APD/GBA (Belgium) - 39/2024

APD/GBA - 39/2024
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 80(1) GDPR
Type:	Complaint
Outcome:	Other Outcome
Started:	29.06.2020
Decided:	22.02.2024
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	39/2024
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	French
Original Source:	APD (in FR)
Initial Contributor:	nzm

The DPA considered that an e-reputation consultancy company cannot represent a data subject under Article 80(1) GDPR, as it is for-profit body whose statutory objectives are not in the public interest.

English Summary

Facts

In 2007, the newspaper “La Dernière Heure Les Sports” (“controller”) published an article on their website on the managing director of a company ("data subject") following the death of one of his employees. This article reported that the data subject was found guilty of manslaughter as well as for contravention of legislation on the use of work equipment and on health and safety at work. Adjustments had been made since the accident, so the court decided to suspend the data subject’s criminal sentencing. He was however declared civilly liable and ordered to pay compensation to the parents of the deceased worker.

In 2018 and 2019, the data subject requested the removal of the URL of the article 3 times, using the standard form made available online by the controller for the dereferencing of results. The second and third requests were made by a French e-reputation consultancy company on behalf of the data subject. An e-reputation consultancy company takes care of people's reputation online, in particular by asking the removal of URLs linked to them.

The controller indicated that after considering the balance of interests and rights, they decided not to block the URL.

On 18 June 2020, the e-reputation consultancy company lodged a complaint with the Belgian DPA (“APD”) on behalf of the data subject. The company also attached a mandate received from the data subject which says the following: “I, the undersigned X [read data subject] (...) declare and certify that company X1 [read e-consultancy company] (...) is authorised to represent me on an exclusive basis in relation to publishers and hosts of Internet sites, in order to carry out the assignment entrusted to it”.

The controller asked that the APD consider the complaint inadmissible as it was brought by a company incorporated by French law, thus breaching Article 80(1) GDPR.

Holding

Article 80(1) GDPR states that the data subject has the right to mandate (i) a non-for-profit body, organization or association (ii) which has been properly constituted with the law of a Member state and (iii) has statutory objectives which are in the public interest and is active in the field of data protection, to lodge a complaint on their behalf.

The APD considered that the e-consultancy company is not a non-for-profit body, organization or association and does not have statutory objectives which are in the public interest, as evidenced by the terms and conditions of the company’s website which refer to “the sale of the following services: e-reputation cleansing (request for deletion of URLs) and Serp-Sculpting”, for which different prices are set.

The APD concluded that the company does not fulfill the requirements of Article 80(1) GDPR, and therefore cannot represent a data subject. Thus, the complaint was considered inadmissible.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/10



                                                                        Litigation Chamber


                                       Decision on the merits 39/2024 of February 22, 2024


File number: DOS-2020-02861


Subject: Complaint for refusal of dereferencing by a search engine –

representation of the complainant within the meaning of section 80.1. GDPR



The Litigation Chamber of the Data Protection Authority, made up of Mr.

Hielke HIJMANS, president, and gentlemen Yves Poullet and Jelle Stassijns, members;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the

protection of natural persons with regard to the processing of personal data and

to the free movement of these data, and repealing Directive 95/46/EC (General Regulation on the

data protection), hereinafter “GDPR”;

Having regard to the Law of December 3, 2017 establishing the Data Protection Authority (hereinafter

“LCA”);


Having regard to the Law of July 30, 2018 relating to the protection of individuals with regard to

processing of personal data (hereinafter “LTD”);

Considering the internal regulations as approved by the House of Representatives on

December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;


Considering the documents in the file;


Has taken the following decision regarding:



The complainant: Mr. X1, hereinafter “the complainant”;


                        Represented by Madame X2, e-reputation consultant of the company X3



The defendants: Y1, hereinafter “the first defendant”;



                        Y2, hereinafter “the second defendant”;


                        Hereinafter collectively referred to as “the defendants”; Decision on merits 39/2024 — 2/10


                        Having for advice Master Gerrit VANDENDRIESSCHE,

                        qerrit.vandendriessche@altius.com and Master Louis-Dorsan JOLLY, louis-

                        dorsan.jolly@altius.com, lawyers whose practice is established in 1000 Brussels,
                        avenue du Port 86C, box 414.





I. Facts and procedure

 1. The subject of the complaint filed on June 18, 2020 with the Data Protection Authority (APD)

       speakscomplainantrepresentedbytheFrenchcompanydee-reputationX3,concernstherefusalby

       the first defendant to dereference a depressed article from the newspaper La Dernière Heure

       Les Sports published on this newspaper's website in 2007 under the title “..” […].

