APD/GBA (Belgium) - 113/2024
From GDPRhub
| APD/GBA - 113/2024 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 5(1)(a) GDPR Article 6(1)(a) GDPR Article 7(3) GDPR Article 5(3) Directive 2002/58 |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 06.09.2024 |
| Published: | |
| Fine: | n/a |
| Parties: | MediaHuis noyb |
| National Case Number/Name: | 113/2024 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | APD/GBA (Belgium) (in NL) |
| Initial Contributor: | wp |
The DPA ordered the controller to bring the websites’ cookie banners into compliance with the GDPR by adding the reject button within its first layer and changing the colours used.
English Summary
Facts
A data subject visited four website operated by MediaHuis (https://www.mediahuis.be/en/), namely: • Gazet van Antwerpen; • De Standaard; • Het Nieuwsblad; • Het Belang van Limburg. On each website there was a cookie banner which: Didn’t contain a reject button within its first layer; Buttons colours were misleading; It was not as easy to withdraw consent as it was to give it; Contained a reference to the legal basis of legitimate interest. The data subject filed four complaints referring to abovementioned cookie banners with the Belgian DPA (ADP/GBA). noyb was appointed by the data subject as their representative under Article 80(1) GDPR. MediaHuis was assigned the role of data controller. According to the controller, the law, especially Article 7(3) GDPR or Article 4(11) GDPR, didn’t prescribe the controller to implement reject button within the first layer of the cookie banner or to use different colours for the buttons or to implement consent withdrawal option in a particular way. The fact that the cookie banners were not in line with the guidelines of different data protection authorities and the EDPB, as mentioned by the data subject, did not amount to violation of the GDPR. Moreover, the data subject gave their consent for processing activities of the controller and, for that reason, they had no interest to bring a case before the DPA.
Holding
The DPA found the controller violated the Article 5(1)(a) GDPR, Article 6(1)(a) GDPR, Article 7(3) GDPR. Firstly, the DPA clarified that for the consent to be freely and unambiguously given under Article 6(1)(a) GDPR and Article 5(3) ePrivacy Directive, the reject button had to be presented alongside the accept button. Otherwise, the data subject would have no real alternative to consenting for placing and processing cookies. Secondly, the buttons’ colours used by the controller were of deceptive nature. They inclined a data subject to give a consent for the cookies processing. Because of that, the controller was in breach of Article 5(1)(a) GDPR. Since the cookie banner was lacking of the reject button within its first layer, and the colours used were misleading, the DPA order the controller to bring the cookie banner into compliance with the GDPR within 45 days. The order was combined with a penalty of €25,000 per day and per each website concerned, due if the controller fails to implement the ordered changes. The maximum amount of total penalty was set on €10,000,000. Thirdly, the controller violated Article 7(3) GDPR. To withdraw the consent given, a data subject had to perform more actions - “click more” – whilst to give a consent only one click sufficed. Nevertheless, the controller updated their websites by adding the reject button to the first layer of cookie banner and the option to withdraw the consent, using the manage link at the bottom of each website. Since the violation was remedied, the DPA reprimanded the controller. Fourthly, the legitimate interest called upon by the controller covered placing and processing of the cookies, which were not “strictly necessary”. The controller’s cookies were of different kind, including the analytical cookies. Especially for the latter, the application of Article 6(1)(f) GDPR is per se excluded and the consent needed to be obtained. Furthermore, by adding the legitimate interest to be a “back-up” legal basis for the cookies related processing, the controller mislead the data subject. The controller violated then Article 6(1)(a) GDPR. Nonetheless, the DPA reprimanded the controller that the legal basis for placing and processing of analytical cookies and other cookies that were not “strictly necessary cookies only was a consent under Article 6(1)(a) GDPR. In answer to the controller’s claims, the DPA emphasised that: the fact that the data subject gave a consent didn’t deprive them from starting the case before the DPA; the guidelines of the EDPB were not legally binding, as pointed by the controller, but they played important role regarding the interpretation of the GDPR. In addition, the DPA excluded alleged pressure put on the data subject by noyb to initiate the proceedings. The controller argued the relationship between the data subject, being a trainee at noyb, was instructed to lodge the complaints with the DPA. Hence there was no legal interest of the data subject in the case at hand. However, for the DPA statements of that kind were unfounded, bearing in mind the facts of the case. In particular, the outcome of the data subject’s hearing before the DPA that proved the data subject’s interest being involved.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/70
Dispute resolution
Decision on the merits 113/2024 of 6 September 2024
File number: DOS-2023-03279
Subject: measures concerning the cookie banners on the news websites of Mediahuis
(websites De Standaard, Gazet van Antwerpen, Het Belang van Limburg and Het
Nieuwsblad)
The Dispute resolution of the Data Protection Authority, composed of Mr.
Hielke HIJMANS, chairman, and Messrs. Christophe Boeraeve and Jelle Stassijns, members;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of
personal data and on the free movement of such data, and repealing
Directive 95/46/EC (General Data Protection Regulation), hereinafter
'GDPR';
Having regard to the Act of 3 December 2017 establishing the Data Protection Authority,
hereinafter 'WOG';
Having regard to the Act of 30 July 2018 on the protection of natural persons
with regard to the processing of personal data, hereinafter 'WVP';
Having regard to the internal rules of procedure, as approved by the
Chamber of Representatives on 20 December 2018 and published in the Belgian Official Gazette on
15 January 2019;
Having regard to the documents in the file;
1The new Internal Rules (“RIO”), following the amendments made by the law of 25 December 2023
amending the law of 3 December 2017 establishing the Data Protection Authority (GBA), entered into force on 1 June 2024.
In accordance with Article 56 of the law of 25 December 2023, the new RIO only applies to complaints,
mediations, inspections and proceedings before the Dispute Chamber that were initiated on or after that date:
https://gegevensbeschermingsautoriteit.be/publications/reglement-van-interne-orde-van-de-
gegevensbeschermingsautoriteit.pdf
Cases initiated before 1 June 2024, as in the present case, are subject to the provisions of the WOG as they were not
amended by the law of 25 December 2023 and the RIO as it was before that date existed:
https://gegevensbeschermingsautoriteit.be/publications/reglement-van-interne-orde.pdf. Decision on the merits 113/2024 — 2/70
Has taken the following decision regarding:
Complainant: X, represented by noyb – European Center for Digital Rights
hereinafter “the complainant” or “complaining party”;
Defendant: Mediahuis N. V, represented by Mr. Jan CLINCK, Mr. Pierre ANTOINE
and Mr. Gerrit VANDENDRIESSCHE, hereinafter “the defendant”. Decision on the merits 113/2024 — 3/70
Table of contents
I. Facts and procedure .......................................................................................................... 4
I.1. The four complaints.................................................................................................................. 4
I.2. The settlement proposal and the settlement procedure in the procedure prior to the substantive hearing .............................................................................................................. 5
I.3. The substantive proceedings .............................................................................................. 6
II. Reasons .............................................................................................................................. 8
II.1. Preliminary points .............................................................................................................. 8
II.2. The complaint lodged under Article 80.1 GDPR .................................................. 15
II.3. The infringements .................................................................................................................. 26
III. Measures and provisional enforceability .................................................................................. 56
III.1. Orders .................................................................................................................................. 56
III.2. Reprimands .................................................................................................................. 58
III.3. Penalty payments: special considerations .................................................................................. 58
III.4. Provisional enforceability .................................................................................................. 66
IV. Publication of the decision.................................................................................................68 Decision on the merits 113/2024 — 4/70
I. Facts and procedure
I.1. The four complaints
1. This case is based on four joint complaints from one complainant concerning the
cookie practices of the defendant on four of its websites:
a. The first complaint concerns the website of ‘Gazet van Antwerpen’ (www.gva.be)
b. The second complaint concerns the website of ‘De Standaard’ (www.standaard.be)
c. The third complaint concerns the website of ‘Het Nieuwsblad’ (www.nieuwsblad.be)
d. The fourth complaint concerns the website of ‘Het Belang van Limburg’ (www.hbvl.be)
2. The complainant is represented by Noyb–EuropeanCenterforDigitalRights (“Noyb”),
which has its registered office in Austria. In each of the four complaints and per individual website, a mandate signed and dated by the complainant is enclosed that
authorizes the representative to represent the complainant on behalf of the Belgian GBA.
The scope of the mandate is worded as follows: “regarding: the collection of
my data by placing cookies on the defendant’s website” followed
by the identification of each of the four aforementioned websites, and then “and to
take all necessary measures to enforce my rights, including the initiation of
judicial or extrajudicial proceedings.”
3. The complaints each raise four alleged “violations” and set out the complainant’s grievances as follows:
• “Violation type 1: No ‘refuse’ option at the first information level of the
cookie banner”
• “Violation type 2: Misleading button colours”
• “Violation type 3: It is not as easy to withdraw consent as
it is to give consent”
• “Violation type 4: Reference to legitimate interest”
4. The complaints are filed – dated 18 July 2023 – with the First Line Service of the
Data Protection Authority by email. The complaints were formally received after
midnight on 19 July 2023.
5. On 3 August 2023, the First Line Service requests the complainant's representative
the following: "Please inform us of the complainant's interest in filing
the complaint, as provided for in Article 60 of the Act of 3 December 2018
establishing the Data Protection Authority". Decision on the merits 113/2024 — 5/70
6. On 24 August 2020, the complaint is declared admissible by the First Line Service on the
basis of Articles 58 and 60 WOG, after which the complaint is transferred to the Dispute Chamber on the basis of Article 62,
§ 1 WOG. 7. On 1 September 2023, the complaining party submits a document to the First Line Service
that formulates an answer to the question that the First Line Service addressed to
Noyb on 3 August 2023 regarding (the legal framework for) the interest of the complainant and the mandate.
8. In the aforementioned document, Noyb refers to communications that it sent to the First Line Service on 17 and 25
August 2023, and to which the First Line Service replied to Noyb
on 24 and 29 August 2023 respectively. This communication was not added to the current file by the
First Line Service, because this exchange took place in the context of another file pending with the GBA; the Dispute
Chamber has confirmed this approach to the defendant. Of course, the content of these messages is
also not taken into account in the context of the assessment
and the decision in the current file. I.2. The settlement proposal and the settlement procedure in the procedure prior to the hearing on the merits
9. On 21 September 2023, the Dispute Resolution Chamber sends a letter to the parties with the
message that it would send a settlement proposal to the parties within a period of thirty days. In the meantime, the parties are given the opportunity to
inspect the file, which both parties also requested; they were granted inspection.
10. On 20 October 2023, a settlement proposal is sent simultaneously to both
parties, after which the settlement procedure formally commences within the meaning of Article 95 §1, 2°
WOG.
11. On 30 October 2023, the representative delivers the complainant's response to the
settlement proposal to the Dispute Resolution Chamber, with the proposal to make a number of
adjustments. 12. On 6 November 2023, the Dispute Resolution Chamber communicates to the parties that – in accordance with the comments made by the complaining party – it would not proceed to adjust the terms of the settlement proposal.
13. On 7 November 2023, the defendant indicated through her counsel that the response period provided for in the settlement proposal was not feasible. For that reason, the defendant requested that the response period be extended to 20 December 2023. On 10
2When delivering the copy of the file, the defendant repeatedly (on 28 September 2023 and again on 2 November 2023) requested the Dispute Chamber to deliver the aforementioned messages dated 17 and 14 August 2023, which the Dispute Chamber refused to do in order to safeguard the integrity of the other file. Decision on the merits 113/2024 — 6/70
November 2023, the Dispute Chamber indicates that at that time it is not possible
to respond to the extension of the term as proposed by the defendant, but the
Dispute Chamber does grant a seven-day extension.
14. On 27 November 2023, the defendant, through her counsel, sends a letter in which she
states that she is not averse to a settlement, but does want clarification on a number
of points. The defendant also suggests adjustments to the terms of the settlement
proposal.
15. On 28 November 2023, the Dispute Chamber sends an acknowledgement of receipt to the
defendant, after which another message is sent by the Dispute Chamber on 1 December 2023
stating that a response to the letter of 27 November 2023 from the
defendant cannot be provided until later. 16. On 5 December 2023, the Dispute Resolution Chamber sends the defendant a response on
all aspects for which the defendant requested clarifications or adjustments in the
letter of 27 November 2023.
17. On 11 December 2023, the defendant indicates through her counsel that she cannot
accept the settlement proposal in its entirety. In the same
message, the defendant immediately indicates that she has made a number of changes in response
to the 2nd and 3rd grievance of the complainant, and that further
changes would be made regarding the 4th grievance. With regard to this last grievance, the defendant states that
she “will not fall back on the legitimate interest to still place such cookies.”
18. On 18 December 2023, the Dispute Chamber will then take a formal decision to
withdraw the settlement proposal, which will briefly set out the reasons for abandoning
the settlement procedure.
I.3. The proceedings on the merits
19. On 5 February 2024, the parties concerned will be notified by registered mail
of the provisions as set out in Article 95, § 2, as well as those in Article 98 of the WOG.
They will also be notified, pursuant to Article 99 of the WOG, of the deadlines for submitting
their defences. In the letter, the Dispute Chamber invites the parties to
take a position on a number of aspects, setting out potential infringements that
are charged to the defendant. 20. On 12 February 2024, the defendant sends a letter to the Dispute Resolution Chamber, containing
several comments and requests regarding the procedure, as well as a
request to have the procedural documents sent by post, rather than
electronically. The Dispute Resolution Chamber responds to this message on 19 February 2024
and also extends the previously established deadlines for submitting conclusions. Decision on the merits 113/2024 — 7/70
21. On 27 March 2024, the Dispute Resolution Chamber receives the conclusion in response from the
defendant; at the same time, this conclusion is delivered to the representative of the
complainant.
22. On 17 April 2024, the Dispute Resolution Chamber receives the conclusion in reply from the
complainant. The representative of the complainant hereby replies on a number of points to the conclusion in
the defendant's response dated March 27, 2024.
23. The (representative of the) complainant also requests the Dispute Chamber to be heard, as well as to take the necessary corrective measures. In addition, the complainant requests not to suspend provisional enforceability, as requested by the
defendant, since this option provided by the legislator should be interpreted narrowly. Finally, the complainant requests to publish the decision on the GBA website.
24. On May 8, 2024, the Dispute Chamber receives the conclusion of the reply from the defendant;
at the same time, this conclusion is delivered to the representative of the complainant.
25. On June 17, 2024, the parties are informed that the hearing will
take place on July 1, 2024.
26. On July 1, 2024, the parties are heard by the Dispute Chamber.
27. On 8 July 2024, the Minutes of the hearing will be submitted to the parties.
28. On 12 July 2024, the Dispute Chamber receives a number of comments
regarding the Minutes from the complaining party, which it decides to include in its deliberations.
29. On 12 July 2024, the defendant provides a number of comments
regarding the Minutes for the first time, stating that this PV is not a true
representation of the hearing. The Dispute Chamber decides to include the aforementioned comments
in its deliberations. On 16 July 2024, the defendant then submits new comments
regarding the minutes, which the Dispute Chamber decides to include in its
deliberations. 30. At the same time, the defendant requests a copy of the recording of the hearing, a request which she bases on art. 95 § 2 WOG and art. 15.3 AVG. On 18 July 2024, the defendant is informed that she can come and listen to the full unedited recording of the hearing
in the offices of the GBA, that the data protection officer of the GBA has been involved, and that the period for submitting
comments on the minutes is extended. On 31 July 2024 – the day of the expiry of the period for
comments on the minutes – the defendant delivers Decision on the merits 113/2024 — 8/70
a letter to the Disputes Chamber, as well as to the DPO of the GBA, regarding her
request to obtain a copy of the recording of the hearing.
II. Reasons
II.1. Preliminary points
31. A first preliminary point concerns the reply conclusion of the complaining party. The
defendant states in her summary conclusion that the conclusion of the complaining party must be excluded from the
debates, on the one hand because it was not signed (by the
legal mandate holder of the representative Noyb) and on the other hand because the
conclusion was not drawn up in accordance with art. 744 of the Judicial Code.
32. The Dispute Chamber argues why the defendant's argument on this point
fails as a matter of law. In essence, the procedure before the Dispute Chamber is
governed by the procedural provisions of the WOG. The Market Court has already stated several times that
the Dispute Chamber is an administrative body and not an (administrative) court
in the formal sense. In this sense, it cannot be correctly stated that the provisions of the Judicial Code in the procedure before the Dispute Chamber would apply in full and always as lex generalis, where the lex specialis of the WOG does not provide for any provision.
