[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdp3bk2mIws8ezpDoTEL4s3u-aieTdCJb7E5yeFK1UwA":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"55e10a4f-81f5-476c-93a2-5fa331013f81","C. A. - 2025\u002FAR\u002F2079","c-a-2025-ar-2079-ff8c24","Fixed link ← Older revision Revision as of 08:05, 8 October 2026 Line 7: Line 7: |Court_Original_Name=Cour d'appel Bruxelles |Court_Original_Name=Cour d'appel Bruxelles |Court_English_Name=Court of Appeal of Brussels |Court_English_Name=Court of Appeal of Brussels |Court_With_Country=C. A. (Belgium) |Court_With_Country=Court of Appeal of Brussels (Belgium) |Case_Number_Name=2025\u002FAR\u002F2079 |Case_Number_Name=2025\u002FAR\u002F2079","The Brussels Court of Appeal upheld a finding that a data broker, Infobel S.A., unlawfully processed and resold personal data for direct marketing without valid consent. The court reduced the Belgian DPA's initial €40,000 fine to €5,000, citing the low severity of the violation, though it acknowledged the unlawful processing of data obtained from a telecom operator.","Court reduces data broker's GDPR fine from €40,000 to €5,000 for unlawful data processing.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=C._A._-_2025\u002FAR\u002F2079&diff=53336&oldid=51965","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-10-08T08:05:38+00:00","2026-10-08T10:00:15.999949+00:00",7,[17],{"name":18,"type":19},"Infobel","vendor","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":20,"icon":22,"name":23,"slug":24},null,"GDPR","gdpr",[26,31,33,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":47},[],[],{"slug":49,"title":50,"body":51,"framework_refs":52,"framework_notes":63},"data-broker-fined-for-unlawful-resale-of-personal-data-without-consent","Data Broker Fined for Unlawful Resale of Personal Data Without Consent","Infobel S.A. unlawfully obtained personal data from a telecom operator and resold it for direct marketing purposes without securing valid consent from the individuals involved, violating GDPR's lawful basis requirements. This case highlights the risk that data brokers face when they fail to establish a clear, documented legal basis for each stage of data processing and sharing. The reduced fine, while smaller than the original, still represents regulatory and reputational exposure that could have been avoided with proper data governance. It also underscores that courts and regulators are scrutinizing the entire data supply chain, not just the original data collector.",[53,54,55,56,57,58,59,60,61,62],"GDPR Article 5(1)(a) – Lawfulness, fairness, and transparency","GDPR Article 6 – Lawful basis for processing","GDPR Article 13\u002F14 – Transparency obligations to data subjects","GDPR Article 30 – Records of processing activities","GDPR Article 44-49 – Restrictions on international transfers","NIST Privacy Framework PR.DS-P1 – Data processing policies","NIST SP 800-53 PT-2 – Authority to process personally identifiable information","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management System (PIMS)","ITIL Service Value Chain – Governance and compliance management",{}]