C. A. - 2025/AR/2079
Court reduces data broker's GDPR fine from €40,000 to €5,000 for unlawful data processing.
The Brussels Court of Appeal upheld a finding that a data broker, Infobel S.A., unlawfully processed and resold personal data for direct marketing without valid consent. The court reduced the Belgian DPA's initial €40,000 fine to €5,000, citing the low severity of the violation, though it acknowledged the unlawful processing of data obtained from a telecom operator.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Infobel?
Get an email when a new story names Infobel, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonInfobel S.A. unlawfully obtained personal data from a telecom operator and resold it for direct marketing purposes without securing valid consent from the individuals involved, violating GDPR's lawful basis requirements. This case highlights the risk that data brokers face when they fail to establish a clear, documented legal basis for each stage of data processing and sharing. The reduced fine, while smaller than the original, still represents regulatory and reputational exposure that could have been avoided with proper data governance. It also underscores that courts and regulators are scrutinizing the entire data supply chain, not just the original data collector.