{"id":100278,"date":"2025-09-26T11:21:58","date_gmt":"2025-09-26T10:21:58","guid":{"rendered":"https:\/\/www.ictrechtswijzer.be\/?p=100278"},"modified":"2025-09-26T11:22:51","modified_gmt":"2025-09-26T10:22:51","slug":"may-a-politician-send-me-unsolicited-election-emails","status":"publish","type":"post","link":"https:\/\/www.ictrechtswijzer.be\/en\/mag-een-politicus-mij-ongevraagd-verkiezingsmails-sturen\/","title":{"rendered":"May a politician send me unsolicited election emails?"},"content":{"rendered":"

You open your mailbox and find an e-mail from a politician asking you to vote for him or her. You do not remember ever subscribing to his or her newsletter. Is this allowed? No, the unsolicited use of your personal data for election propaganda violates the General Data Protection Regulation (GDPR)<\/a>. Data collected for a specific purpose should not be used for any other incompatible purpose - such as an election campaign.<\/p>\n\n\n\n

In a decision of 22 September 2025 (no. 151\/2025<\/a>), the Data Protection Authority (DPA) once again brought this principle into sharp focus and reprimanded a politician for illegally sending election emails.<\/p>\n\n\n\n

The facts: an unwanted election email<\/h2>\n\n\n\n

A citizen received an e-mail on June 5, 2024, from a politician as part of his election campaign<\/sup>. The citizen, suspecting that his data was being used unlawfully, immediately exercised his right of access<\/sup>. He asked the politician where his data came from, for what purpose it was used, and exactly what data was in his possession<\/sup>.<\/p>\n\n\n\n

The response was unsatisfactory. The politician initially claimed that the e-mail had been sent by mistake. After insistence came a vague explanation: the data had \"perhaps\" been obtained at an event and was being used for \"general communication.\" Not content with this, the citizen filed a complaint with the Data Protection Authority.<\/p>\n\n\n\n

The politician defended himself by arguing that there was human error: an employee had accidentally used the wrong contact list, causing 5,000 people to mistakenly receive the email. This qualified as a \"data leak,\" which the politician said would suspend normal GDPR obligations.<\/p>\n\n\n\n

The decision of the Data Protection Authority<\/h2>\n\n\n\n

The Litigation Chamber of the DPA did not follow the politician's reasoning and found multiple violations of the GDPR.<\/p>\n\n\n\n

Infringement 1: Unlawful processing and abuse of purpose limitation<\/h3>\n\n\n\n

The crux of the matter revolves around two fundamental principles of the GDPR:<\/p>\n\n\n\n

    \n
  1. Legality (Art. 5.1.a and 6.1 GDPR):<\/strong> Any processing of personal data requires a valid legal basis, such as unambiguous consent. The politician himself admitted that he had no consent from the complainant.<\/li>\n\n\n\n
  2. Purpose limitation (Art. 5.1.b GDPR):<\/strong> Personal data may only be collected for \"specified, explicit and legitimate purposes.\" The plaintiff's data had been collected as part of activities of a political incubator, not for the politician's election campaign in any other capacity. Using these data for election propaganda was a novel, incompatible purpose.<\/li>\n<\/ol>\n\n\n\n

    The Litigation Chamber ruled that the politician had violated both principles<\/sup>.<\/p>\n\n\n\n

    Breach 2: Lack of transparency and duty of disclosure<\/h3>\n\n\n\n

    The politician's website included a link to a privacy statement<\/sup>. However, this link led to the political party's general privacy statement, and not to a specific statement that described the politician's own processing operations<\/sup>. As a result, citizens were not adequately informed about what happened to their data, in violation of the transparency obligation<\/sup>.<\/p>\n\n\n\n

    Infringement 3: Violation of the right of access.<\/h3>\n\n\n\n

    When a citizen exercises their right of acess, the data controller must provide clear and complete information. The politician's answers - \"perhaps obtained at an event\" and \"for general communication\" - were too vague and incomplete<\/sup>. This constituted a violation of Article 15 of the GDPR<\/sup>.<\/p>\n\n\n\n

    The DPA ultimately imposed a reprimand, a formal warning. No fine was imposed because the violations were inadvertent and the politician had taken corrective measures in the meantime, such as taking GDPR training.<\/p>\n\n\n\n

    Legal analysis and interpretation<\/h2>\n\n\n\n

    This decision is an important reminder of the strict application of the GDPR, even in a political context. The defendant's attempt to frame the facts as a \u201cdata breach\u201d in order to circumvent fundamental obligations is rightly dismissed by the Litigation Chamber. A data breach is a security breach and does not relieve the data controller of its obligation to have a valid legal basis and respect the purpose limitation principle at all times.<\/p>\n\n\n\n

    Crucial is the concept of the data controller. A politician may act in different capacities: as a city council member, as the initiator of a think tank, or as a parliamentary candidate. For each of these roles, he may be a separate data controller. Databases built in one capacity cannot simply be transferred and used in another capacity. This would completely erode the principle of purpose limitation.<\/p>\n\n\n\n

    By the way, this is not the first time the GDPR has looked into the use of e-mail addresses by politicians. Another recent case, which we analyzed here<\/a>, was about collecting publicly available e-mail addresses for an election campaign.<\/p>\n\n\n\n

    What this specifically means<\/h2>\n\n\n\n