fine could be imposed^.
4. First Supreme Court ruling (Jan. 9, 2023): The GBA did not stop there and went to the Supreme Court. The highest court overturned the Market Court's ruling. The Supreme Court ruled that the Market Court had misinterpreted the GBA's arguments. The GBA had indeed disputed that a free school could be considered a "public body" within the meaning of the GDPR itself, a point the Markets Court was required to consider. The case was referred back to a differently constituted Markets Court.
5. Third judgment Markets Court (Feb. 27, 2024): The Market Court reconsidered the case and came to the same conclusion: no fine possible. The Court analyzed the Belgian law and preparatory works and stated that a free subsidized school, which performs a task of general interest and is largely publicly funded, cannot be considered a legal entity offering "services on the market. Moreover, the Court ruled that this Belgian regulation does not violate European law because such a school can functionally be considered a "public body" within the meaning of the GDPR.

The ultimate question before the Court of Justice

The GBA, dissatisfied with this outcome, filed another cassation appeal. This leads us to the most recent and crucial chapter in this saga. On June 27, 2025 decided not to tie the knot itself, but to refer a preliminary question to the Court of Justice of the European Union (CJEU).

The question reads, freely translated:

"Does Article 83.7 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, read in conjunction with recitals 38 and 58 and Articles 6.1(f), 8, 57.1(b) of that regulation, preclude national legislation which does not allow the supervisory authority to impose an administrative fine on legal persons under private law who provide subsidized free education?

The Supreme Court is thus asking the European Court whether the Belgian exception for schools is compatible with the GDPR's goal of ensuring effective and deterrent enforcement, especially when the data protection of vulnerable groups such as children is at stake.

What does this mean for your school or organization?

The ruling of the European Court of Justice will be of great importance.

• If the Court finds that the Belgian exemption is admitted is, free subsidized schools in Belgium will in principle not be able to receive administrative fines from the GBA. Note, however, that other corrective measures such as an order to modify data processing, a reprimand or a temporary ban remain possible.
• If the Court finds that the Belgian exemption is contrary with the GDPR, the GBA will have the power to effectively impose fines on free subsidized schools (and possibly other subsidized non-profit organizations with a governmental mission) as well. This would dramatically change enforcement practices in the Belgian non-profit and education sector.

Regardless of the outcome, this case highlights the critical importance for every educational institution in Flanders to thoroughly evaluate its data processing operations and ensure full compliance with the GDPR. After all, the risks are not only financial, but also involve reputational damage and the trust of parents and students.