![]() Lastly, the Belgian SA found the record of processing activities to be incomplete. In addition, the Belgian SA established that BTB did not adequately respond to the plaintiffs’ requests under Article 15. Moreover, BTB did not properly consider all the risks derived from the processing, including the risks of invisible discrimination of the data subjects, when balancing the interests at stake. The Belgian SA also found that the interests of BTB were overridden by the fundamental rights of the data subjects, due to the lack of information provided proactively and individually to them, the context of the processing and the nature of the personal data, as well as the retention period of 15 years. The Belgian SA found that BTB could not rely on its legitimate interests, since the personal data collected indirectly could not be deemed necessary to pursue the interest of maintaining updated records of the data subjects. The Inspection Service of the Belgian SA identified several violations of the key principles of transparency and lawfulness, as well as infringements regarding the plaintiffs’ right to access and other accountability requirements.īTB argued that the processing for its Data Delivery and Data Quality activities was lawfully based on its legitimate interests and that the individuals had been adequately informed of the processing, both ‘upfront’ by the data sources who sold the data to BTB, and by the clients of BTB who received the personal data, when communicating for the first time with the data subjects. The Belgian SA received a complaint about the processing activities carried out by BISNODE BELGIUM - which was subsequently taken over by the French BLACK TIGER GROUP and renamed BLACK TIGER BELGIUM (hereafter “BTB”) -, claiming that the company had indirectly collected and unlawfully processed personal data of the plaintiffs for over 15 years, without properly informing them beforehand. Summary of the Decision Origin of the case Key words: Big Data, Transparency, Lawfulness of processing, Principles relating to processing of personal data, Right to be informed, Exercise of data subject rights.Decision: Compliance order, Definitive ban on data processing, Administrative fine.Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 14 (Information to be provided where personal data have not been obtained from the data subject), Article 15 (Right to access by the data subject), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 30 (Records of processing activities).Controller: Black Tiger Belgium (formerly Bisnode Belgium).Date of final decision: 16 January 2024. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |