APD/GBA (Belgium) - 169/2022

APD/GBA - 169/2022
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 100(1)(1) WOG
Type:	Complaint
Outcome:	Rejected
Started:	05.07.2018
Decided:	22.11.2022
Published:
Fine:	n/a
Parties:	RTBF
National Case Number/Name:	169/2022
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	French
Original Source:	GBA (in FR)
Initial Contributor:	n/a

The Belgian DPA closed the procedure in this decision because in a prior decision, the DPA and the press organisation had agreed to a settlement regarding the use of cookies on the website of the press organisation.

English Summary

Facts

The data subject filed a complaint at the Belgian DPA on July 2018, because of a lack of consent for the processing of personal data by a press organisation (controller), which used cookies on its website. The investigation service of the DPA started an investigation into the controller. The investigation service found that the controller placed (third party) cookies on the data subjects device before the data subject had given consent. If the data subject wished to refuse third party cookies, the data subject had to use an opt-out mechanism on the website of the third pary in question. Also, non-essential cookies were already placed on the data subject’s device at the launch of the homepage, without consent from the data subject. These cookies included targeted advertising and social network cookies.

However, in decision 168/2022, the DPA had agreed to a settlement with the same controller. This settlement included potential infringements of the Act of 13 June 2005, as well as potential infringements of the GDPR with regard to cookies and, more generally, the storage and consent to the placement and further processing of information on the data subjects device. The settlement covered possible violations in the period between 25 May 2018 to 20 November 2020.

Holding

The DPA determined that the settlement decision (168/2022) was addressed to the same controller as the controller of the present decision. The DPA also found that the settlement in decision 168/2022 covered issues raised by the data subject in this complaint. Also, the complaint of the data subject fell within the same period covered by the settlement (25 May 2018 until 11 November 2020).

Therefore, the DPA determined that it could not take action with respect to potential violations regarding the complaint by the data subject. The DPA also considered violations after 11 november 2022, which were not covered by the settlement. However, The DPA concluded that there were no indications after 11 November 2020 that supported the complaint made by the data subject. The DPA closed the procedure on technical grounds pursuant of Article 100(1)(1) WOG.

Comment

This decision (169/2022) is a consequence of a settlement decided in decision 168/2022 by the Belgian DPA. Decision 168/2022 is one of the 10 cases opened by the Belgian DPA on "Cookie on press websites". For a detailed summary and some context for all of these decisions, click this link.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/7





                                                                        Litigation Chamber


                                      Decision on the merits 169/2022 of 22 November 2022





File number: DOS-2018-03810


Subject: Complaint relating to the use of cookies on the RTBF website


The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke

Hijmans, chairman, and Messrs. Dirk Van Der Kelen and Christophe Boeraeve, members;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and

to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the

data protection), hereinafter "GDPR";

Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter

ACL);


Having regard to the internal regulations as approved by the House of Representatives on 20

December 2018 and published in the Belgian Official Gazette on January 15, 2019;

Considering the documents in the file;


Having regard to decision 168/2022 of November 22, 2022 of the Litigation Chamber;


Made the following decision regarding:



The plaintiff: Mr. X, hereinafter “the plaintiff”;



The defendant: The Belgian Radio Television of the French Community (RTBF), a company
                    autonomous public of a cultural nature,



                    Hereinafter “the RTBF” or “the defendant”;



                    Counsel Peter Craddock, Decision on the Merits 169/2022 - 2/7


I. Facts and procedure


 1. On July 5, 2018, the complainant lodged a complaint with the Data Protection Authority

       data (APD) against the defendant.


 2. In the terms of his complaint, the complainant alleges the irregularity of the processing (collection and

       further processing(s) of its data by the defendant via cookies taking into account
       lack of consent on his part. Beyond his personal situation, the complainant

       generally denounces the unlawfulness of such processing.


 3. On July 25, 2018, the complaint was declared admissible on the basis of Articles 58 and 60 of the ACL
                                                                                            er
       and the complaint is forwarded to the Litigation Chamber under Article 62, § 1 of the LCA.

