GAS Rivierenland Analysis available

Website: gasrivierenland.be — Seat: Grote Markt 21, 2800 Mechelen.

Member municipalities (15): Berlaar, Bonheiden, Boortmeerbeek, Bornem, Duffel, Heist-op-den-Berg, Herent, Kortenberg, Lier, Mechelen, Nijlen, Putte, Puurs-Sint-Amands, Sint-Katelijne-Waver, Willebroek.

1. Identified GDPR and ePrivacy violations

A technical audit of gasrivierenland.be and its linked privacy and cookie pages reveals multiple shortcomings against the GDPR, the Belgian Law of 30 July 2018, and the Electronic Communications Act (art. 129 ECA).

2. GDPR articles violated (summary)

3. Online forms — security

Findings from a technical audit of the contestation form /snelheidsboete/andere-bestuurder and the landing page (April 2026).

4. Recommended defence arguments

• Invoke Article 82 GDPR (right to compensation) when unlawfully processed data is used.
• Argue that the controller itself fails to meet its duty to inform, which affects the lawfulness of the processing.
• Complaint possible with the Data Protection Authority (www.dataprotectionauthority.be).

German-speaking Community (DG) — 9 municipalities Analysis available

Members (9): Amel (Amblève), Büllingen, Burg-Reuland, Bütgenbach, Eupen, Kelmis, Lontzen, Raeren, Sankt Vith. All located in the Liège province.

Who handles GAS fines for DG municipalities?

The DG itself does not issue GAS fines. For its 9 municipalities, GAS is handled either by the municipality itself or by the Liège provincial sanctioning officer. The Liège provincial analysis therefore also applies.

Special language guarantees

Recommended defences

• Demand that all notifications, PVs and decisions be issued in German. Notifications in French or Dutch to DG residents may be null.
• Appeal to the Eupen police court (not Verviers or Liège), which operates in German.

WVI (West-Flanders Intercommunale) Analysis available

Website: wvi.be — Seat: Baron Ruzettelaan 35, 8310 Bruges.

GDPR and ePrivacy breaches

Recommended defences

• A "Cookie settings" link is not enough — prior consent is required.
• Complaint possible with the DPA.

Bruges & surroundings (GAS zone) Analysis available

Website: brugge.be — Seat: Burg 12, 8000 Bruges.

GDPR and ePrivacy breaches

Recommended defences

• The GAS fine is issued by the city but observation runs through the police zone — both data controllers must be GDPR-compliant, and neither is fully.
• Complaint possible with the DPA.

IDELUX Analysis available

Website: idelux.be — Seat: Drève de l’Arc-en-Ciel 98, 6700 Arlon.

GDPR and ePrivacy breaches

Recommended defences

• Lack of a valid cookie banner.
• Complaint possible with the DPA.

INASEP Analysis available

Website: inasep.be — Seat: Rue des Viaux 1b, 5100 Naninne.

GDPR and ePrivacy breaches

Recommended defences

• Omission of "Expansion" as processor.
• Complaint possible with the DPA.

BEP Analysis available

Website: bep.be — Seat: Avenue Sergent Vrithoff 2, 5000 Namur.

GDPR and ePrivacy breaches

Recommended defences

• BEP uses a 2018 document — well before Schrems II (2020). Violates Art. 5(2).
• Complaint possible with the DPA.

Intradel Analysis available

Website: intradel.be — Seat: Port de Herstal, 4040 Herstal.

GDPR and ePrivacy breaches

Recommended defences

• Documents exist but carry no date.
• Complaint possible with the DPA.

TIBI (Charleroi) Analysis available

Website: tibi.be — Seat: Rue du Déversoir 1, 6010 Couillet.

GDPR and ePrivacy breaches

Recommended defences

• Strong ground: TIBI uses a banner without a reject option — the Belgian DPA has issued multiple decisions (notably 81/2023) condemning this practice.
• Complaint possible with the DPA.

IPALLE Analysis available

Website: ipalle.be — Seat: Chemin de l’Eau Vive 1, 7503 Froyennes (Tournai).

GDPR and ePrivacy breaches

Recommended defences

• No date on privacy documents.
• Complaint possible with the DPA.

HYGEA (Mons-Borinage) Analysis available

Website: hygea.be — Seat: Rue de la Biscuiterie 19, 7110 Houdeng-Goegnies.

GDPR and ePrivacy breaches

Recommended defences

• Strong ground: the TLS error is objectively verifiable and demonstrates a direct Art. 32 breach. Attach a screenshot of the browser warning.
• Complaint possible with the DPA.

EcoWerf Analysis available

Website: ecowerf.be — Seat: Aarschotsesteenweg 210, 3012 Wilsele (Leuven).

GDPR and ePrivacy breaches

Recommended defences

• Paddle CMS not listed as processor.
• Complaint possible with the DPA.

Leiedal Analysis available

Website: leiedal.be — Seat: President Kennedypark 10, 8500 Kortrijk.

GDPR and ePrivacy breaches

Recommended defences

• A "Cookie preferences" link is not enough — prior consent is still required for non-essential cookies.
• Complaint possible with the DPA.

IGEAN milieu & veiligheid — intergemeentelijke GAS-dienst Analysis available

Data controller: IGEAN milieu & veiligheid — Doornaardstraat 60, 2160 Wommelgem — Website: www.igean.be.

This annex is intended to supplement the contestation of a sanction or retribution by IGEAN milieu & veiligheid — intergemeentelijke GAS-dienst with a technical exposition. The findings were recorded on 22 August 2026 on www.igean.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

IGEMO Analysis available

Website: igemo.be — Seat: Schoutetstraat 2, 2800 Mechelen. DPO: Sigrid Palmers — privacy@igemo.be.

1. Identified GDPR and ePrivacy breaches

2. Breached GDPR articles (summary)

3. Recommended defences

• Argue IGEMO has been in default for five years, undermining the credibility of its enforcement.
• Schrems II (CJEU C-311/18) applies to Microsoft/MailChimp transfers without supplementary measures.
• Complaint possible with the DPA.

IOK (Kempen) Analysis available

Website: iok.be — Seat: Antwerpseweg 1A bus 1, 2440 Geel. DPO contact: privacy@iok.be (via Welzijnszorg Kempen).

1. Identified GDPR and ePrivacy breaches

2. Breached GDPR articles (summary)

3. Recommended defences

• Argue the reference to a non-public register violates Art. 13(2)(a) GDPR.
• Complaint possible with the DPA.
• Article 82 GDPR (compensation) if unlawful processing is proven.

Haviland (Halle-Vilvoorde) Analysis available

Website: haviland.be — Data controller: Haviland Regiopartners, Poverstraat 75 bus 47, 1731 Asse — Information security contact: informatieveiligheid@haviland.be.

Member municipalities (23): Affligem, Asse, Beersel, Dilbeek, Grimbergen, Kampenhout, Kapelle-op-den-Bos, Lennik, Liedekerke, Londerzeel, Machelen, Meise, Merchtem, Opwijk, Pepingen, Roosdaal, Sint-Pieters-Leeuw, Steenokkerzeel, Ternat, Vilvoorde, Wemmel, Zaventem, Zemst. Not every municipality participates in every GAS category (GAS 1-2-3, blue zone, GAS 4, GAS 5).

1. Identified GDPR and ePrivacy violations

A technical audit of haviland.be on 17 April 2026 reveals the following shortcomings against the GDPR, the Belgian Law of 30 July 2018, and art. 129 of the Electronic Communications Act.

2. Key violations (summary)

3. Online forms — security

Findings from a technical audit of haviland.be/nl and haviland.be/nl/contact (April 2026). Note: the contact form is likely client-rendered (Paddle CMS); only the page wrapper is statically inspectable.

4. Recommended defence arguments

• Point to the demonstrable contradiction between the privacy policy and the cookie statement — this affects the lawfulness of the processing (Art. 6 GDPR).
• Invoke Article 82 GDPR (right to compensation) for unlawful use of tracking without valid consent.
• Complaint possible with the Data Protection Authority and the Flemish Supervisory Commission (both cited in the policy itself).

