Court of Appeal of Brussels - 2022/AR/953

Hof van Beroep - 2022/1527
Court:	Court of Appeal of Brussels (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 4(11) GDPR Article 6(1)(a) GDPR Article 7(1) GDPR Article 7(3) GDPR Article 12(1) GDPR Article 13 GDPR Article 14 GDPR Article 63(1) LCA
Decided:	22.02.2023
Published:
Parties:	SA Rossel et Cie
National Case Number/Name:	2022/1527
European Case Law Identifier:
Appeal from:	APD/GBA (Belgium) 103/2023
Appeal to:
Original Language(s):	French
Original Source:	GBA (in French)
Initial Contributor:	kv33

The Belgian Market Court annulled a decision of the Belgian DPA, which had fined a large media company €50,000 for multiple GDPR violations regarding cookies. This DPA decision was annulled by the court because the DPA's management board had provided insufficient evidence in its referral to the DPA's investigation service, which was not complaint with Belgian Law.

English Summary

Facts

This ruling is the result by an appeal of a large media company (controller), which was fined €50.000 by the Belgian DPA. (3) For the detailed summary of the facts of this DPA decision, see this link to the full decision (in French) and this link to a detailed summary on GDPRHub (103/2022 - 16 June 2022). Decision 103/2022 by the Belgian DPA was the result of a sector wide investigation by the Belgian DPA regarding the placement of cookies on Belgian media websites. (4)

This investigation officially started on 16 January 2019, when the DPA’s management board took the decision (from here: "The referral") to instruct the DPA’s investigation service to launch a sector enquiry into cookies on Belgian news websites (4). The referral of the management board to the investigation service was described in Article 63(1) LCA (Law establishing the Belgian DPA). Article 63(1) LCA allowed the management board to enquire the investigation service to start an investigation when there were "serious indications of a practice that could give rise to an infringement of the fundamental principles of personal data protection". However, the referral itself did not contain any reference to "serious indications" of potential infringements, or any evidence for that matter.

On 7 March 2019, an handwritten note was drawn up by the investigation service (so, not by the management board (!)) (40) This note contained several reasons for starting the investigation. One of these reasons was the high amount of visitors of the controller's websites.

On 16 June 2022, the DPA issued decision 103/2022 in which it determined that the controller had committed seven GDPR related violations. Among the other violations, the controller violated Article 6(1)(a) GDPR by placing unnecessary cookies on its website without asking for consent first. The controller also violated Articles 4(11), 6(1)(a) and 7(1) GDPR for the collection of consent using the so called "further browsing" technique. This meant that data subjects would automatically consent to receive cookies if they chose to further browse the controller’s website. (8) In the decision, the DPA explicitly stated that the referral itself contained several elements which justified the existence of serious evidence "within the meaning of Article 63(1) of the LCA. As would later be clarified by the court, this turned out to be factually incorrect. No evidence was described in the referral. However, several reasons for starting the investigation were described in the note of the investigation service of 7 March 2019 (see above).

The controller appealed decision 103/2022 at the Market Court in Brussels. Among other grounds of appeal, the controller stated that the initial referral of the DPA’s management committee to its inspection service was irregular. As a result, the decision was also invalid. (10)

Holding

The court determined that it had full jurisdiction to annul and potentially adjust the decision of the DPA. (36) The court also determined that the subject matter of the appeal was the reversal of DPA decision 103/2022, and not the annulment of any act by either the management board or the inspection service. (36 - 37)

The court assessed the documents in the administrative file of decision 103/2022 and confirmed that the management board had taken the decision (the referral) to investigate the controller on 16 January 2019. The referral was the only act by the management board that could qualify as such under Article 63(1) LCA. It was therefore also the only administrative act leading up to decision 103/2022 that was assessed by the Market Court. (39) The court excluded the internal note of the investigation service of 7 March 2019 because it could not be seen as (a part of) the referral, despite the fact that this note contained several reasons why the investigation was initiated. There were two reasons for the exclusion. First, the note was drawn up by the investigation service (and not by the management board). Second, it was drawn up after the official referral had already been sent (16 January 2019). (40)

The court continued by citing Belgian Law (Article 3 of the law of 29 July 1991 for the motivation of administrative acts) and stated that the motivation for administrative acts had to include the factual and legal considerations for taking the decision. (41) The court clarified that any decision had to be supported by actual facts and reasoning. There also had to be a reasonable relationship between the decision and its intended goal. This obligation to motivate an administrative act had to ensure that any defendant was able to defend itself/himself/herself against a decision. (41)

The court also clarified that it was normally not within its power to assess the presence of evidence of a potential infringement under Article 63(1) LCA, except in the case of a blatant disregard for the principles of good administration, or a manifest error of assessment. The court was only allowed a 'regularity and legality' check, which included checking compliance with the requirement to motivate an administrative act, pursuant to Article 3 of the law of 29 July 1991. (43)

The court went on to assess if the referral was compliant with this motivation requirement of Article 3 of the law of 29 July 1991. Specifically, this motivation requirement would obligate the DPA to properly explain why there was 'serious evidence', pursuant to Article 63(1) LCA. The court concluded that the referral itself did in contain any specific arguments for the existence of "serious evidence". Therefore, the DPA had failed to properly motivate its reasons for the referral and failed to disclose its indications for potential infringements, in violation with Article 3 of the Law of 29 July 1991 and Article 63(1) LCA.

The court stated that this failure to motivate the referral had consequences for the legality of decision 103/2022. In this decision, the DPA had incorrectly stated that the referral contained several elements which justified the existence of serious evidence "within the meaning of Article 63(1) of the LCA. This was in fact not the case. Therefore, the contested decision was factually incorrect and had to be annulled according to the court. The DPA was also ordered to pay the costs of the proceedings (€1,800) and a registration fee (€400).

Comment

The court highligted several paragraphs of decision 103/2022 in which the DPA incorrectly stated that the referral contained the reasons for starting the investigation. These were in particular paragraphs 63, 65, 69 and 71.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

Brussels Court of Appeal -2022/AR/953 -p. 2





IN QUESTION:

SA Rossel et Cie (hereafter “Rosse!”), BCE 0403.537.816, whose registered office is located at
1000 Brussels, rue Royale 100,

Requesting Party,


Having as counsel Me Etienne Wéry, lawyer, whose firm is established in [...].

AGAINST:

The Data Protection Authority (hereinafter the "DPA"), BCE0694.679.950, located at 1000
Brussels, rue de laPresse35,


Opposing party

With the advice of My Evrard de Lophem, Grégoire Ryelandt and Clara Delbruyère,
lawyers, whose practice is established [...].

Having regard to the procedural documents and in particular





           the decision rendered by the Litigation Chamber of the Authority for the Protection of
           Data, June 16, 2022 (decision number: 103/2022, file number:
           DOS-2020-02998);


           Rosse's request! filed on July 13, 2022;

       -
           The schedule recorded at the introductory hearing of July 27, 2022;

                           °
           the conclusions n l of Rosse! filed November 30, 2022;


           the summary conclusions of the APD submitted on January 16, 2023;


              the records of exhibits filed by the parties;


Heard the advice of the parties Rossel and APD at the public hearing of January 25, 2023.




             rPAGE 01-00003160840-0 □□2- □□42- □1- □1-� 


                                                                ..J
             I