Company: Non-compliance with general data processing principles

The Belgian DPA imposed a fine of EUR 20,000 on a company. The controller is a company engaging in direct marketing activities. During those activies the company failed to comply with multiple data processing principle. In particular the company had no sufficient legal basis for the data processing, failed to inform the data subjects and failed to provide data subjects with lawfully requested informations.

GDPR Articles: Art. 5 (1) a), (2) GDPR, Art. 6 (1) GDPR, Art. 12 (1) GDPR, Art. 14 (1), (2) GDPR, Art. 15 (1) c), d), g), Art. 24 (1) GDPR, Art. 25 (1) GDPR
Industry: Industry and Commerce