Belgian DPA's Investigation against Toerisme Vlaanderen

Reprimand issued


The Belgian DPA issues a reprimand to a government agency for failing to provide website visitors with clear information and a means to refuse non-strictly necessary cookies.

Our analysis

The Inspection Service of the Belgian DPA initiated an investigation into a regional government agency for tourism, which collects personal data of Airbnb hosts through Airbnb as an intermediary. The controller's legal task of monitoring the quality of Airbnb hosts forms the legal basis for the collection of personal data. However, the Inspection Service found that the controller's interpretation of its legal obligations was too broad and that its privacy policy contained wrong and missing information, violating Article 12(1), Article 13, and Article 14 GDPR. The controller admits to having previously had issues with its privacy policy but has since resolved them. Additionally, the Inspection Service found that the website had non-strictly necessary cookies and lacked clear information on how to refuse them. The DPA confirms the violations of the privacy policy and the cookie policy but dismisses the report on non-strictly necessary cookies. The DPA also determines that the controller did not proactively involve the DPO, resulting in a breach of Article 38(1) and Article 39(1) GDPR. However, the DPA concludes that the controller can rely on legal obligation under Article 6(1)(c) GDPR to process the personal data of Airbnb hosts as the purpose is clear, necessary, and proportional.


The DPA issued a reprimand to the controller for past breaches of GDPR, but dismissed any parts that did not constitute GDPR infractions. The DPA also clarified that it did not have the authority to impose a fine on a governmental agency.


Belgian DPA and Toerisme Vlaanderen

Case number


Related deceptive patterns

Related laws

Legal enforcement database by Leiser, Santos and Doshi

The information about laws and cases on this website is brought to you by the Leiser, Santos and Doshi enforcement database.

About us