Belgian DPA imposes fine on data broker Infobel for selling data without consent

The Belgian data protection authority GBA has imposed a fine of €40,000 on data broker Infobel for illegally reselling data for marketing purposes.

A consumer filed a complaint with the GBA after receiving a marketing brochure in his mailbox from a company with which he wasn’t a customer. The complainant asked how the company had obtained his details.

The consumer was told that a media agency provided his information. The agency got his information from a data broker called Infobel, which in turn had received it from a telecom provider.

Infobel claimed it was authorized to sell the complainant’s information to the media agency because it had obtained consent from data subjects to do so. However, the Belgian data protection authority claimed there was no specific, informed, and unambiguous consent, as is dictated by Article 4 (11) of the General Data Protection Regulation (GDPR).

“Consent must be actively given. The use of pre-checked boxes or inactivity should not be considered consent,” the GBA stated, adding that a company must obtain consent for every specific purpose.

“The person must have the freedom to give or withhold consent for each purpose.”

The Belgian data protection authority has therefore imposed a fine of €40,000 on Infobel for reselling data for marketing purposes without valid consent. In calculating the fine, the GBA took into account that the database in question had not been used since 2023 and that it had since been deleted.

The data broker must also inform its corporate clients of this decision. Lastly, Infobel must delete all data for which it can’t prove it has obtained valid consent from the data subjects.

“The activities of data brokers involve obtaining data about a person indirectly and transferring it onto a large number of actors with whom that person does not necessarily have a relationship, meaning they are not always aware that their data is being processed, for what purpose, and by whom. We have therefore imposed a fine in this case, as the resale of data was not based on valid informed consent,” Director of the GBA Hielke Hijmans says in a statement.

Infobel has 30 days to appeal the fine.