       The complainant was informed of this on July 26, 2018.

 4. On November 14, 2018, the Litigation Chamber decides to request an investigation from the

       Inspection Service, pursuant to articles 63, 2° and 94, 1° of the LCA.

 5. On November 21, 2018, in accordance with Article 96, § 1 of the LCA, the Chamber's request

       Litigation to proceed with an investigation is forwarded to the Inspection Service (IS). the

       complainant is informed on the same date.


 6. On 26 June 2019, the investigation by the Inspection Service was closed, the report was attached to the file

       and this is forwarded by the Inspector General to the President of the Litigation Chamber
                  er
       (Art. 91, § 1 and § 2 of the LCA).

 7. According to its report, the IS notes that cookies, in particular from third parties,

       are deposited before the user has given his consent and only if the user

       wishes to refuse commercial cookies, he must do so by means of an opt-in mechanism.

       out on a third-party site. The IS concludes that the technical analysis shows only cookies

       non-essentials are placed at the launch of the homepage of the website https://www.rtbf.be
       although no consent has yet been given by the user. These cookies contain

       including advertising targeting and social network cookies.

                                                                                             er
 8. On July 3, 2019, the Litigation Division decided, pursuant to Article 95, § 1, 1° and

       article 98 of the LCA, that the case can be dealt with on the merits.

 9. On July 24, 2019, the parties concerned are informed by registered letter of the

       provisions as set out in article 95, § 2 as well as in article 98 of the LCA. They are

       also informed, pursuant to Article 99 of the LCA, of the deadlines for transmitting their

       conclusions, i.e. September 6, 2019 for the complainant and October 7, 2019 for the

       defendant.

 10. Respectively on July 29 and August 14, 2019, the Respondent and the Complainant request

       a copy of the file (art. 95, §2, 3° LCA), which is sent to them respectively on 30

       July and August 22, 2019. Decision on the merits 169/2022 - 3/7



 11. On August 27, 2019, the Litigation Chamber received the complainant's submissions in response.

 12. On October 7, 2019, the Litigation Division receives the submissions in response from the

       defendant.




II. Motivation


13. Under Article 100 LCA, the Litigation Chamber has the power to:


    1° dismiss the complaint without follow-up;

    2° order the dismissal;

    3° order a suspension of the pronouncement;

    4° propose a transaction;

    (5) issue warnings or reprimands;

    6° order to comply with requests from the data subject to exercise these rights;

    (7) order that the person concerned be informed of the security problem;

    8° order the freezing, limitation or temporary or permanent prohibition of processing;

    9° order the processing to be brought into conformity;

    10° order the rectification, restriction or erasure of the data and the notification of

    these to the recipients of the data;

    11° order the withdrawal of accreditation from certification bodies;
    12° to issue periodic penalty payments;

    13° to impose administrative fines;

    14° order the suspension of cross-border data flows to another State or a

    international body;

    15° forward the file to the public prosecutor's office of the Brussels Court, who informs it of the follow-up

    data on file;

    16° decide on a case-by-case basis to publish its decisions on the website of the Protection Authority

    Datas



14. When a complaint is forwarded to it by the First Line Service (SPL) which declared it

    admissible, or by the IS after an investigation report as in the present case, the Chamber

    Litigation will first examine whether it is technically possible to render a decision

    with regard to said complaint. Otherwise, this complaint will necessarily be closed.

    not followed up for technical reason .1






1
   See. the dismissal policy note of the Litigation Chamber, point 3.1.
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
litigation.pdf Decision on the merits 169/2022 - 4/7



15. In support of the arguments which follow and on the basis of the powers conferred on him

    granted by the legislator under section 100.1. of the LCA, the Litigation Chamber
    decides to proceed with the dismissal of the complaint in accordance with article 100.1., 1° of

    the ACL.


