The Belgian Data Protection Authority (DPA) highlights the increasing risks regarding the protection of personal data within youth aid organizations and child care structures, such as summer camps.

The DPA's Inspection Service notes a rise in compliance risks due to new legal obligations, such as the verification of criminal record extracts for camp leaders ("model 596_2") and the processing of national registry numbers for tax certificates. Beyond the excessive sharing of children's photos by their parents, the authority points out deeper failings: processing of health data through unsecured channels, inadequate management of parental consent, and insufficient investment in risk analysis. It is also noted that many private sector organizations fail to appoint a data protection officer, an obligation in force since the end of 2018 for those processing national registry numbers. During its inspections, the Inspection Service systematically checks for the presence of a compliant privacy statement, the appointment of such an officer, and the completion of a data protection impact assessment (DPIA), reminding that lack of investment does not justify a GDPR infringement.