May a politician use my e-mail address for election advertising?

A political party or candidate may not use your e-mail address for election advertising without your express prior consent. This applies even if your e-mail address is publicly available on a website. A decision of the Data Protection Authority (DPA) dated 19 August 2025 (No. 133/2025) affirms that collecting public data for unsolicited political emails is a clear violation of data protection laws (GDPR).

The facts: an unsolicited campaign email

The case that led to the decision of 19 augustus 2025 (133/2025) began simply. A citizen (the plaintiff) received an e-mail from a Flemish Member of Parliament on 29 April 2024, asking him to participate in his political campaign. Surprised by this news, the complainant asked where the politician had gotten her information.

Initially, the politician gave an erroneous answer, stating that he had "presumably" obtained the data through contacts with the elderly association OKRA. Later, in the proceedings before the DPA, he corrected this: he had found the e-mail address on a municipal website, where the complainant was listed as a representative of the Gezinsbond. He had previously written to her in that capacity, but due to an internal classification error, her e-mail address had mistakenly ended up on a mailing list for political communications.

The decision of the Litigation Chamber

The DPA's Dispute Chamber ruled that the politician had violated the General Data Protection Regulation (GDPR) and imposed a reprimand.

Infringement 1: No valid legal basis (consent is required)

While political communications may fall under a "legitimate interest," electronic direct marketing - such as e-mails - is subject to a stricter, specific rule. Article XII.13 of the Code of Economic Law requires the prior, free and specific consent from the recipient. The politician did not have this permission and could not prove it. Thus, the transmission was unlawful.

Infringement 2: Violation of the purpose limitation

The GDPR requires that data be used only for the purpose for which it was originally collected (the principle of "purpose limitation"). In this case, the e-mail address had been published for Gezinsbond contacts. Using this address for election propaganda is a totally different, incompatible purpose. The DPA emphasizes that "scrapping" public sources for electoral purposes violates this principle.

Infringement 3: Lack of transparency and violation of the right of inspection

When data is not obtained directly from the individual, the data controller must proactively inform that individual about, among other things, the source of the data, the purpose of the processing, and his or her rights. The politician had failed to do so.

Moreover, when the complainant exercised her right to inspect, he gave false information about the origin of her data. Providing false information is a clear violation of Article 15 of the GDPR.

Legal analysis and interpretation

This decision is an important reminder that other legal provisions must be taken into account in addition to the GDPR. Although article 6 of the GDPR lists various legal grounds for data processing, the ePrivacy Directive (transposed into the Code of Economic Law) must also be taken into account when it comes to electronic marketing. This means that for commercial as well as political e-mail campaigns, the bar is raised: the "legitimate interest" is not sufficient, and active "consent" (opt-in) is the only valid legal basis.

The DPA uses a broad definition of "direct marketing," which includes political messages. The ruling makes clear that the public availability of an e-mail address is not a free pass for reuse. The purpose for which the data was originally made public is and remains the determining factor. The error cited by the defendant was not accepted by the Dispute Chamber as a valid justification, underscoring the responsibility of the data controller to have robust internal procedures that prevent such errors.

What this specifically means

• For citizens: You have the right to know where and why your data is being used. If you receive an unsolicited political e-mail, you can ask the sender where they got your data and demand that it be deleted. The burden of proof for consent is always on the sender.
• For politicians and political parties: Be extremely careful when collecting contact information. Email addresses from public websites, association membership lists or social media should not be added to an election propaganda mailing list without explicit permission. Provide separate databases and clear procedures to ensure compliance with the GDPR and ensure ePrivacy rules. Human error can lead to conviction.
• For associations and organizations: Think about what contact information you publish online. Consider using functional, non-personal email addresses (e.g., info@vereniging.be) to better protect your representatives' data.

Frequently asked questions (FAQ)

My e-mail address is on my sports club's website. May a politician use it for a campaign email?
No. The fact that your e-mail address is public for contacts related to the sports club does not give someone permission to use it for political advertising. This would violate the principle of purpose limitation.

Is there a difference between political advertising through e-mail and through a letter in the mailbox?
Yes, legally there is a big difference. For electronic marketing (e-mail, SMS), in principle, your prior consent (opt-in) is always required. For addressed mail, there is a more lenient regime based on "legitimate interest," where you do have the right to object (opt-out).

What should I do if I ask a politician or company where they get my data and they give an evasive or wrong answer?
Providing incomplete or incorrect information is a violation of your right to inspect. You can point this out to the party and insist on a correct answer. If this is refused, you can file a complaint with the Data Protection Authority.

Conclusion

The DPA's decision connects the dots: publicly available e-mail addresses are not free game for political campaigns. Without explicit, prior consent, sending political advertising by e-mail is unlawful. This case shows that even an inadvertent error can lead to a formal reprimand and underscores the importance of careful and proper management of personal data.