City of Brussels / Stad Brussel / Ville de Bruxelles Analysis available

Website: brussel.be — Contestation portal: brucity.cityenforcement.com — Data controller: City of Brussels (KBO 0207.373.429), Hallenstraat 4, 1000 Brussels — DPO: dpo@brucity.be.

Member municipality: City of Brussels. Contestation deadline: 10 calendar days from receipt of the payment invitation. A contestation does not suspend the payment obligation; non-payment adds €15 in administrative costs.

1. Identified GDPR and ePrivacy violations

Audit on 17 April 2026 of the pages brussel.be/parkeren-bezwaar-tegen-retributie, brussel.be/wettelijke-vermeldingen and the portal brucity.cityenforcement.com.

2. GDPR articles violated (summary)

3. Online forms — security

4. Recommended defence arguments

• Point to the factual contradiction between the anonymity claim and the collection of plate + report reference.
• Invoke DPA decisions 56/2026 and 129/2023.
• Demand production of the DPIA for ANPR/scan vehicles and a valid processor agreement with cityenforcement.
• Complaint possible with the Belgian Data Protection Authority (Drukpersstraat 35, 1000 Brussels).

Province de Hainaut Analysis available

Data controller: Province de Hainaut — Bureau provincial des Amendes Administratives — Avenue Général de Gaulle 102, 7000 Mons — Website: www.hainaut.be.

This annex is intended to supplement the contestation of a sanction or retribution by Province de Hainaut with a technical exposition. The findings were recorded on 22 August 2026 on www.hainaut.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Province de Liège Analysis available

Data controller: Province de Liège — Fonctionnaires sanctionnateurs provinciaux — Rue Ernest Solvay 11, 4000 Liège — Website: www.provincedeliege.be.

This annex is intended to supplement the contestation of a sanction or retribution by Province de Liège with a technical exposition. The findings were recorded on 22 August 2026 on www.provincedeliege.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Province de Namur Analysis available

Data controller: Province de Namur — Bureau des amendes administratives — Rue Henri Blès 190C, 5000 Namur — Website: www.province.namur.be.

This annex is intended to supplement the contestation of a sanction or retribution by Province de Namur with a technical exposition. The findings were recorded on 22 August 2026 on www.province.namur.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Province de Luxembourg Analysis available

Data controller: Province de Luxembourg — Service des amendes administratives — Place Léopold 1, 6700 Arlon — Website: www.province.luxembourg.be.

This annex is intended to supplement the contestation of a sanction or retribution by Province de Luxembourg with a technical exposition. The findings were recorded on 22 August 2026 on www.province.luxembourg.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Province du Brabant wallon Analysis available

Data controller: Province du Brabant wallon — Fonctionnaire sanctionnateur — Place du Brabant wallon 1, 1300 Wavre — Website: www.brabantwallon.be.

This annex is intended to supplement the contestation of a sanction or retribution by Province du Brabant wallon with a technical exposition. The findings were recorded on 22 August 2026 on www.brabantwallon.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Stad Mechelen Analysis available

Data controller: Stad Mechelen — Grote Markt 21, 2800 Mechelen — Website: www.mechelen.be.

This annex is intended to supplement the contestation of a sanction or retribution by Stad Mechelen with a technical exposition. The findings were recorded on 22 August 2026 on www.mechelen.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Ville d'Arlon Analysis available

Data controller: Ville d'Arlon — Rue Paul Reuter 8, 6700 Arlon — Website: www.arlon.be.

This annex is intended to supplement the contestation of a sanction or retribution by Ville d'Arlon with a technical exposition. The findings were recorded on 22 August 2026 on www.arlon.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Commune de Saint-Josse-ten-Noode / Gemeente Sint-Joost-ten-Node Analysis available

Data controller: Commune de Saint-Josse-ten-Noode / Gemeente Sint-Joost-ten-Node — Avenue de l'Astronomie 13, 1210 Saint-Josse-ten-Noode — Website: www.sjtn.brussels.