 2. This article relates legal facts concerning the complainant. It mentions the name and

       of the first name of the complainant and informs Internet users about his conviction by the

       labor courts in 2007.

 3. Specifically, the article reports that in 2007, the complainant was convicted of

       of involuntary manslaughter due to lack of foresight or precaution, as well as

       contravention of the legislation on the use of work equipment and on signaling

       safety and health at work. This conviction follows the death (…) of a
       worker of the company ... of which the complainant was general manager.


 4. In view of the adjustments made since the accident when adopting its decision and

       in order not to compromise the professional activities of the complainant, the court seized

       decided to suspend the sentencing. As reported in the article by
       press, the complainant was nevertheless declared civilly responsible and was sentenced to

       compensate the parents of the deceased worker.


 5. It appears from the documents in the files transmitted by the defendants and from the documents produced
       by the complainant that before the referral to the APD, the dereferencing of this URL was requested

       3 times from the first defendant, via the standard form made available

       online by the latter for the purpose of dereferencing search results.

 6. Thus, the defendants report that in 2018, the son of the plaintiff, Mr. S.D., introduced

       in the name of his father a first request for dereferencing of the disputed URL. There

       first respondent acknowledged receipt of the request the same day, analyzed and processed

       the request and responded to it the next day, i.e. (…), motivating its response by indicating that it

       had decided not to intervene regarding this URL due to factors such as
       the relevance of it in the context of the professional life of the complainant. Decision on merits 39/2024 — 3/10


7. The complainant's son reiterated his request by email addressed to the first respondent

      later in 2018 and the first respondent responded to her the same day that she maintained

      her decision.

8. At the end of 2019, Madame X4, e-reputation consultant for the company X3, introduced on behalf of the

      complainant a second request for dereferencing of the same disputed URL via the

      online form of the first respondent.

9. The first respondent acknowledged receipt of the request the same day and, after analysis

      of the request, given that the press article only concerned the professional life of the

      complainant, requested (…) more information on the “current” profession of the

      complainant (i.e. that exercised at the time of the reference request) in order to be able to

      continue to review the request.

10. Mrs. X4 indicated the next day that the content of the disputed press article was

      related to a job that the complainant was still doing. On this basis, the first

      defendant stated in November 2019 that she had decided not to dereference the URL

      contentious due to factors such as the relevance of the latter in the context of life
      professional of the complainant.


11. In May 2020, Madame X2, also an e-reputation consultant for X3 company, introduced

      in the name of the complainant a third request for dereference always from the same URL

      disputed via the first defendant's online form. The first defendant
      acknowledged receipt of the request the same day and indicated a week later that she had

      decided not to proceed with the requested referencing for reasons similar to those

      mentioned in the context of the first two requests addressed to him.

      Madame X2 reiterated her request in a June 2020 email addressed to the first

      defendant. The first respondent responded the next day that she maintained her

      position.

12. On several occasions therefore, the first defendant considered that it was not required to

      give a favorable response to the request for dereferencing of the disputed URL in the

      terms below and invited the complainant to contact the APD in the event of disagreement with this

      decision.

               “After examining the balance between the interests and rights associated with the content in

               question, including factors such as the relevance of the latter in the context

               of your client's professional life, (read the search engine) has decided to
               don't block it.


               For the moment, we have decided not to take any action regarding this URL.

               (…)”. Decision on merits 39/2024 — 4/10


 13. As explained in point 1, the complainant represented by the French company e-

       reputation X3 already mentioned, on June 18, 2020, filed a complaint with the APD.


 14. This complaint form is sent to the APD by the company X3 on behalf of the complainant. He is there

       thus stated by the said company that:

                 “the refusal of (read the search engine) does not respect, in our opinion, the

                 latest clarifications from the Council of State on the application of the right to

                 dereferencing. Regarding an article relating a conviction relating to our

                 client for facts dating from 1998 and a judgment rendered in 2006, the inclusion of

                 this processing of personal data in the engines is not relevant to this

                 day and has very significant repercussions in his life. There is no character

                 strictly necessary to maintain these links justifying the refusal of (reads the engine

                 of research). Furthermore, regarding an accident, our client having no role
                 in public life and the facts being very old, we do not understand the refusal

                 from (read the search engine). (…)


                 Our request for the Right to be Forgotten has been refused. Following which we contacted the

                 writing. We had several discussions with the lawyers in charge, but they

                 unfortunately did not result in a common agreement. You will find attached

                 all exchanges in question. This is why we allow ourselves today

                 to file a complaint for the reasons mentioned above in order to contest
                                                                     1
                 these decisions which do not seem fair to us.

