{"id":99761,"date":"2025-08-19T12:59:51","date_gmt":"2025-08-19T11:59:51","guid":{"rendered":"https:\/\/www.ictrechtswijzer.be\/?p=99761"},"modified":"2025-08-19T13:37:39","modified_gmt":"2025-08-19T12:37:39","slug":"who-is-responsible-for-incorrect-publication-of-personal-data-in-the-belgian-official-journal","status":"publish","type":"post","link":"https:\/\/www.ictrechtswijzer.be\/en\/wie-is-verantwoordelijk-voor-een-foutieve-publicatie-van-persoonsgegevens-in-het-belgisch-staatsblad\/","title":{"rendered":"Who is responsible for incorrect publication of personal data in the Belgian Official Gazette?"},"content":{"rendered":"

A publication in the Belgian Official Journal<\/a> seems set in stone. But what if that publication, through human error, contains sensitive personal data that never should have been in it, such as your bank account number? A recent legal case has boned this question to the bone. The case, which began with an unfortunate mistake at a notary's office, exposed a fundamental conflict between the General Data Protection Regulation (GDPR)<\/a> and one of the cornerstones of our Belgian law: the immutability of the Belgian Official Gazette.<\/p>\n\n\n\n

The trigger<\/h4>\n\n\n\n

The case came to a head following the publication of an extract of a deed of capital reduction of a company. The notary who had drawn up the deed made a mistake and included in the extract for the Official Gazette not only the information required by law, but also the amounts repaid and bank account numbers<\/strong> of the shareholders involved. The publication of these financial data was in no way required by law.<\/p>\n\n\n\n

When the shareholder discovered this, he immediately took steps through his notary to have this highly sensitive information deleted, invoking his \"right to data erasure\" under the AVG. It seemed like a simple rectification, but it was anything but. The FPS Justice, as administrator of the Belgian Official Gazette, refused to remove the original publication. The department invoked the principle of immutability<\/strong>: what is in the Official Gazette cannot be changed or deleted retroactively. As an alternative, the FPS Justice suggested a new<\/em>, publish corrected excerpt, but that was no solution, as the original, erroneous publication with the bank details would simply remain available online.<\/p>\n\n\n\n

On this, the shareholder filed a complaint with the Data Protection Authority (GBA)<\/sup>.<\/p>\n\n\n\n

The legal action: GBA, Market Court and Court of Justice<\/h4>\n\n\n\n

The Data Protection Authority (DPA)<\/strong> did not follow the FPS Justice's reasoning. In its decision (no. 38\/2021) of March 23, 2021<\/a> the GBA ruled that the Belgian Official Gazette should indeed be considered a data controller and imposed a reprimand, as well as an order to still comply with the complainant's request and erase the personal data within 30 days. The GBA stated that according to the definition in the AVG, the data controller is the entity that processes the ends and means<\/strong> for data processing determines. Although the duty<\/em> until publication is in the law, it is the FPS of Justice that controls the specifics: the website, the databases, and how the data are presented and made searchable online. Because of this control over the \"how\" of publication, the Official Gazette met the definition.<\/p>\n\n\n\n

The Belgian State, acting for the FPS Justice, appealed this decision to the Market Court<\/strong>. The Market Court decided in a judgment of February 22, 2022<\/a> two preliminary questions to the Court of Justice of the European Union<\/strong> set:<\/p>\n\n\n\n

    \n
  1. Can a body such as the Belgian Official Gazette, which is legally obliged to publish deeds supplied by third parties without checking their content, be considered a \"data controller\"?<\/li>\n\n\n\n
  2. If so, is the Official Gazette solely responsible, or does it share that responsibility with the parties (in this case, the notary) who provided the data?<\/li>\n<\/ol>\n\n\n\n

    Court's ruling: a chain of separate responsibilities<\/h3>\n\n\n\n

    In his judgment of 11 January 2024 (C-231\/22)<\/a> the Court of Justice gave a clear and nuanced answer.<\/p>\n\n\n\n