This annex is intended to supplement the contestation of a sanction or retribution by Commune de Saint-Josse-ten-Noode / Gemeente Sint-Joost-ten-Node with a technical exposition. The findings were recorded on 22 August 2026 on www.sjtn.brussels and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Provincie Vlaams-Brabant Analysis available

Data controller: Provincie Vlaams-Brabant — Provincieplein 1, 3010 Leuven — Website: www.vlaamsbrabant.be.

This annex is intended to supplement the contestation of a sanction or retribution by Provincie Vlaams-Brabant with a technical exposition. The findings were recorded on 22 August 2026 on www.vlaamsbrabant.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Provincie Oost-Vlaanderen Analysis available

Data controller: Provincie Oost-Vlaanderen — Gouvernementstraat 1, 9000 Gent — Website: oost-vlaanderen.be.

This annex is intended to supplement the contestation of a sanction or retribution by Provincie Oost-Vlaanderen with a technical exposition. The findings were recorded on 22 August 2026 on oost-vlaanderen.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Provincie Limburg Analysis available

Data controller: Provincie Limburg — Universiteitslaan 1, 3500 Hasselt — Website: www.limburg.be.

This annex is intended to supplement the contestation of a sanction or retribution by Provincie Limburg with a technical exposition. The findings were recorded on 22 August 2026 on www.limburg.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Stad Ieper Analysis available

Data controller: Stad Ieper (KBO 0207.518.630) — Grote Markt 34, 8900 Ieper — Website: www.ieper.be.

This annex is intended to supplement the contestation of a sanction or retribution by Stad Ieper with a technical exposition. The findings were recorded on 22 August 2026 on www.ieper.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Stad Eeklo Analysis available

Data controller: Stad Eeklo (KBO 0207.461.616) — Industrielaan 2, 9900 Eeklo — Website: www.eeklo.be.

This annex is intended to supplement the contestation of a sanction or retribution by Stad Eeklo with a technical exposition. The findings were recorded on 22 August 2026 on www.eeklo.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Stad Halle Analysis available

Data controller: Stad Halle (KBO 0207.528.640) — Oudstrijdersplein 18, 1500 Halle — Website: www.halle.be.

This annex is intended to supplement the contestation of a sanction or retribution by Stad Halle with a technical exposition. The findings were recorded on 22 August 2026 on www.halle.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Stad Tienen Analysis available

Data controller: Stad Tienen (KBO 0207.537.929) — Grote Markt 27, 3300 Tienen — Website: www.tienen.be.

This annex is intended to supplement the contestation of a sanction or retribution by Stad Tienen with a technical exposition. The findings were recorded on 22 August 2026 on www.tienen.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Ville de Dinant Analysis available

Data controller: Ville de Dinant (BCE 0207.360.125) — Rue Grande 112, 5500 Dinant — Website: www.dinant.be.

This annex is intended to supplement the contestation of a sanction or retribution by Ville de Dinant with a technical exposition. The findings were recorded on 22 August 2026 on www.dinant.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Ville de Wavre Analysis available

Data controller: Ville de Wavre (BCE 0207.381.392) — Place de l'Hôtel de Ville, 1300 Wavre — Website: www.wavre.be.

This annex is intended to supplement the contestation of a sanction or retribution by Ville de Wavre with a technical exposition. The findings were recorded on 22 August 2026 on www.wavre.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Ville de Huy Analysis available

Data controller: Ville de Huy (BCE 0207.348.088) — Grand-Place 1, 4500 Huy — Website: www.huy.be.

This annex is intended to supplement the contestation of a sanction or retribution by Ville de Huy with a technical exposition. The findings were recorded on 22 August 2026 on www.huy.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Ville d'Ath Analysis available

Data controller: Ville d'Ath (BCE 0207.362.500) — Rue de Pintamont 54, 7800 Ath — Website: www.ath.be.

This annex is intended to supplement the contestation of a sanction or retribution by Ville d'Ath with a technical exposition. The findings were recorded on 22 August 2026 on www.ath.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Commune de Waterloo Analysis available

Data controller: Commune de Waterloo (BCE 0216.694.712) — Rue François Libert 28, 1410 Waterloo — Website: www.waterloo.be.