16. In matters of dismissal, the Litigation Chamber must justify its decision by

    step and:


    - to pronounce a classification without technical continuation if the file does not contain or not

        sufficient elements likely to lead to a sanction or if it includes a

        technical obstacle preventing him from rendering a decision;



    - or pronounce a classification without continuation of opportunity, if in spite of the presence of elements

        likely to lead to a sanction, the continuation of the examination of the file does not seem to him

        timely given its priorities.


17. If the dismissal takes place on the basis of more than one reason (respectively technical or

    opportunity), the reasons for dismissal must be dealt with in order

    important.

18. In the present case, the Litigation Chamber issues a decision without any technical follow-up

    application of Article 100.1., 1° of the LCA on the basis of the reasoning which follows (points 19 to 27).


19. On November 22, 2022, the Litigation Chamber took decision 168/2022 with regard to the

    defendant. Pursuant to this decision, the Litigation Chamber adopted, with regard to

    facts identical to those denounced by the complainant, one of the measures listed in Article 100.1 of the

    LCA mentioned above, i.e. a transaction (article 100.1.4° LCA).


20. Said settlement decision 168/2022 extends “to potential infringements under the law of 13

    June 2005 (in force at the time of the findings of the APD Inspection Service in the
            2
    file), as well as potential violations of the General Data Protection Regulation.
    data (GDPR), with regard to cookies and, more generally, the storage and

    consent to the placement and further processing of information on the device of

    the user as a data subject. The transaction decision relates to the websites

    involved and mentioned in the file and concerns the party to which the proposal of

    transaction is addressed”.







2The settlement decision comes in the context of an own initiative investigation carried out by the Inspection Service on the
problem of data processing via cookies in the Belgian media sector, including those operated by the
defendant.

3Point 19 of decision 168/2022 of the Litigation Chamber. Decision on the merits 169/2022 - 5/7



21. This settlement decision 168/2022 is addressed to the same party as the defendant of the

    this decision, or to RTBF.


22. The object of the transaction also relates, as has just been mentioned, to “the infringements

    potential GDPR, with regard to cookies and, more generally, the storage and

    consent to the placement and further processing of information on the device of

    the user as a data subject”. The settlement thus covers the grievances raised

    by the complainant under the terms of his complaint as recalled in point 2 above.


23. Finally, Decision 168/2022 specifies that “the transaction relates only to a specific period:
                                                                 4
    the period from May 25, 2018 to November 11, 2020”, i.e. the date of submission of the last

    IS report in said file.


24. Within the limits of this decision 168/2022, the Litigation Chamber has thus exhausted its referral

    as to the facts denounced by the complainant and as to the corresponding grievances. Bedroom

    Contentious therefore dismisses the plaintiff's complaint for technical reasons and this, in

    the same material and temporal limits.


25. Decision 168/2022 specifies in the same way that “the transaction exhausts the powers of the

    Litigation Chamber to take corrective measures in respect of infractions

    within the limits of the legal elements and provisions described above and in the

    transaction proposal, as well as within the period [read the period] referred to above. The

    Chambre Litieuse emphasizes that the transaction does not affect the powers of the courts and

    courts nor those of other authorities to examine infringements where appropriate. The

    transaction in this case binds only the Litigation Chamber of the Authority of
                                     5
    Belgian data protection”.

26. As mentioned above, the object of the transaction formalized in the decision

    168/2022 is limited to the period from May 25, 2018 to November 20, 2020, the date on which the SI has


    closed its findings in the said file, which exceed the date of June 26, 2019 on which the

    SI has closed its investigation initiated following the complainant's complaint (point 6).

27. For the period from November 20, 2020 to date, the Litigation Chamber therefore does not have

    findings that support the grievances invoked by the complainant. For this reason, the Chamber

    Litigation is therefore not in a position to find any breach in the head

    of the defendant and classifies the complaint without follow-up as regards this technical reason also to

    support of criterion A.1. of its classification policy note without follow-up.




