{"id":100543,"date":"2025-10-20T09:13:33","date_gmt":"2025-10-20T08:13:33","guid":{"rendered":"https:\/\/www.ictrechtswijzer.be\/?p=100543"},"modified":"2025-10-20T09:30:34","modified_gmt":"2025-10-20T08:30:34","slug":"can-a-dpa-fine-of-e100-000-be-reduced-by-the-markets-court-to-e5-000","status":"publish","type":"post","link":"https:\/\/www.ictrechtswijzer.be\/en\/kan-een-gba-boete-van-e100-000-door-het-marktenhof-herleid-worden-naar-e5-000\/","title":{"rendered":"Can a DPA fine of \u20ac100,000 be reduced by the Market Cour to \u20ac5,000?"},"content":{"rendered":"

If a telecom operator leaves a request for access to personal data unanswered for 14 months, the Data Protection Authority (DPA) can impose a substantial fine. The question, however, is whether such a penalty will always stand. Yes, such a fine can be significantly reduced if it is deemed disproportionate. In a ruling<\/a> of 22 January 2025, The Market Court in Brussels reduced a fine of \u20ac100,000 to \u20ac5,000 because the original penalty was disproportionate to the specific circumstances of the infringement.<\/p>\n\n\n\n

The facts<\/h3>\n\n\n\n

The case revolved around a customer of a major Belgian telecom operator. After some errors in billing and activation of services, the customer wanted to exercise his right to access his personal data in January 2022, as provided in Article 15 of the General Data Protection Regulation (GDPR)<\/a>. He asked his question through the operator's Facebook Messenger chat, but the employee could not help him and refused to provide the contact information of the Data Protection Officer (DPO).<\/p>\n\n\n\n

Despite a reminder in March 2022, no response was forthcoming. The customer then filed a complaint with the Data Protection Authority in June 2022. Only in March 2023, fourteen months after the original request and after DPA proceedings had been initiated, did the operator deliver the requested information. The DPA ruled in a decision of 23 August 2024 (no. 107\/2024<\/a>) that the operator had violated the GDPRand imposed an administrative fine of \u20ac100,000.<\/p>\n\n\n\n

Market Court decision<\/h3>\n\n\n\n

The telecom operator appealed the DPA's decision. The Market Court confirmed that the operator had indeed violated the GDPR. The late response to a request for access is a clear violation of Article 15 GDPR, combined with the procedural rules of Article 12 GDPR. The fact that the DPO's contact details could be found elsewhere on the website did not diminish the company's duty to properly handle a request once made.<\/p>\n\n\n\n

The crucial point in the judgment, however, was the assessment of the penalty. The Court ruled that a fine of \u20ac100,000 was manifestly disproportionate in light of the facts. The DPA's decision was overturned on this point. Exercising its plenitude of jurisdiction, the Court itself imposed a new, much lower fine of \u20ac5,000.<\/p>\n\n\n\n

Legal analysis and interpretation<\/h3>\n\n\n\n

This judgment is an important illustration of the principle of proportionality when imposing GDPR sanctions. According to Article 83 of the GDPR, any fine must be \"effective, proportionate and dissuasive.\" Here, the Market Court acts as a crucial check on the DPA's discretion.<\/p>\n\n\n\n

The Court went over the criteria in Article 83 GDPR to test the proportionality of the fine and came to the following findings:<\/p>\n\n\n\n