33. Moreover, the Belgian legislator has explicitly determined in the WOG that the parties can submit defences. The legislator then left it to the GBA to
regulate how defences can be submitted – and to regulate this, if necessary, in the Rules of Internal Order. 5
34. It was in its letter of 5 February 2024 that the parties were informed of
the manner in which the conclusions had to be submitted. Nowhere in that invitation is it mentioned that the parties should submit
defences in a manner with formal requirements as cited by the defendant, nor is it
referred to the Judicial Code. The Dispute Chamber cannot restrict a party's means of defence – mutatis6
mutandis, this must also apply to the manner in which a party draws up and
files its conclusion when nothing else has been 'imposed' on the parties in advance. The complaining party
3
E.g. Judgment of the Court of Appeal of Brussels (Chamber 19A, Market Court Section), 20 October 2020, 2020/AR/582, §7.4; Judgment of the Court of Appeal of Brussels (Chamber 19A, Market Court Section), 7 July 2021, 2021/AR/320, P. 24; Judgment of the Court of Appeal of Brussels (Chamber 19A,
Market Court Section), 1 March 2023, 2022/AR/1085, P. 7.
4 Art.98, 2° WOG: “. . . the possibility [for the parties to submit their defences”;
And also in art. 99 WOG: “The Dispute Chamber invites the parties to submit their defences.”
See in this regard articles 48 et seq. of the former Rules of Internal Order (version 2018), which apply to the present
file.
6Cf. judgment Marktenhof (2021/AR/320), 7 July 2021, p. 15: “The circumstance that the answer form would only allow a
limited number of words of response is not pertinent in this respect. The scope of the response and therefore of the exercise
of the rights of defence cannot be validly limited by the Dispute Chamber.” Decision on the merits 113/2024 — 9/70
has complied with the conclusion deadlines with regard to the filing of the
document.
35. Taking all this into account, it is clear to the Dispute Chamber that the document in question
(the complainant's reply) should not have been excluded from the debates, that it
could simply form part of the deliberations of the Dispute Chamber, and that the
arguments put forward by the defendant in order to exclude the document from the debates
are unfounded.
36. A second preliminary issue concerns new documents that are submitted
at the hearing by the complainant's representative. The defendant opposes the
submission of these documents and their addition to the file. Given the
late nature of the submission of the documents, the opposition of the defendant to the
submission, and in the absence of any valid reason for the
late nature of the submission, the documents are excluded from the debates in their entirety and
will not be included in the debates before and the deliberations of the
Dispute Chamber.
37. TheDispute Chamber points out in connection with this second
preliminary point that, as a body of a supervisory authority, it must be
able to take into account all the elements that have come to its attention, in
order to guarantee a high level of data protection. This does not alter the fact that the procedure
must meet the requirements of adversarial and equality of parties. The procedure provided for in the
subsection "deliberation and decision on the merits" in art. 98 et seq. WOG aims precisely at providing a procedure for
adversarial proceedings. In administrative law, special account must be taken
of the duty to be heard and the rights of defence.
38. A third preliminary point concerns the legally valid appearance of the person who appears for
the representative of the complainant (physically) at the hearing. When the
hearing takes place, the defendant indicates that she has questions about the
mandate of the person to act for Noyb in accordance with the articles of
association of this organisation.
39. It should first be noted that Noyb has reported as the representative of
the complainant to the Dispute Chamber, submitting the mandate in this regard, by
sending a message via a specific e-mail address. For the presence at the hearing of the person in question, prior to the hearing the representative had reported via the e-mail address that the Noyb employee would be present as a representative. The Dispute Chamber is not obliged to investigate ex officio or at the request of the parties how the designation of this employee took place in concrete terms. The notification by the organisation Noyb via e-mail of the identity of the employee in question is sufficient. For that reason alone it has been sufficiently established that the person could legally appear before Noyb. 40. It should be noted that the complainant was present in person at this hearing, and
this at the side of the employee of Noyb. Based on the appearance of the complainant,
it can be established that the complainant also assumes that the person in question
could legally act for his representative Noyb.
41. The person in question did therefore legally appear before Noyb at the hearing.
42. As a fourth preliminary point: at the hearing, the complaining party, for the first time and
without prior notice, but not in limine litis, questions in its pleadings the
“independence” of the chairman of the Dispute Chamber for the handling
of this case. Furthermore, the complaining party asks the chairman of the
Dispute Chamber to withdraw. The complaining party refers to
anonymous "sources" who allegedly heard in private conversations that there was a strategy
to reject complaints "from Noyb", and to a public event where the
chairman of the Dispute Chamber was present. No further concrete
elements are provided that would substantiate the lack of "independence" of the
sitting member.
43. The Dispute Chamber understands from the wording of the complaining party that it is more (or
at least also) about the impartiality than the independence of the
Dispute Chamber. Such "requests for disqualification" must be handled carefully and
accurately by the requesting parties. Expressing dissatisfaction with (the outcome or course of) a procedure is something different than raising requests for disqualification against members of public institutions, whose legitimacy is based precisely on their independence and impartiality.0
44. Specifically with regard to the oral request of the complaining party to withdraw
from the chairman, the chairman decides not to grant this request for the following reasons.
8
L. Van Den Eynde, “Partiality and conflicts of interest in active management: the sneak path of the equality principle”, TBP,
2024, Ed. 4, 215-230, specifically section 2.1 “types of (im)partiality and evidence”; Compare with regard to the confusion of concepts in the context of the
judiciary: Ooms A., “Judicial impartiality is not always what it seems. A historical and
prospective analysis of the boundary between objective and subjective impartiality.”, Croniques de droit public, 14(2010)4, p.
499-524; ; Opdebeek I. and De Somer S., Algemeen Bestuursrecht: fundamenten en principes, Ed. 2, Antwerp, 2019
Intersentia, specifically part V, Chapter III, Section 8 regarding the principle of impartiality for the administration.
9Compare art. 835 Judicial Code for requests for disqualification with regard to members of the judicial order, a provision that
states, among other things, that such requests for disqualification with the reasons for the disqualification must be filed
with the registry in a formal document, and that only by lawyers with more than 10 years of experience at the bar.
10The legislator anchors several elements in this regard in art. 44 WOG. Decision on the merits 113/2024 — 11/70
45. First and foremost, the complainant was sufficiently aware that the chairman was handling this file
(jointly), at least as recently as 5 February 2024 when the parties were
invited to submit their defences in this file in a letter signed by the chairman. The complainant had the opportunity
to take the necessary steps to address the fact. The (extremely) late nature of the request for
withdrawal is in itself sufficient to not grant this request.
46. In addition, reference can be made to the following facts.
47. It is the defendant who has put forward a number of means and arguments
in this file that highlighted the (procedural) interest and the
delegation of the representative by the complainant, not the Dispute Chamber. Furthermore, in the present
file, only the First Line Service has asked without obligation about the (procedural)
interest of the complainant, apparently without any adverse effect on the latter when
declaring the complaint admissible. In its letter with the invitation to submit
the defence, on the other hand, the Dispute Chamber did not ask the complaining party to
further explain its (procedural) interest or the circumstances of the
mandate. It is therefore factually incorrect to suggest a bias that can be
traced back to a person or a strategy of the Dispute Chamber or its chairman.
This does not, however, alter the fact that it is within the jurisdiction of the
Dispute Chamber to ask this type of question to the parties.
48. The complaining party was then able to respond to the aforementioned
resources and arguments of the defendant in the reply and at the hearing. However, the complainant indicated at the beginning of the hearing that the substantive rather than the formal points should form the core of the debate, and that the complainant would be subject to a "more thorough investigation" than a controller.
This is factually incorrect, and on several points.
49. First of all, the settlement procedure itself illustrates that the Dispute Resolution Chamber -
prior to this decision - initiated proceedings in order to quickly resolve the substantive
grounds formulated in the complaint. Moreover, at that time it was the first time that the Dispute Resolution Chamber used the settlement procedure as a power in the phase
preceding the deliberation on the merits.
50. Furthermore, the Dispute Resolution Chamber does not understand to what extent the complainant would have been subject to a "more thorough
investigation". The Dispute Chamber did not ask or suggest anything to the complainant in this regard prior to the submission of the arguments by the defendant, and the Inspectorate did not intervene in this case. The fact that the defendant submits arguments and resources in this regard is the right of a defendant in proceedings with potentially weighty corrective measures. Such arguments and resources cannot and may not be excluded from the debate. Decision on the merits 113/2024 — 12/70
51. Furthermore, in response to the question from the defendant whether the latter should limit herself to her arguments on these procedural elements at the hearing, the Dispute Chamber indicated 12that the parties are free to arrange their pleadings as they wish, but that the hearing, in accordance with the letter of 5 February 2024, will at least deal with those substantive points.
The extent to which the substantive aspects have (partly) formed the core of the
debate for the Dispute Chamber could hardly be clearer.
52. The Dispute Chamber clarifies that the representative of the complainant in this
case must separate the various formal procedures in which it acts for different complainants
from each other. In this case, the Dispute Chamber, when enabling the
case and inviting the submission of defences, has not raised the alleged
problem regarding the (procedural) interest of the complainant, nor the alleged
problem regarding the mandate itself. In the following parts of the present
decision, the Dispute Chamber also rejects the defendant's arguments in this
respect.
53. The Dispute Chamber cannot be asked not to address the
arguments of the defendant, or not to subject the arguments in this respect
to an assessment. Moreover, it is precisely the task of the Dispute Chamber to
consider the submitted means and arguments, which must be
assessed per case. 14
54. The Dispute Chamber also judges in an impartial manner, without fear or
favour for the other party. In this sense, the defendants are also
entitled to a fair analysis of the facts and in accordance with the legal standards. 15 A complaining party
has no right to preferential treatment on a procedural level, nor does this party
have the privilege of avoiding a legal debate – potentially to its disadvantage.
11
The defendant submitted a question to the Dispute Chamber on 19 June 2024, the complaining party could read along in cc.
12 The Dispute Chamber replied to the defendant on this matter on 21 June 2024, the complaining party could read along in cc. 13
In this context, it should also be noted that procedural documents from the complainant could not be included in this file, because they were transferred to the margin of another file in which the representative acted. See in this regard the exchanges between the defendant and the Dispute Resolution Chamber in documents 20, 21, 28 and 32 of the administrative file.
14
Cf. Judgment of the Brussels Court of Appeal (Market Court Section) of 16 September 2020, 2020/AR/1160, §5.7: “It is not appropriate in a constitutional state that the Dispute Resolution Chamber of the GBA could ‘choose’ which argument it does or does not provide an answer to.”
15 Cf. Article 6 ECHR, Article 47 Charter of Fundamental Rights of the EU and Article 52 GDPR; although the Litigation Chamber is not a court in the traditional sense, this principle also applies to administrative procedures (ECHR, Öztürk v. Germany, 21 February 1984,
ECLI:CE:ECHR:1984:0221JUD000854479); within Belgian law, the impartiality of administrative bodies is also guaranteed as a principle of good administration, cf. supra and Judgment of the Council of State, 22 June 2017, no. 238.610.
16Although the Litigation Chamber is not a court of law, reference can be made to art. 6 of the Judicial Code, which states that judges must apply the applicable legal rules in all cases subject to their judgment; under art. 57 GDPR, it is mutatis mutandis up to the supervisory authority to handle complaints and examine the outcome, without any indication of preferential treatment. Decision on the merits 113/2024 — 13/70
When aspects are discussed or dealt with in an investigation, at a hearing or in
a decision, this does not mean that the aspects are justified or well-founded.
55. In a credible dispute, one arrives at the truth in a thoughtful manner on the basis of
facts and qualitative arguments. In this context, (legal) questions must of course be able to be
asked without this in itself entailing partiality.
56. The fact that, in the context of loyal and confidentially organised cooperation and
the loyal sharing of information within and between supervisory authorities in the
European Economic Area, information could be provided that would raise critical legal
questions on a particular issue is an inherent element of the cooperation procedure in Chapter
18
of the GDPR.
57. The mere fact that a previous case before the Dispute Chamber with allegedly similar circumstances
entails a possible adverse outcome for the same party or its representative does not in itself
justify the recusal of a sitting member in another (i.e. this) case.
58. If a party does not agree with a decision of an authority, it is
free under Article 78 GDPR to institute proceedings against that decision. In the
Belgian legal system, this can also be done by any interested third party at the Market
Court in accordance with Article 108, §3 WOG. If Noyb therefore believes that it is such an
interested party, it has access to justice if necessary. The fact that in a previous case no appeal could be
lodged because the complainant concerned did not wish this, as was raised at the hearing, is not an
argument that is reprehensible to the Dispute Chamber and is not relevant.
59. Finally, as a fifth and final preliminary point, after receiving
the PV in this file, the defendant informed the Dispute Chamber on 12 July 2024 that it
considered this PV to be “not a faithful representation” of the hearing and that it
could violate the rights of the defence. In that context, the defendant requested that a new PV be drawn up.
60. On 23 July 2024, the Dispute Chamber informed the defendant that the audio
recording could be listened to in its entirety and unedited in the buildings of the GBA, after
the Dispute Chamber had already exceeded the deadline for submitting comments
to the PV.
1 See Article 54.2 GDPR and Article 48 § 1 WOG. 18The principle of impartiality cannot be applied contra legem in this regard in connection with the circumstances of
international information sharing, cf. Judgment of the Council of State of 23 June 2020, Lossau, no. 224.038; discussion in L. Van Den
Eynde, “Partiality and conflicts of interest in active management: the sneak path of the equality principle”, TBP, 2024, Ed. 4,
(215)219, §11.
19In this sense, reference is made in the conclusions and pleadings by various parties in the proceedings to Decision
22/2024 of the Disputes Chamber, against which no appeal was lodged with the Market Court.
20
In the comments on the report, the complaining party makes the following comment: “[…] now the failure to lodge an
appeal is anything but in the interest of noyb.” Decision on the merits 113/2024 — 14/70
extended until 31 July 2024. In this context, it should be emphasised that the Dispute Chamber included the following passage in the
invitation to the hearing:
You are also informed that the entire hearing will be
recorded for the sole purpose of drawing up a report. The
sound recording will be destroyed as soon as the appeal period as stated in
art. 108 WOG has expired. If the appeal option is used, the sound
recording will only be destroyed upon receipt of the Market Court's judgment.
61. The Dispute Chamber refuses the requested copy for the following reasons.
62. Firstly, the drawing up of the report by the Dispute Chamber and the submission thereof
to the parties is not a legal right, but merely an initiative of the GBA to (formally) record the hearing in the
administrative file, as well as to formalise elements that were not raised in the
conclusion round in the file.
The Internal Rules state that this is merely a representation by way of
synthesis; the report itself also explicitly states as follows:
“The present report is only intended to record clarifications and
additions that were put forward during the hearing, without repeating the elements that
were set out in the written conclusions of the parties.” (the Dispute Chamber
underlines in light of this decision)
63. In that sense, the Dispute Chamber has taken note of everything that was said
during the hearing. In her conclusions, the
defendant has presented her arguments in detail (including table of contents and
overview of documents, the synthesis conclusion has 117 pages). The Dispute Chamber has not included similar elements that were mentioned
during the pleadings in the PV, and merely referred to the fact that the
pleadings deal with "formal" and "substantive" elements - elements that can be found
in and are identical in wording to the synthesis conclusion several times. Every question or
substantively new comment at the hearing was included in the PV.
64. Secondly, the Dispute Chamber states that it is not the objective of the PV to
provide an exhaustive overview of everything that was said at the hearing. An exhaustive
overview is not only not very relevant to the objective of the right to be heard as
laid down in the law, it is also undesirable for the proper functioning of the
procedure before the Dispute Chamber and for the smooth course thereof for the parties. In particular, the
debates will not be reopened after the hearing has ended, as is also
expressly stated in the PV itself. Under the principle of effectiveness, the GDPR must be
usefully
21
Art. 54 “old” version RIO GBA. Decision on the merits 113/2024 — 15/70
can be upheld: unnecessary additions to the procedure are not only
undesirable, they are also illegal in accordance with that principle.
65. An exhaustive transcription of everything said at the hearing would result in several dozen pages of PV for a 1.5-hour hearing such as in the present case; the procedural added value of a hearing is thus undermined.
66. Finally, in the context of the request, the defendant points out that she would be entitled to a copy of the recording under art. 95 § 2 WOG because it forms part of the file. This
is incorrect. The PV is the document that is included in the file; in addition, the parties' comments on that PV are added to the
file. The audio recording only facilitates the preparation of the aforementioned PV and is not a document in the administrative file.
The right to be heard, as laid down in art. 98, 2° WOG, does not extend to
obtaining a copy of the recording of the hearing. By the end of the hearing, the debates are closed, so access to the copy of the audio recording on the basis of art. 95 § 2 WOG – a statutory provision that deals with the copy of the file when the case is brought to court – is in any case not an issue.
67. For all these reasons, the defendant's request for the preparation of a new – more exhaustive – PV of the hearing of 1 July 2024 is rejected.
68. For the sake of transparency of the procedure, it should be noted that several lawyers for the defendant requested a copy of the audio recording of the hearing on the basis of art. 15.3
GDPR, by means of messages to the Dispute Chamber on 18 July and 31 July 2024. In the message of 31 July 2024, several lawyers for the defendant wrote to both the Dispute Chamber and the Data Protection Officer ("DPO") themselves. As soon as
a lawyer referred him to article 15.3 GDPR on 18 July 2024, the DPO of
the GBA was informed of the request. This exercise of a right under art.
