{"id":101007,"date":"2025-11-06T18:25:22","date_gmt":"2025-11-06T17:25:22","guid":{"rendered":"https:\/\/www.ictrechtswijzer.be\/?p=101007"},"modified":"2025-11-06T18:40:57","modified_gmt":"2025-11-06T17:40:57","slug":"in-the-event-of-bankruptcy-is-the-curator-permitted-to-sell-my-customer-data","status":"publish","type":"post","link":"https:\/\/www.ictrechtswijzer.be\/en\/mag-de-curator-bij-een-faillissement-mijn-klantgegevens-doorverkopen\/","title":{"rendered":"In the event of bankruptcy, is the curator permitted to sell my customer data?"},"content":{"rendered":"

You are a customer of a company, but it goes bankrupt. Suddenly, you receive emails from a completely new company that has taken over operations. This begs the question: can the curator just pass on the customer list, including your personal data? The short answer is: yes, but under strict GDPR conditions. A decision of the Data Protection Authority (DPA) of 5 November2025 (No. 177\/2025<\/a>) sheds light on this.<\/p>\n\n\n\n

The facts: a complaint after the takeover<\/h2>\n\n\n\n

The case that came before the DPA litigation Chamber involved a complaint against the curator of a bankrupt swimming school. A former customer (the complainant) filed a complaint after receiving an e-mail from a new organization.<\/p>\n\n\n\n

In this e-mail, the new organization announced that it was taking over the operation of the pool. The e-mail explicitly stated, \u201cWe were able to obtain (...) your e-mail address thanks to the purchase of the customer database from the curator\u201d.<\/p>\n\n\n\n

The complainant believed that the curator should have sought her permission before selling her data. The curator defended himself by arguing that he had not simply sold data, but the bankrupt company's entire trading fund, of which the customer base is a part.<\/p>\n\n\n\n

The decision of the DPA<\/h2>\n\n\n\n

The Litigation Chamber of the DPA decided to dismiss the complaint (to file without action).<\/p>\n\n\n\n

What is important, however, is why the complaint was dismissed. This was not because the curator was right on all counts, but on the basis of expediency. The DPA ruled that the complaint was insufficiently detailed and, more importantly, that too much time had elapsed (more than four years). Given the \u201climited stakes\u201d of the case, the DPA did not consider it appropriate to launch an in-depth investigation.<\/p>\n\n\n\n

Instead of imposing a sanction, the DPA took an \u201ceducational approach\u201d: it used the case to once again clearly lay out the rules for curators and buyers.<\/p>\n\n\n\n

Legal analysis and interpretation<\/h2>\n\n\n\n

Although the case was dismissed, the GBA's reasoning is crucial for any trustee or transferee.<\/p>\n\n\n\n

1. The curator is the controller.<\/h3>\n\n\n\n

The DPA confirms that the curator, acting as representative of the bankrupt company, should be considered the data controller within the meaning of the General Data Protection Regulation (GDPR)<\/a>. He is thus personally bound by the rules of data protection law.<\/p>\n\n\n\n

2. Consent is not the only legal basis<\/h3>\n\n\n\n

The complainant assumed that her consent was required for the transfer. The DPA makes it clear that this is a misconception. The transfer of personal data can also be based on other legal grounds.<\/p>\n\n\n\n

In the case of bankruptcy, the curator can most likely invoke the legitimate interest (Art. 6.1.f GDPR). This interest is to be able to sell the trade fund as a whole, including the customer list, in order to ensure \u201ccontinuity of service\u201d and maximize the assets of the bankruptcy.<\/p>\n\n\n\n

3. The crucial conditions: information and right to object<\/h3>\n\n\n\n

When a controller (the curator) relies on \u2018legitimate interest,\u2019 this automatically activates two other duties:<\/p>\n\n\n\n