APD/GBA (Belgium) - 80/2021

APD/GBA (Belgium) - 80/2021
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 17(1)(c) GDPR Article 19 GDPR Article 21(2) GDPR Article 24(3) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	19.07.2021
Published:	19.07.2021
Fine:	None
Parties:	n/a
National Case Number/Name:	80/2021
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	French French
Original Source:	BE DPA (in FR) BE DPA (in FR)
Initial Contributor:	n/a

The Belgian DPA issued a new decision following a so-called 'light decision', whereby it had ordered a company to stop processing certain personal data used for direct marketing and to delete the data. Since the company neither complied with the order nor notified the DPA of any action taken, the DPA issued a new decision, with a reprimand and a new order to comply within one month.

English Summary

Facts

In a former decision adopted within the so-called 'light procedure', the Belgian DPA ordered a company to stop the processing of the personal data of a complainant who had objected to the sending of direct marketing emails several times.

The provider did not comply with the order and the litigation chamber decided to open the case to adopt a decision on the merits ("décision au fond").

None of the parties sent their submissions, despite the fact that they were invited to do so.

Holding

The DPA issued a reprimand against the company and ordered it to:

• comply with the right to object within a month after the notification of the decision;
• stop the processing of personal data for direct marketing purposes;
• erase all the data of the complainant (except if another legal basis could justify the processing for another purpose)
• notify all the recipients in accordance with Article 19 GDPR.

Comment

In a 'light procedure', the parties are not heard and the decision is made on the basis of the complaint. In a 'decision on the merits' ("décision au fond") the parties are heard.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

                                                                                                          1/6








                                                                                Contentious Room



                                                 Decision on the merits of July 19, 2021






File number: DOS-2020-00559



Subject: Direct Marketing - Substantive Decision Following Failure to Perform a

"light" decision on article 95.1.5 ° LCA - reprimand and personal orders

requests for the exercise of the complainant's rights (opposition, erasure and notification to third parties)





The Contentious Chamber of the Data Protection Authority, made up of Mr. HielkeHijmans,

chairman, and Messrs. Romain Robert and Dirk Van Der Kelen, members, taking up the matter in this

composition;



Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the protection
of natural persons with regard to the processing of personal data and on free movement

of this data, and repealing Directive 95/46 / EC (General Data Protection Regulation),

hereinafter "GDPR";



Considering the Law of December 3, 2017 establishing the Data Protection Authority (hereinafter the APD law);



Having regard to the internal regulations as approved by the Chamber of Representatives on December 20, 2018

and published in the Belgian Official Gazette on January 15, 2019;



Having regard to the documents in the file;




took the following decision regarding:

                                                                                                         .

The complainant: X (hereinafter "the complainant"); .

                                                                                                         .

The defendant: Y (hereinafter "the defendant") Decision on 80/2021 - 2/6




I. Facts and procedural history



    1. Pursuant to his complaint of January 31, the complainant indicates that on several occasions he reported to the

        defendant that he did not wish to receive emails from him, emails addressed to him

        to his e-mail address […]. These emails relay promotions offered by the

        defendant, active in the used vehicle market in particular.


    2. It appears from the documents sent by the complainant that on December 11, 2019, a promotional email

        unsolicited was sent to him at his address […].


    3. On December 12, 2019, the next day, the complainant sent the STOP message to the email address

        […], Following in this the procedure mentioned by the defendant to unsubscribe from the

        "Newsletter" received. This immediate reaction of the complainant had been preceded on July 4, 2019 and

        November 5, 2019 of similar "STOP" messages.

    4. It is also apparent from the documents filed by the complainant that on January 31, 2020, the latter was

        again opposed to sending an unsolicited email from the defendant by sending the

        STOP message by return email to the sender.