15.3 GDPR does not fall under the administrative procedure that precedes the
present decision.
II.2. The complaint filed under art. 80.1 GDPR
II.2.1. Legal framework
69. Article 80 GDPR provides:
Representation of data subjects
1. The data subject shall have the right to instruct a non-profit-making body, organisation or association
which has been properly constituted in accordance with the law of a Member State,
the statutory objectives of which are in the public interest and which is active in
the field of the protection of the data subject’s rights and freedoms in relation to the Substantive decision 113/2024 — 16/70
the protection of his or her personal data, to lodge the complaint on his or her behalf,
to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf,
and to exercise the right to compensation referred to in Article 82 on his or her behalf,
where Member State law so provides. 2. Member States may provide that a body, organisation or association referred to in paragraph 1
of this Article, independently of a data subject's mandate, has the right to lodge a complaint in that Member State with the supervisory
authorities competent in accordance with Article 77 and to exercise the rights referred to in Articles 78 and 79,
if it considers that the rights of a data subject under this Regulation have been
infringed as a result of the processing. In this light, recital 142 of the preamble is also relevant:
Where a data subject considers that his or her rights under this Regulation have been infringed, he or she should have the right to authorise a non-profit-making body, organisation or association,
established in accordance with the law of a Member State, which has statutory objectives that are in the public interest and which is active in the field of
the protection of personal data, to lodge a complaint on his or her behalf with a supervisory authority, to exercise the right
to a judicial remedy on behalf of data subjects, or to receive compensation on behalf of data subjects, where provided for by
Member State law. Member States may provide that these bodies, organisations or associations have the right
to lodge a complaint in that Member State, irrespective of any authorisation by a data subject, and the right to an effective judicial remedy, if
they have reason to believe that the rights of a data subject have been violated
as a result of the processing of personal data in breach of this
Regulation. Such bodies, organisations or associations may be provided that they
do not have the right to claim compensation on behalf of a data subject without the
authorisation of the data subject.
II.2.2. Context of the complaint
70. The manner in which the complainant, in consultation with Noyb as representative,
can be visualised as follows. Decision on the merits 113/2024 — 18/70
74. This of course points to a certain form of coordination, but it is nowhere established that any coordination
took place before the complainant's grievances arose, nor
before the mandate of Noyb by the complainant. In that sense, it certainly cannot be established
that there could potentially have been any pressure from Noyb with regard to the complainant.
75. It should be noted, however, that this fact is not undisputed, since the defendant indicates that the
interest of the complainant as a person concerned has not been demonstrated, and that the findings or grievances
cannot be completely separated from the Noyb organisation. The defendant refers
at the hearing to the fact that the determination with work material was made during
working hours, as well as that it is discussed about a project at Noyb (and not a
complaint from the complainant as an individual).
76. Fourthly, the complainant believes that there has been a breach of the GDPR and that his
rights have been harmed.
77. Fifthly, a complaint was filed on behalf of the complainant by Noyb as his
representative. The complaint was formulated in consultation with the complainant and
filed with the Belgian supervisory authority, and submitted to the First Line Service of the
GBA without any alleged procedural defects.
II.2.3. No direct evidence of a ‘fictitious’ mandate and
present (procedural) interest on the part of the complainant
Position of the complainant
78. In its conclusion of reply, the complainant addresses the “admissibility” of the
complaint. The Dispute Resolution Chamber summarizes the position.
In a first part on this matter, the complainant argues regarding the
“admissibility pursuant to art. 77(1) in conjunction with art. 80(1) GDPR”.
a. First, under the section “burden of proof”, the complainant states that the complaints
and appendices show that there is a personal connection between the complainant and the
data processing, inter alia because the complainant visited the websites, from which
the necessary indications of the violations described in the complaint appear. In this
regard, the complainant further states that the GDPR does not impose any requirements on the
content, form or scope of the complaint, nor on the evidence that the complainant
should provide. Furthermore, the complainant states that it is the controller who bears the burden of
proving that the GDPR is complied with, and not the complainant.
b. Secondly, under the section “the processing operations in question
violate the GDPR”, the complainant states that the complaints describe where GDPR violations Decision on the merits 113/2024 — 19/70
occur, and that the GDPR or the WOG do not require the complainant
to first exercise his rights vis-à-vis the controller. Furthermore, the complainant points out that the
defendant did not accept the cookie banners pursuant to the settlement proposal and that the
cookie banners are still unlawful.
c. Thirdly, under the section “sufficient personal interest”, the complainant
states that the complainant visited the websites and that personal data were processed in
doing so. The complainant then chose to be represented by Noyb, in accordance with art. 80(1) GDPR. The
representation assignment can always be terminated, and art. 80(1) GDPR
does not impose any restriction on granting such a representation mandate
during or after a “direct subordinate relationship” between the complainant and
the representative, according to the complainant. Furthermore, the complainant states that the
Court of Justice of the EU has accepted that a person who is (has been) employed by Noyb can be represented by the latter, and that the
argument of invalid representation by Noyb has been rejected again and again
in the pending cases concerning Noyb. In addition, Noyb points out that the decisions
of the Dispute Resolution Chamber do not set a precedent.
d. Fourthly, the complainant states under the section “Incorporation under Belgian law
(art. […] 220§2,1° GBW)” that the GBA has already previously endorsed that this
Belgian provision is more restrictive than art. 80(1) GDPR and that it disregards it in the sense that non-
compliance with it has ‘no impact’. The
complainant further submits that the GBA must disregard the effect of the national provision
in order to guarantee the full effect of EU law and therefore to admit Noyb as a representative on the basis of Article 80(1) GDPR; Noyb
is validly established under the law of a Member State, in this case Austria.
79. In a second part on this matter, the complaining party argues regarding the
“admissibility under art. 80(2) GDPR”:
a. The complaining party states in this regard that there is a valid representation under
art. 80(1) GDPR, which means that a question of admissibility under art. 80(2) GDPR is not
at issue. In addition, the complaining party notes that Noyb can institute proceedings with the courts itself in accordance with art. 17 Judicial Code and that there is no
reasonable justification for not allowing Noyb to independently file a complaint with the GBA. In addition, the complaining party notes that the legislative history
of art. 17 Judicial Code does not state that the provision does not apply to procedures
before the (Dispute Chamber of the) GBA. On the other hand, according to the complaining party, it follows
from the legislative history of art. 58 WOG that “anyone” can file complaints, Decision on the merits 113/2024 — 20/70
including legal entities and associations. Furthermore, the complainant states that
allowing Noyb to appear before a court as an independent procedural actor, but not
before the GBA, would constitute a violation of the principle of equality within the meaning of art.
10 of the Belgian Constitution. The complainant concludes: “The fact that noyb
would have sufficient interest in filing complaints such as these already follows
from Noyb’s statutes.”
Defendant's position
80. The defendant's position is clarified in this matter in two of its grounds,
and is as follows (the Dispute Chamber summarises):
e
"2nd ground (in the main order): Absence of a sufficient personal interest on the part of
the complainant":
a. In this ground, the defendant first states, in summary, that "no
credible evidence or claim of processing of personal data of
the complainant" is adduced in the complaint. According to the defendant, it is not certain
that the complainant himself visited the websites in question.
The defendant states that, based on “further investigation”, it establishes, for example, that a number of “false or at least defective assertions” can be read into the complaint – and refers for each of the four complaints to the fact that for each of the four complaints, references to news pages (web pages) were included in the evidence that were dated after the date on which the complainant claimed to have visited the websites.
In addition, the defendant points to other inconsistencies in the submitted
documents.
b. Secondly, in this plea, it is argued, in summary, that the “processing in question” does not violate the GDPR. The defendant argues in this regard that the
complainant, as the data subject, gave his consent and that he consulted the
various information layers, as is evident from the evidence.
Moreover, as the defendant points out, the complainant did not exercise his
rights vis-à-vis the defendant. This means that, if the defendant, that
the Litigation Chamber cannot impose an order to erase data within the meaning
of Article 17 GDPR or an order to notify this erasure or rectification to
third parties within the meaning of Article 19 GDPR.
c. Thirdly, the defendant states, in summary, that the “data subject” (complainant)
does not have a sufficient personal interest and the representative is acting under a fictitious
mandate. The defendant refers to press releases from Noyb
regarding its actions against “cookie banner terror” as well as a specific Decision on the merits 113/2024 — 21/70
press release concerning the settlements of the Litigation Chamber. The defendant
quotes the following passage from this latest press release from Noyb: “Noyb files 15 complaints
against the aforementioned media sites in order to force them to adjust their cookie
banners after all.” The defendant also states that the complainant was an intern at Noyb at the time of the
visits to the disputed websites, that the visits to the websites were not
spontaneous visits (given the limited time spent – less than 1 minute per website), the
geographical data regarding the website visits can be traced back to Austria, the complainant himself
states that he is acting against a general practice and that the complainant filed a complaint
against other media companies on the same day. The defendant also points out that the
letter to the First Line Service by Noyb on 1 September 2023 does not
demonstrate that the complainant indeed has the required personal interest, and that the
Dispute Resolution Chamber had already ruled in an earlier decision in a similar case
(Decision 22/2024 of 24 January 2024) that Noyb's mandate is fictitious.
d. Fourthly, the defendant states that Noyb committed an abuse of rights because it used the
complaints procedure to "implement its own publicly announced programme via a fictitious mandate from a subordinate
trainee". The defendant further states: "In this way, Noyb attempted to circumvent the non-
transposition into Belgian law of Article 80.2 . . .." The defendant
cites several more elements before concluding: "Noyb therefore used the
complaints procedure at the GBA for a purpose other than that for which the
procedure is actually intended. This is an abuse of rights."
e. Finally, the defendant responds to a number of points from the
complainant's conclusion. In this context, the defendant notes that the complaining party does not
respond to "several - earlier factual - arguments" of the defendant and that
those facts are therefore not disputed. “3rd plea (in subordinate order): NOYB cannot independently file a complaint”
a. In this plea, the defendant firstly and ‘in principal order’ states that the mandate
of the complainant is limited to Article 80.1 GDPR. The defendant states that the
Dispute Chamber cannot assess the elements in the complaint under Article 80.2
GDPR: in that case, the Dispute Chamber would judge “ultra petita”.
b.
Secondly and ‘in subordinately’, the defendant states that Article 80.2
GDPR does not apply in Belgium. The defendant refers to the choice of the Belgian
legislator not to activate this provision via national law. Decision on the substance 113/2024 — 22/70
c. Thirdly and also ‘in subordinately’, the defendant states that
Noyb itself cannot file a complaint since it does not have a sufficient
personal interest.
d. Fourthly, the defendant offers a reply to what was stated in the conclusion of the complaining party, i.e. that a sufficient interest for Noyb follows from the articles of association of that company. The defendant states that the articles of association of Noyb only show the general, public nature of the interest.
Assessment by the Dispute Chamber
81. The representative of the complainant is generally active (pro-)actively to expose certain practices in the field of data protection law.
These general association-specific objectives are of course not sufficient in themselves to speak of a
fictitious mandate under Article 80.1 GDPR. The defendant cites a number of (sub-) means in its defence to argue that various problems can be identified with regard to the
mandate. However, the Dispute Chamber does not find in any of these means direct indications or
evidence to state that the mandate would be fundamentally flawed, let alone
would have been created in a ‘fictitious’ manner in this case. The
Dispute Resolution Chamber argues as follows.
82. Firstly, it is indeed the case that Noyb has in the past maintained several projects
in which it attempted to address certain practices by means of complaints. The fact that in that
context mandates were generally formulated in a fictitious manner is of course not sufficient
to establish that Noyb cannot represent any parties involved in the same
matter. Nor is there any formal indication in this case that Noyb itself took the initiative
to encourage the complainants to file complaints with a specific concrete content.
83. Secondly, the complainant emphasises at the hearing that he visited the websites
independently and had problems with the practices of the controller, specifically after
taking note of the settlement decision of the Dispute Resolution Chamber
concerning the websites. Furthermore, the complainant is Dutch-speaking, so it is not inconceivable that the
complainant also visits the websites in question occasionally or routinely and has an interest in
the personal data processing being carried out properly when this happens. If
the complainant then also states that he visited the website independently – albeit on
a work laptop – and feels aggrieved by this, without any indication of
prior instruction or pressure from the representative, the legitimate,
direct and personal interest is established. There is no indication that there is any
abuse of rights.
84. It should be emphasised here, as the complainant rightly points out, that in the context of the right to complain, the data subject must only be "of the opinion" that his rights have been infringed. Decision on the merits 113/2024 — 23/70
A fortiori, recital 143 – in connection with the delegation by a data subject – expressly states that a data subject has the right to mandate an organisation as soon as that person "believes" that his rights have been infringed.
The fact that the representative subsequently makes her expertise available in the context of the representation assignment, in order to gather additional evidence, can be regarded as good
practice.
85. In short, the mandate was lawfully granted under Article 80.1 GDPR.
86. Thirdly, caution is indeed required when entering into a mandate under Article 80.1
of the GDPR, when a working relationship (an employment relationship, a relationship as an intern, or
other) is at stake. Problems (such as conflicts of interest) may indeed arise in
the context of an internship relationship; the Dispute Chamber does not read or find any
argument in which the internship relationship in this case is in problematic relation to the
mandate for submitting the complaint. After all, it is legally and sensu stricto not excluded that the
representative can also be a trainee supervisor.
87. It is up to the representative to assess, within the framework of the
applicable legal standards, whether the representation relationship is appropriate. The Dispute Chamber
will only intervene if there are clear indications that the legal requirements for
valid representation have not been complied with, or if the integrity of the
procedure is compromised. This is the case, for example, when a mandate is created in a
fictitious manner, or: when the grievances are demonstrably ‘directed’
by the representative.
88. The following should be noted in this regard. There is a difference between, on the one hand, being asked
– however optional this may be – by an employer or ‘internship supervisor’ to give permission
for something, versus, on the other hand, asking the internship supervisor or employer to
grant a representation assignment. In this case, there is nothing in the facts to indicate that the
former is the case, which means that no legal defect in the mandate can
be established. Moreover, the complainant also stated in so many words at the hearing
that he himself (albeit in consultation with another person who was also a
trainee at the same time) and therefore not on instruction, had established a problem with the
websites in question. There is no evidence to suggest that this statement by the complainant himself
would not be true: the complainant raised this issue in person at the hearing.
89. The fact that trainees are offered a forum to file complaints concerning
alleged unlawful processing of their own personal data or other
related infringements is not problematic per se as long as this is done within the legal Decision on the substance 113/2024 — 24/70
provisions 23 and without prior instructions as to, for example, the
identity of the controller and the specific infringements sought. This
forum may also in principle include providing working material and a physical
workplace to individuals. Strategic coordination between the complainant and his/her
representative as to how a complaint is filed, which infringements are focused on and
how the content is presented can of course only take place after such grievances
have arisen. 90. It is of course not excluded that the complainant's objective of wanting to see himself represented in order to act on allegedly infringed rights that he himself wishes to see upheld coincides with the association's own objectives of Noybom, in the general interest, of wanting to see the rules on lawful personal data processing in the case of cookies upheld.
91. In short, there is also no indication that the mandate would be fictitious. The complainant has a direct and personal interest and has independently, not on the instructions of the representative, granted the mandate.
92. Fourthly, the defendant rightly notes that a number of ambiguities, errors or
defects are apparent from the evidence (in interaction with the content of the complaint itself).
However, these aspects seem to point to the careless submission of evidence by the complaining party or representative, specifically with regard to the
dating of such documents, rather than to fundamental problems regarding the delegation
of the representative. The complainant also claims to have visited the web pages himself,
which is questioned by the defendant. In any case, the carelessness or
errors are not of such a nature that they should lead to the dismissal of the file in
the present case.
93. At the hearing, the complaining party acknowledges that not all documents in the complaint and
the administrative file have been accurately identified or described. However, the complainant states that he
took the initial screenshots and that he therefore raised the initial grievances that
form the basis for the complaint. As regards the HAR files (with a display/recording of network traffic at a given time, in which the placement and reading of various cookies on the websites at issue are visible) that were attached to the complaint, it is argued that they were not generated by the complainant (but by employees of the representative). The complainant states that the HAR files are not intended to monitor the processing of personal data by the
23 Reference is made here, among other things, to art. 57.4 GDPR, which states that excessive requests from individual data subjects may be
refused for processing. Decision on the merits 113/2024 — 25/70
the complainant as a data subject, but to frame the general practices of the
defendant. 94. None of this constitutes any direct evidence of a problem regarding (the fictitiousness of) the
mandate. The complainant is open about the method and points out that additional
evidence was collected after the grievances arose for the complainant. Furthermore,
the defendant does not dispute that the screenshots and practices
shown on those screenshots were effectively real screenshots taken
from the websites at issue.
