The Belgian Data Protection Authority recently ruled on a
complaint after an employer shared a full court judgment with all
its staff, revealing the personal data of employees and trade
unions involved in the case. Below we outline what happened, the
DPA's findings, and the key lessons for employers.
The complaint
In 2014, two trade unions and several employees initiated
proceedings against the employer concerning the legality of a part
of its remuneration system. The employer won on appeal and shared
the full judgment internally with all its employees by e-mail. The
majority of the employees were placed in blind-copy (Bcc), making
it impossible to see who had received the e-mail. However, the
judgment was neither anonymised nor pseudonymised, revealing
the names and addresses of the employees involved in the case
to all recipients. One of them was an employees' representative
(also an employee of the company).