    5. On February 28, 2020, the complainant filed a complaint with the APD.


    6. On March 10, 2020, the complaint was declared admissible on the basis of Articles 58 and 60 LCA by the

        APD's Front Line Service (SPL). The complainant was informed of this in accordance with article

        61 LCA and the complaint was transmitted on the same date to the Litigation Chamber by virtue of

        article 62.1 LCA.


    7. On April 14, 2020, the Litigation Chamber has, in application of articles 58.2.c) of the RGPD and 95.1, 5 °

        LCA, adopted decision 12/2020 against the Respondent (Annex 1) and decided to order

        the defendant, prior to any decision on the merits, to comply, within one month

        at the request of the complainant to exercise the rights of opposition and erasure (art. 21.2 and 17.1 c) of

        GDPR) and therefore to cease all processing of the complainant's personal data for

        prospecting purposes (article 21.3 of the GDPR) as well as to erase the data

        personal data concerning him (article 17.1 c) of the GDPR). A compliance order has, by the same

        decision, also sent to the defendant in application of Article 19 of the GDPR, either to

        notify the erasure made to any recipient of the personal data of the

        complainant. The follow-up given to this decision had to be notified, supporting documents

        support to the Litigation Chamber within one month of notification of the decision.


    8. In view of the failure to implement this decision 12/2020 within the time limit of one month, the

        Litigation Chamber, as announced under the terms of the operative part of the said decision, decided to

        deal with the case on the merits on the basis of Article 98 LCA. Decision on 80/2021 - 3/6




    9. On May 25, 2020, the Litigation Chamber informed the parties and invited them to argue

        their arguments according to an exchange of conclusions schedule. The Litigation Chamber notes

        neither party has concluded.




II. Place


     II.1. From the "light" procedure (article 95.1. LCA) to the substantive procedure (article 98 et seq. LCA)


                                                                                                   1
    10. As it explained in its note on "Policy of discontinuing action", the Chamber

        Litigation recalls that if the facts illustrated in the complaint are sufficiently clear to establish

        an infringement of the GDPR, the Litigation Chamber can take a decision without requesting the

        arguments of the defendant against whom the complaint is lodged, in the context of

        of a so-called "light" decision as provided for in Article 95 LCA. In this case, the LCA does not have

        there is an obligation to seek the point of view of the processing manager / subcontractor in view

        allow ODA to offer a faster response to the needs of citizens at the end of a procedure

        simplified.


    11. The Contentious Chamber then takes a so-called “light” decision (for example a warning or

        an order to respond to the complainant's request to exercise his rights) on the basis of the facts as they

        are reported to him, without first obtaining the point of view of the party implicated.


    12. Decision 12/2020 adopted on April 14, 2020 by the Litigation Chamber was a decision of this


        type (see point 7 above).

    13. Render a decision without having heard the arguments of the party complained of (the party


        defendant) does, however, run the risk of disregarding factual circumstances or

        important legal issues (e.g. force majeure, technical reality) that could have led to the

        Litigation Chamber to qualify its decision. In accordance with the principle of good administration,

        it is important to hear the arguments of all parties before making a decision on it

        that affects it. The decisions of an administrative authority such as the Litigation Chamber are

        must be founded both in law and in fact, as well as to be impartial, i.e. in particular without

        prejudice and without either party being favored because one of them

        would not have been heard. Consequently, the Litigation Chamber renders its decisions "light" "prima

        facie "i.e. on the basis of an" appearance of right ", without prejudice to the substance (see in this regard the

        operative terms of decision 12/2020).










1
 https://autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-contentieuse.pdf Decision on 80/2021 - 4/6




    14. If the defendant decides to comply with the decision rendered, the dispute is thus closed and a

        acceptable solution for both parties was obtained simpler and faster on foot

        of the procedure provided for in Article 95 LCA.


    15. If the data controller / processor fails to comply with the said decision (or by

        case of dispute), a substantive procedure is launched.


    16. In the present case, as mentioned in points 8 and 9 above, the defendant has not given

        following the light 12/2020 decision and neither party has concluded following the invitation given to it

        made in this sense.


