[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdp3bk2mIws8ezpDoTEL4s3u-aieTdCJb7E5yeFK1UwA":3},{"article":4,"iocs":44},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":21,"category":22,"article_tags":26},"55e10a4f-81f5-476c-93a2-5fa331013f81","C. A. - 2025\u002FAR\u002F2079","c-a-2025-ar-2079-ff8c24","Fixed link ← Older revision Revision as of 08:05, 8 October 2026 Line 7: Line 7: |Court_Original_Name=Cour d'appel Bruxelles |Court_Original_Name=Cour d'appel Bruxelles |Court_English_Name=Court of Appeal of Brussels |Court_English_Name=Court of Appeal of Brussels |Court_With_Country=C. A. (Belgium) |Court_With_Country=Court of Appeal of Brussels (Belgium) |Case_Number_Name=2025\u002FAR\u002F2079 |Case_Number_Name=2025\u002FAR\u002F2079","The Brussels Court of Appeal upheld a finding that a data broker, Infobel S.A., unlawfully processed and resold personal data for direct marketing without valid consent. The court reduced the Belgian DPA's initial €40,000 fine to €5,000, citing the low severity of the violation, though it acknowledged the unlawful processing of data obtained from a telecom operator.","Court reduces data broker's GDPR fine from €40,000 to €5,000 for unlawful data processing.","Help C. A. - 2025\u002FAR\u002F2079: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 07:34, 24 June 2026 view sourceDs (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators277 editsm Tag: Visual edit← Older edit Latest revision as of 08:05, 8 October 2026 view source Sfl (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators620 editsm Tag: Visual edit Line 7: Line 7: |Court_Original_Name=Cour d'appel Bruxelles|Court_Original_Name=Cour d'appel Bruxelles |Court_English_Name=Court of Appeal of Brussels|Court_English_Name=Court of Appeal of Brussels |Court_With_Country=C. A. (Belgium)|Court_With_Country=Court of Appeal of Brussels (Belgium) |Case_Number_Name=2025\u002FAR\u002F2079|Case_Number_Name=2025\u002FAR\u002F2079 Latest revision as of 08:05, 8 October 2026 C. A. - 2025\u002FAR\u002F2079 Court: Court of Appeal of Brussels (Belgium) Jurisdiction: Belgium Relevant Law: Article 5(1)(a) GDPR Article 6(1) GDPR Article 24 GDPR Decided: 03.06.2026 Published: Parties: Infobel National Case Number\u002FName: 2025\u002FAR\u002F2079 European Case Law Identifier: Appeal from: APD\u002FGBA (Belgium)199\u002F2025 Appeal to: Original Language(s): French Original Source: Brussels Court of Appeal (in French) Initial Contributor: ds A court held that a data broker unlawfully processed and sold personal data for direct marketing purposes without the data subjects’ consent. However, the court reduced the fine issued by the DPA from €40,000 to €5,000 due to the low severity of the violation. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The Belgian DPA had imposed a €40,000 fine on INFOBEL S.A., a commercial data broker (the controller), for processing and reselling personal data for direct marketing purposes without demonstrating a valid legal basis. The data at issue had been obtained from a telecom operator with which the data subject had took a telephone subscription in the past and were subsequently used and resold by the controller for direct marketing purposes. The DPA found that the controller had not demonstrated that the data subject had given freely given, specific, informed and unambiguous consent to the processing of his data for their resale for direct marketing purposes. Specifically, it held that the consent was not freely given, since the resale of personal data was not directly and objectively linked to the performance of the contract that concerned the provision of telephone services. The DPA also found that no separate opt-in had been offered for the specific purpose of reselling the data for direct marketing purposes, that the data subject had not been adequately informed as the controller’s identity was not mentioned anywhere in telecom operator’s general terms and conditions and that the consent was based on an opt-out rather than a clear affirmative act. The DPA had accordingly determined that the controller infringed article 5(1)(a) GDPR in conjunction with Article 6 GDPR and Article 24 GDPR. It had also ordered the controller to delete the personal data processed without a valid legal basis and to inform the recipients of those data of the decision and of the lack of a legal basis for the processing. The controller appealed the decision and challenged the fine before the Brussels Court of Appeal. It argued, inter alia, that the erasure order and the related obligation to inform recipients had become devoid of purpose because the relevant database had already been deleted in 2023. The DPA maintained that the erasure order was still justified because it had not been able to verify that the data had in fact been deleted. Holding The court upheld the DPA’s finding that the controller had unlawfully processed the data subject’s personal data. It confirmed that the controller had failed to demonstrate valid consent under Article 5(1)(a) GDPR, Article 6(1) GDPR and Article 24 GDPR. The court emphasised that the controller could not avoid the burden of proof by merely referencing to statements and contractual agreements with other parties. It also referred to the CJEU’s judgment in Case C-129\u002F21, according to which “if the party that collected this data from the subscriber or any third party to whom it was transferred wishes to use it for other purposes, that party or third party must obtain the subscriber’s consent once again”. However, the court partially annulled the DPA’s corrective measures. It held that the erasure order had no practical effect because the data at issue were no longer being processed by the controller. It noted that the DPA had not requested further evidence concerning the alleged deletion of the data. The court further set aside the controller’s obligation to inform the recipients of the relevant personal data since it depended on the first order. In addition, the court found that the DPA had incorrectly characterised the processing operation as substantial and large-scale. It noted that the DPA had not verified the exact number of affected data subjects and only one complaint had been lodged. The court further held that the DPA could not rely on processing predating the GDPR to conclude that the infringement had continued for several years. The court took into account that the controller had not violated the GDPR in the past, its cooperation with the DPA and the fact that the case concerned a single complaint. It considered the infringement to be of low rather than medium severity. The court therefore replaced the €40,000 fine with a €5,000 fine. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the French original. Please refer to the French original for more details. Copy Issued to: The Data Protection Authority Art. 792 CJ Exempt from registration fees - Art. 280, 2° C.Enr. Retrieved from \"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=C._A._-_2025\u002FAR\u002F2079&oldid=53336\" Categories: Court of Appeal of Brussels (Belgium)BelgiumArticle 5(1)(a) GDPRArticle 6(1) GDPRArticle 24 GDPR2026French This page was last edited on 8 October 2026, at 08:05. Content is available under Creative Commons Attribution-NonCommercial-ShareAlike unless otherwise noted. Privacy policy About GDPRhub Disclaimers","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=C._A._-_2025\u002FAR\u002F2079&diff=53336&oldid=51965","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-10-08T08:05:38+00:00","2026-10-08T10:00:15.999949+00:00",7,[18],{"name":19,"type":20},"Infobel","vendor","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":21,"icon":23,"name":24,"slug":25},null,"GDPR","gdpr",[27,32,34,39],{"category":28},{"id":29,"icon":23,"name":30,"slug":31},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":33},{"id":21,"icon":23,"name":24,"slug":25},{"category":35},{"id":36,"icon":23,"name":37,"slug":38},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":40},{"id":41,"icon":23,"name":42,"slug":43},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[]]