Belgian DPA issues €50,000 fine for GDPR breach

The Belgian data protection authority (DPA) has imposed a fine of €50,000 on the company Family Service, which distributes ‘pink boxes’ well-known by parents-to-be in Belgium, for various breaches of the General Data Protection Regulation (GDPR). Family Service is a marketing company that distributes pink boxes that include samples, special offers, and information sheets for future parents. The inspection service of the DPA launched an investigation into the company after a complaint was lodged alleging the company transferred personal data to third parties – including data brokers – without valid consent from its customers and without the provision of sufficient information. Taking into consideration the number of data subjects (the company processes data related to 21.1% of the Belgian population), the seriousness of the breach and the nature of the data processed (in particular data relating to children), the DPA decided to impose the fine and ordered the company to comply with the GDPR.