 15. In support of the complaint lodged by the complainant, the company X3 attaches a “mandate” received from

       complainant whose text reads as follows: “I, the undersigned X1 [read the complainant] (…) declare and

       certifies that the company X3 (…) is authorized to represent me exclusively with the

       publishers and hosts of websites in order to carry out the mission assigned to it

       entrusted”.

 16. On June 29, 2020, the complaint was declared admissible by the First Line Service (SPL) of

       ODA on the basis of articles 58 and 60 of the LCA and the complaint is transmitted to the Chamber

       Litigation under article 62, § 1 of the LCA.

                                                                                              er
 17. On July 28, 2020, the Litigation Chamber decides, under Article 95, § 1, 1° and

       article 98 of the LCA, that the file can be processed on its merits.

 18. On this same date, the parties concerned are informed by registered mail of the

       provisions as set out in article 95, § 2 as well as article 98 of the LCA. They are






1It is the Litigation Chamber which underlines. The underlined elements demonstrate that it is indeed the X3 company which introduced the
complaint on behalf of his client, the complainant. Decision on merits 39/2024 — 5/10


      also informed, under article 99 of the LCA, of the deadlines for transmitting their

      conclusions.

19. The deadline for receipt of the defendants' response submissions has been set

      on September 8, 2020, that for the complainant's reply conclusions on September 28

      2020 and that for the defendants' reply conclusions as of October 20, 2020.


20. On August 26, 2020, the defendants requested a copy of the file (art. 95, §2, 3° LCA),
      which was sent to them on August 27, 2020.


21. By their same letter of August 26, 2020, the defendants agree to receive all

      communications relating to the case by electronic means and express their wish,
      subject to in-depth examination of the file, to have recourse to the possibility of being heard

      in accordance with section 98 of the LCA.


22. On September 8, 2020, the Litigation Chamber received the conclusions in response from the

      defendants.

23. The complainant does not submit a reply.

24. On October 20, 2020, the Litigation Chamber received the conclusions in reply and

      summary of the defendants. Their argument can be summarized as follows:


      - Primarily, the defendants consider that the complaint is inadmissible in that it

          is introduced by the French company X3 on behalf of the complainant in violation of the
          prescribed in section 80.1. of the GDPR read in conjunction with article 220.2 of the LTD;


      - In the alternative, if the Litigation Chamber were to consider that the complaint is

          validly introduced, the defendants argued at the time that it was appropriate to

          stay the proceedings (…).

      - In the alternative, the defendants argue that the complaint is unfounded in this regard.

          that there is no reason to pursue the second defendant who is not responsible for

          treatment. There is also no reason to order the dereferencing of the article.
          contentious since the conditions for dereferencing are not met, the result

          of the balancing of the interests present revealing a preponderant interest of the

          public to access the information contained in the referenced article. The seriousness of the source

          journalistic, the accuracy of the facts reported, the link of the facts with the activities

          professional performance of the complainant both at the time and on the day the conclusions were drawn up,

          and the role played by the latter in public life as businessmen are as much
          criteria invoked by the search engine to support its decision not to

          dereference. The defendants conclude that the referencing of the disputed article

          is necessary for freedom of expression and information within the meaning of Article 17.3.a) of the

          GDPR and none of the grounds in Article 17.1.a) to f) of the GDPR are applicable. Decision on merits 39/2024 — 6/10



II. Motivation


 25. The Litigation Chamber recalls that under the terms of article 77.1 of the GDPR, “without prejudice

       any other administrative or judicial remedy, any person concerned has the right

       to lodge a complaint with a supervisory authority, in particular in the State

       member in which his habitual residence is located, his place of work or the place where the

       violation would have been committed, if it considers that the processing of personal data

       personnel concerning it constitutes a violation of these regulations”.


 26. This article 77.1. is supplemented by article 80.1. of the GDPR which provides for its part that “the

       data subject has the right to mandate a body, organization or

       non-profit association, which has been validly constituted in accordance with the law of a

       Member State, whose statutory objectives are of public interest and is active in the field

       the protection of the rights and freedoms of the persons concerned within the framework of the

       protection of personal data concerning them, so that it introduces a
       claim in his name, exercises in his name the rights referred to in articles 77, 78 and 79 and

       exercises on his behalf the right to obtain compensation referred to in article 82 when the law of a State

       member foresees it” .2


 27. Regarding the conditions provided for by Belgian law in execution of article 80.1. of the GDPR,

       they appear in article 220.2. of the LT, are cumulative and the following:


                 Ҥ 2. In the disputes provided for in paragraph 1, a body, an organization or a

                 non-profit association must:

                 1° be validly constituted in accordance with Belgian law;


                 2° have legal personality;


                 3° have statutory objectives of public interest;

                 4° be active in the field of protecting the rights and freedoms of individuals

                 concerned in the context of the protection of personal data

                 for at least three years.


