On Tuesday 16 January 2024 at 3:32 p.m., the DPA announced a decision by its Litigation Division sentencing Black Tiger Belgium to the following extent:
- Order to bring the data quality service into compliance (breach of Articles 5.1 and 6.1 as well as 12.1, 14.1 and 14.2 of the GDPR), by ceasing to process data in the Spectron database before having notified the individuals concerned of the processing of their personal data (including a 3-month opt-out period), as far as the individuals for whom Black Tiger Belgium has contact details are concerned (for the others, the processing is purely prohibited in the absence of a legal basis).
- Order to bring the data retention period into line with the purposes of processing, so that only the most up-to-date data is processed as part of data quality, in accordance with the principle of data minimization. Additional order to adapt the corresponding documentation (breach of Articles 5.1, 5.2, 24.1 and 25.1 and 25.2 GDPR).
- Order to rectify the processing operations registry by indicating the categories of data processed and data subjects, as well as the data controllers concerned.
- Order to provide the DPA with proof of completion of the above actions within three months.
- A Fine of EUR 129,500 for breach of Articles 5, 6, 12, 14, 24 and 25 of the GDPR.
- A fine of EUR 41,440 for breach of Articles 12 and 15 of the GDPR (no mention of sources and response by post).
- A Fine of EUR 3,700 for breach of Article 30 GDPR (no mention of data controllers).
Clarification of the situation based on the following facts:
- The Spectron database does not exist at Black Tiger. It did exist at Bisnode Belgium and was dedicated to BtoB data broking activities, which were sold in 2021.
- The decision follows a proceeding initiated in 2020 by a citizen’s claim about a campaign carried out in paper format dating back to 2016. In 2016, GDPR regulations were not into force.
- This campaign corresponded to a data broking activity produced by Bisnode Belgium.
- Black Tiger Group acquired Bisnode Belgium in March 2021 and from June 2021 ceased all Data Broking activities previously carried out by Bisnode Belgium.
- The shareholders of Black Tiger Group requested a meeting with the DPA in March 2021, unfortunately to no avail.
- Black Tiger’s current activities as a software publisher are in no way affected by this claim or this decision.
Brief summary of certain highly questionable aspects of the a forementioned decision:
- It is surprising that the data protection authority did not, particularly in a decision imposing sanctions, make the distinction between data broking and data quality activities.
- As soon as the decision was handed down, the DPA carried out a very fast and large-scale communication campaign on all social media at its disposal.
- Nowhere in its communications on social media did the DPA state that the decision was still subject to appeal.
- The DPA took action only after the change of control of Bisnode Belgium over the latter’s past practices. Why didn’t the DPA take action against Bisnode Belgium at a time it was engaged in BtoC and BtoB data broking on a daily basis?
- Since 2015, Black Tiger Group has built its strategy and positioning on a rigorous approach to the use of data.
- Since 2016, Black Tiger Group has been investing heavily in its technology so that it can offer its customers a continuous online compliance module covering an entire IT system and incorporating a compliance score.
- This compliance module was presented to the French supervisory authority in 2017 and has been presented on a regular basis ever since.
- As soon as Black Tiger Group acquired Bisnode Belgium in March 2021, all activities that were not in line with Black Tiger Group’s strategy, in particular data broking, have ceased immediately.
- This information was communicated to the market in June 2021 to inform all Black Tiger Belgium customers.
- Black Tiger tried unsuccessfully to lay it out to the DPA.
Next steps :
- Black Tiger Belgium will shortly lodge an appeal against the above-mentioned decision and reserves all its rights regarding the damages it has suffered.
Recent Comments