95. The same applies to the HAR files that were added from the websites at issue.
The defendant does consider the dating or the person acting behind the document
to be unclear for these files, but the Dispute Resolution Chamber considers in that context
that there is nothing to indicate that the documents were manipulated in any way. Furthermore,
the HAR files in particular play no role in the further assessment by the
Dispute Resolution Chamber, among other things because these files are not relevant to the
infringements that are established below.
96. As regards the screenshots, it is established that it is the complainant who has taken cognizance of the cookie banners and their various layers; at least some of the screenshots
attached to the complaint were initially generated by the complainant.
97. It can be considered good practice that when Noyb represents a data subject, it ensures as a representative that it collects the necessary
evidence; this does not have to be an initiative of the complainant when it mandates Noyb to bring a pre-established case (with grievances
leading back to the complainant's own initiative), insofar as the evidence further supports the
complaint. In this sense, it is certainly not the case that the Dispute Chamber considers documents
provided by the representative inadmissible. 98. In short, the incorrectly designated, qualified or otherwise defective
evidence is not of such a nature that it points to a problem in connection with the
interest of the complainant or the representation assignment, nor does it lead to the
case having to be dismissed. The decision is based solely on the evidence of which the
veracity has been established or evidence or elements provided by the defendant
itself.
99. Fifthly, it is by no means the case that a complaint should be
dismissed in any event because a complainant (in that case still as a data subject)
does not first contact the controller, or that the Dispute Resolution Chamber
could not take measures if a data subject has not first contacted the controller. Depending on the circumstances, it is not even necessary Decision on the merits 113/2024 — 26/70
that a person's personal data are processed in order to see a complaint handled
before a supervisory authority – despite some legal discussion
about this in the past. It is true that the Dispute Chamber and the GBA as a whole – in the
light of their limited resources – strive for the most efficient possible complaint handling
whereby the failure to exercise rights can certainly play a role in the assessment
whether or not to dismiss a complaint. Such an assessment is not at issue here by the
Dispute Chamber here and now.
100. In conclusion: for all these reasons, all means of the defendant that relate to
aspects concerning the representation assignment and the mandate of the representative by the
complainant in this case are not useful. The Dispute Chamber rules
that the representation is legitimate under Article 80.1 GDPR, and that
the complainant has a personal, direct and established interest in the
personal data processing that forms the basis of the present complaint procedure.
The arguments of the parties that relate to the role of Article 80.2
GDPR in this case will not be discussed further, since this provision does not play a role in this case.
II.3. The infringements
II.3.1. A refuse all option on the first level of the cookie banners
Position of the complainant
101. The complainant's position on this point is as follows:
"None of the […] cookie banners on the websites of the defendant [defendant],
contain a "Refuse all" button on the first level, but only a button with
"Agree and close" and a button with "More information". The option to refuse all cookies
easily and at once is deliberately hidden by the defendant [defendant].
Because no "Refuse all" option is included on the first information level of the
cookie banner and this makes accepting all cookies many times easier than refusing them, there is a
"default effect" for and an incentive to accept all cookies (cf. ov. 32 AVG).
On this basis, the consent obtained by the defendant for the placement of cookies cannot be regarded as ‘unambiguous’ (Article 4(11)
24Cassation, V t. GBA, C.20.03223.N, ECLI:BE:CASS:2021:ARR.20211007.1N.4, §6: “By holding on this ground that an
infringement of Article 5, paragraph 1, c), GDPR has not been proven and by annulling the contested decision of the claimant, while it is not required
that the complainant’s personal data have actually been processed in order for the claimant to be able to impose
corrective measures or an administrative fine in response to a complaint, after establishing that a practice exists that
gives rise to an infringement of the principle of minimum data processing, the appeal judges fail to justify their
decision in law.” (the Dispute Chamber underlines) Decision on the merits 113/2024 — 27/70
GDPR), which renders the consent obtained from the complainant invalid (Article 6(1)(a) GDPR
in conjunction with Article 5(3) ePrivacyRl in conjunction with Article 10/2 GBW[…]). As a result, the defendant [respondent]
cannot […] demonstrate that the complainant has given consent to the processing of
his personal data (Article 7(1) in conjunction with Article 5(2) GDPR).
The complainant hereby reiterates that the EDPB Cookie Banner Taskforce
Report also endorses the fact that the absence of a button of the type
"Reject all" on the same level as the "Accept all" button is considered an infringement
by a large majority of data protection authorities.[…]
As already stated in the complaint, the fact that this is the prevailing
legal view also follows from guidelines from national supervisory authorities of
France, Germany, Denmark and Finland. To these can also be added (among
others) the guidelines of the Dutch[…], Austrian[…] The GBA also explicitly stipulates that: “A “manage settings” button is therefore not sufficient next to an “accept all” button.[…]
Merely offering an option to refuse all cookies, which clearly requires more
steps, time and effort than accepting all cookies, also constitutes, on the basis of
the EDPB guidelines on deceptive design and dark patterns, a
violation of the principle of propriety of art. 5(1)(a) GDPR:
[quote of the aforementioned guidelines in English]
However, determining that not offering a “Refuse all” option on the first
information layer of the defendant’s cookie banners constitutes an infringement does not
so much concern the application of supervisory guidelines, but this
simply concerns a direct and concrete application of the legislation (in accordance
with the applicable legal view).
However, a single approved action plan or individual (old) decisions of the
Dispute Chamber in a few specific cases, in which a “Reject All” button was not the subject, cannot be attributed the value that they should apply as a valid legal opinion.[…] As
has already been mentioned in this opinion, the Market Court has confirmed that the
decisions of the Dispute Chamber of the GBA do not have a precedent effect.”
Defendant’s position
102. The defendant’s position in its summary conclusion is as follows (the
Dispute Chamber summarises): Decision on the merits 113/2024 — 28/70
“4th ground (subordinate): The absence of a ‘refuse’ option in the first
information layer of the cookie banner does not constitute invalid consent”
• Firstly, the defendant indicates that the alleged infringement “is without object
because the complainant gave his consent”. In this context, the defendant states that as soon as a controller has the consent of the data subject, there is a legal basis for lawfully processing the data; the defendant points out that the complainant gave his consent.
• Secondly, the defendant states that the obligation to place the ‘refuse’ option on the first information layer is not apparent from any legislation. In this respect, the defendant states that valid consent can be obtained, “even when there is no ‘refuse’ option on the first information level of the cookie banner”.
• Thirdly, the defendant states that the consent requirements under Article 7 of the GDPR have indeed been respected. The defendant states that Article 7 of the GDPR does not provide for an obligation to have a ‘refuse’ option in the first information layer of the cookie banner. In this respect, the defendant points out, among other things, that Article 7.3 GDPR deals with the withdrawal of consent: “The GDPR, on the other hand, does not impose similar requirements for refusing consent at a time when consent has not yet been given.” Furthermore, the defendant points out in this context that Article 4.11 GDPR also does not impose an obligation to have a ‘refuse’ option on the first layer of the cookie banner: according to the defendant, the expression of will can be made freely, specifically, informed and unambiguously. According to the defendant, the expression of will is in any case made actively.
• Fourthly, the defendant indicates that the cookie banner is in accordance with the “decision-making practice of the Dispute Resolution Chamber”. The defendant points in particular to two decisions – Decision 12/2019 of 17 December 2019 and
Decision 19/2021 of 12 February 2021 – in which, in particular in the latter decision,
the Dispute Chamber explicitly stated, as quoted by the defendant:
“The new cookie banner no longer assumes implicit consent
(‘by continuing to use this website’) but gives the choice between
‘accept recommended cookies’ and ‘adjust cookie preferences’.”
• Fifthly, the defendant indicates that the cookie banner is in line
with the EDPB guidelines on consent. In doing so, the defendant indicates that it does not read anything about the requirement for a ‘refuse’ option at the
first information level of the cookie banner. Decision on the substance 113/2024 — 29/70
• Sixthly, the defendant states that the cookie banner is in accordance
with the IAB Europe action plan that was approved by the Dispute
Chamber. 25The defendant states: “Mediahuis understands that the Internet Advertising Bureau (“IAB”)
action plan, validated by the Dispute Chamber on 11
January 2023, also does not include the requirement for a ‘refuse’ option in the first
information layer of a cookie banner. This action plan allegedly does not
include anything about which buttons should be on the first information layer of a
cookie banner.”
• Seventhly, the defendant states that no infringement occurs, purely
because the practice would not be in accordance with “policy documents of
authorities”. In doing so, the defendant states that these are merely
policy documents; they are not binding as they are not law. In addition, the defendant indicates that it understands from the EDPB Cookie Banner Taskforce report that a number of authorities consider that the absence of a ‘refuse all’ option in the same layer as an ‘accept all’ option does not constitute an infringement of Article 5(3) ePrivacy Directive, which indicates to the defendant that there is no consensus on this issue among European supervisory authorities. Furthermore, the defendant indicates that the GBA is ‘not consistent’ in the information it provides to the public, pointing to the difference in web pages on cookies in the ‘citizen’ section of the GBA website versus the ‘professional’ page of the GBA website.
In addition, the defendant points out that the information on the website for
"professionals" is unclear, and, among other things, links to non-professional
web pages of the GBA website. The defendant also had the inconsistencies
established by a bailiff on 27 November 2023, and attaches the
findings as a document.
• Eighth, the defendant also replies to the conclusion of the complainant.
Assessment by the Dispute Chamber
103. Art. 10/2 WVP provides:
In application of article 125, § 1, 1°, of the law of 13 June 2005 on
electronic communications and without prejudice to the application of the Regulation
and this law, the storage of information or the obtaining of access to information
already stored in the terminal equipment of a subscriber or user
is only permitted on condition that:
1° the subscriber or user concerned, in accordance with the conditions
determined in the Regulation and in this law, receives clear and precise information about the
purposes of the processing and his rights under the Regulation and
this law;
2° the subscriber or end user has given his consent after being
informed in accordance with the provision under 1°.
The first paragraph shall not apply to the technical storage of information or
access to information stored in the terminal equipment of a subscriber or an
end-user for the sole purpose of carrying out the transmission of a communication
over an electronic communications network or of providing a service expressly requested by the
subscriber or end-user where this is strictly necessary for this purpose.
(The Litigation Chamber underlines and emphasises)
26
104. The European Data Protection Board, like the European Court of
27
Justice, has already stated that the requirements for the concept of “consent” in the
28
e-Privacy Directive must meet the requirements for consent under the GDPR. This is
particularly the case for those cookies that involve data processing: as the “Cookie Banner Taskforce” report of 17 January 2023 states, such
subsequent processing implies that at the time of consent,
this consent must meet the conditions of the GDPR. 29
105. Article 4.11 GDPR defines consent as follows:
any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which
a statement or by a clear affirmative action signifies agreement to the processing of personal data
relating to him or her;
106. Article 6.1. opening and point a GDPR stipulates:
Processing shall be lawful only if and to the extent that at least one of the following conditions is met:
26 EDPB, Opinion 5/2019 on the interaction between the ePrivacy Directive and the General Data Protection Regulation, in particular as regards the tasks and powers of data protection authorities, 12
March 2019, available at:
https://www.edpb.europa.eu/sites/default/files/files/file1/201905 edpb opinion eprivacydir gdpr inEDPB,ay nl.pdf;
Guidelines 5/2020 on consent under Regulation 2016/679, v 1.1, 4 May 2020, §6-7.
27
Judgment of the Court of Justice of the EU, Proximus v. GBA, C-129/21, see specifically § 51: “As regards the manner in which such consent must be demonstrated, it follows from Article 2, second paragraph, point (f), of Directive 2002/58, read in conjunction with Article 94, paragraph 2, and Article 95 of the GDPR, that such consent must in principle meet the requirements of Article 4, point 11, of that regulation.”
28
Cf. Also A. GOBERT, “Chapitre 5. La jurisprudence de l’APD en matière de cookies » in M. Knockaert and J.-M. Van
Gyseghem (eds.), 5 années de jusprudence de la Chambre Contentieuse de l’APD, Brussels, Editions Larcier-Intersentia,
(139)145, §13 : « To be valid, consent to the deposit of non-essential cookies must therefore meet the conditions
set out in article 4.11. duRGPD. » (loosely translated: « To be valid, a cookie for the installation of non-essential
consent must meet the conditions set out in article 4.11 GDPR.”).
29
EDPB, Report of the work undertaken by the Cookie Banner Taskforce, 17 January 2023, §2. Decision on the substance 113/2024 — 31/70
(a) the data subject has given consent to the processing of his/her personal data for one or more specific purposes;
107. From a joint reading of the aforementioned legal provisions, and after the clarification of the Court of Justice on the interaction between the e-Privacy Directive and the GDPR, it is clear that the “refuse all” option
must be provided by the defendant on the first layer when the defendant places an “accept all” button on
that same layer. 30 Otherwise, consent cannot possibly be obtained in a “free” and “unambiguous” manner. 31
108. On the one hand, consent is not “free” when the data subject who does not wish to
give his/her consent (within the meaning of Article 10/2, first paragraph, 2° of the LVP) is obliged to perform more
actions in order to refuse consent. As recital 42 of the preamble to the GDPR states: “Consent shall not be considered to be freely given if the
32
data subject has no genuine or free choice . . .” A choice implies at least an
equivalent option to perform an action in an equivalent manner (not
consenting) other than the one for which the choice is offered (consenting). 33 It should be noted, for the sake of
addition, that the visitor concerned cannot close the cookie banner without making a
choice, which constitutes a problematic form of a so-called cookie wall. 34
109. The fact that consent is not freely given is sufficient in itself to establish that
consent is not validly offered and cannot be obtained. 110. On the other hand, consent is not “unambiguous” if the data subject cannot take the active action to refuse consent in a similar manner, because, for example, he is not aware of the option to refuse cookies, since such an option is only mentioned or can be selected in a subsequent ‘layer’ of the cookie banner.
In this sense, a data subject cannot take an unambiguous active action on the first
layer of the cookie banner, precisely because no alternative is offered to refuse consent.
30 See also the cited examples in the “cookie checklist” of the GBA, available via:
https://www.gegevensbeschermingsautoriteit.be/publications/cookie-checklist.pdf, par. 3: “A “manage settings” button
is therefore not sufficient in addition to an “accept all” button. see also the previous press release on this subject from the
Data Protection Authority:
https://www.gegevensbeschermingsautoriteit.be/burger/nieuws/2023/02/10/cookiebanners-de-edpb-publiceert-
voorbeelden-van-niet-conforme-praktijken.”
31
EDPB Guidelines 5/2020 on consent, paragraph 39: “For consent to be freely given,
access to services and functions may not be made dependent on a user’s consent to store
information, or to gain access to information already stored, in a user’s terminal
equipment (so-called cookie walls)”, available at:
https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_nl.pdf
32
The Dispute Resolution Chamber underlines.
33EDPB, Guidelines 5/2020 on consent under Regulation 2016/679, v 1.1, 4 May 2020, §13: “The
element ‘freely’ implies real choice and control for the data subjects.”
34Ibid., §39: “For consent to be freely given, access to services and functionalities should not be made
subject to a user’s consent to retain information, or to gain access to
information already stored, in a user’s terminal equipment (so-called cookie walls)[…]” Substantive decision 113/2024 — 32/70
votes. 35 All this cannot be separated from the broader digital context in which
many website operators use cookie banners and thus many concerned
internet users see them appearing on a daily basis, which can lead to a certain
degree of “click fatigue”.
111. The fact that consent cannot be given unambiguously is sufficient
in itself to establish that consent is not validly offered as a choice
and cannot be obtained.
112. Furthermore, in the next layer, the “reject all” option is indeed displayed in the
same way as the “agree with all” option in that layer, but in any case in
less clear colours than the “accept and close” option in the first layer, and then
a whole number of other buttons that are displayed below it in the same,
equivalent way.37
As an example (mutatis mutandis applicable to the four websites at issue) on the
website of De Standaard, on a screenshot from the defendant’s synthesis
conclusion of the second layer:
35
Cf. EDPB, Guidelines 5/2020 on consent under Regulation 2016/679, v 1.1, 4 May 2020, §77: “A
‘clear affirmative action’ means that the data subject must have taken an intentional action to
consent to the specific processing[…]”.
36EDPB, Guidelines 5/2020 on consent under Regulation 2016/679, v 1.1, 4 May 2020, §87: “A
‘clear affirmative action’ means that the data subject must have taken an intentional action to
consent to the specific processing[…]”.
37Cf. Mutatis mutandis, the elements related to the term “privacy maze” within the excessive information section, cf.
EDPB, Guidelines 3/2022 on deceptive design patterns in social media platform interfaces: how to recognize and avoid them”
v. 2.0, 14 February 2023, §173. Decision on the merits 113/2024 — 33/70
38
A clear contrast with the ‘agree and close’ button in the first layer of the
cookie banner:
39
38
Defendant’s summary conclusion, 66.
39
Screenshot shown in the defendant’s summary conclusion, as a reprise of the screenshot in the
original complaint; summary conclusion defendant, 64. Decision on the merits 113/2024 — 34/70
113. Certainly, the right to data protection must be brought into proportion with
other fundamental rights 40 – such as the freedom to conduct a business 41 – but when the
legislator makes consent mandatory for certain processing operations (under the e-
Privacy Directive as transposed into the WVP), that consent must of course meet the
specific requirements set by the same legislator (under the e-Privacy Directive and
the GDPR).
114. Therefore, when it is established that consent must be obtained under the applicable
legislation for the placement of non-strictly necessary cookies – which is not the subject of
discussion in this case – this inherently implies at least a direct choice, regardless of the
possible granularity for consenting to the placement of certain types or
categories of cookies. As the complainant notes, in the cases at issue, there is no legal reason why the refusal of cookies should not be done in the same simple way on the four websites at issue. To hold otherwise would be to disregard the "free" and "unambiguous" requirement for obtaining valid consent.
115. The defendant's argument that the complainant has no interest because he has given his
consent is not helpful. It is not because consent is given that the consent meets all the requirements of valid consent and therefore
constitutes valid consent within the meaning of Article 4.11 in conjunction with Article 7.1 of the GDPR.
116. The defendant's argument that the standard is unclear and that nowhere in legislation
is there any mention of the fact that "refusing everything" in the cases at issue must be offered at the first
level of information is also not helpful. This also applies to the argument that the situation would be in line with the EDPB guidelines on consent, simply because those guidelines do not mention anything (with the erroneous implication that the guidelines do not require anything) regarding the refusal option on the first ‘layer’ of the cookie banner.
117. The Litigation Chamber once again clarifies its powers in this regard.
118. Article 8(3) of the Charter of Fundamental Rights of the European Union states that independent authorities must monitor compliance with the right to the protection of personal data. This provision underlines the importance of independent control and forms the basis for the establishment of supervisory authorities.
Under Article 57.1 GDPR, the supervisory authorities are responsible for the
40
Recital 4 of the Preamble to the GDPR.
41 Article 16 EU Charter.
42
Cf. GBA, Cookie Checklist, n. 3: “A “manage settings” button is therefore not sufficient in addition to an “accept all” button”, see also the previous press release on this subject from the Data Protection Authority:
https://www.gegevensbeschermingsautoriteit.be/burger/nieuws/2023/02/10/cookiebanners-de-edpb-publiceert-
voorbeelden-van-niet-conforme-praktijken.” Decision on the merits 113/2024 — 35/70
enforcement of the GDPR. 43 Under Article 4 WOG, the GBA is competent for this
enforcement. 44 Under Article 32 WOG, the Dispute Chamber is the administrative
dispute body of the GBA; it decides on a case-by-case basis.
119. Since the entry into force of the law of 21 December 2021 transposing the
European Electronic Communications Code and amending various provisions
regarding electronic communications on 10 January 2022 (“EC”), the DPA is now
competent, in accordance with Belgian law, to supervise the provisions regarding the
placement and use of cookies (i.e. “the storage of information or the
obtaining of access to information already stored in the terminal equipment of a
subscriber or a user”). The aforementioned law, among other things, made changes to the
EC. More specifically,
Article 256 of the law of 21 December 2021 provides for the repeal of Article 129 EC and
the transfer of this provision to the law of 30 July 2018 on the
protection of natural persons with regard to the processing of personal data (WVP). 45
Given that the GBA has residual jurisdiction to supervise the provisions of the WVP, this confirms the material jurisdiction of the GBA with regard to the placement and use of cookies.
120. The European legislator has, partly in light of the increasingly digital society, explicitly chosen to grant the enforcement of the GDPR to an authority that is in contact with similar authorities in the other Member States of the European Economic Area. 46 For that reason, the supervisory authority must be able to enforce, with a view to not only legal but also technological developments. In this context, the legislator wanted the interpretation of a factual situation to be tested by an authority.
121. The fact that certain legal or technological developments have an impact on a particular decision-making practice is a logical consequence of this approach – and is also taken into account in the context of the sanctioning in this case (infra, section III.1.1.). An open
standard therefore does not prevent the imposition of measures, or even the imposition
of an administrative fine, precisely because increasing technological developments
(at a high pace) require effective, adequate and proportionate
enforcement in new circumstances.
43 See also art. 32 WOG regarding enforcement powers for the Dispute Chamber.
44 Art. 4 § 1 WOG: “The Data Protection Authority is responsible for monitoring compliance with the
fundamental principles of the protection of personal data, within the framework of this law and the laws that
contain provisions regarding the protection of the processing of personal data.” 45Law of 21 December 2021 transposing the European Electronic Communications Code and amending
various provisions on electronic communications, B.S. 31 December 2021.
46
Recital 7 of the preamble to the GDPR: "These developments require a strong and more coherent framework for
data protection in the Union, supported by strict enforcement, because this is important for the
trust needed to allow the digital economy to develop throughout the internal market. " Substantive decision 113/2024 — 36/70
122. In short, the authority cannot only interpret a standard of an "open" nature, it must
do so; any argument that puts forward non-enforcement because of an "open standard"
is not helpful.
123. As regards the defendant's argument that Article 7 of the GDPR in particular does not explicitly make the refusal option mandatory, reference is also made to the previous argumentation in the context of the open standard. After all, the Dispute Chamber examines the lawfulness of the consent, according to the definition and the conditions assigned to the concept of consent by the legislator: it therefore concerns consent under Article 10/2 of the WVP and Article 6.1.a of the GDPR, as defined in Article 4.11 of the GDPR.
124. As regards the defendant's argument that the cookie banner is in
accordance with the previous decision-making practice of the Litigation Chamber, it should be noted that the
decisions of the Litigation Chamber have no precedent value. 47 Although this
argument may be useful in the context of possible measures (in particular
the sanctioning), the legal assessment that corresponds to the most correct legal
view - based on the most recent case-law as well as the view of the EDPB
48 - can hardly be omitted solely on the basis of this argument.
125. The argument that the Litigation Chamber would have approved an action plan of a
sector organisation that would be directly related to the disputed situations at hand, is also
not a useful argument. As noted earlier, the decisions of the Litigation
Chamber have no precedent value. Moreover, the actor to which the defendant refers is completely
foreign to the present proceedings. 126. It should also be noted that, under Article 5.2 and Article 24 of the GDPR, it is the controller who is responsible for compliance with the application of the GDPR and for taking appropriate technical and organisational measures in this regard. The defendant does not in any way dispute its responsibility for the substantive assessment of its processing activities, so while the argument may not be substantively substantive, it is also more than clear that the argument in the formal sense fails to achieve its purpose.
127. As for the argument that the guidelines of the supervisory authority and of the European Data Protection Board do not have the force of law, this
argument is of course correct in the formal sense and within the hierarchy of legal nouns. This does not mean, however, that they do not (should not) have any authoritative value, at least
47
Judgment of the Court of Appeal of Brussels (Chamber 19A, Market Court section, 1 December 2021, 2021/AR/1044, § 7.0.2.: “The Belgian legal system does not attribute binding precedent value, neither to administrative nor to judicial decisions (see
among others art. 6 Judg. W.)”
48Cf. regarding the evolution: A. GOBERT, “Chapter 5. The case law of the APD in the matter of cookies » in M. Knockaert and J.-
M.VanGyseghem(eds.),5annéesdejursprudencedelaChambreContentieusedel’APD,Brussel,EditionsLarcier-Intersentia,
(139)148-9, §20. Decision on the substance 113/2024 — 37/70
because Article 57.1.f GDPR imposes on the DPA the task of informing controllers
of their obligations under the Regulation, just as Article 70.1.u imposes on the EDPB the task of having supervisory authorities cooperate and, where
appropriate, formulate guidelines, best practices and recommendations to ensure the consistent application
of the GDPR (Article 70.1.d GDPR).
128. Within the DPA, and within the EDPB, the necessary expertise is available
to produce balanced and legally correct guidelines, recommendations and examples of best
practices. These guidelines and recommendations have the character of ‘soft law’, which has a
normative effect. Although controllers retain the right to challenge the legal interpretation,
their authoritative nature cannot be called into question. The GBA sets out clear and clearly formulated examples and
practices in its cookie checklist.9 It is emphasised that
data controllers can always object to specific
interpretations. The defendant is not deprived of any legal remedy in
this regard.
129. More specifically, the Dispute Chamber also addresses the defendant's
argument that the GBA is not consistent in providing information, since it does not
explicitly refer to the refusal option on its website for citizens, but does on the
page for professionals. Again, this argument is not helpful, since it is also the task of an
authority to make data controllers more aware of their obligations (Article 57.1.d GDPR, i.e. a separate and
independent legal task). 130. Since the defendant does not deny that the professional page is or could be directed at her, the question is why the defendant tries to derive an argument from the difference between that page and the page
directed to the citizen to state that no infringement has occurred or that no infringement can be attributed to her. Moreover, this
argument proves that the information that the GBA provides on its website with regard to
the controller is completely and unmistakably consistent with the decision of the Dispute
Chamber before us. 131. The Dispute Chamber decides that the defendant infringes Article 10/2 WVP
in conjunction with Article 6.1.a GDPR, since the consent of the data subjects in light of the placing
of cookies on its website, is not lawful, since it is not freely and
unambiguously obtained. The free and unambiguous nature of the consent
is fundamental to being able to speak of lawful consent; in the absence of
49 GBA, “cookie checklist” available via: https://www.gegevensbeschermingsautoriteit.be/publications/cookie-
checklist.pdf.
50 Cookies that do not fall under the exceptional cases of Article 10/2 WVP. Decision on the merits 113/2024 — 38/70
such lawful consent, the processing of personal data based on
such consent is not lawful.
II.3.2. Use of misleading button colours
Position of the complaining party
132. The complaining party's argument is as follows:
"The "Agree and close" button on the first level of the cookie banners of the
websites always has a striking, eye-catching colour (red, blue or
black with white text) against a white background. While the button with "More
information" has a colour that almost disappears against the background colour of the
cookie banners (light grey with dark grey letters against a white background).
By explicitly 'highlighting' the "Agree and close" button compared
to the option to refuse cookies, website visitors, such as the complainant,
are explicitly encouraged to click on "Agree and close". Research has also shown that if the button for giving consent has a (much) more conspicuous
colour than the button for refusing consent, consent is given 1.7 times more often
than when both buttons have the same colour.
This means that the consent obtained by the defendant for placing cookies
cannot be regarded as ‘unambiguous’ (Article 4(11) GDPR),
which means that the consent obtained from the complainant is invalid (Article 6(1)(a) GDPR in conjunction with Article
5(3)ePrivacyRl in conjunction with Article 10/2 WVP), which means that the
defendant cannot demonstrate that the complainant has given consent to the processing of his
personal data (Article 7(1) in conjunction with Article 5(2) GDPR).
As already emphasized in the complaint, it also follows from the EDPB Cookie Banner Taskforce
report that the contrast and colors used in the cookie banner may not be "obviously misleading", as this leads to
"unintended" and thus invalid consent.[…] Guidelines from many
supervisory authorities, such as the Greek[…], Austrian[…] and the
Czech[…] supervisory authority, also explicitly state that controllers may not use misleading button colors
that encourage website visitors to click "Agree and close". Decision on the merits 113/2024 — 39/70
If users of a website are induced to make decisions that go against their privacy interests because of visual elements, such as color,
this must also be considered a violation of the principles of lawfulness, fairness and transparency of art. 5(1)(a) GDPR:
[quote in English from the EDPB guidelines 03/2022 on misleading
design in interfaces of social media platforms]
As already explained above, determining that the use of
misleading button colours in the defendant's cookie banners constitutes an infringement
is not so much the application of supervisory guidelines, but rather
simply a direct and concrete application of legislation (in accordance with the
applicable legal view).
A single approved action plan or individual (old) decisions of the
Dispute Chamber in a few specific cases, which did not concern misleading
button colours of cookie banners, cannot be attributed the value that they
should apply as a valid legal opinion.[…] As already
mentioned in this conclusion, the Market Court has also confirmed that the
decisions of the Dispute Chamber of the GBA do not
have a precedent effect.[…]
In addition, when the complainant visited the websites, the
button with "All agreed" on the second level of the cookie
banners had the same eye-catching colour as on the first level of the cookie
banner. While the button with "Nothing agreed" had the
same inconspicuous colour as on the first level of the cookie
banner.
However, the current cookie banners on the defendant's websites have these buttons
“Reject All”, “Agree With All”, “Disagree” and “Agree” on the second
level of the cookie banner all the same white colour with light grey
letters.[…] This shows that adjusting the cookie banners and offering
a neutral choice without ‘dark patterns’ is therefore possible
for the defendant and that offering other misleading button colours is a deliberate
choice to make it more difficult for website visitors to refuse cookies. It
also shows that the defendant himself apparently also believes that the previous
cookie banner did not meet the applicable legal requirements.[…]
Decision on the merits 113/2024 — 40/70
However, the complaint must be assessed on the basis of the facts at the
time the complaint was filed. Otherwise, the respondent could evade any processing responsibility under data protection
law by deleting the personal data in connection with a complaint or investigation.
This does not alter the fact that the breach has indeed occurred (for a considerable time).
Moreover, this does not remove all the breaches described in this paragraph.”
Defendant's position
133. The defendant's defence is as follows (the Dispute Chamber summarises):
"5th ground (subordinate): Different colours in the cookie banner do not constitute an infringement of Articles 5.1.a GDPR and 6.1.a GDPR in conjunction with Articles 10/2 GBW
and 125, §1, 1° WEC"
a. Firstly, the defendant submits in the main order: "The complaint is without object
to the extent that Mediahuis has not used different colours in the second
information layer of the cookie banners since 20 November 2023".
b. Secondly, the defendant submits in a subordinate order: "No infringement of Article
6.1.a. GDPR or Articles 10/2 GBW and 125, §1, 1° WEC". In this respect, the
defendant again states that the complainant gave his consent, as well as that
there is “no prohibition” on the use of different colours for obtaining
consent in cookie banners.
c. Thirdly, the defendant raises another subordinate point: “No infringement
of the principle of legality, propriety and transparency (Article 5.1.a
GDPR)”. On this point, the defendant states that there is no infringement of this principle, because
there is “no prohibition” on the use of different colours by the cookie
banner that is used in the context of granting consent,
in addition, that the use of colour is in accordance with the decision-making
practice of the Dispute Chamber, that the use of colour is in accordance with the
action plan of the IAB that was approved by the Dispute Chamber, and that there
is no question of deception (in connection with the alleged misleading nature of the
buttons).
d. Fourthly, the defendant submits that “in any case”: “Mediahuis does not violate Articles 10/2 GBW, 125 WEC, 5.1.a and 6.1.a because the use of colour in its cookie banners is not fully in line with policy documents of the Decision on the merits 113/2024 — 41/70
authorities”. The defendant also states that such documents do not have the force of law.
e. Fifthly, the defendant offers a reply to the conclusion of the complaining party.
Assessment by the Dispute Resolution Chamber
134. As the EDP guidelines on misleading design patterns within the operation of
social media platforms clarifies, in the case of a potentially misleading design, the principle of propriety contained in Article 5.1.a GDPR can be considered when
assessing whether an infringement of the law has occurred. 51
135. On each of the four websites at issue, the first ‘layer’ of the cookie banner
is displayed in a quasi-exact manner as on the website of the newspaper “De Standaard” –
albeit with different colours, depending on the relevant news website at issue:
52
136. By using certain more explicit colours on the four websites at issue, which
may have the primary reason for inducing the data subject to give
consent to be able to place cookies, the Dispute Chamber
expressly considers that the duty of propriety under Article 5.1.a GDPR has been
violated, and it also jeopardises the legally valid obtaining of consent, which
constitutes an infringement of Article 6.1.a GDPR. After all, consent cannot be
obtained unambiguously when a data subject is “led” to perform a certain act.
5EDPB,Guidelines3/2022ondeceptivedesignpatternsinsocialmediaplatforminterfaces:howtorecognizeandavoidthem”
v. 2.0, 14 February 2023, 4.
52Partial reproduction of document 1 administrative file, complaint, p. 9. Decision on the merits 113/2024 — 42/70
137. It is clear that the conspicuous use of colour on the first layer of the
cookie banners at issue, where the button displaying the accept all option (‘agree and close’)
is given the most explicit colour in a more emphatic contrast, is intended to
reflect a particular choice that leads to more intrusive processing of personal
data as a result of the placement of cookies.
138. The EDPB Cookie Banner Taskforce report points out that, with regard to the use of colour,
no general standard can be imposed on controllers, but
53
the assessment must be made on a case-by-case basis.
139. In the cases at hand, the defendant uses various striking colours that
likely create a deceptive snugness for a data subject:
a. On the website of “De Standaard”, “akkoordensluiten” is highlighted in dark red as
the most data-processing option, while for the referral to the
alternatives, a light grey banner on a white background must be clicked;
b. On the website of “HetBelang van Limburg” “closing agreements” is highlighted in dark black as the most data-processing option, while a light grey banner on a white background is required for the redirection to the alternatives;
c. On the website of “HetNieuwsblad” “closing agreements” is highlighted in dark blue as the most data-processing option, while a light grey banner on a white background is required for the redirection to the alternatives;
d. On the website of “GazetvanAntwerpen” “closing agreements” is highlighted in bright red as the most data-processing option, while a light grey banner on a white background is required for the redirection to the alternatives.
140. Interfaces that, as in the present case, are designed with deceptive comfort, clearly induce a data subject to choose the most data-processing options, among other things, because the person does not even know how many steps he still has to take before he can choose not to have the cookies placed (i.e. not to give consent for the placement). The data subject knows that with this comfortable option he is on the first layer of
53EDPB, Report of the work undertaken by the Cookie Banner Taskforce, 17 January 2023, §17.
54EDPB,Guidelines3/2022ondeceptivedesignpatternsinsocialmediaplatforminterfaces:howtorecognizeandavoidthem,
v. 2.0, 14 February 2023, §177. Decision on the merits 113/2024 — 43/70
the cookie banner chooses the ‘path of least resistance’ – without this necessarily reflecting its
real, informed preference for granting consent.
141. The defendant’s argument that the complaint is “without object” on this point because
the second layer of information (after an adjustment during the procedure) no longer
uses different colours is evidently not helpful. The assessment in this respect
concerns the use of colours on the first layer of the cookie banner, the
assessment of the Dispute Chamber is not limited in the file (including the letter dated 5
February 2024 with alleged infringements) to the second layer of the
cookie banner. 142. The argument that the complainant concerned did give permission is also not helpful,
since whether or not permission was given does not prevent the assessment of the propriety of
the processing. Nor is the fact that permission was given ipso facto sufficient to state that the permission was validly granted.
143. The argument that there is “no prohibition” on the use of different colours is correct
in the formal sense. However, the Dispute Resolution Chamber has already explained above that this
does not prevent the choice of certain colours from violating the duty of propriety in the light of
personal data processing activities, and that the unambiguous nature of the permission
cannot be guaranteed.
144. The argument that the Dispute Chamber approved an action plan of a sector organisation that
is directly related to the disputed situations at hand is also not a useful argument. As previously noted, the
decisions of the Dispute Chamber have no precedent value. Moreover, it concerns an
actor that is completely foreign to the present procedure. In addition, the
Dispute Chamber emphasises that, under Article 5.2 and Article 24 GDPR, the
controller is responsible for compliance with the application of the GDPR and for taking the
appropriate technical and organisational measures in this regard. The defendant in no way disputes its responsibility
for the substantive assessment of its processing activities, so while the argument
may not be substantively useful, it is also more than clear that the argument in the
formal sense misses its target. 145. The Litigation Chamber does not dispute – as the defendant argues – that the guidelines of the
supervisory authority and of the European Data Protection Board do not
have the force of law. However, this does not mean that they do not
(should not) have any authoritative value, at least because Article 57.1.f of the GDPR imposes the task on the DPA
to inform controllers of their obligations under the
regulation, just as Article 70.1.u imposes the task on the European Board
to have supervisory authorities cooperate and, where appropriate, formulate guidelines, best practices and
recommendations to ensure the consistent application of the GDPR (Article 70.1.d. GDPR).
146. For all these reasons, it is clear that misleading colours are used on the first layer of the cookie banner, which constitutes a breach of the duty of propriety within the meaning of
art. 5.1.a. GDPR. Since the consent is not unambiguous, it cannot be said that
there is valid consent within the meaning of art. 6.1.a. GDPR.
II.3.3. Withdrawal of consent cf. article 7.3 GDPR
Position of the complaining party
147. The position of the complaining party is as follows:
“It is not as easy to withdraw consent on any of the websites of the defendant [respondent] as it is to
accept cookies. Accepting all cookies is done with one simple click (or two clicks if the "More information" button is pressed), while withdrawing consent is not possible with one click. Instead, website visitors must go to a specific section of the website to withdraw cookies. At the very bottom of the page, somewhere among an extensive list of various other links, is a link called "Manage privacy preferences". If this is clicked, the website visitor can click "Reject all", "Agree to all" or, per purpose, "Disagree" or "Agree".
Pursuant to Art. 7(3), first sentence of the GDPR, the data subject has the right to withdraw his or her consent at any time. Withdrawing consent should be as easy as giving it under Art. 7(3), third sentence of the GDPR. Now, the requirements of Art. 7 GDPR is met, the defendant also violates art. 12(1) GDPR,
art.17(1)(b) GDPR, art.5(3)e Privacy Guidelines art.10/2 GBW. The defendant also
does not act in accordance with the principles of lawfulness, transparency and fairness (art. 5(1)(a) GDPR).
Moreover, the simple withdrawal of consent is indeed a requirement for the given consent to be qualified as valid in the first place according to art. 7(1) in conjunction with 4(11) of the GDPR (and therefore also for the question of whether the requirements of art. 10/2GBW and art. 125§1, 1° WEC are met[…]). The EDPB has also confirmed this in the guidelines on consent:
“The requirement of being able to withdraw consent easily is described in the GDPR as a necessary aspect of valid consent. If the right to withdraw Decision on the merits 113/2024 — 45/70
does not meet the requirements of the GDPR, then the mechanism for the controller’s consent does not meet the GDPR. [...].”[…]
(emphasis added)
The EDPB Cookie Banner Task Force report also emphasises that
withdrawing consent for cookies should be as easy as giving it […]
This is also confirmed in the EDPB guidelines on consent and clarified as follows:
“However, where consent is obtained by electronic means, by
a single mouse click, swipe or keystroke, the data subject should be able to
withdraw consent just as easily in practice.”[…]
The EDPB guidelines on deceptive design and dark patterns
explicitly reiterate this same requirement […] .
Consequently, the defendant should be given the
opportunity to withdraw consent by a single mouse click. Now that a clearly visible
option for giving consent is offered, there should also be an equally clearly
visible option for withdrawing consent. A link with the name under "Manage Privacy Preferences", in small print, among an extensive list of other links, at the very bottom of the defendant's website pages - where
it takes some time to scroll all the way down - clearly does not meet these requirements.
A floating, permanently visible (hoover) button to withdraw consent that is permanently visible would meet these
requirements.
The defendant has improved the ability to withdraw consent and change cookie settings somewhat
compared to when the complainant filed the complaint. It is now possible to click on a "Reject All" button once the "Manage Privacy Preferences" button has been found and clicked, whereas previously it was only possible to withdraw consent for each purpose separately.[…] This shows that the defendant can easily offer an equivalent option to withdraw cookies once the website visitor has found the option to adjust the cookie settings, and that the defendant has previously deliberately not done so. It also shows Decision on the merits 113/2024 — 46/70 that the defendant apparently also considers that the previous cookie banner did not meet the applicable legal requirements of Article 7(3) GDPR.
However, the complaint must be assessed on the basis of the facts at the time the complaint was filed. Otherwise, the respondent could evade any processing responsibility under data protection
law by deleting the personal data in connection with a complaint or investigation. This also does not alter the fact that the
breach has indeed occurred (for a considerable time). Moreover, with the changes
made by the defendant, it is still not as easy to withdraw consent as it is to give it, it has
just become easier than it was at the time the complaint was filed. Defendant's position
148. The defendant's position is as follows (the Dispute Chamber summarises):
"6 ground (subordinate): The withdrawal of consent does not constitute a violation of
Article 4(11) in conjunction with 7.3 GDPR, nor of Articles 10/2 GBW and 125, §1, 1° WEC"
a. Firstly, the defendant states "in the main order" that there is no interest in the proceedings for the
complainant, as it appears from the file that the complainant did not withdraw his consent - although
he had given it. In addition, the defendant points out that no consent was given by the complainant on
10 February 2023, but it was given on
(presumably) five other, later dates.
b. Secondly, the defendant “subordinately” states that a user can withdraw his consent just as easily as giving it and that the complaint on this point is therefore without
object. The defendant points out that a “manage privacy preferences” button is available on every web page of the four
websites at issue, and that a user can then withdraw all consents with one click.
c. Thirdly, the defendant “subordinately” states that there is no infringement of Article 4.11
GDPR, since the definition contained therein does not state anything with regard to the withdrawal
of consent already given. This is contained in Article 7.3 GDPR.
d. Fourthly, the defendant “subordinately” states that there is no infringement of Article 7.3
GDPR. In this respect, the defendant points out that the wording "as simple as" in the standard is an open concept that is not given concrete legal substance, whereby the defendant explains in concrete terms why the websites at issue do indeed comply with the standard. In the previous situation on the website, there was no "no agreement" option. The defendant states in this regard: "A visitor who wanted to withdraw his full consent therefore had to click a number of times more than in the situation in which he wanted to give his full consent. This single point of difference (a number of clicks) cannot constitute a lack of equivalence within the meaning of Article 7.3, last sentence of the GDPR." e. Fifthly, the defendant states “subordinately” that there is no infringement of article 10/2
GBW and article 125 § 1, 1° WEC. As regards this point, the defendant states that the
e
complaint concerning the 3 alleged infringement concerns the withdrawal of consent already given, and not
about the lawful placement of the initially placed cookies – as a result of which the provisions raised by the Dispute Chamber “ex officio”
do not apply.
f. Sixthly, the defendant replies to the conclusion of the plaintiff on this point.
Assessment of the Dispute Chamber
149. First, the situation before the withdrawal of consent
at the time of the complaint (the ‘old’ situation) must be considered, and before the defendant made a number of
adjustments during the proceedings. These adjustments to the websites at issue
led to the withdrawal of consent in the ‘new’ situation after clicking on the
link ‘manage privacy preferences’ on the websites at issue - with a single click
(“reject all”).
150. In the ‘old’ situation, a data subject did indeed have to make a “number of clicks” (as
the defendant himself put it) in order to withdraw consent,
while the initial consent (“accept and close”) required only one click. The
defendant himself expressly acknowledges that a visitor (here qualified as the data subject)
had to click “a number of times more” than “the situation in which he wanted to give his full
consent.”
151. In this ‘old’ situation, withdrawing consent was apparently not as
easy as giving it, which constitutes a violation of art. 7.3 GDPR. The fact that
‘withdrawing’ consent is a relative concept – in the sense that
withdrawing consent must be “as easy” as giving it – does not
detract from this. Such qualification as a relative concept in the legal sense may be
correct, but in the relative circumstances the “number of clicks” that the
defendant himself speaks of are clearly relatively more clicks than the single click of the “accept
and close” button in the cookie banner. 152. As regards the ‘new’ situation, following the defendant’s adjustments during the
procedure: in the new situation, consent can be withdrawn after clicking on the ‘privacy preferences’ link on each web page of each news website at issue
with a single click (“reject all”). The choice is offered on a cookie banner identical to
the second layer of the cookie banner for giving consent: this
practice does not – based on the documents in the file – give rise to
establishing an infringement.
153. The website does not require a mandatory “permanently visible” button for
properly withdrawing consent. If a data subject can withdraw consent under Article 7.3 GDPR with two clicks from each web page on the websites at issue, this is in line with the spirit of the legal provision. A data subject can reasonably assume that the settings regarding cookies are located at the bottom of a web page. The person can therefore still access the information regarding the withdrawal of consent and do so by means of a single button.
154. As the EDPB pointed out in the Cookie Banner Taskforce report, it is sufficient that a link is available on the website and that this is in a “visible and standardised place”. Placing a direct link at the bottom of each web page leading to a banner with a single button for withdrawing consent is in line with this wording. The EDPB also, in the same report,
underlined that the legislation only shows that easily accessible solutions for
withdrawing consent should be offered, but that “it cannot be
imposed” that a “specific withdrawal solution” be implemented and “in particular the
design of a hovering solution” cannot therefore be imposed on a controller within the
current legal context. 56
155. The defendant rightly emphasises that the fact that consent under Art. 7.3 GDPR
must be able to be withdrawn “as easily” as it was given,
sets a relative situation. In that sense, for the proper functioning of a website – which is
in the interest of the visitor concerned, it cannot be expected that the withdrawal of
consent is done in exactly the same way if this means that it must be done (in the most
literal sense) ‘at all times’ in that way. 156. In that line of reasoning, a “hoover” button (the proposal put forward by the complainant) would not be sufficient either, because such a “hoover” button does not offer exactly the same visual representation as a cookie banner (for granting consent) for withdrawing consent at any time during a visit to the website. This would have a blocking effect for the internet user, which is of course manifestly unreasonable.
55EDPB, Report of the work undertaken by the Cookie Banner Taskforce, 17 January 2023, §32.
56EDPB, Report of the work undertaken by the Cookie Banner Taskforce, 17 January 2023, §35. Decision on the substance 113/2024 — 49/70
157. As regards the ‘old’ situation, an infringement must therefore be established
of art. 7.3 GDPR. Given that there are no indications that this infringement continues within the
‘new’ situation after adjustments in this regard by the defendant, the Dispute Chamber
decides on this point to reprimand the defendant. No other coercive or
punitive measures are appropriate in this regard.
II.3.4. Use of legitimate interest for placing cookies that
require consent and alleged violation of transparency and
information obligations
Position of the complainant
158. The position of the complainant is as follows:
“When the complainant visited the websites, the websites of the defendant
[defendant] contained a legitimate interest button in the second layer of the
cookie banner that was set to “Agree” by default for carrying out an “Extensive
measurement” in order to “Measure advertising and content performance. Insights can
be derived about the audience that saw the advertisements and content. Data can be used to build or improve user experience, systems and software.” This “legitimate interest button” for performing
such “measurements” was placed next to a button to give consent
for the same purpose and was only visible if the website visitor pressed the ‘+’
button.
The defendant [respondent] thus claimed to have a legitimate interest (Article 6(1)(f) GDPR) for performing “extensive measurements” if the complainant
would not give consent (Article 6(1)(a) GDPR). Legitimate interest
thus formed the ‘back-up’ basis for the defendant. The defendant thus
unlawfully switches from an “opt-in” system based on Article 6(1)(a) GDPR to an
“opt-out” system based on Article 6(1)(f) GDPR.
Legitimate interest was and is not at all a valid legal basis for
placing and reading non-strictly necessary cookies, such as cookies placed
to perform “extensive measurements” (cf. art. 5(3)
ePrivacy Directive in conjunction with art. 10/2 GBW). This has been confirmed again in the EDPB
Cookiebanner Taskforce Report[..] and in guidelines from national supervisory authorities. Decision on the merits 113/2024 — 50/70
It is correct that other grounds from art. 6 GDPR can be used in very limited cases
for placing and reading cookies. But this applies
only to the extent that it concerns strictly necessary cookies and for the exclusive
purpose of sending comm[u]nications via an electronic communications network (art. 5(3) ePrivacy Directive in conjunction with art. 10/2 GBW). The defendant's performance of "extensive measurements" does not fall under this strict exception.
The further processing of personal data obtained via cookies, for which consent is required, should also be based on the basis of consent, as also confirmed by the EDPB and the EDPS.[…] This also applies
to the further processing of data for the performance of "extensive measurements" by the defendant.
It is also misleading that the defendant made it appear that
consent is the basis for the processing, but if this consent is not
given, simply switches to the basis of legitimate interest, without respecting the
complainant's choice to refuse consent.
In doing so, the defendant violated the principles of lawfulness, fairness and
transparency (Article 5(1)(a) GDPR). This practice is, after all, contrary to Article 6 GDPR
and Article 5(3) ePrivacy Directive jo. art. 10/2 GBW and therefore unlawful.
The EDPB Guidelines on consent also expressly state that
this conduct of the defendant is unfair (art. 5(1)(a) GDPR):
“It is important to note here that if a controller
chooses to rely on consent for part of the processing, it must be
prepared to respect the choices made regarding that consent, and to stop that part of the
processing if an individual withdraws consent. To pretend that data are being
processed on the basis of consent, when in fact relying on another
legal ground, would be materially unfair to the data subjects. [...] In other words, the
controller cannot substitute consent for other legal grounds. For example,
it is not permitted, where the validity of consent raises problems,
to subsequently use the legal basis of “legitimate interest” to
justify processing.”[…] (emphasis added) Decision on the merits 113/2024 — 51/70
Moreover, no information on the alleged
legitimate interest was included in the cookie banner, nor was an option to object
included at the first level of the cookie banner.
The only possibility to object and even receive the information about such a claimed legitimate interest was hidden in the
second layer of the cookie banner. From the text "Set preferences" on the first
information level of the cookie banner, this information or the possibility to object did not follow. In
fact, even within the second information level, the plus sign (+) at "Extended
measurement" had to be clicked through to change the "Legitimate interest" of the defendant to "Disagree".
