Isabel SA – €120,000 Fine (Belgium, 2026)

The data subject was the manager of a company who used TruliUs. TruliUs was a digital authentication and identification service developed by Isabel SA (the controller), allowing natural persons to prove their identity and authority to act on behalf of a company when accessing third party business platforms. In that capacity, the data subject used this solution to authenticate themselves and prove that they were authorised to act on behalf of their company when accessing their accountant’s digital platform. The data subject had sent two emails to the DPO contact address indicated in Trulius’ privacy notice, on 11 and 19 March 2021, but received no reply. On 29 March, 2021, the data subject lodged a complaint with the DPA against the controller. The controller argued that, for the TruliUs authentication and identification processing, it acted only as a processor and not as a controller. It submitted that TruliUs was a standardised service made available to its clients, who freely decided whether to use it and thereby determined the purposes and essential means of the processing. According to the controller, the purpose of authentication and identification served only its clients’ interests. It further argued that the clients determined key elements such as the recipients of the data, the data subjects concerned and the duration of the processing. Also, that the use of the service was optional because traditional identification methods remained available. The controller further relied on the service’s terms and its internal documentation, which classified itself as a processor acting on behalf of the client. Therefore, the controller considered the data subject’s company to be the controller. The data subject contested this position. They argued that their company could not be considered responsible for processing carried out through this platform, where their data were collected and processed. They stressed that neither they nor their platform had practical control ov