    II.2 As to the substance


    17. In view of the foregoing, the Contentious Chamber considers that in this case, on the basis of


        the elements at its disposal, in particular the documents filed by the complainant, it is based

        to issue a reprimand to the defendant on the basis of Article 100.1., 5 ° LCA, together with a

        order to follow up on the complainant's request to exercise his rights (article 100.1. 6 ° LCA)

        and this, for the reasons and according to the methods below.


    18. The GDPR does not define what is meant by "processing for prospecting purposes" or for

        purposes of "direct marketing" according to the English terminology. In its Recommendation 01/2020 of

        January 17, 2020 relating to the processing of personal data for marketing purposes

        direct, APD indicates that it is better to understand "direct marketing" as "any communication,

        solicited or unsolicited, aimed at promoting an organization or a person, services,

        of products, whether paid or free, as well as brands or ideas, addressed by

        an organization or a person acting in a commercial or non-commercial context,

        directly to one or more natural persons in a private or professional context, by

        any means, involving the processing of personal data "(page 8 of the

        Recommendation - definition).


    19. The processing of such an e-mail address for the complainant (person concerned within the meaning of article

        4.1. (Second part) of the GDPR) is, with regard to this definition, a personal data


        (Article 4.1. of the GDPR) processed for prospecting purposes (direct marketing) within the meaning of Article 21. 2 of

        GDPR. In this case, the data subject is entitled to exercise his right to object by

        application of Article 21.2 of the GDPR.


    20. Accordingly, the controller is obligated to provide the complainant with information on

        the measures taken at the end of the exercise of the right of opposition within the period of one month to count

        of the receipt of the request as provided for in Article 12.3. of the GDPR. Pursuant to Article 21.3.



2 See. in this regard, Decision 64/2020 of the Contentious Chamber (point 23): https://autoriteprotectiondonnees.be/publications/decision-
as to the merits-n-64-2020.pdf Decision as to the 80/2021 - 5/6




         of the GDPR, when the data subject objects to processing for prospecting purposes, the

         personal data is no longer processed for these purposes.


    21. As a result of the exercise of the right of opposition based on Article 21.2 of the GDPR by the person

         concerned, the controller is also under the obligation, in application

         of Article 17.1 c) of the GDPR, to erase the personal data of the data subject

         as soon as possible, ideally within a month. Only if he treats these same

         data for another purpose and in support of an own legal basis that the person responsible for


         processing is authorized to keep this data.


    22. Pursuant to Article 19 of the GDPR, the controller is also required to notify

         any erasure of personal data carried out (in accordance with Article 17.1 c) of

         RGPD - see. above) to each recipient to whom the personal data would have

         been communicated.


    23. In the present case, the complaint and the documents communicated in support thereof reveal that the Respondent

         sends promotional emails to the complainant's email address and that processing

         this address continued for the same prospecting purposes despite the latter's opposition. In

         Indeed, the complainant exercised his right to object on several occasions, from July 2019, following the

         procedure put in place by the defendant. The complainant indicates that he continues to receive


         emails of the same type to which, following a new mailing of December 11, 2019, to

         new opposite on December 12, 2019 and once again on January 31, 2020 as evidenced by

         documents which he communicated to the Litigation Chamber.


    24. Accordingly, the Litigation Chamber concludes that there have been breaches of Article 21.2 of the GDPR as well

         than in Article 17.1 c) of the GDPR - provided that the complainant has not asserted any other basis of lawfulness to

         the support for which the processing of the complainant's data could have continued for a purpose

         separate from that of direct marketing - combined with Article 12.3. of the GDPR. In support of these

         breaches, it sends the defendant, as already mentioned in point 17 above, a

         reprimand accompanied by a compliance order as described in the device below.





