An unnamed B2B data broker – €20,000 Fine (Belgium, 2025)

In 2021 the managing partner of a company (the data subject) received a direct marketing e-mail from another company. He filed an access request with the company and found that his personal data were provided by a B2B data broker (the controller). The data subject then filed an access request with the data controller. In particular, he required a list of all the sources and the individual recipients of his personal data. The controller replied that his data were collected via the Crossroads Bank for Enterprises (that is, the Belgian public register for businesses) and other public sources, and refused to provide information on individual recipients. The data subject later filed a complaint with the DPA. He complained about several violations of the GDPR, including the unlawful processing of his email and the incomplete response to his access request. During the investigation, the DPA found that the controller relied on several data sources other than the Crossroads Bank, including the controller's affiliate companies. When questioned by the DPA, the controller itself was unable to provide a clear and complete picture of its sources. The DPA held that the controller violated Articles 5(1)(a), 5(2), 6(1), 12(1), 14(1), 14(2),15(1), 24(1), and 25(1) GDPR. The DPA fined the controller for a total of €20,000: * €8,000 for unlawfully processing the data subject’s email address (Articles 5(1)(a), 5(2), and 6(1)); * €6,000 for violating the principle of transparency and the transparency duties of data controllers (Articles 5(2), 12(1), 14(1), 14(2), 24(1), and 25(1)); * and €6,000 for failing to appropriately respond to the data subject’s access request (Article 15(1)). On the nature of the data The controller claimed that the email addresses it controlled, were contact information for a legal person. On this basis, the controller argued that it did not process personal data. The DPA rejected this argument. In the present case, the data subject’s email included his name. Therefore, it referred to the data subject and constituted his personal data. It did not matter that the email was used for B2B marketing and that it referred to both the data subject and the company he was working for. On the controller's legitimate interest The controller claimed that the processing of the data was based on its legitimate interest under Article 6(1)(f) GDPR. However, the DPA held that the controller could not rely on the legal basis of legitimate interest. So, the DPA concluded that the processing was unlawful. In the DPA’s view, the controller failed to balance its interest with the rights and freedoms of the data subject for a number of reasons (among others: the processing did not meet the reasonable expectations of the data subject, and the data subject was not informed proactively and given the opportunity to object to the processing beforehand). The DPA also pointed out that the controller’s legitimate interest assessmentA legitimate interest assessment (informally referred to as LIA) is a document that details the controller's assessment of its legitimate interest, especially with regards to the balancing between its legitimate interest and the rights and freedoms of data subjects. Documenting this assessment in written form is not mandatory but many controllers do so as a matter of good practice, in order to comply with the principle of accountability (Article 5(2) GDPR). was fundamentally flawed because it weighted the controller’s interest against his customers’ instead of the data subjects’. On transparency The controller argued that it was under no obligation to provide information to the data subjects. In the controller’s view, providing information was up to its clients, who acted as independent controllers of personal data and- unlike the controller- were in direct contact with the data subjects due to their marketing activities. Furthermore, the controller argued that the data subjects were informed anyway because the controller’s privacy statement included all the relevant information. The DPA rejected both arguments. It held that all successive controllers along the data processing chain must separately inform data subjects. Furthermore, it stated that the controller could not reasonably expect the data subject to consult its privacy statement. Finally, it held that the controller’s privacy statement was incomplete either way. Ultimately, the DPA held that the controller should have reached out in a direct and proactive way in order to provide the data subject with information. For this reason, the DPA found that the controller violated its transparency obligations. On the access request With regards to the access request, the controller claimed that providing the data subject with a list of individual recipients, would have involved a disproportionate effort. Therefore, the controller argued that was exempt from the obligation to do so, as stated by Article 14(5)(b) GDPR. The DPA rejected this argument: it held that the exemption under Article 14(5)(b) did not apply to the data controller's obligation to respond to access request (Article 15 GDPR). So, the DPA held that the controller was under an obligation to provide a list of individual recipients of personal data, rather than a mere list of categories of recipients. In this regard, the DPA also referred to the Österreichische Post case of the CJEUCJEU, case C-154/21 - Österreichische Post, 12 January 2023, margin numbers 39, 43 and 48 (available [https://curia.europa.eu/juris/document/document.jsf?docid=269146&doclang=en here]). as well as the Guidelines of the EDPBEDPB, 'Guidelines 01/2022 on data subjects' rights - Right of access', 28 March 2023 (Version 2.0), margins 116-117 (available [https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-012022-data-subject-rights-right-access_en here]). and the Article 29 Working PartyWP29, ‘Guidelines on Transparency under Regulation 2016/679’, 17/EN WP260 rev.01, 11 April 2018, pp. 43-44 (available [https://www.edpb.europa.eu/our-work-tools/our-documents/article-29-working-party-guidelines-transparency-under-regulation_en here]).. Finally, the DPA also held that the controller failed to inform the data subject about the sources of his personal data and the the length of its storage.