In other words, objecting to and being informed about the alleged
legitimate interest of the defendant required the website visitor to click through several times, something that
website visitors only do in practice in 2% of cases.
This is in conflict with Art. 21(4) GDPR and Art. 12(2) GDPR, since both the fact that the defendant
based its processing (subsidiarily) on its alleged legitimate
interest and the possibility to object to this alleged legitimate interest of the defendant
had not been expressly brought to the attention of the data subject. This also meant that the defendant's conduct
was not transparent (Article 5(1)(a) GDPR).
Furthermore, it is also incomprehensible that the defendant apparently assumed that if a
data subject did not give consent to the relevant "extended measurement"
processing, he would not also object to the processing under Article 21
GDPR. However, the cookie banner seemed to assume that data subjects must express the same
desire not to have their data processed twice: once as a refusal of consent and then as an additional
objection to the same processing activity (which constitutes a "double opt-out").
In view of the foregoing, the defendant has violated the principles of legality,
property and transparency by the defendant (Article 5(1)(a) GDPR).
Fortunately, the defendant has already removed the references to a "legitimate interest" in its
cookie banners. The inclusion of a "legitimate interest" in the
cookie banners therefore appears not to be necessary for the defendant and appears to be easily
adjustable, from which it follows that the defendant has previously deliberately chosen
to include a reference to legitimate interest in its cookie banners.
It also shows that the defendant apparently also believes that the
previous cookie banner did not meet the applicable legal requirements and that
the defendant therefore never had a legitimate interest in carrying out
“extensive measurements”, now that the defendant speaks of a “useless and
irrelevant reference to legitimate interest”.
However, the complaint must still be assessed on the basis of the facts at
the time the complaint was filed. Otherwise, the respondent could always
evade any processing responsibility under the data protection legislation by
remedying GDPR violations after filing a complaint or during an
investigation. This also does not detract from the fact that the violation
did indeed occur (for a considerable time).” Defendant's position
159. The defendant's defence is as follows (The Dispute Chamber summarises):
"7th ground (subordinate): The reference to 'legitimate interest' does not constitute a
violation of Article 6.1.f GDPR, nor of Articles 10/2 GBW and 125, par. 1, 1° WEC"
a. Firstly, the defendant states "in the main" that there is an absence of a
sufficient personal interest on the part of the complainant in connection with the
alleged use of the legitimate interest. In addition, the defendant states, among other things,
that no cookies were placed in this way in the case of the complainant, since the
complainant gave his consent for the placing of cookies.
b. Secondly, the defendant states "subordinately" that the complaint is without
object because Mediahuis' current cookie screens no longer refer to legitimate
interest. The defendant points out that during the same period as the
settlement procedure, a number of adjustments regarding the placement of cookies on the basis of
legitimate interest were prepared (and ultimately
implemented on 22 December 2023).
c. Thirdly, the defendant states "more subordinately" that there is no violation of
Article 6.1.f. GDPR and that the complaint is unfounded to the extent that it states that
legitimate interest can never be used as a legal basis for cookies.
d. Fourthly, the defendant states "more subordinately" that there is no violation of
Article 10/2 GBW and Article 125 § 1, 1° WEC. The defendant: “[…] if under Article
10/2 GBW the exception to the rule (consent) applies, then Decision on the merits 113/2024 — 53/70
it goes without saying that in such a case the rule (consent) itself does not
apply.”
e. Fifthly, the defendant replies to the conclusion of the complainant regarding this
part.
ste
“8 ground of appeal (subordinate): No violation of Articles 5.1.a, 12.2 and 21.4 GDPR
with regard to the transparency of the cookie banner”
a. Firstly, the defendant states “in the main order” that the complaint is without object, since
there is no longer a “legitimate interest” since 23 December 2023. In addition, the
defendant states that any reference to the legitimate interest was removed on 22 December
2023.
b. Secondly, the defendant “subordinately” states that there is no violation of Article
5.1.a. GDPR. In this respect, the defendant considers the ‘charge’ under Article
5.1.a. GDPR unclear, the defendant states that the design of its cookie banner does indeed comply with the legal standards, and that the
legitimate interest can exist simultaneously with the mention of
consent.
Thirdly, the defendant “subordinately” states that there is no violation of Article
c. 12.2 GDPR. In this respect, the defendant states that there can be no violation
here, because the duty to facilitate would only exist when exercising the right (as contained in Article 21.4
GDPR).
d. Fourthly, the defendant “subordinately” states that there has been no violation of Article
21.4 GDPR, referring to the information in the privacy policy as well as the information at the time of the first contact
with users.
e. Fifthly, the defendant replies to the conclusion of the complainant on this
point.
Assessment by the Dispute Resolution Chamber
160. The defendant admits that cookies were placed on the basis of legitimate
interest, at least some of which had to be placed on the basis of the
consent pursuant to the e-Privacy Directive and its transposition into the WVP. Cookies
placed in order to carry out ‘extensive measurements’ regarding website use
for purposes including advertising (at least as regards the analysis
of the reach and effectiveness of cookies targeted at that purpose), are by definition
not strictly necessary. Such cookies therefore require consent under Art. 10/2
WVP, but also under art. 6.1.a GDPR for the subsequent processing of personal data. Decision on the merits 113/2024 — 54/70
161. As the EDPB has underlined in the Cookie Banner Taskforce report, the
use or mention of legitimate interest as a legal basis in the cookie banner can also be confusing for users, who may think that they
have to refuse twice in order not to have their personal data processed. 57 In that
sense, the legal basis for placing a cookie must therefore be either on the basis of
legitimate interest or on the basis of consent.
162. In the absence of consent, it is not possible to choose to
provide the legitimate interest as a 'back-up' legal basis, as it were. This is
not only not very transparent with regard to data subjects whose consent is
requested, it is also not permitted within the scope of art. 10/2 WVP (as a transposition of
Article 5.3 e-Privacy Directive) and Art. 6 GDPR. Both provisions require the implementation
by a controller of a personal data processing based on
a single legal basis. Just as the Litigation Chamber has already stated in several decisions 58,
the EDPB points this out in its guidelines on consent:
Before starting the processing activities, it must be determined
which of the six grounds apply in relation to which specific
purpose . . .
It is important to note here that if a controller
chooses to rely on consent for part of the processing, it must be
prepared to respect the choices regarding that consent, and to stop that part of the
processing if a person withdraws his consent.
To pretend that data is processed on the basis of consent,
while in reality relying on another legal basis, would be fundamentally
59
unfair to the data subjects.
163. The Dispute Chamber considers that it does not adopt an (unnecessarily) strict interpretation of what
strictly necessary cookies constitute. 60 However, the legislator currently leaves no room
for a different interpretation and itself expressly speaks of a “strictly necessary”
nature (Article 10/2 WVP). To hold that cookies such as certain analytical cookies – which are
not strictly necessary for the proper functioning of the website – can be placed on the basis of
legitimate interest would not merely reflect a ‘lenient’ or ‘flexible’
attitude, it would be an interpretation that is contrary to the law. This
situation applies.
57 Cf. EDPB, Report of the work undertaken by the Cookie Banner Taskforce, 17 January 2023, §22. 58
Litigation Chamber, Decision on the substance 133/202 of 2 December 2021, marg. 56-9; Litigation Chamber, Decision on the substance
147/2022 of 17 October 2022, marg. 18; Litigation Chamber, Decision on the substance 105/2023 of 1 August 2023, marg. 98.
59EDPB, Guidelines 5/2020 on consent pursuant to Regulation 2016/679, v 1.1, 4 May 2020, §121-2.
60
Cf. A. GOBERT, “Chapter 5. The case law of the APD on the matter of cookies” in M. Knockaert and J.-M. Van Gyseghem, 5
années dejursprudencedelaChambreContentieusede l’APD, Brussels, Editions Larcier-Intersentia, (139) 142, §8: here the author speaks of a « strict interpretation of article 5 §3 e-Privacy Directive ». Decision on the merits 113/2024 — 55/70
a fortiori for cookies used for marketing purposes. The Dispute Chamber applies the
applicable legal rules to the facts.
164. It was not independently determined - for example by the Inspection Service - which
cookies were placed and in what order of magnitude. In any case, the defendant's acknowledgement of the fact regarding the unlawful placement of cookies on the basis of a
legitimate interest requires the defendant to reprimand the defendant: they may only place cookies on the basis of a
legitimate interest, insofar as the cookie complies with the
exceptional scenario under Article 10/2, paragraph 2 of the WVP; since they did not do so in the past,
this constitutes an infringement of the aforementioned provision. The same applies mutatis mutandis to
the subsequent processing of personal data that must be based on either Article 6.1.a. or Article 6.1.f of the GDPR - not both provisions at the same time or as a
interchangeable 'back-up'. 165. It is therefore not relevant whether or not the complainant in question has obtained lawful consent; the mere fact that the defendant potentially does not ask for consent to place such cookies, and this subsequently results in unlawful processing of personal data, is sufficient to establish the infringement.
166. The fact that the decision to place such cookies is partly in the hands of third parties
(regardless of whether these would constitute joint controllers, controllers or processors in that
processing process) is irrelevant. After all, the defendant is, pursuant to Article 5.2 GDPR,
responsible for ensuring that the placing of cookies and the processing of personal data resulting from the placing of cookies via its
websites in question are carried out lawfully.
167. The elements of the complaint relating to the transparency and
information obligations, as well as those elements relating to (facilitating the
exercise of) the right to object in connection with the placing of cookies on the
basis of legitimate interest, are not further examined by means of this decision.
The Dispute Chamber does not have sufficient elements in light of the
evidence for the assessment of these alleged infringements.
168. The Dispute Chamber finds that the grievances set out in the complaint – as
correctly cited by the defendant – are too broad, with the result that the
defendant has not been able to properly defend itself against them on the basis of the
documents from the administrative file submitted in the complaint or during the
procedure (for example with regard to the general reference to an alleged infringement of
the “principles of transparency, legality and propriety”). Decision on the merits 113/2024 — 56/70
169. The Dispute Chamber finds that the defendant violated Article 10/2 WVP in conjunction with Article 6.1.a/
GDPR, since the defendant admits to having placed cookies on the basis of the
legitimate interest while these did not fall under the exception provision of Article 10/2 WVP
, before making adjustments to its website in this regard. In doing so, the
legitimate interest (also under Article 6.1.f. GDPR for subsequent processing) was used
as a ‘backup’ when no consent (under Article 6.1.a GDPR) was granted for
placing cookies. 170. The defendant should not have placed these cookies and at least did not investigate whether the cookies could be placed on the basis of legitimate interest –
while this falls under its responsibility as controller in light of the
lawfulness of its personal data processing. For this reason, the
Dispute Chamber will proceed to reprimand the defendant on this point.
171. The Dispute Chamber will proceed to partially dismiss the complaint with regard to
the grievances concerning the transparency and information obligations (more specifically
Articles 12.2 and 5.1.a GDPR are mentioned in this case by the complaining party), as well as (the
exercise of) the right to object (Article 21.4 GDPR is mentioned by the
complaining party) on the grounds stated above.
III. Measures and provisional enforceability
III.1. Orders
172. The Dispute Chamber considers it appropriate to impose two separate
orders for each of the four disputed websites of the defendant pursuant to the
first two infringements.
173. Order 1: the Dispute Chamber orders the addition of a
refuse option on each layer of the cookie banner on each of the four
disputed websites, where the option to accept all ("agree") is provided on the
same layer, insofar as the accept all option serves to
grant consent within the meaning of Article 10/2 WVP in conjunction with Article 6.1.a GDPR for
placing cookies that involve the processing of personal data. 174. Order 2: when placing buttons on the cookie layers in the context of obtaining
consent to place cookies on the defendant's websites at issue,
the buttons – and in particular the colours and contrast of those buttons –
must not be of a misleading design. The refuse all option must be displayed in an
equivalent manner to the accept all option, as it is now displayed on each of
the four websites at issue. This does not in principle preclude the defendant
as data controller from opting to display such buttons in approximately the
same visible place, using the same colour and the same size of button and text
display; it is the responsibility of the controller to make this choice in order to fulfil its obligations, in accordance with Articles 5.2 and 24 GDPR..
175. For each of the two orders, the defendant can draw inspiration from the suggestions and
examples provided by the GBA in its Cookie Checklist. However, it is up to the controller to make the technical and
organisational choices in this regard. An illustrative image from the Checklist could be relevant for
complying with the orders:
61
176. Each of the two orders must be complied with for each of the four
disputed websites, at the latest on the 45th day after notification of this
decision. 62 The defendant shall, within the same period, as part of the execution of the order,
submit a clear document to the Dispute Chamber and the complainant; this document shows which
61 Screenshot of GBA, Cookie Checklist, available via:
https://www.gegevensbeschermingsautoriteit.be/publications/cookie-checklist.pdf, 1; the Cookie Checklist was attached to
the settlement proposal and is therefore included in the present administrative file.
62In principle, the first of these 45 days starts on the day after the defendant receives the registered letter with the
decision in question or the deadline for collecting the registered letter expires. Decision on the merits 113/2024 — 58/70
wayadjustmentshavebeenmadetoeachofthedisputedwebsitesinordertoexecutethetwoorders.
e
177. If the Dispute Chamber determines from the 45th day after the decision that the orders
have not been or appear to be incompletely complied with, it will notify
the defendant of this. As soon as the defendant receives this notification, the
penalty (infra) will be declared forfeited until (a) new notification(s) from the Dispute Chamber
until each order for each of the disputed websites has been complied with. In the event of partial
compliance with one or two orders for one or more disputed websites, the
Dispute Chamber will notify the defendant for which order and for which disputed
website(s) it considers the execution of the order or orders to be sufficient.
III.2. Reprimands
178. The Dispute Chamber reprimands the defendant with regard to the difficulty in the "old"
situation on the disputed websites to withdraw consent for the placement and reading of
cookies (including for the personal data processing that follows the placement of cookies), which constitutes an infringement of
art. 7.3 GDPR.
179. The Dispute Chamber reprimands the defendant and states that it may only place cookies on the basis of
legitimate interest if and insofar as they fall under the exceptional situations provided for in
art. 10/2 in fine WVP, and in that sense may also fall under the
legal basis contained in art. 6.1.f. GDPR for the following personal data processing.
III.3. Penalty payment: special considerations
III.3.1. Mitigating circumstances and impact on the nature of the corrective measure
(penalty payment)
180. The Dispute Chamber takes into account the following argumentation of the defendant
in this context:
the
“9th remedy (subordinate): No corrective measures can be taken with
respect to Mediahuis”. In this regard, the defendant points out that the only corrective
measures – if the Dispute Chamber were to decide on an infringement – could be the formulation
of a warning or a reprimand.
a. Firstly, the defendant points out that it has already taken various measures
to bring its cookie banners more in line with the recommendations of the
GBA. Decision on the merits 113/2024 — 59/70
b. Secondly, the defendant argues that the applicable legal requirements are too
general in light of the practices that the complainant and the Dispute
Chamber raise. In addition, the defendant points out that the rules invoked constitute
general, open standards, whereby the controller can also make certain
choices regarding colours, buttons, text used, etc.
c. Thirdly, the defendant argues that the content of the rules on cookies
is constantly changing and that there is no consensus on the content.
Fourthly, the defendant responds to the conclusion of the complainant on this point.
d.
181. The complainant has also made a number of “requests and suggestions”
regarding the sanctioning or imposition of measures; however, it is up to the
63
authority to make the choice to use certain powers, and these arguments will
therefore not be discussed further by the complainant. 182. The Litigation Chamber has carefully considered the extent to which it can use its corrective powers, in accordance with the infringements that the defendant has committed and
has continued to commit to date. In particular, the Litigation Chamber has taken into account the
case-law of the Court of Justice, which states that there must be intent or negligence in
committing an infringement in order to be able to impose an administrative fine. 64
183. Although the Litigation Chamber can clearly assess the legal situation
today in the light of recent case-law of the Court of Justice and the unanimous position of
(the majority of) supervisory authorities on the aspects discussed, the Litigation Chamber considers that the
defendant rightly refers to previous decisions of the Litigation Chamber in this regard. In this sense, it is far from sufficiently established that there would be no intention and negligence in the context of the defective presentation of free consent (cf. the legal discussion regarding the option "refuse all" - in the presence of an "accept all" button). The Dispute Chamber therefore does not impose an administrative fine.
184. Nevertheless, the Dispute Chamber also takes note of the defendant's objection to adapting its cookie banner so that consent is given in a free and unambiguous manner and can therefore be obtained lawfully in the light of the most
correct legal assessment. This requires in particular the addition of a "refuse all" button or other presentation of equivalent effect, when the cookie banner
63 Judgment of the ECJ of 7 December 2023, UF and AB v. Land Hessen (Schufa), joined cases C-26/22 and C-64/22,
ECLI:EU:C:2023:958, specifically §68-9.