                 §3.The body, organization or non-profit association provides proof, through

                 presentation of its activity reports or any other document, that its activity



2 It is the Litigation Chamber which underlines. See. also the first part of recital 142 of the GDPR: (142):
Where a data subject considers that his or her rights under this Regulation are infringed, he or she should have the
right to apply for a non-profit body, organization or association, constituted in accordance with the law of a
Member State, whose statutory objectives are of public interest and which is active in the field of data protection
of a personal nature, so that he lodges a complaint in his name with a supervisory authority, exercises the right to a
legal recourse on behalf of the data subject or, if provided for by the law of a Member State, exercise the right
to obtain redress on behalf of affected individuals.

3The preparatory work of the LTD mentions that the condition of 3 years applies both to the existence of the personality
legal and for the exercise of activities in the field of data protection. See. House of Representatives, Draft
of law relating to the protection of individuals with regard to the processing of personal data, Doc. Parl.,
DOC 54 31/26/001 (article by article commentary – article 220). Decision on merits 39/2024 — 7/10


                has been in effect for at least three years, that it corresponds to its corporate purpose and that

                This activity is related to the protection of personal data.


 28. In this case, it appears from the file as reported above in points 13-15 that it is the company

       X3 (..), an e-reputation consultancy company established in Marseille in France, which has

       submits the complaint on behalf of the complainant and represents the latter in the exercise

       of his right to complain (complaint) within the meaning of article 77.1. of the GDPR before the Chamber

       Litigation (APD).

 29. The Litigation Chamber notes that the company X3 is a company in the form of a

       joint stock company (..).


 30. The Litigation Chamber is of the opinion that there are serious doubts as to the compatibility

       with the GDPR of the condition set by the Belgian legislator in article 220.2.1° of the LTD in

       what the non-profit body, organization or association must be validly
       constituted in accordance with Belgian law. Indeed, the Belgian legislator introduced in doing so a

       more restrictive condition than that provided for in section 80.1. of the GDPR which requires that this

       body, this non-profit organization or association is constituted

       in accordance with the law of a Member State.


 31. This consideration has no impact in this case since, in any hypothesis, the company

       X3 does not meet the other conditions of article 80.1 GDPR, read in combination with

       article 220.2 of the LTD, since it is not a “body, organization or

       non-profit association” and also has no “statutory purpose of public interest. He
       it is a commercial company as evidenced for example by its General Conditions

       sales available on its internal website […] under the terms of which it is a question of “sale

       of the following services: E-reputation cleaning (request for deletion

       URL) and Serp-Sculpting. » for which different prices are established.


 32. In support of the above, the Litigation Chamber concludes that this company does not meet

       therefore in no way the conditions of article 80.1 GDPR, read in combination with article

       220.2 of the LTD recalled above and that the complainant could not and cannot validly

       be represented by this company to exercise the right conferred by section 77.1. of
       GDPR.


 33. The Litigation Chamber adds that in this it follows the defendants' argument

       except on the consequences that they think they can draw from the absence of deposit of



4
 The preparatory work of the LTD specifies with regard to article 220.2. that “it is the choice to limit this right to
non-profit bodies, organizations and associations validly constituted in accordance with Belgian law and
in particular to the law of June 27, 1921 on non-profit associations, foundations, European political parties and
European political foundations. House of Representatives, Bill relating to the protection of natural persons
with regard to the processing of personal data, Doc. Parl., DOC 54 31/26/001 (article by article commentary –
section 220). Decision on merits 39/2024 — 8/10


       conclusions in reply by the complainant on this point in particular. Unlike this

       that the defendants expose, the absence of filing of conclusions by the complainant (point 23)

       - and therefore argumentation in response to the defendants' thesis as to its

       non-compliant representation - does not amount to acquiescence on the part of the complainant.
       The latter remains free to conclude or not, certainly depriving himself if necessary of supporting his

       complaint and to defend oneself in the light of the arguments developed by the parties

       defendants. However, it cannot be deduced from this that he acquiesces in the defense of these

       this.



