1. HTTPS and HSTS — why all traffic must be encrypted

When you fill in a contestation form on a municipal website, your data (licence plate, name, case number) travels across dozens of intermediary networks before reaching the municipality’s server. Without HTTPS (TLS encryption), every hop — the café Wi-Fi, an ISP’s router, or an attacker on the same network — can literally read or alter the data.

HTTPS alone isn’t enough: an attacker can intercept the first connection and force the user back to http:// (the SSL-stripping attack). HSTS (Strict-Transport-Security) fixes this: the server tells the browser “only come back via HTTPS for the next 1–2 years”.

2. Content-Security-Policy — barrier against script injection

A Content-Security-Policy (CSP) tells the browser which scripts, stylesheets and images may be loaded from which sources. Without CSP, any script from any server can execute — an attacker who exploits a cross-site scripting flaw can freely load scripts from their own server.

A good CSP uses default-deny: anything not explicitly allowed is blocked.

3. Referrer-Policy — leak of case data via URLs

By default, your browser sends the full URL of the previous page as the Referer header. Problematic when the URL carries sensitive data — PV reference, token, licence plate. municipality.be/contest?pv=20241234&plate=1-ABC-123 is then forwarded in plain text to every external script.

4. Permissions-Policy — control over camera, microphone, location

The Permissions-Policy header (formerly Feature-Policy) lets the server decide which sensor permissions (camera, microphone, GPS) the page may even request. For a contestation form there’s no legitimate reason to ask.

5. X-Frame-Options — clickjacking protection

Clickjacking is an attack where the legitimate municipal page is loaded into an invisible iframe on an attacker site. The user clicks on what looks like a game, but the click is actually passed to the hidden iframe — e.g. onto a “Withdraw my contestation” button.

6. X-Content-Type-Options — MIME-sniffing abuse

Browsers sometimes try to “guess” a file’s type. Attackers exploit that: they upload an apparently innocent image which is then interpreted as JavaScript. The one-line header X-Content-Type-Options: nosniff turns that guessing off.

7. Third-party trackers — Google Analytics, GTM, Facebook Pixel

Many municipal sites load — often without the administrator knowing — scripts from large US technology companies. Google Tag Manager isn’t a tracker itself, but a loader of other trackers; once active, it can asynchronously load Google Analytics, Facebook Pixel, LinkedIn Insight Tag and sometimes dozens of other things.

Each script gets access to your IP, browser version, OS, URL and event parameters. With Facebook Pixel, visits are linked to your Facebook account if you were ever signed in.

8. Schrems II and US transfers

The CJEU invalidated the EU-US Privacy Shield in July 2020 (Schrems II, C-311/18). US intelligence agencies have overly broad powers to intercept EU citizens’ data; EU citizens have no effective judicial remedy in the US.

Any transfer — via GA, Pixel, Google Fonts, AWS — is in principle unlawful unless supplementary safeguards exist (SCCs, Transfer Impact Assessment, encryption).

9. Cookie consent — art. 129 ECA / ePrivacy

The ePrivacy directive (in Belgium via art. 129 ECA) requires prior and explicit consent for any non-essential tracker. “Prior” means: before the browser loads the tracker. In practice many sites load GA and Pixel immediately and only then show the cookie banner — the damage is already done.

10. Processor agreements — art. 28 GDPR

Every external service a municipality uses (ANPR camera vendor, collection agency, hosting provider) requires a written processor agreement before the first processing. The DPA is strict: a retroactively signed DPA cannot cure earlier processing (DPA 56/2026 Dilbeek).

11. Outdated software — Drupal 7 is EOL

Drupal 7 reached end-of-life on 5 January 2025. No more security updates. Any vulnerability disclosed after that date stays open forever. Several Belgian public sites (April 2026) are still running Drupal 7.

12. Secrets in the browser — API tokens in the HTML

Sometimes our audit discovers an API token directly in the HTML (Mapbox, Google Maps, CRM key). Everything in the HTML is visible to whoever loads the page. An attacker can take over the token and charge it against the municipality.

13. How all this translates into your contestation

Each of the findings above is a single data point. We combine them into four coherent argument lines:

a. Unlawful evidence collection

If the municipality processed your data by inadequate means, the underlying evidence chain is legally flawed. The fact that you received the fine does not change the unlawful nature of the collection.

b. Absence of a legal basis

For marketing analytics on a public site there is no legal basis. Without a valid basis, processing is unlawful and the sanction can be voided.

c. Chapter V violations (US transfers)

Every GA/Pixel/Fonts integration without a Transfer Impact Assessment breaches arts. 44–49 GDPR. Sufficient for a complaint with the DPA.

d. Missing security measures

An accumulation of small gaps shows the municipality has no systematic security approach. Strengthens arguments (a) and (c).