- Enforcing jurisdiction
- Luxembourg · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 3018 – Order (Luxembourg, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Luxembourg data protection authority ordered Rocketreach to stop selling personal data without a legal basis. This is important because it emphasizes that companies must have a valid reason to process personal data.
What happened
Rocketreach was found to be selling access to personal data without proper legal justification.
Who was affected
Individuals in the EU whose personal data was sold by Rocketreach.
What the authority found
The authority stated that Rocketreach did not comply with data protection rules by failing to designate an EU representative and not responding to data access requests.
Why this matters
This ruling serves as a warning to companies that they must follow data protection laws, especially when dealing with EU residents' information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Rocketreach sells access to personal data on EU data subjects, allegedly without any legal basis. 1. Deleting the data subject's information when all he solely asked for was access. 2. Did not answer requests to enquire about the Legal basis of processing. 3. Has not selected an EU Representative 4. Mass Processing of European Data Subjects Luxembourg DPA argues it cannot proceed against a company established abroad that has not designated an EU Represenative.
Outcome
Order
A binding order requiring the controller to take specific action.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 3018 in LU
This is the only recorded action for this entity in this jurisdiction.
Details
Order Date
4 February 2020
Authority
Commission Nationale pour la Protection des Données
GDPRhub ID
gdprhub-2389About this data
Cite as: Cookie Fines. DPA case 3018 - Luxembourg (2020). Retrieved from cookiefines.eu
Last updated: