Is the government transparent enough about your data on MyMinfin?

The Belgian Data Protection Authority (DPA) has judged that the federal government does not always comply with its transparency obligations when processing personal data on citizen platforms. In a decision dated March 10, 2026 (No. 53/2026) the FPS Finance was reprimanded for not adequately informing citizens about logging on the platform MyMinfin. Although the government collects extensive data, it must communicate it to citizens in an understandable and accessible way.

The facts

The case arose following a complaint by a citizen embroiled in legal proceedings with the FPS Finance over a personal income tax assessment. At the heart of the dispute was when the citizen had learned of his assessment notice, as this determines the deadline for filing an objection.

During the proceedings, the FPS Finance brought evidence from the log data of the online platform MyMinfin. This showed that the tax authority meticulously records which documents a citizen consults, at what exact time this is done and whether these documents are printed. The complainant argued that he had never been informed about this, neither through the general website nor through the FPS Finance's cookie statement.

The decision of the Litigation Chamber

The DPA Litigation Chamber considered two key issues: the right of inspection and the active information requirement.

1. The access request (Article 15 GDPR).

The complainant, through his attorneys, had made a request for information about the processing of his log data. However, the DPA ruled that this particular request was not a valid request for access within the meaning of the General Data Protection Regulation (GDPR).

The reasons were twofold:

• The attorneys had not mentioned their client's identity in the request.
• The request sought only general, abstract information about the processing, rather than a copy of the data subject's actual personal data.

2. The transparency obligation (Article 13 GDPR).

Regarding transparency, the DPA did rule in favor of the complainant. The FPS Finance itself admitted that at the time the information about logging actions on MyMinfin had not yet been included in its privacy statement.

The Litigation Chamber considered that:

• Personal data directly from citizens are collected through the platform.
• The tax authorities are required to provide all relevant information (such as purposes and retention periods) at that time.
• The absence of this information violates the principle of transparency.

Legal analysis and interpretation

This ruling by the Litigation Chamber underscores the fundamental importance of the transparency principle in Article 5.1(a) of the GDPR. Transparency is not a mere formality; it is an essential condition for citizens to maintain control over their data and to effectively exercise their other rights (such as the right to erasure or objection).

Of interest is the strict interpretation of the right of inspection (Article 15 GDPR). The DPA here follows the European Data Protection Board (EDPB) guidelines.. A request is only an access request if it relates to the concrete processing of data of an identified person. General questions about “how a system works” fall under the general obligation of transparency on the part of the controller, but do not necessarily give the citizen the legal standing of an individual request for inspection if identity is lacking.

Moreover, the DPA is a reminder of the government's exemplary role. Because the FPS Finance processes huge amounts of sensitive data on all Belgian taxpayers, they are expected to comply impeccably with data protection laws.

What this specifically means

For the various stakeholders involved, this ruling has important implications:

• For the citizen/taxpayer: Be aware that almost every action on government portals such as MyMinfin is logged. These logs can be used by the government as evidence in legal disputes (for example, to prove when you opened a document). However, you have the right to be clearly informed about this in advance through the privacy notice.
• For government agencies and organizations: It is not enough to have a general privacy notice. Any specific processing, including technical logging for monitoring purposes, must be explicitly and intelligibly stated at the time the data is collected.
• In case of legal action: If you wish to exercise your rights under the GDPR through an attorney, your identity must be clearly disclosed to the controller in order to be considered a valid request.

Frequently asked questions (FAQ)

May the FPS Finance track my click behavior on MyMinfin?
Yes, but they must be fully transparent about this. They must explain in their privacy statement what data they collect (e.g., time of consultation), why they do so, and how long they keep that data.

Can I request general information about how an app processes my data via a review request?
Basically, the right of access is for your own personal data. For general information about the system, you should look at the organization's privacy statement. A request without mentioning your name will usually not be accepted as a valid inspection request.

What sanction did the FPS Finance receive in this case?
The DPA issued an official reprimand. A fine was not imposed, partly because FPS Finance had since rectified the breach by amending its privacy notice and because it is a government agency.

Conclusion

The Data Protection Authority ruling reminds us that digital transparency by the government is not a favor, but a legal duty. Whether it's tax records or other citizen platforms, you have a right in Belgium to know what happens to your data behind the scenes.