Anonymous (Complainant) – €50,000 Fine (Belgium, 2021)

Background: The defendant is a marketing company that distributes "pink boxes" which targets pregnant mothers that include samples, special offers and information sheets for future parents. The offers and samples contained in the "pink boxes" where made available by the network of partners of the defendant. As to the data processed, the personal data of (future) mothers collected by the defendant included: the mother's name, mother's first name, date of birth of the baby, sex of the baby, name of the baby, e-mail address, street and house number, zip code and city. This personal data was then transferred by the defendant to third parties (so-called "structural partners") in exchange for the aforementioned offers and samples. These partners where in fact data brokers which processed the data for marketing campaigns and sold it to other third parties. Facts: The complainant filled in a registration form with the defendant - when she received a pink box from - and authorized the processing her personal data. She was not informed clearly of the processing and possible subsequent processings (with regards to the defendant's network of partners). The complainant subsequently decided to withdraw her consent as she no longer desired to be contacted by third parties concerning promotions for childcare products. However, even after having exercised her right, the complainant still received unwanted phone calls from partners of the defendant in connection with certain promotions. The complainant then lodged a complaint with the Belgian data protection authority alleging the defendant transferred personal data to third parties, including data brokers, without valid consent on the part of the customer, and without the provision of sufficient information. The discussion mainly mainly revolved around the (lack of) information given by the defendant about the sale and processing of personal data by its the network of partners as well as the scope and validity of the consen