APD/GBA (Belgium) - 117/2022: Difference between revisions

Latest revision as of 11:23, 5 August 2022

APD/GBA - 117/2022

Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 6(1) GDPR Article 12(3) GDPR Article 15 GDPR Article 21(2) GDPR Article 21(3) GDPR
Type:	Complaint
Outcome:	Other Outcome
Started:	29.12.2021
Decided:	26.07.2022
Published:	26.07.2022
Fine:	n/a
Parties:	n/a
National Case Number/Name:	117/2022
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Dutch
Original Source:	Beslissing 117/2022 van 26 juli 2022 (in NL)
Initial Contributor:	Enzo Marquet

The Belgian DPA held that a controller can rely on legitimate interest as a legal basis to send former customers direct marketing if the relationship ended 'not that long ago' and the data subject did not object to this processing.

English Summary

Facts

The data subject was a former customer of the controller (which remained unknown). The data subject received direct marketing from the controller. The data subject objected to the further processing of its personal data while also requesting access to all personal data processed by the controller and the legal basis used to send the direct marketing.

The controller responded within 30 days, confirming that the data subject would no longer receive direct marketing and provided all processed data, including the applicable legal bases.

The data subject then submitted a complaint at the DPA stating that the controller cannot rely on legitimate interest for processing its email adress as the data subject was a former, not current customer.

Holding

The DPA held that a controller is allowed to rely on legitimate interest to send direct marketing, including former customers under certain conditions, pursuant to Recital 47 GDPR and its Guidance 01/2020 on Direct Marketing (nr. 168).

In its Guidance, it was stated that when there was no relationship between the controller and data subject, or when it goes back a long time, legitimate interest cannot be invoked, as direct marketing is not part of the data subject's reasonable expectations.

The DPA followed that because the relationship between the controller and the data subject ended not that long ago (around two years prior), a contrario, the data subject could reasonably expect that his data would still be used for direct marketing. Hence the controller could use legitimate interest as a legal basis.

In addition, the controller confirmed that the processing for direct marketing is only done up to two years after the cancellation of the service.

The DPA therefore held that the controller did not breach the GDPR and dismissed the case.

Comment

It seems like the Belgian DPA is contradicting itself, as in its Guidance 01/2020 on Direct Marketing, the DPA specifically states that the 'soft op-in' exception for direct marketing is only applicable to current customers.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

1/5

Dispute room

Decision 117/2022 of 26 July 2022

File number : DOS-2021-07812

Subject : Use of data for commercial communication

The Dispute Chamber of the Data Protection Authority, composed of Mr Hielke
Hijmans, sole chairman;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

on the protection of natural persons with regard to the processing of

personal data and on the free movement of such data and revocation of

Directive 95/46/EC (General Data Protection Regulation), hereinafter GDPR;

In view of the law of 3 December 2017 establishing the Data Protection Authority,

hereinafter WOG;

Having regard to the internal rules of procedure, as approved by the Chamber of

Representatives on 20 December 2018 and published in the Belgian Official Gazette on

January 15, 2019;

Having regard to the documents in the file;

Has made the following decision regarding:

The complainant: X, hereinafter referred to as “the complainant”

The controller: Y, hereinafter “the defendant”, Decision 117/2022 - 2/5

I. Facts procedure

1. On 29 December 2021, the complainant shall lodge a complaint with the Data Protection Authority

against the controller.

2. The subject of the complaint concerns the receipt of unsolicited advertising from [...], a

controller brand intended for digitally active customers.

As a result of this, the lower has exercised his right to object with regard to

the controller, as well as requested access to the data concerning him

processed personal data. The complainant indicated that he would like to know in particular
what legal basis is the basis for the processing of his personal data

for commercial purposes.

The controller responded to this within the legal term of 30

days by not only confirming that the complainant will no longer receive marketing information

would receive more, as well as provide an overview of the data processed with

in each case the indication of the legal basis.

The complainant argues that the controller cannot rely on the

legal basis 'legitimate interest' for the processing of his e-mail address for

marketing activities, since the controller only deals with his data

as a former customer, but not as a current customer.

3. On January 13, 2022, the complaint will be declared admissible by the Frontline Service on

pursuant to Articles 58 and 60 WOG and the complaint pursuant to art. 62, 1 WOG

submitted to the Disputes Chamber.

II. Justification

4. On the basis of the elements in the file known to the Disputes Chamber, and on the basis

of the powers conferred on it by the legislator on the basis of Article 95, § 1 WOG

allocated, the Disputes Chamber decides on the further follow-up of the file; in this case

the Disputes Chamber will dismiss the complaint in accordance with Article 95,

§ 1, 3° WOG, based on the motivation below.

5. When a complaint is dismissed, the Disputes Chamber must make its decision
1
step-by-step motivation and:

- to pronounce a technical dismissal if the file is not or not sufficiently

contains elements that could lead to a conviction, or if there is insufficient

1Brussels Court of Appeal, Section Marktenhokamer A, Market Affairs Chamber, judgment 2020/AR/329, 2 September
2020, p. 18., Decision 117/2022 - 3/5

there is a prospect of conviction for a technical impediment,

as a result of which she cannot reach a decision;

- or to declare a policy dismissal, ifdespite the presence of elements

that may lead to a sanction, the continuation of the investigation of the

dossier does not seem appropriate in light of the priorities of the

Data Protection Authority, as specified and explained in the

dismissal policy of the Disputes Chamber . 2

6. In the event that more than one ground is being discarded, the discarded grounds (resp.

technical dismissal and policy dismissal) should be treated in order of importance. 3

7. In the present file, the Disputes Chamber will dismiss the complaint,

on the basis of technical considerations. There is one motive at the basis of the

decision of the Disputes Chamber why it considers it undesirable to follow up further

to the file and therefore decided not to proceed to, inter alia, a treatment against

ground.

8. With regard to the claimant's claim that the use of his e-mail address for direct

marketing purposes is not possible on the basis of the 'legitimate interest' of the

controller, the Disputes Chamber points out that the consent,

but the legitimate interest of the controller as

legal basis applies to process and thus use the complainant's e-mail address

for direct marketing purposes. Recital 47AVGexplicitlydeterminesthatthe

processing of personal data for direct marketing purposes

considered carried out with a view to a legitimate interest (Article 6.1 f) GDPR).

This legal basis also applies in respect of former customers. like this

Data Protection Authority in its Recommendation No. 01/2020 of 17 January 2020

regarding the processing of personal data for direct marketing purposes, 5

expressly (in margin no. 168) that when the controller never does any

has had a relationship with a data subject, or this relationship goes back a long time without

that this has meanwhile been followed, the legitimate interest cannot

be invoked, because the receipt of a direct marketing message does not belong to the

2 In this regard, the Disputes Chamber refers to its dismissal policy as set out in detail on the GBA's website:
https://www.dataprotectionauthority.be/publications/sepotbeleid-van-de-geschillenkamer.pdf
3
cf. Title 3 – In which cases is my complaint likely to be dismissed by the Disputes Chamber? from the
dismissal policy of the Disputes Chamber.
41.The processing is only lawful if at least one of the following conditions is met:

a) the data subject has consented to the processing of his/her personal data for one or more specific
purposes;

[…]
f) the processing is necessary for the purposes of the legitimate interests pursued by the
controller or of a third party, except where the interests or fundamental rights and
freedoms of the data subject that require the protection of personal data outweigh those interests, with
especially when the person concerned is a child.

5https://www.dataprotectionauthority.be/publications/aanbeveling-nr.-01-2020.pdf, Decision 117/2022 - 4/5

reasonable expectations of the data subject. However, in the present case, the

the complainant only canceled his subscription in 2019, so not so long ago in view of the

facts dating back to 2021, so it can be argued a contrario that the complainant

former customer could reasonably expect his data to be immediately

marketing would be used. In addition, the controller has

confirmed to the complainant that the data of former customers after the termination of the

contract can only be processed for a maximum period of 2 years for

marketing activities. The complainant himself states that he is a former customer of the

controller, so that it can use the complainant's data for

advertising purposes, such as in this case for the launch and offer of a new digital
brand that is under the control of the controller, even if the

the complainant never made use of the new telecom brand.

