DPA case 76/2025 – Complaint Upheld (Belgium, 2025)

A hearing aid retailer (the first controller) used personal data for sending direct marketing papers to home addresses. The first controller obtained the data from a media company specialized in direct marketing (the second controller). In turn, the second controller obtained the data from a chain of commercial data brokers. In 2022, one of the recipients of direct marketing (the data subject) contacted the second controller and requested both access to his personal data, and their erasure. The second controller forwarded the request to both the first controller and the data broker he received the data from. However, the second controller did not itself reply to the request. In 2023 the data subject filed a complaint with the DPA. He claimed that both controllers violated the principle of lawfulness, by processing his data for direct marketing without a legal basis. He also complained that the second controller violated Articles 12 and 15 GDPR by failing to reply to his request. Regarding the first controller: The DPA considered that the first controller did not demonstrate that its legitimate interest in carrying out direct marketing prevails over the rights and interests of data subjects. For this reason, the processing could not be based on the controller's interest and lacked a legal basis under the GDPR. The DPA specified that their balancing depends on the circumstances of the concrete case, and recital 47 of the GDPR provides that the reasonable expectations of the persons concerned must be taken into account. These expectations relate in particular to processing operations, data, purposes and the persons responsible for further processing. They are influenced by the relationship between the controller and the data subjects. The DPA then pointed out that it is not sufficient for the controller to rely on the declarations of the data seller and the existence of a contractual clause to consider that the data has been lawfully collected and can be reused