APD/GBA (Belgium) - 151/2022

APD/GBA - 151/2022
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Artikel 100, §1, 4, van de WOG
Type:	Other
Outcome:	n/a
Started:	14.09.2022
Decided:
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	151/2022
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Dutch
Original Source:	GBA (in NL)
Initial Contributor:	n/a

The Belgian DPA reached a settlement in 8 decisions with various controllers (press organisations) regarding the use of cookies on their website. The controllers committed to pay €10,000 and to abide by the terms of the settlement. The settlement decisions are without recognition of a violation by the DPA or the controllers and without prejudice for data subjects to go to court. Because of one of these settlements, the DPA closed the proceedings in two other decisions because it had already agreed to a settlement with the controller regarding its use of cookies.

English Summary

Facts

In decision 151/2022, a press organisation (controller) used cookies on its website. The inspection service of the DPA reported the following observations regarding these cookies:

• 'placement of non-essential cookies before consent was given'

• 'lack of choice'
• 'further browsing'
• 'disclaimer for third party cookies'
• 'lacking information'
• 'impossibility to withdraw consent'

Further context regarding these observations was not provided in this decision.

This decision is one of the 10 cases opened by the Belgian DPA on "Cookie on press websites". See under "Comment" Section.

Holding

The Belgian DPA came to a settlement agreement with the controller pursuant of Article 100(1)(4), WOG (Law establishing the data protection authority). According to the DPA, the settlement was suggested because of the large amount of cases that still needed to be decided. This settlement only covers the facts, the period and technical context as described in the investigation report, which was not disclosed.

Terms of the settlement

The controller agreed to pay €10,000 and agreed to comply with the terms of the settlement. The DPA did not make any determination about the existence of a violation and formally closed the procedure.

The controller accepted the settlement without adverse recognition. This acceptance of the settlement proposal could also not be used as an aggravating circumstance in determining sanctions in any future proceedings at the DPA. On the other hand, the controller was not allowed to pursue any further (civil) action with regard to this settlement. As an example, the DPA stated that any ‘negative communication’ from the controller with regard to this settlement was not allowed (It is not clear what the DPA meant with 'negative communication').

Should the controller not respect the settlement agreement, the DPA still had the possibility to revoke the settlement and resume the handling of the case.

Comment

This decision is one of the 10 cases opened by the Belgian DPA on the use of cookies on press websites. Two of these cases were already decided on the merits and resulted in €50,000 fines for each controller (see decisions 85/2022 and 103/2022).

The other 7 cases involved different controllers and also resulted in settlements of €10,000. Whereas all decisions are almost identically written, different potential violations were mentioned by the inspection services in each case.

The 8 settlement cases (including this decision) will be outlined below:

• 150/2022: Controller: IPM Group NV, for the use of cookies on the websites of La DH en La Libre (Decision of 21 October 2022)
  • (150/2022 is the only decision where the settlement agreement was not attached to the decision).

• 151/2022: Controller: IPM Group NV, for the use of cookies on the website of L'Avenir (This decision) (Decision of 21 October 2022)
  • Potential violations regarding cookies:
    • 'placement of non-essential cookies before consent was given'
    • 'lack of choice',
    • 'further browsing',
    • 'disclaimer for third party cookies',
    • 'lacking information'
    • 'impossibility to withdraw consent'.

• 153/2022: Controller: DPG Media NV, for the use of cookies on the websites of HLN, De Morgen, VTM en 7 sur 7 (Decision of 4 November 2022)
  • Potential violations regarding cookies:
    • 'Statistical cookies without consent'
    • 'lacking information'
    • 'unjustified storage periods of cookies'
    • 'failure to comply with withdrawal of consent'
  • Period covered by the settlement disclosed: 25 May 2018 until 20 November 2020.