III. Publication of the decision


    25. In view of the importance of transparency with regard to the decision-making process and


         decisions of the Litigation Chamber, this decision will be published on the Authority's website

         data protection by deleting the direct identification data of

         parties and named persons, whether natural or legal.



3
    See. in this regard, Decision 62/2021 of the Contentious Chamber (points 14 et seq.):
https://autoriteprotectiondonnees.be/publications/avaution-62-2021.pdf Decision on 80/2021 - 6/6




    FOR THESE REASONS,

    the Contentious Chamber of the Data Protection Authority decides, after deliberation:



    - To reprimand the defendant on the basis of Article 100.1., 5 ° LCA, in

        application of articles 58.2.c) of the RGPD and 100.1 6 ° LCA, of the compliance orders below

        after ;



            - Orders the defendant to comply, within one month of the notification of the

                this decision, at the request of the complainant to exercise the right of opposition (art. 21.2

                of the GDPR) and therefore to cease any processing of the personal data of the

                complainant for prospecting purposes (article 21.3 of the GDPR);



            - Orders the defendant to proceed within one month of the notification of this


                decision, to the erasure of the complainant's personal data (Article 17.1 c) of

                GDPR), except to be able to rely on a separate basis of lawfulness authorizing the processing

                data of the complainant for another purpose;



            - Orders the defendant to comply, within one month from the date of

                notification of this decision, its notification obligation as provided for in

                Article 19 of the GDPR, or to notify the erasure made to any possible recipient

                personal data of the complainant;



    - To order the defendant to inform, with supporting evidence, the Authority

        data protection (Litigation Chamber) of the continuation of this decision

        and this at the latest in the month of its notification. This communication can be done by e-mail

        addressed to the following address (contact address of the Litigation Chamber):

        litigationchamber@apd-gba.be.



    Under Article 108, § 1 of the LCA, this decision may be appealed against to the

    Market Court within thirty days of its notification, with the Authority

    data protection as a respondent.








(se.) Hielke Hijmans


President of the Litigation Chamber

Annex: Decision 12/2020 of the Contentious Chamber 1/6












                                                                         Litigation Chamber



                                                           Decision 12/2020 of April 14, 2020












File No .: DOS-2020-00559



Subject: Complaint against a company for unsolicited and unsolicited promotional emails

respect for the right to object



The Contentious Chamber of the Data Protection Authority, made up of Mr. Hielke

Hijmans, chairman, serving as sole member;



 Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the

protection of individuals with regard to the processing of personal data and the

free movement of such data, and repealing Directive 95/46 / EC (general regulation on the

data protection), hereinafter GDPR;



Having regard to the law of 3 December 2017 establishing the Data Protection Authority (hereinafter the law

LCA);



Having regard to the Rules of Procedure as approved by the Chamber of Representatives on

December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;



Having regard to the documents in the file;



Took the following decision regarding:

    - the complainant: X (hereinafter the complainant)



    - the data controller: Y (hereinafter the defendant) Decision 12/2020 - 2/6






    1. Facts and procedural history


Under the terms of his complaint, the complainant indicates that on several occasions he reported to the respondent

that he did not wish to receive emails from him, emails addressed to him at his address

electronic […]. These emails relay promotions offered by the defendant in the context of

of its business activities.




It appears from the documents in the file that on December 11, 2019, an unsolicited promotional email was

sent to the complainant at his address […].



On December 12, 2019, the complainant sent the STOP message to the email address [...], following in this

the procedure mentioned by the defendant to unsubscribe from the "newsletter" received. This


the complainant's immediate reaction had been preceded on July 4, 2019 and November 5, 2019 by messages

Similar "STOP".



It also emerges from the documents in the file that on January 31, 2020, the complainant again objected

sending an unsolicited email from the defendant by sending the STOP message by

return mail to sender.



On February 28, 2020, the complainant filed a complaint with the Data Protection Authority (DPA).




