{"id":100386,"date":"2025-10-06T22:07:35","date_gmt":"2025-10-06T21:07:35","guid":{"rendered":"https:\/\/www.ictrechtswijzer.be\/?p=100386"},"modified":"2025-10-06T22:11:40","modified_gmt":"2025-10-06T21:11:40","slug":"can-a-company-sell-your-personal-data-in-the-event-of-a-takeover","status":"publish","type":"post","link":"https:\/\/www.ictrechtswijzer.be\/en\/mag-een-bedrijf-uw-persoonsgegevens-doorverkopen-bij-een-overname\/","title":{"rendered":"Can a company sell your personal data in the event of a takeover?"},"content":{"rendered":"

In a business takeover or the sale of a business activity, not only buildings and contracts are transferred, but often an entire customer base. What then happens to your personal data? A ruling<\/a> of the Market Court in Brussels on 3 September 2025 offers a clarifying answer: the sale of a customer database is a processing of personal data that must follow strict rules. However, the Data Protection Authority (DPA) must also proceed with caution in this regard.<\/p>\n\n\n\n

The facts: sales of Jobat and a user's complaint<\/h2>\n\n\n\n

The case revolved around the sale of the activities of the well-known jobsite Jobat by Mediahuis NV. <\/sup>In 2019, these activities, including user data, were transferred to Hors bv, a new company established as a joint venture between Mediahuis and DPG Media. <\/sup><\/p>\n\n\n\n

A user of Jobat disagreed. He claimed that his personal data had been transferred to a new entity without his consent or proper information. He filed a complaint with the DPA. <\/p>\n\n\n\n

The DPA ruled in favour of the complainant and issued Mediahuis with a reprimand. According to the DPA, Mediahuis should have proactively informed users about the transfer in advance. The DPA also stated that while Mediahuis could have a \"legitimate interest\" in the transaction, it violated the GDPR<\/a> because it had not conducted a prior documented analysis of this interest. Mediahuis disagreed with this decision and appealed to the Market Court, a specialized section of the Brussels Court of Appeal. <\/p>\n\n\n\n

The decision: the Market Court overturns the DPA's sanction<\/h2>\n\n\n\n

In its September 3, 2025 ruling, the Market Court overturned the DPA's decision. <\/sup> The Court ruled that the analysis of the DPA was legally and factually deficient on several crucial points.<\/p>\n\n\n\n

The main reasons for the annulment were:<\/p>\n\n\n\n

    \n
  1. Wrong focus of research:<\/strong> The DPA focused solely on the material \"transmission\" of data. The Market Court held that this was too narrow. The relevant act under the GDPR was the entire legal transaction: the sale and transfer of ownership of the customer base as a business asset (\"asset deal\"). The mere transmission is merely a logical and necessary consequence of this. <\/li>\n\n\n\n
  2. Violation of rights of defense:<\/strong> The DPA accused Mediahuis of failing to conduct a prior, documented analysis of its legitimate interest. The Market Court held that this obligation did not follow directly from Article 6.1.f GDPR (legitimate interest), but from the general accountability principle of Article 5.2 GDPR. Crucially, the DPA had never properly examined or questioned this specific allegation (the lack of documentation) during the proceedings. This prevented Mediahuis from adequately defending itself against it, in violation of its rights of defense. <\/li>\n\n\n\n
  3. Incomplete investigation of responsibilities:<\/strong> After the transfer, Hors bv became the new data controller for Jobat's data. This meant that Hors bv had its own legal duty under Article 14 GDPR to inform users. However, the DPA had not involved Hors bv in any way and placed the duty to inform unilaterally and retrospectively on the seller, Mediahuis. This made the DPA's decision insufficiently reasoned.<\/li>\n<\/ol>\n\n\n\n

    Legal analysis and interpretation<\/h2>\n\n\n\n

    This ruling is of great importance for the practice of company takeovers in Belgium. The Market Court corrects an overly narrow and formalistic approach to the DPA and places data protection in the proper corporate law context.<\/p>\n\n\n\n

    The crux of the matter is the legal basis of the legitimate interest (Article 6.1.f GDPR). Selling a business unit is a fundamental commercial interest for a company. The GDPR does not prohibit this, but it does require a careful balancing of this business interest against the rights and freedoms of the individuals involved (the users).<\/p>\n\n\n\n

    The crucial lesson from this ruling is the link to the accountability requirement in Article 5.2 GDPR. A company must not only believe that it has a legitimate interest; it must also be able to demonstrate this. This requires a proactive, documented analysis (a Legitimate Interest Assessment or LIA) conducted prior to processing. This describes the transaction, identifies the interest and justifies the trade-off with data subjects' rights.<\/p>\n\n\n\n

    In addition, the ruling clarifies the information duties in the case of an ''asset deal'<\/a>. The seller (Mediahuis) must be transparent about the processing (Article 13 GDPR), but the buyer (Hors bv) is given its own separate duty of information after receiving the data (Article 14 GDPR). Ignoring the buyer's role was a fundamental error in the DPA's investigation. <\/p>\n\n\n\n

    What this specifically means<\/h2>\n\n\n\n