• 154/2022: Controller: Mediahuis NV, for the use of cookies on the websites of Het Nieuwsblad, De Standaard, Gazet van Antwerpen en Het Belang van Limburg. (Decision of 4 November 2022)
  • Potential violations regarding cookies:
    • 'placement of not strictly necessary cookies before obtaining the permission'
    • 'pre-ticked boxes for partners'
    • 'use of third-party cookies without consent'
    • 'lacking information'
    • 'unjustified storage periods of cookies'
    • 'failure to comply with withdrawal of consent'

• 155/2022: Controller: VRT: or the use of cookies on the websites of VRT (Decision of 4 November 2022)
  • Potential violations regarding cookies:
    • 'Placement of not strictly necessary cookies before consent was obtained'
    • 'Statistical cookies without consent'
    • 'Inadequate cookie policy'
    • 'Unjustified storage periods of cookies'
    • 'Non-compliance with the withdrawal of consent'

• 156/2022: Controller: Mediafin NV, for the use of cookies on the website of De Tijd (Decision of 4 November 2022)
  • Potential violations regarding cookies:
    • 'Placement of not strictly necessary cookies before consent was obtained'
    • 'Social Network cookies and Statistical cookies without consent'
    • 'lacking cookie policy'
    • 'Unjustified storage periods of cookies'
    • 'Non-compliance with the withdrawal of consent'
  • Period covered by the settlement disclosed: 25 May 2018 until 30 November 2020.
  • Possible violations as part of the settlement disclosed: Possible violations of Law of 13 June 2005 (WEC - Wet elecktronische communicatie) as well as possible GDPR violations with regard to cookies.

• 157/2022: Controller: RTL Belgium NV, for the use of cookies on the RTL website (Decision of 4 November 2022)
  • Potential violations regarding cookies:
    • 'Placement of cookies not strictly necessary before consent was obtained'
    • 'Statistical cookies without consent'
    • 'Pre-ticked boxes for partners'
    • 'Inconsistent information about cookies'
    • 'Unjustified storage periods of cookies'
    • 'Withdrawal of consent not respected'
  • Period covered by the settlement disclosed: 25 May 2018 until 11 November 2020.
  • Possible violations as part of the settlement disclosed: Possible violation of Article 129 of Law of 13 June 2005 (WEC - Wet elecktronische communicatie) as well as possible GDPR violations, especially but not limited to Articles 4, 5, 6, 7, 13, 14, 25 GDPR, in all matters relating to cookies.

• 168/2022: Controller: RTBF, for the use of cookies on the RTBF website (Decision of 22 November 2022)
  • Potential violations regarding cookies:
    • 'Audience measurement cookies without consent'
    • 'Possibility to continue browsing with the addition of cookies linked to the functionalities requested by the user'
    • 'Social network cookies 'pre-checked' in the consent'
    • 'Unjustified cookie retention times'
    • 'Withdrawal of consent not respected'
  • Period covered by the settlement disclosed: 25 May 2018 until 11 November 2020.
  • Possible violations as part of the settlement disclosed: Possible violations of Law of 13 June 2005 (WEC - Wet elecktronische communicatie) as well as possible GDPR violations with regard to cookies.

• In two separate complaints, data subjects complained, among other things, about the use of cookies on the website of the same controller (see summaries of decisions 169/2022 and 170/2022). However, the DPA closed both procedures pursuant of Article 100(1)(1) WOG, specifically with regard to the facts relating to cookies, because the DPA had already agreed to a settlement with this controller regarding the use of cookies on its website (This settlement decision is 168/2022, see above). The DPA closed the procedure in decision 169/2022 completely, while in decision 170/2022, the DPA closed the procedure for facts which were covered by the settlement. For the other parts of the data subject's complaint, the DPA stated that it would continue to investigate the facts.

Remark

It remains unclear whether the actual complainants or the future complainants would have to go to the Court of appeal if the subject-matter of their complaint is covered by the settlement. That would be a huge burden for the data subject to enforce their rights if the DPA would deny to handle the complaint on the basis of a settlement about which the complainant would not have a say. Since the potential violations are not even specified in the decision, and the conditions of the settlement regarding the compliance of the website, it remains difficult to know what changes were made and accepted by the DPA in terms of cookies by the website. This lack of transparency is an obstacle for the users to have a clear position from the BE DPA on the compliance of cookies policy. Besides, it seems that in Belgium you can get away with murder just by paying a fee and commit to be silent about this.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

1/8




                                                                           Litigation room


                                                           Decision on the substance 151/2022

                                                                      of October 21, 2022




File number : DOS-2020-03297


Subject: use of cookies on the L'Avenir website




The Disputes Chamber of the Data Protection Authority, consisting of Mr. Hielke
Hijmans, chairman;


Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

on the protection of natural persons with regard to the processing of

personal data and on the free movement of such data and revocation of
Directive 95/46/EC (General Data Protection Regulation), - hereinafter GDPR;


Having regard to the law of 3 December 2017 establishing the Data Protection Authority,

hereafter WOG;

Having regard to the rules of internal order, as approved by the Chamber of

Representatives on 20 December 2018 and published in the Belgian Official Gazette on 15

January 2019;


Having regard to the documents in the file;

In view of the settlement proposal submitted to the party on September 14, 2022, which if

appendix is attached to this decision and forms an integral part thereof;



Made the following decision regarding:


The party: IPM Group NV, [...], represented by master Frédéric DECHAMPS. Decision on the merits 1512022 - 2/8


I. Procedure prior to the basis of decision:


 1. In the present case concerning IPM Group NV, on September 14, 2022 a

       settlement proposal to this party. The full contents of the letter with this

       settlement proposal is attached to this decision.

 2. On September 26, 2022, the party submits a letter to the registry of the Disputes Chamber with

       it contains a request for amendment of the proposed conditions in the settlement proposal.

 3. On 5 October 2022, an answer will be given to this request to amend the

       requirements. The request is rejected.

 4. On October 10, 2022, the party will deliver a letter to the registry of the Disputes Chamber in which

       it declares that it formally and expressly accepts the settlement proposal.


 5. Given the express acceptance of the party, then on October 10, 2022, a
       settlement reached. The present decision formalizes this settlement.




II. Terms of settlement


 6. The terms of the settlement are identical to those in the letter containing the settlement proposal

       of 14 September 2022. Therefore, the Annex forms an integral part of that proposal

       from the present decision. The terms of this proposal are set out below in it

       in brief.

 7. The findings made by the Inspection Service of the Data Protection Authority

       in the context of this case, and the possible infringements that may be related thereto

       will no longer be dealt with by the Disputes Chamber. The

       scope of this settlement is thus intrinsically limited to the elements of the case, such as
       indicated in the settlement proposal, which contains the following sentence: "The settlement proposal

       therefore concerns the facts, the period and the (technical) context, as described in the

       inspection report; the facts that do not relate to this period and this context

       are therefore not covered by this settlement. .." The party pays an amount of

       10,000 euros to the Belgian treasury and meets the terms of the settlement.




III. Publication of the decision


 8. Given the importance of transparency with regard to decision-making by the
       Litigation Chamber, this decision will be published on the website of the

       Data Protection Authority. Decision on the merits 1512022 - 3/8







     FOR THESE REASONS,


     the Disputes Chamber of the Data Protection Authority decides, after deliberation:


     - Pursuant to Article 100, §1, 4, of the WOG, to declare the settlement valid as it is

         accepted by the party on October 10, 2022, subject to the provisions of this decision and her

         conditions included in the appendix.





An appeal can be lodged against this decision on the basis of Article 108, §1, of the WOG

at the Marktenhof (Brussels Court of Appeal), within a period of thirty days from the

notification thereof, with the Data Protection Authority as the defendant.


Such an appeal can be lodged by means of an interlocutory application dated

must contain the information referred to in Article 1034 ter of the Judicial Code . It 1

interlocutory petition must be submitted to the Registry of the Market Court

in accordance with article 1034 quinquies of the Ger.W. , or via the e-Deposit information system

of the Ministry of Justice (Article 32 ter of the Ger.W.).









(get.) Hielke H IJMANS


Chairman of the Litigation Chamber

















1
 The petition states, under penalty of nullity:
 1° the day, month and year;
 2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his
     national register or company number;
 3° the surname, first name, place of residence and, where appropriate, the capacity of the person to be

     summoned;
 4° the object and brief summary of the means of the claim;
 5° the court before which the action is brought;
 6° the signature of the applicant or his lawyer.
2
 The application, with the attachment, will be sent in as many copies as there are parties, by registered letter to the Registrar
sent by the court or deposited with the clerk's office. Decision on the merits 1512022 - 4/8







        Litigation Chamber REGISTERED



                                                         For the attention of IPM Group NV, [...]



                                                         With Mr. Frédéric DECHAMPS and Mr. Nathan as counselors
                                                         VANHELLEPUTTE, whose office is located in [...]



                                                         By email : […]




                                                         Defendant


Secretariat

T: +32 (0)2 274 48 56
Email: litigationchamber@apd-gba.be









      Your reference Our reference Attachment(s) Date

      / DOS-2020-03297 14/09/2022
                                                               0




     Subject: settlement proposal in the case "Use of cookies on the website of L'Avenir"



     Dear Sir / Madam,



     Given the large number of files waiting to be dealt with by the Litigation Chamber, with

     long processing times for all files, the Disputes Chamber has, pursuant to

     article 100, §1, 4° of the Law establishing the Data Protection Authority (“WOG”), 3

     decided to propose a settlement in the above-mentioned case by means of this letter (


     “settlement proposal”).



     The settlement proposal fits in a context in which two of the ten files are related

     with the present dossier (the ten so-called “cookies on press sites” dossiers).

     led to a decision on the merits, in which the Disputes Chamber found infringements that

     twice led to the imposition of an administrative fine of EUR 50,000. 4




     3
      BS, January 10, 2018.
     4 See decision 85/2022 of 25 May 2022 of the Litigation Chamber, available at
     https://www.dataprotectionauthority.be/publications/besluit-ten-gronde-nr.-85-202ziedf; Decision Substantive decision 1512022 - 5/8




This settlement proposal is made without any prejudicial recognition and binds the Litigation Chamber

not as to any position it might take if this proposal were to be made

turned down.



If the party to whom the settlement proposal is made expressly rejects this proposal,

the Disputes Chamber will continue the proceedings on the merits and will deal with the case in a different manner

deal with it through a settlement. If it determines that infringements have been committed, it will use

to make use of the sanctioning powers it has under European law and the 5

Belgian law have been granted .6



    a) L'Avenir under the responsibility of Nethys, and then IPM Group


On December 21, 2020, the Disputes Chamber has an invitation to close in this case

sent to Nethys NV, of which Les Editions Vers l'Avenir Presse BV a

subsidiary when the inspection report was added to the administrative one

file of the Litigation Chamber (attached for information).



In response to this letter, IPM NV informed us of the

fact that Les Editions Vers l'Avenir BV had been taken over by IPM Group since October 14, 2020.

IPM NV has conclusions for its subsidiary Les Editions de l'Avenir presse BV

submitted. For that reason, the Disputes Chamber addresses this proposal directly to IPM NV.




    b) Procedural status of the settlement proposal


The settlement proposal submitted here precedes the deliberation phase on the

infringements that may have been committed in this case. In that sense, the Dispute Chamber holds in her

settlement proposal only takes into account the findings stated in the

Inspection report from the Data Protection Authority, without the accuracy of this one

findings yet to be investigated.



Since the procedure before the Disputes Chamber of the Data Protection Authority is not

can be equated with the procedure of criminal law, "the settlement" in which is

provided for by the Belgian legislator under Article 100, §1, 4°, of the WOG





103/2022 of June 16, 2022, only available in French at:
https://www.dataprotectionauthority.be/publications/besluit-ten-gronde-nr.-103-2022.pdf.
5See Article 58 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and freedom
movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).

6See also article 100 of the WOG. Decision on the merits 1512022 - 6/8


                                                                          7
equated with the “amicable settlement” of criminal law. The settlement within the meaning of the WOG

has a sui generis character.



In the first place, the Litigation Chamber hic et nunc does not rule on the existence of

possible infringements, even if the procedure is in the “substance” phase of the treatment

in accordance with articles 98 and 99 of the WOG. The Litigation Chamber uses the hair


expressly granted authority to formulate a settlement proposal, as well

is possible in a case of a "settlement" in criminal matters.



The Disputes Chamber also states the precise facts, in time and space, on the basis of which it

settlement proposal is made (infra). Although the Litigation Chamber is, as stated above,

does not pronounce hic et nunc on the existence of infringements, it must submit the settlement proposal

nevertheless formulate it on the basis of the facts stated in the file. The amount that the


After all, the Litigation Chamber proposes to pay the party must be in proportion to the nature of the dispute

the possible infringements. The settlement proposal therefore concerns the facts, the period and (technical)

context, as described in the inspection report; the facts that do not relate to this

period and this context are therefore not covered by this settlement. 8



     c) Findings by the Inspectorate that relate to the settlement proposal




In this case, the inspections were carried out by the Inspection Service of the Data Protection Authority

findings that the Disputes Chamber takes into account - without, however, substantively

pronounce the case - the following: 9

     - "Statement 1: installation of non-strictly necessary cookies before consent was given

         obtained" 10

                                                   11
     - "Finding 2: Lack of choice"
                                                                12
     - "Assessment 3: use of further browsing"
                                                                       13
     - "Finding 4: disclaimer for third party cookies"

