{"id":100487,"date":"2025-10-13T08:45:43","date_gmt":"2025-10-13T07:45:43","guid":{"rendered":"https:\/\/www.ictrechtswijzer.be\/?p=100487"},"modified":"2025-10-13T08:49:45","modified_gmt":"2025-10-13T07:49:45","slug":"can-a-mayor-use-the-municipalitys-contact-list-for-his-private-project","status":"publish","type":"post","link":"https:\/\/www.ictrechtswijzer.be\/en\/mag-een-burgemeester-de-contactlijst-van-de-gemeente-gebruiken-voor-zijn-priveproject\/","title":{"rendered":"Can a mayor use the municipality's contact list for his private project?"},"content":{"rendered":"

A public mandate comes with great responsibility, especially in the area of data protection. A decision of the Data Protection Authority (DPA) of 10 October 2025 (No. 163\/2025<\/a>) sheds light on a sensitive question: may a mayor use the municipality's official contact information to advertise a personal, commercial project? The answer is an unequivocal no. The DPA rruled that this constitutes unlawful processing of personal data in violation of the General Data Protection Regulation (GDPR)<\/a> . <\/p>\n\n\n\n

The facts: an invitation with a double agenda<\/h2>\n\n\n\n

The case revolved around a mayor who used the e-mail addresses of hundreds of internal employees, external contacts and citizens to send an invitation to the presentation of his new book. <\/sup>This invitation was sent from his official municipal email address. <\/sup><\/sup><\/sup><\/sup><\/p>\n\n\n\n

Although the mayor argued that the book translated his administrative vision and framed it within the public interest to inform citizens, the DPA established a different purpose. <\/sup><\/sup><\/sup><\/sup>The invitation and the book were directly linked to a new, private, and commercial project by the mayor, complete with its own website, coaching services, and even a recently established company. <\/sup><\/sup><\/sup><\/sup><\/sup><\/sup><\/sup><\/sup><\/sup>Thus, the focus was not on the general interest of the municipality, but on the mayor's commercial interests as a private person. <\/sup><\/sup><\/sup><\/p>\n\n\n\n

The decision of the Litigation Chamber<\/h2>\n\n\n\n

The DPA Litigation Chamber ruled that both the mayor and the municipality were at fault, albeit on different grounds.<\/p>\n\n\n\n

1. The mayor as a separate 'data controller'<\/h3>\n\n\n\n

This is the legal crux of the matter. The DPA argued that in sending this particular email, the mayor was not acting as an \"employee\" of the municipality, but as a separate data controller. Why? Because he himself determined the purpose <\/strong>of the data processing (direct marketing for his book) and deployed the means (the municipality's email environment). <\/p>\n\n\n\n

This distinction is important: because he acted as a separate entity, he could not hide behind the legal grounds that the municipality had for collecting and using that contact information. <\/p>\n\n\n\n

2. No valid legal basis for direct marketing<\/h3>\n\n\n\n

The municipality collected contact information for its public interest tasks, such as communication with citizens and internal operations. <\/sup>Sending a commercial invitation is incompatible with this. <\/sup><\/p>\n\n\n\n

The mayor therefore needed his own new legal basis for his direct marketing campaign. According to the ePrivacy Directive<\/a>, converted into the Belgian Code of Economic Law<\/a>, the sending of direct marketing via e-mail generally requires the prior consent of the recipient. The Mayor could not demonstrate that he had such valid consent. Consequently, the processing was unlawful.<\/p>\n\n\n\n

3. The municipality and the role of the DPO<\/h3>\n\n\n\n

The municipality was also reprimanded. <\/sup>The DPA found that the municipality's Data Protection Officer (DPO) also held a full-time position as a communications expert. <\/sup><\/sup><\/sup><\/sup> As a result, the DPO did not have sufficient time to properly perform its statutory duties. The municipality thus violated its duty to provide the DPO with the necessary resources, including time. <\/sup><\/sup><\/p>\n\n\n\n

Legal analysis and interpretation<\/h2>\n\n\n\n

This decision is a textbook example of the GDPR principle of purpose limitation (Article 5.1.b GDPR). Personal data may only be collected for specified, explicit and legitimate purposes. They may not be further processed in a way that is incompatible with those original purposes. The DPA applied the compatibility test from Article 6.4 of the GDPR and concluded that the mayor's private, commercial purpose was completely incompatible with the public purposes of the municipality. <\/p>\n\n\n\n

In addition, the ruling emphasizes the importance of correctly identifying the controller (Article 4.7 GDPR). Whoever determines the \"why\" (purpose) and the \"how\" (means) of a processing operation bears ultimate responsibility. By pursuing his own ends, the mayor stepped out of his role as an organ of the municipality and became the controller himself, with all the obligations that entails. This is an important warning for any mandatary or official who has access to public databases.<\/p>\n\n\n\n

Finally, for the municipality, the reprimand underscores the strategic importance of the DPO. A DPO without sufficient time and resources is a paper tiger. The DPA makes it clear that it considers this a priority and strictly monitors the effective and independent performance of this function within government agencies. <\/sup><\/p>\n\n\n\n

What this specifically means<\/h2>\n\n\n\n