Infobel – Court Ruling (Belgium, 2026)

The Belgian DPA had imposed a €40,000 fine on INFOBEL S.A., a commercial data broker (the controller), for processing and reselling personal data for direct marketing purposes without demonstrating a valid legal basis. The data at issue had been obtained from a telecom operator with which the data subject had took a telephone subscription in the past and were subsequently used and resold by the controller for direct marketing purposes. The DPA found that the controller had not demonstrated that the data subject had given freely given, specific, informed and unambiguous consent to the processing of his data for their resale for direct marketing purposes. Specifically, it held that the consent was not freely given, since the resale of personal data was not directly and objectively linked to the performance of the contract that concerned the provision of telephone services. The DPA also found that no separate opt-in had been offered for the specific purpose of reselling the data for direct marketing purposes, that the data subject had not been adequately informed as the controller’s identity was not mentioned anywhere in telecom operator’s general terms and conditions and that the consent was based on an opt-out rather than a clear affirmative act. The DPA had accordingly determined that the controller infringed article 5(1)(a) GDPR in conjunction with Article 6 GDPR and Article 24 GDPR. It had also ordered the controller to delete the personal data processed without a valid legal basis and to inform the recipients of those data of the decision and of the lack of a legal basis for the processing. The controller appealed the decision and challenged the fine before the Brussels Court of Appeal. It argued, inter alia, that the erasure order and the related obligation to inform recipients had become devoid of purpose because the relevant database had already been deleted in 2023. The DPA maintained that the erasure order was still justified because it had not been able to