9. On the other hand, the controller must comply with

the objection that can be made by the data subject at any time against the

processing of personal data concerning him, without the data subject having to do so
6
must provide some justification (Article 21.2 AVG and Article 21.3 AVG). The

controller has within the period of one month after receipt of

the complainant's request (Article 12.3 GDPR) to stop sending direct marketing messages
received, followed by confirmation of the deletion of the

personal data of the complainant.

10. The Disputes Chamber decides that the controller has no infringement

committed to Article 6.1 of the GDPR. In addition, the controller has within the

legal period of one month, appropriate action has been taken on the complainant's request

because he was provided with the requested information, as well as his e-mail address no longer
is used for direct marketing purposes, so that no infringement was committed

committed to Article 12.3 AVG in conjunction with Article 15 AVG and Article 21.2 and 21.3 AVG.

III. Publication and communication of the decision

11. Given the importance of transparency with regard to the decision-making of the

Litigation Chamber, this decision is published on the website of the

Data Protection Authority. On the other hand, it is not necessary for the
identifiers of the parties are disclosed directly.

6See in that regard also Recital 70 of the GDPR: When personal data is processed for direct
marketing, the data subject, whether it concerns initial or further processing, should have the right to
always have an objection free of charge to this processing, including in the case of profiling insofar as this
relates to direct marketing. That right must be expressly, clearly and separately from other
information, be brought to the attention of the data subject., Decision 117/2022 - 5/5

12. In accordance with its disclaimer policy, the Dispute Chamber will make the decision to the defendant
7
to transfer . After all, the Disputes Chamber has decided to cancel its dismissal decisions

to notify the defendants ex officio. However, the Disputes Chamber waives

such notice when the complainant has requested anonymity with regard to

of the defendant and the notification of the decision to the defendant, even if

it is pseudonymised, nevertheless makes it possible to

8
(re)identify . However, this is not the case in the present case.

FOR THESE REASONS,

the Disputes Chamber of the Data Protection Authority decides, after deliberation,

to dismiss the present complaint on the basis of Article 95, § 1, 3° of the WOG.

Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the

notice against this decision, an appeal may be lodged with the Marktenhof (court of

profession Brussels), with the Data Protection Authority as defendant.

Such an appeal may be lodged by means of a petition against the contradiction that the
9
the statements listed in article 1034ter of the Judicial Code should contain .It

adversarial petition must be submitted to the registry of the Marktenhof

in accordance with article 1034quinquies of the Ger.W. , or via the e-Deposit

IT system of Justice (Article 32ter of the Ger.W.).

To enable the complainant to consider other possible remedies, the

Disputes Chamber the complainant to the explanation in its dismissal policy. 11

(get.) Hielke HIJMANS

Chairman of the Disputes Chamber

7Cf. Title 5 – Will the dismissal of my complaint be published? Will the counterparty be notified?

of the Disputes Chamber's dismissal policy.
8Ibid.

9The petition states, on pain of nullity:
1° the day, month and year;
2° the surname, first name, place of residence of the applicant and, where appropriate, his capacity and his national register or

company number;
3° the surname, first name, place of residence and, where applicable, the capacity of the person to be
summoned;
4° the subject matter and the brief summary of the grounds of the claim;
5° the court before whom the claim is brought;
6° the signature of the applicant or of his lawyer.

10The application with its annex, in as many copies as there are interested parties, shall be sent by registered letter
sent to the clerk of the court or deposited at the clerk's office.
11
cf. Title 4 – What can I do if my complaint is closed? of the Disputes Chamber's dismissal policy.

@@ Line 79: / Line 79: @@
 === Holding ===
-The DPA held that a controller is allowed to rely on legitimate interest to send direct marketing, including former customers under certain conditions, pursuant to [[Recital 47 GDPR]] and its Guidance 01/2020 on Direct Marketing (nr. 168).
+The DPA held that a controller is allowed to rely on legitimate interest to send direct marketing, including former customers under certain conditions, pursuant to Recital 47 GDPR and its Guidance 01/2020 on Direct Marketing (nr. 168).
 In its Guidance, it was stated that when there was no relationship between the controller and data subject, or when it goes back a long time, legitimate interest cannot be invoked, as direct marketing is not part of the data subject's reasonable expectations.