     - "Finding 5: Inadequate information 14




7See in particular articles 216 bis and 216 ter of the Code of Criminal Procedure (“CPC”) regarding the expiry of the

criminal proceedings for some crimes under certain conditions (respectively the payment of a sum of money, and the
implementation of measures and compliance with conditions).
8In this sense, the ne bis in idem principle does not apply to facts falling outside its scope.

9 The Litigation Chamber takes full account of the additional investigation report of the Inspectorate of 30
November 2020 in DOS-2020-03297.
10
  Report of the Inspectorate of the Data Protection Authority of 7 October 2020 in file DOS-2020-03297
(“Inspection Report”), pp. 13-4.
11Inspection Report, pp. 14-5.

12Inspection Report, pp. 15-6.
13
  Inspection report, pp. 16-7.
14Inspection report, pp. 17-8. Decision on the merits 1512022 - 7/8


                                                                        15
    - « Finding 6: impossibility to withdraw consent"



    d) Substantive conditions

In the context of the settlement proposal, the following terms and conditions are accepted by the party in the

procedure accepted:

    - IPM Group undertakes to pay an amount of EUR 10,000 to the

        Belgian treasury, in accordance with the terms determined by the Federal
                                   16
        Government Finance Department. IPM Group waives any civil or other action in connection therewith

        related to the Settlement, such as, but not limited to, negative communications

        with this settlement;

    - The Litigation Chamber finds no infringement by IPM Group and formally closes the procedure

        with its settlement decision, to the extent that IPM Group accepts the settlement and the

        comply with its terms;

    - For the Disputes Chamber, the fact that the settlement proposal is accepted does not matter

        confession of the defendant. This acceptance of the settlement proposal can be done with

        not be used as an aggravating circumstance when determining sanctions
                                                                        17
        in any future proceedings before the Dispute Chamber;

    - In case of express acceptance or in the absence of a response from the party to whom

        the settlement proposal is addressed within the period specified below, takes this

        settlement proposal takes the form of a formal decision published on the website of the

        Data Protection Authority is published, stating the name of

        the party.

In the event of non-compliance with the terms of the accepted settlement, the

Litigation Chamber reserves the right to withdraw the settlement decision and this case on a

treat in another way.



    e) Term


IPM Group must within 30 days of receipt of the present settlement proposal

indicate whether or not it will accept this proposal. In the absence of an answer it will

settlement proposal shall be deemed accepted subject to the above conditions.



    f) The existence of other controllers and/or processors






15Inspection Report, page 18.
16Cfr. art. 107 WOG.

17See in particular Article 83(2)(e) of the GDPR in the context of imposing administrative fines when
identify breaches following “previous relevant breaches by the controller or the
processor”. Decision on the substance 1512022 - 8/8



This settlement proposal is only addressed to IPM Group. It takes no position on the question

whether and to what extent other actors are responsible for possible violations that give rise

have given to this settlement proposal.


    g) Settlement Validation


In the event that the settlement proposal results in a formal settlement decision by the

express acceptance or the lack of response within the aforementioned period of the

party to whom the settlement proposal is addressed may be appealed by the "aggrieved party".
              18
registered.

The final settlement does not affect the rights of any individuals (in this case, the

case not based on a complaint) who have suffered damage, to a civil court

claim damages, in particular pursuant to Article 82 of the GDPR.







Yours faithfully,









(get). Hilke Hijmans

Chairman of the Litigation Chamber























18An appeal against this decision can be lodged with the Marktenhof (Court of Appeal of
of appeal of Brussels), within a period of thirty days from the express acceptance or the lack of response
within the aforementioned period, with the Data Protection Authority as the defendant.


Such an appeal may be lodged by means of an interlocutory application that contains the
Judicial Code must contain said information. The interlocutory petition must be submitted to the Registry of the Market Court
be submitted in accordance with article 1034 quinquies of the Ger.W., or via the e-Deposit information system of the
Ministry of Justice (Article 32 ter of the Ger.W.).