4
 Point 20 of decision 168/2022 of the Litigation Chamber.
5Point 21 of decision 168/2022 of the Litigation Chamber.

6In this sense, decision 168/2022, like the present decision to dismiss, leaves intact the competence of
the DPA to decide for the period after November 20, 2020, if it were to be newly seized of it, on
any shortcomings that would persist to this day with regard to the facts denounced by the complaint. Decision on the merits 169/2022 - 6/7



28. With regard to the settlement decision (168/2022) for which it opted as

    decision to close the present complaint without follow-up, the Litigation Chamber recalls that it
    belongs sovereignly as an independent administrative authority - with due respect

    relevant articles of the GDPR and the LCA - to determine the corrective measure(s) and

    appropriate sanction(s).


29. Thus, it is not for the plaintiff to ask the Litigation Chamber to order

    such or such corrective measure or sanction. If, notwithstanding the foregoing, the Complainant

    nevertheless had to ask the Litigation Chamber to pronounce one or the other

    measure and/or sanction, it is therefore not for the latter to justify why it does not

    would not accept one or the other request made by the complainant. These considerations

    leave intact the obligation for the Litigation Chamber to justify the choice of measures and

    sanctions which it deems, (among the list of measures and sanctions made available to it by

    articles 58 of the GDPR and 95.1 and 100.1 of the ACL) appropriate to condemn the complaining party
          7
    cause . In this case, the Litigation Chamber refers to points 19-27 above concerning

    its decision to dismiss the complainant's complaint on a technical ground.

30. In any case, the Litigation Division is not competent to grant

    any damages claimed by the plaintiff. This measure is not

    not provided for by articles 95 and 100 of the LCA under corrective measures and sanctions

    which it is empowered to impose. This prerogative is reserved for the courts and tribunals of the order

    judicial.





III. Publication of the decision


31. Given the importance of transparency with regard to the decision-making process

    and the decisions of the Litigation Chamber, this decision will be published on the website of

    the DPA by deleting the direct identification data of the complainant and the

    named persons, whether natural or legal, excluding the defendant.


32. The Litigation Chamber judges that the identification of the defendant is necessary since

    that this Decision refers to Decision 168/2022 adopted by the Chamber
    Litigation against the defendant and whose operative part (transaction) is the basis of this



7 Litigation Chamber, Decision on the merits 81/2020. See also the note from the Litigation Chamber relating to the
complainant's position (point D. page 4 in fine). https://www.autoriteprotectiondonnees.be/publications/note-relative-a-la-
position-of-the-complainant-in-the-procedure-within-the-litigation-chamber.pdf: “The conclusions of the complainant must
deal with the content of the complaint and not, for example, the nature of the sanction that the Litigation Chamber must impose

according to the complainant. The complainant is of course free to give an opinion on the sanction to be imposed, but the Chamber
Litigation is not obliged to adopt this opinion, nor to refute the arguments of the plaintiff concerning the imposition of the
sanction”. Decision on the merits 169/2022 - 7/7


    classification decision without technical follow-up. The identity of the defendant having been published

    under this decision 168/2022, the omission of the identity of the same defendant in the

    terms of this decision would make no sense. Its explicit mention allows

    overwhelmingly the better understanding and coherence of these two decisions of the

    Litigation Chamber.







    FOR THESE REASONS,


    the Litigation Chamber of the Data Protection Authority decides, after deliberation:


    - to close the complaint without further action under article 100.1.1° of the LCA.







In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged,


within thirty days of its notification, to the Court of Markets (Court

d'appel de Bruxelles), with the Data Protection Authority (DPA) as a party

defendant.

Such an appeal may be introduced by means of an interlocutory request which must contain the

information listed in article 1034ter of the Judicial Code. 8


The interlocutory request must be filed with the registry of the Market Court in accordance with

article 1034quinquies of the C. jud. , or via the e-Deposit information system of the Ministry of

Justice (article 32ter of the C. jud.).









(se). Hielke HIJMANS

President of the Litigation Chamber






8The request contains on pain of nullity:

 (1) indication of the day, month and year;
 2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
     Business Number;
 3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
 (4) the object and summary of the grounds of the application;
 (5) the indication of the judge who is seized of the application;
 6° the signature of the applicant or his lawyer.
9
 The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.