meta_id 3148725

On May 12, 2026, Belgium's Data Protection Authority (APD) issued a substantive decision against Isabel SA regarding violations of the General Data Protection Regulation (GDPR) in its TruliUs authentication and identification service. The APD's Contentious Chamber determined that Isabel SA must be qualified as a data controller—not a data processor as the company claimed—for the authentication and identification activities within TruliUs. The service allowed individuals to authenticate on behalf of enterprises through a digital platform. The authority found that Isabel SA unilaterally determined the service's purpose, selected data categories collected via the itsme system, defined user categories, established data retention periods, and designed the technical architecture. These factors demonstrated Isabel SA exercised determinative influence over both the purposes and essential means of the processing activity. The decision identified four violations of the GDPR: failure to provide transparent information to users about data processing (Articles 5.1.a, 12.1, and 13); failure to respond to data subject access requests (Articles 5.1.a, 12.1, and 15.1); collection of excessive data beyond what was necessary for authentication purposes (Articles 5.1.c and 25.2); and violation of the accountability principle by mischaracterizing its role (Article 5.2). The APD imposed an administrative fine of EUR 120,000 for the accountability principle violation and issued a reprimand for the remaining violations. The authority considered the violation's structural nature, approximately two-and-a-half-year duration, and impact on approximately 500 users, while accounting for mitigating circumstances including service withdrawal in March 2023 and data deletion. The decision will be published on the APD's website with Isabel SA identified.