Can a DPA fine of €100,000 be reduced by the Market Cour to €5,000?

If a telecom operator leaves a request for access to personal data unanswered for 14 months, the Data Protection Authority (DPA) can impose a substantial fine. The question, however, is whether such a penalty will always stand. Yes, such a fine can be significantly reduced if it is deemed disproportionate. In a ruling of 22 January 2025, The Market Court in Brussels reduced a fine of €100,000 to €5,000 because the original penalty was disproportionate to the specific circumstances of the infringement.

The facts

The case revolved around a customer of a major Belgian telecom operator. After some errors in billing and activation of services, the customer wanted to exercise his right to access his personal data in January 2022, as provided in Article 15 of the General Data Protection Regulation (GDPR). He asked his question through the operator's Facebook Messenger chat, but the employee could not help him and refused to provide the contact information of the Data Protection Officer (DPO).

Despite a reminder in March 2022, no response was forthcoming. The customer then filed a complaint with the Data Protection Authority in June 2022. Only in March 2023, fourteen months after the original request and after DPA proceedings had been initiated, did the operator deliver the requested information. The DPA ruled in a decision of 23 August 2024 (no. 107/2024) that the operator had violated the GDPRand imposed an administrative fine of €100,000.

Market court decision

The telecom operator appealed the DPA's decision. The Market Court confirmed that the operator had indeed violated the GDPR. The late response to a request for access is a clear violation of Article 15 GDPR, combined with the procedural rules of Article 12 GDPR. The fact that the DPO's contact details could be found elsewhere on the website did not diminish the company's duty to properly handle a request once made.

The crucial point in the judgment, however, was the assessment of the penalty. The Court ruled that a fine of €100,000 was manifestly disproportionate in light of the facts. The DPA's decision was overturned on this point. Exercising its plenitude of jurisdiction, the Court itself imposed a new, much lower fine of €5,000.

Legal analysis and interpretation

This judgment is an important illustration of the principle of proportionality when imposing GDPR sanctions. According to Article 83 of the GDPR, any fine must be "effective, proportionate and dissuasive." Here, the Market Court acts as a crucial check on the DPA's discretion.

The Court went over the criteria in Article 83 GDPR to test the proportionality of the fine and came to the following findings:

• Nature and severity of the breach: The breach involved only one person and was an isolated incident.
• Intent or negligence: There was no intent but negligence on the part of two employees. Although not insignificant, the negligence was not classified as "serious.
• Damage suffered: The damage to the customer was limited to the inconvenience of the late reply.
• Action by the offender: The company had rectified the violation during the proceedings and had organized internal training afterwards to prevent its recurrence.
• Degree of cooperation: The operator had adequately cooperated with the DPA.

Based on these elements, the Court concluded that the DPA had exceeded its margin of discretion. A fine of €100,000 was not necessary to achieve the objectives of punishment and prevention. The final fine of €5,000 was considered more appropriate, taking into account all the circumstances.

What this specifically means

• For enterprises: This ruling shows that ignoring GDPR requests has serious consequences and a fine is inevitable. Make sure you have watertight internal procedures, including for front-line employees such as social media managers. At the same time, the ruling confirms that you do not have to simply accept a decision from the DPA. A thorough analysis of the proportionality of the fine can pay off, and an appeal to the Market Court can lead to a significant reduction.
• For citizens: Your rights under the GDPR are enforceable. Both the DPA and Belgian courts confirm that companies are required to respond to your requests correctly and in a timely manner. Although the final fine may be lower, the principle of your right of access is enforced and sanctioned.

FAQ (frequently asked questions)

Within what time frame must a company respond to a request for access?
In principle, a company must respond "as soon as possible" and in any case within one month of receiving the request. This deadline may be extended by two months, if necessary, provided that the person concerned is notified within the first month.

Can a company refuse a request if it believes I already have the information?
No, not automatically. If a company refuses a request, it must inform the data subject of the reasons for the refusal within one month at the latest. Simply not responding because it is assumed that the information is already known is a violation of the GDPR.

Is the fine always determined based on a company's turnover?
The financial strength and turnover of an undertaking are important factors in determining the maximum fine. However, the principle of proportionality requires that all the circumstances of the specific case be taken into account, such as the gravity, duration and whether or not the infringement was intentional. Thus, high turnover does not automatically lead to a high fine for a limited infringement.

Conclusion

The Market Court ruling is a clear reminder of the importance of the proportionality principle in data protection law. A breach of the GDPR will be punished, but the sanction must be proportionate. Companies are reminded that internal processes for data requests are crucial, while citizens receive confirmation that their rights are protected.