Belgian Data Protection Authority (APD) · 27 January 2021
Family Service / N.D.P.K. nv.
Insufficient legal basis for data processing
- Regulator
- Belgian Data Protection Authority (APD)
- Decided
- 27 January 2021
- Country
- Belgium
- Sector
- Industry and Commerce
- Regulator’s reference
- Not recorded
- Fino case number
- 2021/BE/005
What happened
The Belgian DPA (APD/GBA) issued a fine of €50,000 against a private company for collecting personal data from its target audience (pregnant mothers) without valid consent. Personal data collected was then transferred to this company's network of partners which processed the data for direct marketing purposes and sold it to other third parties in breach of the GDPR.
Summary from the GDPRhub page for this decision, written by its volunteers, not by Fino. CC BY-NC-SA 4.0.
Rules involved
- Art. 5Principles relating to processing of personal dataRead →
- Art. 6Lawfulness of processingRead →
- Art. 7Conditions for consentRead →
- Art. 13Information to be provided where personal data are collected from the data subjectRead →
- Art. 24Responsibility of the controllerRead →
- Art. 25Data protection by design and by defaultRead →
- Art. 28ProcessorRead →
- Accountability
- Consent
- Data principles
- Processor obligations
- Transparency
- Unlawful processing
Sources
The facts on this page come from the sources above, as they recorded them. Nothing has been estimated or filled in. Not legal advice.
Spotted a mistake? Write to angelillolorenzo@gmail.com and quote 2021/BE/005.