Belgian SA sanctions Black Tiger Belgium for lack of transparency and unlawful processing of personal data collected indirectly

Background information

• Date of final decision: 16 January 2024
• National case
• Controller: Black Tiger Belgium (formerly Bisnode Belgium)
• Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 14 (Information to be provided where personal data have not been obtained from the data subject), Article 15 (Right to access by the data subject), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 30 (Records of processing activities)
• Decision: Compliance order, Definitive ban on data processing, Administrative fine
• Key words: Big Data, Transparency, Lawfulness of processing, Principles relating to processing of personal data, Right to be informed, Exercise of data subject rights    

Summary of the Decision

Origin of the case  

The Belgian SA received a complaint about the processing activities carried out by BISNODE BELGIUM — which was subsequently taken over by the French BLACK TIGER GROUP and renamed BLACK TIGER BELGIUM (hereafter “BTB”) —, claiming that the company had indirectly collected and unlawfully processed personal data of the plaintiffs for over 15 years, without properly informing them beforehand. 

The Inspection Service of the Belgian SA identified several violations of the key principles of transparency and lawfulness, as well as infringements regarding the plaintiffs’ right to access and other accountability requirements. 

BTB argued that the processing for its Data Delivery and Data Quality activities was lawfully based on its legitimate interests and that the individuals had been adequately informed of the processing, both ‘upfront’ by the data sources who sold the data to BTB, and by the clients of BTB who received the personal data, when communicating for the first time with the data subjects.

Key Findings 

The Belgian SA found that BTB could not rely on its legitimate interests, since the personal data collected indirectly could not be deemed necessary to pursue the interest of maintaining updated records of the data subjects. 

The Belgian SA also found that the interests of BTB were overridden by the fundamental rights of the data subjects, due to the lack of information provided proactively and individually to them, the context of the processing and the nature of the personal data, as well as the retention period of 15 years. Moreover, BTB did not properly consider all the risks derived from the processing, including the risks of invisible discrimination of the data subjects, when balancing the interests at stake.

In addition, the Belgian SA established that BTB did not adequately respond to the plaintiffs’ requests under Article 15. Lastly, the Belgian SA found the record of processing activities to be incomplete.

Decision 

The Belgian SA imposed three administrative fines on BTB, amounting to a total of 174.640 EUR. These fines relate to the unlawful and unfair processing of personal data without informing data subjects in a proactive, individual and transparent manner; to the failure to respond appropriately to data access requests; and lastly to various infringements relating to the record of processing activities.
Additionally, the Belgian SA imposed several corrective measures on BTB, including a temporary ban of the processing of the personal data of data subjects for whom BTB possesses contact details, until BTB has individually notified them about the processing of their data and given them an opportunity to object to the processing.
Regarding those data subjects whom BTB can no longer notify accordingly, the Belgian SA imposes a definitive ban on the processing of their personal data for B2B 'Data Quality' purposes, given the absence of a lawful basis.

The parties affected by the decision may appeal against it.
 

For further information: national decision