This annex is intended to supplement the contestation of a sanction or retribution by Commune de Waterloo with a technical exposition. The findings were recorded on 22 August 2026 on www.waterloo.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Stad Deinze Analysis available

Data controller: Stad Deinze (KBO 0207.489.352) — Brielstraat 2, 9800 Deinze — Website: www.deinze.be.

This annex is intended to supplement the contestation of a sanction or retribution by Stad Deinze with a technical exposition. The findings were recorded on 22 August 2026 on www.deinze.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Commune d'Ixelles / Gemeente Elsene Analysis available

Data controller: Commune d'Ixelles (BCE 0207.387.826) — Chaussée d'Ixelles 168, 1050 Ixelles — Website: www.ixelles.be.

This annex is intended to supplement the contestation of a sanction or retribution by Commune d'Ixelles / Gemeente Elsene with a technical exposition. The findings were recorded on 22 August 2026 on www.ixelles.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Commune d'Uccle / Gemeente Ukkel Analysis available

Data controller: Commune d'Uccle (BCE 0207.393.074) — Place Jean Vander Elst 29, 1180 Uccle — Website: www.uccle.be.

This annex is intended to supplement the contestation of a sanction or retribution by Commune d'Uccle / Gemeente Ukkel with a technical exposition. The findings were recorded on 22 August 2026 on www.uccle.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Commune de Forest / Gemeente Vorst Analysis available

Data controller: Commune de Forest (BCE 0207.387.529) — Rue du Curé 2, 1190 Forest — Website: www.forest.brussels.

This annex is intended to supplement the contestation of a sanction or retribution by Commune de Forest / Gemeente Vorst with a technical exposition. The findings were recorded on 22 August 2026 on www.forest.brussels and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Commune de Jette / Gemeente Jette Analysis available

Data controller: Commune de Jette (BCE 0207.389.804) — Chaussée de Wemmel 100, 1090 Jette — Website: jette.brussels.

This annex is intended to supplement the contestation of a sanction or retribution by Commune de Jette / Gemeente Jette with a technical exposition. The findings were recorded on 22 August 2026 on jette.brussels and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Commune de Koekelberg / Gemeente Koekelberg Analysis available

Data controller: Commune de Koekelberg (BCE 0207.387.727) — Place Henri Vanhuffel 6, 1081 Koekelberg — Website: www.koekelberg.be.

This annex is intended to supplement the contestation of a sanction or retribution by Commune de Koekelberg / Gemeente Koekelberg with a technical exposition. The findings were recorded on 22 August 2026 on www.koekelberg.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Commune de Berchem-Sainte-Agathe / Gemeente Sint-Agatha-Berchem Analysis available

Data controller: Commune de Berchem-Sainte-Agathe (BCE 0207.386.240) — Avenue du Roi Albert 33, 1082 Berchem-Sainte-Agathe — Website: www.1082.be.

This annex is intended to supplement the contestation of a sanction or retribution by Commune de Berchem-Sainte-Agathe / Gemeente Sint-Agatha-Berchem with a technical exposition. The findings were recorded on 22 August 2026 on www.1082.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Commune de Watermael-Boitsfort / Gemeente Watermaal-Bosvoorde Analysis available

Data controller: Commune de Watermael-Boitsfort (BCE 0207.393.470) — Place Antoine Gilson 1, 1170 Watermael-Boitsfort — Website: www.watermael-boitsfort.be.

This annex is intended to supplement the contestation of a sanction or retribution by Commune de Watermael-Boitsfort / Gemeente Watermaal-Bosvoorde with a technical exposition. The findings were recorded on 22 August 2026 on www.watermael-boitsfort.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Commune d'Evere / Gemeente Evere Analysis available

Data controller: Commune d'Evere (BCE 0207.384.064) — Square Hoedemaekers 10, 1140 Evere — Website: www.evere.brussels.

This annex is intended to supplement the contestation of a sanction or retribution by Commune d'Evere / Gemeente Evere with a technical exposition. The findings were recorded on 22 August 2026 on www.evere.brussels and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Commune de Ganshoren / Gemeente Ganshoren Analysis available

Data controller: Commune de Ganshoren (BCE 0207.387.826) — Avenue Charles-Quint 140, 1083 Ganshoren — Website: www.ganshoren.be.