On March 10, 2020, the complaint is declared admissible on the basis of articles 58 and 60 of the LCA law by

APD's Front Line Service (SPL). The complainant was informed of this in accordance with article

61 of the LCA law and the complaint was transmitted on the same date to the Litigation Chamber by virtue of

of article 62.1 LCA.



Pursuant to article 95.2 LCA, the Litigation Chamber hereby informs the parties

that following this complaint, a case is pending.



Pursuant to article 95.2, 3 ° LCA, a copy of the file may be requested by the parties. In


response, the documents in the file will be sent to them electronically via the address
                                  1
litigationchamber@apd-gba.be.








1 In view of the current exceptional circumstances and the organizational measures taken to combat the
spread of the COVID-19 virus, the file cannot be removed on site. For the same reasons, a consultation of the file
and a copy of it on site is also not possible (article 95. 2, 3 ° LCA). All communications in
this file will also be done electronically for the same reasons. Decision 12/2020 - 3/6




    2. Legal basis



    ✓ Articles 21.2 and 21.3 of the General Data Protection Regulation (GDPR) - Right
        opposition


2. When personal data is processed for prospecting purposes, the person

concerned has the right to object at any time to the processing of personal data
concerning for such prospecting purposes, including profiling insofar as it is linked to a

such prospecting.

3. When the person objects to processing for prospecting purposes, the personal data

staff are no longer processed for these purposes.



    ✓ Article 17 of the General Data Protection Regulation (GDPR) - Right to

        erasure ("right to be forgotten")

The data subject has the right to obtain from the controller the erasure, within

as soon as possible, of personal data concerning him and the controller has

the obligation to erase this personal data as soon as possible, when one of the reasons

the following applies:

(…)
c) the person objects to the processing pursuant to Article 21 (1) and there are no grounds

compelling legitimate grounds for the processing, or the data subject objects to the processing by virtue of

Article 21, paragraph 2.



    ✓ Article 19 of the General Data Protection Regulation (GDPR) - Obligation to

        notification regarding the rectification or erasure of personal data
        personal or restriction of processing


The controller notifies each recipient to whom the personal data

have been communicated any rectification or erasure of personal data or
any limitation of the processing carried out in accordance with Article 16, Article 17, paragraph 1, and

section 18, unless such communication proves impossible or requires effort

disproportionate. The controller provides the data subject with information about

these recipients if the latter so requests.



    ✓ Article 12.3 of the General Data Protection Regulation (GDPR) - Transparency

        information and communications and modalities for the exercise of the rights of the
        concerned person

The controller provides the data subject with information on the measures taken

following a request made in accordance with Articles 15 to 22, as soon as possible and in

any event within one month of receipt of the request. If necessary this Decision 12/2020 - 4/6



deadline may be extended by two months, taking into account the complexity and number of requests. the

controller informs the data subject of this extension and the reasons for

postponement within one month of receipt of the request. When the person

concerned submits their request in electronic form, the information is provided by


electronic where possible, unless the data subject so requests

other.





    3. Motivation


The GDPR does not define what is meant by "processing for prospecting purposes" or for

purposes of "direct marketing" according to the English terminology. In its Recommendation 01/2020 of 17

January 2020 relating to the processing of personal data for direct marketing purposes,

PDA indicates that "direct marketing" should be understood as "any communication,

solicited or unsolicited, aimed at promoting an organization or a person, services,

products, whether paid or free, as well as brands or ideas, addressed by a

organization or person acting in a commercial or non-commercial context, directly to

one or more natural persons in a private or professional setting, by any means,

involving the processing of personal data ”(page 8 of the Recommendation -

definition).



The treatment of the complainant's e-mail address by the respondent is, with regard to this definition,

personal data (article 4.1. of the GDPR) processed for prospecting purposes (direct

marketing) within the meaning of Article 21.2 of the GDPR. The latter was therefore entitled to exercise his right

opposition pursuant to Article 21.2 of the GDPR.



