meta_id 3118663

On 30 April 2026, Belgium's Data Protection Authority (Autorité de protection des données) issued a substantive decision (96/2026) regarding a complaint about the dual filing of a customer as a non-payer. The case concerned a Belgian bank that transmitted personal data to the National Bank of Belgium (Banque Nationale de Belgique) for registration in the Unregistered Records (Enregistrements non régis) of the Personal Credit Register (Centrale des crédits aux particuliers), in addition to existing registration in the Business Credit Register (Centrale des crédits aux entreprises). The complainant, a self-employed individual, defaulted on two investment loans from February and March 2020 respectively. The bank subsequently filed the customer in both registers without providing explicit prior notification of the dual registration possibility. Additionally, the bank incorrectly classified one loan as an "instalment loan" (prêt à tempérament) in the Unregistered Records when it was actually a "term loan" (prêt à terme), as correctly recorded in the Business Credit Register. The Authority found the bank violated the transparency principle under Articles 5.1(a), 12.1, and 13 of the General Data Protection Regulation (GDPR) by failing to inform the customer sufficiently clearly about the possibility of registration in the Unregistered Records, making the treatment reasonably unforeseeable. The Authority also found a breach of the accuracy principle under Article 5.1(d) of the GDPR due to the incorrect loan classification. The Authority issued reprimands for both violations. The complaints regarding purpose limitation and lawfulness were dismissed on technical grounds, as the dual registration constituted part of the original data collection purpose rather than a separate secondary use.