This annex is intended to supplement the contestation of a sanction or retribution by Commune de Ganshoren / Gemeente Ganshoren with a technical exposition. The findings were recorded on 22 August 2026 on www.ganshoren.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Commune d'Auderghem / Gemeente Oudergem Analysis available

Data controller: Commune d'Auderghem (BCE 0207.386.438) — Rue Emile Idiers 12, 1160 Auderghem — Website: www.auderghem.be.

This annex is intended to supplement the contestation of a sanction or retribution by Commune d'Auderghem / Gemeente Oudergem with a technical exposition. The findings were recorded on 22 August 2026 on www.auderghem.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Commune de Woluwe-Saint-Lambert / Gemeente Sint-Lambrechts-Woluwe Analysis available

Data controller: Commune de Woluwe-Saint-Lambert (BCE 0207.397.034) — Avenue Paul Hymans 2, 1200 Woluwe-Saint-Lambert — Website: www.woluwe1200.be.

This annex is intended to supplement the contestation of a sanction or retribution by Commune de Woluwe-Saint-Lambert / Gemeente Sint-Lambrechts-Woluwe with a technical exposition. The findings were recorded on 22 August 2026 on www.woluwe1200.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Commune de Woluwe-Saint-Pierre / Gemeente Sint-Pieters-Woluwe Analysis available

Data controller: Commune de Woluwe-Saint-Pierre (BCE 0207.395.153) — Avenue Charles Thielemans 93, 1150 Woluwe-Saint-Pierre — Website: www.woluwe1150.be.

This annex is intended to supplement the contestation of a sanction or retribution by Commune de Woluwe-Saint-Pierre / Gemeente Sint-Pieters-Woluwe with a technical exposition. The findings were recorded on 22 August 2026 on www.woluwe1150.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Commune d'Anderlecht / Gemeente Anderlecht Analysis available

Data controller: Commune d'Anderlecht (BCE 0207.393.470) — Place du Conseil 1, 1070 Anderlecht — Website: www.anderlecht.be.

This annex is intended to supplement the contestation of a sanction or retribution by Commune d'Anderlecht / Gemeente Anderlecht with a technical exposition. The findings were recorded on 22 August 2026 on www.anderlecht.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Commune de Schaerbeek / Gemeente Schaarbeek Analysis available

Data controller: Commune de Schaerbeek (BCE 0207.377.988) — Place Colignon, 1030 Schaerbeek — Website: www.1030.be.

This annex is intended to supplement the contestation of a sanction or retribution by Commune de Schaerbeek / Gemeente Schaarbeek with a technical exposition. The findings were recorded on 22 August 2026 on www.1030.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Commune de Molenbeek-Saint-Jean / Gemeente Sint-Jans-Molenbeek Analysis available

Data controller: Commune de Molenbeek-Saint-Jean (BCE 0207.391.193) — Rue du Comte de Flandre 20, 1080 Molenbeek-Saint-Jean — Website: www.molenbeek.irisnet.be.

This annex is intended to supplement the contestation of a sanction or retribution by Commune de Molenbeek-Saint-Jean / Gemeente Sint-Jans-Molenbeek with a technical exposition. The findings were recorded on 22 August 2026 on www.molenbeek.irisnet.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Commune d'Etterbeek Analysis available

Data controller: Commune d'Etterbeek (BCE 0207.383.274) — Avenue d'Auderghem 113-117, 1040 Etterbeek — Website: etterbeek.brussels.

This annex is intended to supplement the contestation of a sanction or retribution by Commune d'Etterbeek with a technical exposition. The findings were recorded on 22 August 2026 on etterbeek.brussels and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Stad Turnhout Analysis available

Data controller: Stad Turnhout (KBO 0207.537.434) — Campus Blairon 200, 2300 Turnhout — Website: www.turnhout.be.

This annex is intended to supplement the contestation of a sanction or retribution by Stad Turnhout with a technical exposition. The findings were recorded on 22 August 2026 on www.turnhout.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Stad Beringen Analysis available

Data controller: Stad Beringen (KBO 0207.525.461) — Mijnschoolstraat 88, 3580 Beringen — Website: www.beringen.be.