It appears from the documents in the file that the defendant did not provide the complainant with information on

the measures taken following the exercise of his right of opposition within a period of one month from

of receipt of his request as provided for in Article 12.3. of the GDPR.



It also emerges from the documents in the file that the processing of the complainant's email address

continued beyond the expiration of this month, still for the same prospecting purposes. Indeed,

the complainant exercised his right on several occasions, from July 2019, following the procedure initiated

place by the defendant. He indicates that he continues to receive emails of the same type despite everything.

which he again opposed on December 12, 2019 and again on January 31, 2020 as

The documents in the file attest to this.



Therefore, the defendant did not comply with Article 21.3, taken in conjunction with Article 12.3. of the GDPR. Decision 12/2020 - 5/6




As a result of the exercise of its right of objection based on Article 21.2 of the GDPR, the defendant


was also under the obligation, pursuant to Article 17.1 c) of the GDPR, to erase the data to

personal character of the complainant as soon as possible and at the latest within the one month period referred to

in Article 12.3. of the GDPR. It appears from the documents in the file that this erasure did not take place.




Pursuant to Article 19 of the GDPR, the controller is also required to notify

each recipient to whom the personal data have been communicated any

erasure of personal data carried out in accordance with Article 17.1 c) of the GDPR.



Given the importance of transparency with regard to the decision-making process and


decisions of the Litigation Chamber, this decision will be published on the website of the APD

by deleting the direct identification data of the parties and persons mentioned,

whether they are physical or legal.






FOR THESE REASONS,

THE LITIGATION CHAMBER

Decide, after deliberation:




    - Order the defendant, prior to any decision on the merits, to comply,
                         2 3
         within one month of the notification of this decision, upon request

         to exercise the rights of opposition and erasure of the complainant (art. 21.2 and 17.1 c) of

         GDPR) and therefore to cease all processing of the complainant's personal data

         for prospecting purposes (article 21.3 of the GDPR) as well as to erase


         personal data concerning him (article 17.1 c) of the GDPR) and this, in application of article

         58.2.c) of the GDPR and of article 95.1, 5 ° LCA;



    - Order the defendant, prior to any decision on the merits, to comply,

         within one month of the notification of this decision, at its 5th


         notification obligation as provided for in Article 19 of the GDPR, or to notify

         the erasure made to any recipient of the personal data of the

         complainant;






2
 This period of compliance is longer than that granted by the Litigation Chamber in the past in cases
comparable to take into account the current exceptional circumstances (Ministerial Decree of 23 March 2020 laying down
emergency measures to limit the spread of the COVID-19 coronavirus, M.B., March 23, 2020).
3
 The sending of this decision by the registry of the Contentious Chamber constitutes notification.
4 Same as footnote 2.

5 Idem footnote 3. Decision 12/2020 - 6/6





     - Order the defendant to inform the APD (Litigation Chamber) of the rest
                                                                                                             6
         reserved for this decision at the latest within one month of its notification. This

         communication can be done by e-mail to the following address (contact address of the

         Litigation Chamber): litigationchamber@apd-gba.be.





     - To deal with the case on the merits in the event that the defendant abstains

         to execute this decision within the time limit, in application of Articles 98 and

         following of the LCA.





This decision can be appealed to the Markets Court within 30 days of

from its notification (article 108.11 of the law of 3 December 2017 establishing the Authority of

data protection) with the Data Protection Authority as the defendant.








(se.) Hielke Hijmans

President of the Litigation Chamber







































6This period of notification to the Litigation Chamber of its compliance by the defendant is longer than that

the Litigation Chamber has granted in the past in comparable cases to take account of the circumstances
exceptional current events (Ministerial Decree of 23 March 2020 on emergency measures to limit the spread of
coronavirus COVID-19, M.B., March 23, 2020).
7
  Pursuant to Article 100 of the LCA, the Litigation Chamber is notably authorized to impose a fine
administrative.