III. Corrective measures and sanctions


 34. Under the terms of article 100.1 of the LCA, the Litigation Chamber has the power to:

       1° close the complaint without further action;

       2° order the dismissal of the case;


       3° pronounce a suspension of the sentence;

       4° propose a transaction;


       5° issue warnings or reprimands;

       6° order to comply with the requests of the person concerned to exercise their rights;


       7° order that the person concerned be informed of the security problem;

       8° order the freezing, limitation or temporary or definitive ban on processing;


       9° order compliance of the processing;

       10° order the rectification, restriction or erasure of the data and the notification of

       these to the recipients of the data;

       11° order the withdrawal of the accreditation of certification bodies;


       12° give fines;

       13° issue administrative fines;


       14° order the suspension of cross-border data flows to another State or a
       international body;


       15° transmit the file to the public prosecutor of the King of Brussels, who informs him of the

       follow-up given to the file;

       16° decide on a case-by-case basis to publish its decisions on the website of the Authority of

       Data protection. Decision on merits 39/2024 — 9/10


 35. In matters of dismissal (article 100.1.1° LCA), the Litigation Chamber must

       motivate your decision step by step and:5


       - pronounce a classification without technical follow-up if the file does not contain or not

           sufficient elements likely to lead to a sanction or if it includes a

           technical obstacle preventing it from rendering a decision;

       - or pronounce a classification without further opportunity, if despite the presence of elements

           likely to result in a sanction, the continuation of the examination of the file does not seem to him


           not appropriate given the ODA priorities as specified and illustrated in
                                                                                 6
           the Disposition Policy of the Litigation Chamber.

 36. In the event of classification without follow-up on the basis of several reasons (respectively, classification

       without technical and/or appropriate action), the reasons for classification without action must be

       treated in order of importance .7


 37. In the present case, the Litigation Chamber decides to proceed with a classification without

       continued for technical reasons on the basis of article 100.1.1° of the LCA due to the absence

       compliance of the complainant's representation with articles 80.1. of the GDPR and 220.2. of the

       LTD applied in combination with section 77.1. of the GDPR and therefore, the absence of

       validity of the complaint lodged which prevent it from taking any decision

       on the merits of the request.


 38. The Litigation Chamber specifies in this regard that this classification without technical follow-up

       leaves intact the complainant's right to lodge a complaint with the same subject matter as the complaint

       leading to this decision in compliance with the conditions of admissibility of the

       complaints. This decision to classify without technical action does not in any way prejudge

       of the merits as to the merits of the complainant's delisting request that the

       Litigation Chamber could be required to examine whether it should be validly

       entered in the future.


 39. The Litigation Chamber having thus granted the request made by the

       principal defendants without ruling on the merits of the plaintiff's request,

       it decides to adopt this decision without convening the hearing requested by these

       the latter only, the complainant not having for his part requested to be heard.






5Market Court (Brussels Court of Appeal), September 2, 2020, 2020/AR/329, p. 18.
6https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-

contentious.pdf .
7Clearance policy of the Litigation Chamber, 06/18/2021, point 3 (“In what cases is my complaint
likely to be closed without further action by the Litigation Chamber?”), available on
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
contentieuse.pdf Decision on the merits 39/2024 — 10/10


IV. Publication of the decision



 40. Given the importance of transparency regarding the decision-making process of the Chamber

        Contentious, this decision is published on the APD website. However, it is not

        in view of all the specific elements and considerations of the case, not

        necessary for this purpose that the identification data of the parties to this decision are

        directly mentioned.



     FOR THESE REASONS    ,


     the Litigation Chamber of the Data Protection Authority decides, after
                                                                                                        er
     deliberation, to dismiss this complaint in accordance with article 100, § 1,

     1° of the LCA.





In accordance with article 108, § 1 of the LCA, an appeal against this decision may be lodged,

within thirty days from its notification, to the Court of Markets (court

of Appeal of Brussels), with the Data Protection Authority as defendant.


Such an appeal may be introduced by means of an interlocutory request which must contain the
                                                                      8
information listed in article 1034ter of the Judicial Code. The interlocutory request must be

filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 9

via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. judic.).









(sé). Hielke H IJMANS

President of the Litigation Chamber













8The request contains barely any nullity:

 1° indication of the day, month and year;
 2° the name, first name, domicile of the applicant, as well as, where applicable, his qualifications and his national register number or
     Business Number;
 3° the surname, first name, address and, where applicable, the status of the person to be summoned;
 4° the object and summary of the grounds of the request;
 5° indication of the judge who is seized of the request;

the signature of the applicant or his lawyer.
9 The request, accompanied by its annex, is sent, in as many copies as there are parties involved, by letter

recommended to the court clerk or filed with the court registry.