This annex is intended to supplement the contestation of a sanction or retribution by Stad Beringen with a technical exposition. The findings were recorded on 22 August 2026 on www.beringen.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Stad Lommel Analysis available

Data controller: Stad Lommel (KBO 0207.519.026) — Hertog Janplein 1, 3920 Lommel — Website: www.lommel.be.

This annex is intended to supplement the contestation of a sanction or retribution by Stad Lommel with a technical exposition. The findings were recorded on 22 August 2026 on www.lommel.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Stad Geel Analysis available

Data controller: Stad Geel (KBO 0207.524.966) — Werft 20, 2440 Geel — Website: www.geel.be.

This annex is intended to supplement the contestation of a sanction or retribution by Stad Geel with a technical exposition. The findings were recorded on 22 August 2026 on www.geel.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Ville de Mouscron Analysis available

Data controller: Ville de Mouscron (BCE 0207.356.899) — Grand-Place 1, 7700 Mouscron — Website: www.mouscron.be.

This annex is intended to supplement the contestation of a sanction or retribution by Ville de Mouscron with a technical exposition. The findings were recorded on 22 August 2026 on www.mouscron.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Stad Kortrijk Analysis available

Data controller: Stad Kortrijk (KBO 0207.494.678) — Grote Markt 54, 8500 Kortrijk — Website: www.kortrijk.be.

This annex is intended to supplement the contestation of a sanction or retribution by Stad Kortrijk with a technical exposition. The findings were recorded on 22 August 2026 on www.kortrijk.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Stad Oostende Analysis available

Data controller: Stad Oostende (KBO 0207.473.295) — Vindictivelaan 1, 8400 Oostende — Website: www.oostende.be.

This annex is intended to supplement the contestation of a sanction or retribution by Stad Oostende with a technical exposition. The findings were recorded on 22 August 2026 on www.oostende.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Stad Sint-Niklaas Analysis available

Data controller: Stad Sint-Niklaas (KBO 0207.486.859) — Grote Markt 1, 9100 Sint-Niklaas — Website: www.sint-niklaas.be.

This annex is intended to supplement the contestation of a sanction or retribution by Stad Sint-Niklaas with a technical exposition. The findings were recorded on 22 August 2026 on www.sint-niklaas.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Stad Aalst Analysis available

Data controller: Stad Aalst (KBO 0207.449.148) — Grote Markt 3, 9300 Aalst — Website: aalst.be.

This annex is intended to supplement the contestation of a sanction or retribution by Stad Aalst with a technical exposition. The findings were recorded on 22 August 2026 on aalst.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Stad Genk Analysis available

Data controller: Stad Genk (KBO 0207.522.491) — Stadsplein 1, 3600 Genk — Website: www.genk.be.

This annex is intended to supplement the contestation of a sanction or retribution by Stad Genk with a technical exposition. The findings were recorded on 22 August 2026 on www.genk.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Stad Roeselare Analysis available

Data controller: Stad Roeselare (KBO 0207.490.219) — Botermarkt 2, 8800 Roeselare — Website: www.roeselare.be.

This annex is intended to supplement the contestation of a sanction or retribution by Stad Roeselare with a technical exposition. The findings were recorded on 22 August 2026 on www.roeselare.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Ville de Tournai Analysis available

Data controller: Ville de Tournai (BCE 0207.352.297) — Rue Saint-Martin 52, 7500 Tournai — Website: www.tournai.be.

This annex is intended to supplement the contestation of a sanction or retribution by Ville de Tournai with a technical exposition. The findings were recorded on 22 August 2026 on www.tournai.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Ville de La Louvière Analysis available

Data controller: Ville de La Louvière (BCE 0207.382.086) — Place Communale 1, 7100 La Louvière — Website: www.lalouviere.be.

This annex is intended to supplement the contestation of a sanction or retribution by Ville de La Louvière with a technical exposition. The findings were recorded on 22 August 2026 on www.lalouviere.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Ville de Seraing Analysis available

Data controller: Ville de Seraing (BCE 0207.335.221) — Place Communale 8, 4100 Seraing — Website: www.seraing.be.

This annex is intended to supplement the contestation of a sanction or retribution by Ville de Seraing with a technical exposition. The findings were recorded on 22 August 2026 on www.seraing.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Ville de Verviers Analysis available

Data controller: Ville de Verviers (BCE 0207.356.048) — Place du Marché 55, 4800 Verviers — Website: www.verviers.be.

This annex is intended to supplement the contestation of a sanction or retribution by Ville de Verviers with a technical exposition. The findings were recorded on 22 August 2026 on www.verviers.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Ville de Liège Analysis available

Data controller: Ville de Liège (BCE 0207.343.238) — Place du Marché 2, 4000 Liège — Website: www.liege.be.

This annex is intended to supplement the contestation of a sanction or retribution by Ville de Liège with a technical exposition. The findings were recorded on 22 August 2026 on www.liege.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Ville de Namur Analysis available

Data controller: Ville de Namur (BCE 0207.341.854) — Hôtel de Ville, 5000 Namur — Website: www.namur.be.

This annex is intended to supplement the contestation of a sanction or retribution by Ville de Namur with a technical exposition. The findings were recorded on 22 August 2026 on www.namur.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Ville de Mons Analysis available

Data controller: Ville de Mons (BCE 0207.272.119) — Grand-Place 22, 7000 Mons — Website: www.mons.be.

This annex is intended to supplement the contestation of a sanction or retribution by Ville de Mons with a technical exposition. The findings were recorded on 22 August 2026 on www.mons.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Ville de Charleroi Analysis available

Data controller: Ville de Charleroi (BCE 0207.362.105) — Place Charles II 14-15, 6000 Charleroi — Website: www.charleroi.be.

This annex is intended to supplement the contestation of a sanction or retribution by Ville de Charleroi with a technical exposition. The findings were recorded on 22 August 2026 on www.charleroi.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Stad Antwerpen Analysis available

Data controller: Stad Antwerpen (KBO 0207.500.123) — Dienst Mobiliteit & Parkeren — Grote Markt 1, 2000 Antwerpen — Website: www.antwerpen.be.

This annex is intended to supplement the contestation of a sanction or retribution by Stad Antwerpen with a technical exposition. The findings were recorded on 22 August 2026 on www.antwerpen.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Stad Gent Analysis available

Data controller: Stad Gent (KBO 0207.451.227) — Botermarkt 1, 9000 Gent — Website: stad.gent.

This annex is intended to supplement the contestation of a sanction or retribution by Stad Gent with a technical exposition. The findings were recorded on 22 August 2026 on stad.gent and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Stad Brugge Analysis available

Data controller: Stad Brugge (KBO 0207.528.035) — Burg 12, 8000 Brugge — Website: www.brugge.be.

This annex is intended to supplement the contestation of a sanction or retribution by Stad Brugge with a technical exposition. The findings were recorded on 22 August 2026 on www.brugge.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Stad Leuven Analysis available

Data controller: Stad Leuven (KBO 0207.475.077) — Professor Van Overstraetenplein 1, 3000 Leuven — Website: www.leuven.be.

This annex is intended to supplement the contestation of a sanction or retribution by Stad Leuven with a technical exposition. The findings were recorded on 22 August 2026 on www.leuven.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.

Stad Hasselt Analysis available

Data controller: Stad Hasselt (KBO 0207.476.069) — Groenplein 1, 3500 Hasselt — Website: www.hasselt.be.

This annex is intended to supplement the contestation of a sanction or retribution by Stad Hasselt with a technical exposition. The findings were recorded on 22 August 2026 on www.hasselt.be and indicate shortcomings in GDPR, ePrivacy and security of processing.

1. Identified shortcomings

2. Legal qualification

3. Recommended defence arguments

• the contested sanction be set aside or reformed for unlawful processing of personal data;
• the identified technical shortcomings be placed on record;
• in the alternative, that a fresh review be conducted on the basis of lawfully obtained data;
• the data subject's right to lodge a complaint with the Belgian Data Protection Authority be preserved;
• the reservation of the right to compensation under article 82 GDPR be acknowledged.