64Judgment of the ECJ of 5 December 2023, Deutsche Wohnen, C-807/21; Judgment of the ECJ of 5 December 2023, Nacionalinis
visuomenés sveikatos centras, C-683/21. Decision on the substance 113/2024 — 60/70
an “acceptall” button is displayed in the same layer, and this in a proper manner
within the meaning of Article 5.1.a GDPR.
185. The Dispute Chamber therefore considers it necessary to take the necessary coercive measures to ensure that the defendant complies with the assessment and subsequent order of the Dispute Chamber, in order to bring the processing into compliance with the applicable legislation. It does this by imposing a penalty payment.
186. In the context of this decision, the Dispute Chamber has carefully considered the procedure for imposing a penalty payment. In doing so, it has taken into account the specific circumstances of the case and the need to ensure effective enforcement.
The Dispute Chamber has decided to deviate in this case from the usual procedure as described in the policy on penalty payments, with a view to a more direct and efficient approach.
187. This deviation is based on the consideration that the nature of the infringement and the required corrective measures require rapid implementation. By including the penalty payment directly in the decision, without prior notice via a separate form, the
Litigation Chamber aims to encourage the defendant to take immediate action.
188. The Litigation Chamber emphasises that this approach does not restrict the rights of the defendant.
The defendant retains the possibility of appealing against the penalty payment imposed within the framework of a possible appeal against this decision.
III.3.2. The penalty payment and the powers granted to the supervisory authority by the European and national legislators
189. The penalty payment is a special measure in the sense that the amount of money to be paid is not certain and fixed at the time the present
decision is taken. After all, the defendant is first given time to organise itself to remedy the
situation, or to appeal if it does not agree with the decision of the Litigation
Chamber. 190. In this sense, the penalty payment differs from the administrative fine: the first instrument
aims to bring the actual situation into line65 with the applicable legislation,
the second instrument has a punitive 66 character. The penalty payment therefore differs from the
fine both in nature and in purpose.
191. In a judgment of 19 February 2020, the Market Court considered the following:
65
Cf. BaeckJ., CrielSenWagnerK, Attachment and execution law, Brussels, Larcier, 2019, 5, chapter 2, section 1 “indirect means of enforcement”.
66 This deserves some nuance in the sense that it aims for a “deterrent” effect, according to art. 83.1 GDPR. Decision on the substance 113/2024 — 61/70
“Before a penalty is imposed, the infringer must be informed
of the nature of the penalty being considered and its size (if a fine is being
considered). The infringer must be warned
(in order to avoid unnecessary penalties) and given the opportunity
to defend himself with regard to the amounts of the fine proposed by the Dispute
Chamber, before the penalty is actually imposed and implemented.”
192. In light of its “policy on penalty payments”, the Dispute
Chamber considered that, in the context of the adversarial proceedings and in light of the above-mentioned consideration of the
Market Court, the use of the penalty form would be required when imposing a penalty
68
193. However, the Litigation Chamber currently considers that the imposition of a penalty payment should not be submitted to the defendant prior to its imposition for the following reasons:
a) The obligation for the Litigation Chamber to submit the penalty to the defendant prior to a decision is
based on the case-law of the Market Court. In addition to the legal
framework, this step was added in the light of the rights of defence. In accordance with this
case-law, the Litigation Chamber uses a so-called “penalty form” that is submitted to the
defendant prior to the actual decision in the case of an administrative fine.
This procedural step is inherently delaying and additionally procedurally burdensome; the
Litigation Chamber recognises its value in the light of the sanctioning powers that it can
exercise, but at the same time notes that such purely nationally added
elements can hinder the uniform application of an EU regulation.
Such a delaying and procedurally burdensome step must therefore in any case be interpreted narrowly, in the sense that it may not interfere with the objectives
of the legislator with regard to the powers granted to the authority.
b) As already mentioned, the nature of the penalty payment is also fundamentally
different from that of an administrative fine as a punitive measure
in its purest form. The penalty payment aims – as the term in Dutch shows –
to ‘force’ a party to do something in order to bring a factual situation into line with the law
67
Judgment of the Court of Appeal of Brussels (Chamber 19A, Market Court Section) of 19 February 2020, 2019/AR/1600. 68 Dispute Resolution Chamber, Policy on penalty payments, 23 December 2020, available at:
https://www.gegevensbeschermingsautoriteit.be/publications/beleid-inzake-dwangsom.pdf, 3. Decision on the merits 113/2024 — 62/70
to be brought to bear on the decision of the Dispute Resolution Chamber. 69
Leading legal doctrine clearly states that a penalty payment is not a criminal sanction, 70
71
but an indirect means of enforcement. The aim is to execute the order that the
72
Dispute Resolution Chamber imposes on the party. In this sense, the choice of this
coercive measure falls exclusively within the powers of the Dispute Resolution Chamber, and a
party does not have to express an opinion on its use prior to the decision. The fact that
the penalty payment does not have a fixed amount and is conditional in the sense that it
only manifests itself after a party has failed to act does not detract from this. The national
legislator considered it appropriate to grant the jurisdiction to the Dispute
Chamber for a situation such as the one in the present case, and therefore the will of the legislator
must be recognised and respected.
194. The decisions of the Dispute Chamber have no precedent value. 73A maiore ad
minus, the policy documents of the Dispute Chamber are not binding. The
Dispute Chamber recognises that such documents do create confidence in the public,
but points out that it wished to communicate transparently and proactively with the public,
while at the same time being subject to the legal developments before it.
195. The fact that the penalty payment was not raised during the proceedings is irrelevant and
is not required by law: the Court of Justice has repeatedly confirmed that the
supervisory authority has a margin of discretion in determining which measures are
74
appropriate when dealing with a complaint file under the GDPR.
III.3.3. Implementation modalities of penalty payments: accessory nature
196. It is not necessary for the penalty payment to immediately follow the decision of the
Dispute Resolution Chamber, in order to give the defendant time to take the necessary technical and
organizational measures, also in light of the aforementioned unclear legal situation.
69Wagner K., Penalty Payment, Brussels, Story-Scientia, 2003, § 7: “It [the penalty payment] is never intended as an incentive to comply
to actually be forfeited.”; where the Dispute Resolution Chamber refers to legal doctrine and case law regarding the civil
law penalty payment, it should be noted that this is done for the legal framework. The instrument under the WOG is an
administrative law power and therefore differs from this.
70Wagner K., Penalty payment, Brussels, Story-Scientia, 2003, § 20.
71
Ibid., §5.
72 Compare, mutatis mutandis, Wagner K., o.c., §6: “The purpose of the penalty payment is to ensure the direct performance of the obligations . . .”
73
Brussels Court of Appeal (Chamber 19A, Market Court Section): judgment of 1 December 2021 (2021/AR/1044), §7.0.2.; judgment of 7 July 2021 (2021/AR/320), p. 12.
74
Judgment of the Court of Justice of 16 July 2020, Data Protection Commissioner v. Facebook Ireland Ltd and Maximilian Schrems
(“Schrems II”), C-311/18, §111. Decision on the substance 113/2024 — 63/70
197. The penalty payment serves as an accessory to the orders imposed by the Litigation Chamber. In that sense,
the penalty payment is conditional. 75
198. A period of 45 days to provide for the implementation of Orders 1 and 2 is
sufficient for compliance with these orders.
199. On or after the 46th day after notification of the decision (the day of notification is the day on which the party receives the registered mail or the period for
collection thereof expires), the Dispute Chamber will notify the defendant by means of a
notification that the latter 1) sufficiently complies with an order, 2) partially
complies with an order, 3) does not comply with an order. The Dispute Chamber will, if
applicable, initiate the penalty payment on or after the 46th day by means of the notification of the
non-compliance under the aforementioned second or third situation.
200. A penalty payment of EUR 25,000 is appropriate for order 1 per day commenced after the expiry of the
period of 45 days, also in light of the consideration that the defendant could
make not to comply with the order because of its commercial impact. The
penalty applies per disputed website of the defendant, and can thus amount to
EUR 100,000 per day for the defendant.
201. A penalty of EUR 25,000 is appropriate for order 2 per day commenced after the expiry of the
term of 45 days, also in light of the consideration that the defendant could
make not to comply with the order because of its commercial impact. The
penalty applies per disputed website of the defendant, and can thus amount to
EUR 100,000 per day for the defendant.
202. The penalty applies per disputed website of the defendant, and can thus amount to
EUR 200,000 per day for the defendant. This amount is considered proportionate
given the scale of the defendant's activities and the potential impact of the
infringements on the rights and freedoms of the persons concerned.
203. The Litigation Chamber emphasises that this amount is not intended as a penalty, but as an
effective means of ensuring compliance with the orders. The aim is to encourage the defendant
to comply promptly and fully with the measures imposed, taking into account
75Cf. Baeck J,, Criel S and Wagner K, Beslag- en uitvoeringrecht, Brussels, Larcier, 2019, 5, ch. 2, section 2 "Conditionality".
76The Council of State may only impose a penalty payment if the party fails to comply with an earlier judgment; despite the fact that no such legal restriction applies to the Dispute Chamber, it seems reasonable to also provide for a compliance period in this sense so that the defendant can comply.
See art. 36 of the coordinated laws of the Council of State, coordinated on 12 January 1973; Royal Decree of 2 April 1991 regulating the legal proceedings before the administrative law division of the Council of State regarding the order and the penalty payment.
See also Van Eeckhoutte D., “L’astreinte et l’injonction dans le contentieux administratif en Belgique”, Administration Publique:
revue du droit public et des sciences administratives, 2010, Ed. 33, (426)429. Decision on the merits 113/2024 — 64/70
77
with the financial capacity of the company and the potential profits that could
result from non-compliance.
204. If the defendant can demonstrate that full compliance within the set period
is impossible despite all reasonable efforts, the defendant has the option to submit a reasoned request
for extension to the Disputes Chamber before the expiry of the period.
205. The penalty is forfeited per day, with a maximum amount for the total of
forfeited penalty payments of 10,000,000 (in words ten million) euros.
III.3.4. Visualisation of the timeline for compliance with orders and forfeiture
penalty payments
206. For illustrative purposes only, for the proper understanding of the parties and any other
reader of the present decision, the timeline for the implementation of the decision
is shown here. In the event of any ambiguity between this visual representation and the text of this
decision, the text of the decision shall prevail in any case:
77 Cf. the annual accounts of the defendant filed with the National Bank of Belgium, available at:
https://consult.cbso.nbb.be/consult-enterprise/0439849666. 66/70
III.4. Provisional enforceability
207. In the context of provisional enforceability, the Dispute Chamber takes particular note of the defendant's request and argumentation in this regard:
the
"10th ground (subordinate): No provisional enforceability". The defendant cites "special reasons" in this regard and refers to the case law of the
Market Court, which states that an effective remedy in court is only possible "when the
applicant is not pressured to pay a fine and/or to comply with the provisions of the contested decision".
208. The defendant therefore – referring to the case law of the Market Court in this regard – raises the
legitimate question of suspending provisional enforceability in this case, because this
places pressure on the parties in the context of (the outcome of) a possible appeal procedure.
209. The Litigation Chamber refuses the request for suspension of provisional enforceability
for the following reasons.
210. Firstly, provisional enforceability is the standard
situation for the national legislator. The European legislator has granted powers to
take measures to the authority: it is therefore the authority that decides which (corrective) measure
78
is most appropriate – where necessary – to implement or impose on the defendant.
211. The fact that a remedy is possible at a judicial body after a decision
has been taken in this regard does not affect the powers of the authority.
In light of the separation of powers, the judiciary must assess a posteriori whether the supervisory authority has acted within the legal framework and within its discretionary powers. When the court exercises its own power to suspend enforceability, this is a decision that falls within its discretionary power.
212. In light of the credibility of the powers granted to the authority by the European and
national legislators, it cannot be the default situation that the enforceability of the decisions and measures taken by an
authority is suspended as soon as a party requests this. If this were the default situation, it would undermine the entire intention of the
legislator to be able to act decisively and effectively in a digitalised society. This does not
fit in with the teleological design of the powers granted to the authority under the GDPR.
78 Judgment of the ECJ of 7 December 2023, UF and AB v. Land Hessen (Schufa), joined cases C-26/22 and C-64/22,
ECLI:EU:C:2023:958, specifically §68; This of course concerns the initial judgment on such measures, and does not concern the
issue of full jurisdiction in the event that an injunction is instituted. Decision on the substance 113/2024 — 67/70
213. In this sense, it is therefore indeed the intention, both of the European and of the Belgian
legislator, that a party in respect of which the Litigation Chamber takes measures
complies without undue delay with the provisions of the decision of the
authority. Once again, the Disputes Chamber points out that this does not mean that suspension is not possible, but only if there are serious grounds for it
(including, in an extreme case, the irreversible financial problems of a company when an administrative fine is imposed).
214. Secondly, where provisional enforceability is not suspended and the decision
would subsequently still be deemed defective, legal redress is in any case possible,
since the judgments of the Market Court constitute the final substantive judgment in the cases
involved. In the present case, there is no indication that such legal redress would be difficult or
impossible, since no irreversible measures are taken at all with regard to the
defendant. This could possibly have been different if a (high) administrative fine had
been imposed, a case to which the defendant also refers in light of her request.
215. If serious measures are imposed on a defendant, for example
79
in a situation where the legislation is clearly unclear, the suspension of
enforceability could be considered - which is why the legislator has provided
this optional option.
216. In light of the underlying case, the Dispute Resolution Chamber has ruled that
there was indeed legal uncertainty regarding the interpretation of certain
consent requirements regarding cookies - including uncertainty regarding the
interaction between the GDPR and the e-Privacy Directive; however, this has
in the meantime been clarified by the Court of Justice. The DPA has taken a position as an institution
regarding the correct implementation of consent in light of cookie banners.
217. Superfluously: the fact that five similar media companies accepted a settlement that
reflected the position of the GBA as set out in the Cookie Checklist is a clear
indication that the legal situation cannot be manifestly unclear. It can be pointed out
that courts frequently cite the position of the supervisory authorities on cookies and other
tracking tools and therefore regard it as authoritative, without this in itself
meaning anything with regard to enforceability as a standard.
79 Taking into account that the Dispute Chamber cannot submit preliminary questions to the
competent judicial authorities.
80
See, inter alia, the judgment of the ECJ of 27 October 2022, Proximus v. GBA, C-129/21, ECLI:EU:C:2022:833, answer to the first
preliminary question of the Market Court; see amendment to the law on the powers of the GBA to act in the matter of cookies:
81 Decisions of the Dispute Chamber of 1 December 2023 (159/2023, 160/2023, 161/2023 and 162/2023) and 5 December 2023
(164/2023).
82
For illustration: Amsterdam District Court, summary judgment, 7 June 2024, ECLI:NL:RBAMS:2024:3331, available via:
https://uitspraken.rechtspraak.nl/details?id=ECLI:NL:RBAMS:2024:3331, §5.7. Decision on the substance 113/2024 — 68/70
IV. Publication of the decision
218. Given the importance of transparency with regard to the decision-making of the
Dispute Resolution Chamber, this decision is published on the website of the
Data Protection Authority.
219. Given that the defendant is a media company of a considerable size and
equally social scope, and given that the
personal data processing activities concern a significant part of the
Belgian and – more broadly – Dutch-speaking population, the Dispute Resolution
considers it appropriate to disclose the identity of the defendant as well as the
names of the websites at issue. This is, moreover, in line with the
practice of transparency that the Dispute Resolution Chamber has followed in
comparable procedures with comparable actors in the media sectors that
led to settlement decisions, although in those procedures no actual infringements were
decided upon or enforcement measures were imposed. 220. The identity of the complainant's representative is also important for a proper understanding of the procedure, given the procedural elements formulated by the defendant with regard to the practice of mandating that representative.
It should be noted that the representative has disclosed the same circumstances of this
procedure – including the identity of the defendant – on its website. Furthermore, it is important to make the fundamental
differences in the procedural assessment in this case known in a transparent manner compared to other
cases – where the Dispute Chamber did decide that there was a defect in the
delegation of the same representative. Decision on the merits 113/2024 — 70/70
Such an appeal may be lodged by means of an inter partes application which must contain the
mentioned in Article 1034ter of the Judicial Code. The 83
inter partes application must be submitted to the registry of the Market Court
84
in accordance with Article 1034quinquies of the Judicial Code, or via the e-Deposit
information system of Justice (Article 32ter of the Judicial Code).
(signed). Hielke H IJMANS
Chairman of the Disputes Chamber
83
The application shall state, on penalty of nullity:
1° the day, month and year;
2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
company number;
3° the surname, first name, place of residence and, where appropriate, the capacity of the person to be summoned;
4° the subject and brief summary of the grounds of the action;
5° the judge before whom the action is brought;
6° the signature of the applicant or his lawyer.
84The application and its annex shall be sent, in as many copies as there are parties involved, by registered letter
to the clerk of the court or lodged at the registry.
