Court case 2025/AR/253 – Court Ruling (Belgium, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Disputes Chamber of the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit – GBA) adopted a decision concerning Mediahuis NV in connection with an asset deal for the sale of Jobat’s activities. Jobat was a job platform operated within the Mediahuis group, with Mediahuis acting as its controller. In the course of the asset sale, Mediahuis transferred Jobat’s user database, containing personal data of jobseekers and employers, to the buyer, Hors BV. A data subject complained that this transfer was unlawful under the GDPR, as Mediahuis had not identified a valid legal basis or properly informed the affected users. The GBA found that Mediahuis had failed to conduct a proper and documented assessment of the legitimate interest it relied upon under Article 6(1)(f) GDPR. The GBA also found that Mediahuis had not properly informed data subjects as required by Article 5(1)(a), Article 12, and Article 13 GDPR. Mediahuis appealed the decision before the Market Court (Court of Appeal of Brussels). It argued that the GBA had breached the principle of legal certainty , misinterpreted the definition of “processing” under Article 4(2) GDPR, and violated Mediahuis’s rights of defence. Mediahuis also claimed that the GBA had not been consistent with its own dismissal policy and that the complaint constituted an abuse of rights. The Court dismissed the preliminary arguments of Mediahuis. It held that the data subject had not abused their rights and that the GBA retained discretionary power to decide whether or not to dismiss a complaint under Belgium law and Article 57(1)(f) GDPR. The Court clarified that controllers have no “right to dismissal” and that the GBA did not need to justify a decision not to dismiss a complaint. However, the Court found several substantive flaws in the GBA’s decision. It ruled that the Disputes Chamber had given contradictory reasoning by treating the data transfer as both a separate “processing” under Article 4(2) GDPR and a mere step
GDPR Articles Cited
The Disputes Chamber of the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit – GBA) adopted a decision concerning Mediahuis NV in connection with an asset deal for the sale of Jobat’s activities. Jobat was a job platform operated within the Mediahuis group, with Mediahuis acting as its controller. In the course of the asset sale, Mediahuis transferred Jobat’s user database, containing personal data of jobseekers and employers, to the buyer, Hors BV. A data subject complained that this transfer was unlawful under the GDPR, as Mediahuis had not identified a valid legal basis or properly informed the affected users. The GBA found that Mediahuis had failed to conduct a proper and documented assessment of the legitimate interest it relied upon under Article 6(1)(f) GDPR. The GBA also found that Mediahuis had not properly informed data subjects as required by Article 5(1)(a), Article 12, and Article 13 GDPR. Mediahuis appealed the decision before the Market Court (Court of Appeal of Brussels). It argued that the GBA had breached the principle of legal certainty , misinterpreted the definition of “processing” under Article 4(2) GDPR, and violated Mediahuis’s rights of defence. Mediahuis also claimed that the GBA had not been consistent with its own dismissal policy and that the complaint constituted an abuse of rights. The Court dismissed the preliminary arguments of Mediahuis. It held that the data subject had not abused their rights and that the GBA retained discretionary power to decide whether or not to dismiss a complaint under Belgium law and Article 57(1)(f) GDPR. The Court clarified that controllers have no “right to dismissal” and that the GBA did not need to justify a decision not to dismiss a complaint. However, the Court found several substantive flaws in the GBA’s decision. It ruled that the Disputes Chamber had given contradictory reasoning by treating the data transfer as both a separate “processing” under Article 4(2) GDPR and a mere step
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 2025/AR/253 in BE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 2025/AR/253 - Belgium (2025). Retrieved from cookiefines.eu
Last updated: