APD/GBA (Belgium) - 37/2024

APD/GBA - 37/2024
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 6(1)(a) GDPR
Type:	Complaint
Outcome:	Rejected
Started:	09.08.2022
Decided:	21.02.2024
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	37/2024
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	French
Original Source:	APD (in FR)
Initial Contributor:	nzm

The DPA dismissed a cookie complaint regarding the absence of a “Reject all” button on the first layer of the cookie banner, as the “Confirm my choices” button meant that no cookies were placed since none of the categories of non-essential data were ticked by default.

English Summary

Facts

A data subject represented by noyb (European Centre for Digital Rights) complained that a website did not provide a “refuse” option on the first layer of the cookie banner. On 9 August 2022, the data subject lodged a complaint with the Belgian DPA (“APD”).

On 24 August 2022, the APD found that the cookie banner did not include a “reject all”, but required the data subject to choose between accepting all the cookies and confirming the default selection. The APD also discovered that none of the categories of non-essential data were ticked by default. Clicking on the “Confirm my choices” button meant that no cookies were placed, in the same way as a button allowing non-essential cookies to be rejected.

The APD also noted that the cookie banner could be recalled at any time during the visit by means of a floating icon in the bottom left-hand corner of the web page in order to change the cookie settings.

Holding

The APD held that the sole violation cited in the complaint was no longer founded after 24 August 2022, presumably due to measures taken by the controller after the data subject’s visit to the website regarding the "Confirm my choices" button. Indeed, since that date, clicking on this button meant that no none essential cookies were placed on the device. The DPA therefore decided to dismiss the complaint given that the subject of the complaint had disappeared before the complaint was transferred to the APD.

Additionally, the DPA also noted that since the date of the complaint, the controller also added a “Reject all” button.

Comment

In this decision, the APD seems to have considered that the "Confirm my choices" button was equivalent to a "Reject all" button.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/6





                                                                      Litigation Chamber

                                                       Decision 37/2024 of February 21, 2024


File number: DOS-2022-03262


Subject: Complaint due to the processing of personal data through

of a website, without the valid consent of the person concerned



The Litigation Chamber of the Data Protection Authority, made up of Mr.

Hielke HIJMANS, president, sitting alone;


Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the

protection of natural persons with regard to the processing of personal data and

to the free movement of these data, and repealing Directive 95/46/EC (general regulation on the
data protection), hereinafter “GDPR”;


Having regard to the Law of December 3, 2017 establishing the Data Protection Authority, hereinafter

“ACL”;


Having regard to the Law of July 30, 2018 relating to the protection of individuals with regard to

processing of personal data, hereinafter “LTD”;

Having regard to the Internal Regulations as approved by the House of Representatives on

December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;


Considering the documents in the file;


Has taken the following decision regarding:



The complainant: X, hereinafter “the complainant”, represented by NOYB - EUROPEAN CENTER FOR

                    DIGITALR IGHTS, Goldschlagstraße 172/4/3/2 – 1140 Vienna (Austria)


The defendant: Y, hereinafter “the defendant” Decision 37/2024 — 2/6




I. Facts and procedure


 1. The complaint concerns the processing of personal data through the site

       internet […], without the valid consent of the complainant.

       The complainant states that she visited the website on October 28, 2021, in. This web page

       presented a “banner” of a consent management platform (hereinafter, “Z1”)

       provided by Z2. On 10-06-2022, the complainant signed a representation mandate,

       in accordance with Article 80(1) GDPR, with NOYB.

       The complaint mentions several personal data processing operations,

       in the context of providing the web page in its entirety, allegedly based

       on the consent of the person concerned. More specifically, the complaint raises a

       violation of the GDPR as well as the ePrivacy Directive (ePD), namely the absence of an option

       allowing you to “refuse” cookies, at the first level of information in the banner

       Cookies.


 2. On August 9, 2022, the complainant filed a complaint with the Data Protection Authority.

 3. On August 9, 2023, the First Line Service of the Data Protection Authority

       declares the complaint admissible on the basis of articles 58 and 60 of the LCA, and transmits it

       to the Litigation Chamber in accordance with article 62, § 1 of the LCA.



II. Motivation


 4. Based on the facts described in the complaint file as summarized above, and on the
                                                                                                   er
       basis of the powers assigned to it by the legislator under article 95, § 1

       of the LCA, the Litigation Chamber decides on the follow-up to be given to the file; as it happens,

       the Litigation Chamber decides to proceed with the classification without further action of the complaint,
                                       er
       in accordance with article 95, § 1, 3° of the LCA, for the reasons set out below.

 5. In matters of dismissal, the Litigation Chamber is required to provide reasons for its decision.

       decision by step and to:


            - pronounce a classification without technical follow-up if the file does not contain or not

                sufficient evidence likely to lead to a sanction or if it includes a
                technical obstacle preventing it from rendering a decision;


            - or pronounce a classification without further opportunity, if despite the presence

                of elements likely to lead to a sanction, the continuation of the examination of the

                file does not seem appropriate given the priorities of the Authority of





1Market Court (Brussels Court of Appeal), September 2, 2020, judgment 2020/AR/329, p. 18. Decision 37/2024 — 3/6



                data protection as specified and illustrated in the Privacy Policy

                classification without further action by the Litigation Chamber. 2


 6. In the event of dismissal based on several reasons for dismissal, these

       last (respectively, classification without technical follow-up and classification without follow-up
                                                                    3
       opportunity) must be treated in order of importance.

 7. In this case, the Litigation Chamber decides to proceed with a classification without further action.

       the complaint on grounds of expediency. The decision of the Litigation Chamber is based

       more precisely on a reason for which it considers it inappropriate to pursue

       the follow-up of the file, and therefore decides not to proceed, among other things, with an examination


       of the case as to its merits.

 8. In this case, the Litigation Chamber was able to note, on August 24, 2022, that the

       cookie banner did not include a button allowing you to reject all cookies

       (“Reject All”), but required a choice from the user between accepting all cookies,

       on the one hand, and confirmation of the default selection, on the other hand. However, the Chamber

       litigation was also able to observe, during this visit to the site concerned,

       that none of the categories of non-essential cookies were checked by default. The second

       choice offered by Z1 (“CONFIRM MY CHOICES”) therefore resulted in the absence of placement of

       cookies, as well as a button allowing you to reject all non-essential cookies:



























       It therefore appears that the only violation invoked by the complaint is no longer founded from the

       aforementioned date, presumably due to the measures taken by the defendant after




2In this regard, the Litigation Chamber refers to its policy of classification without further action as developed and published on the
website of the Data Protection Authority: https://www.autoriteprotectiondonnees.be/publications/politique-de-
classification-without-suite-of-the-contentious-chamber.pdf.

3Cf. Title 3 – In what cases is my complaint likely to be dismissed by the Litigation Chamber? of the
policy of dismissal without further action by the Litigation Chamber. Decision 37/2024 — 4/6



       the visit to the site by the complainant. The Litigation Chamber therefore decides to classify

       without further action on the complainant's grievance, taking into account the fact that the subject of the complaint has disappeared

       made of the measures taken by the controller before the transfer of the complaint to the
                                                                              4
       Litigation Chamber by the APD Front Line Service.

 9. In the alternative, the Litigation Chamber was also able to observe, on the occasion of this

       visit to the site concerned, that the cookie banner could be recalled at any time during

       of the visit, by means of a floating icon at the bottom left of the internet page, in order to

       modify the settings relating to cookies:


















 10. The Litigation Chamber further emphasizes that the above findings are still

       of application from February 19, 2024, with the exception of the addition of an explicit button

       “REJECT ALL” since the date of the complaint:



























 11. In this regard, the Litigation Chamber recalls that the European Committee for the Protection of

       (EDPB) adopted, on January 17, 2023, the report established by the working group on






4Cf. criterion B.6 in the Dispute Chamber's policy of dismissal. Decision 37/2024 — 5/6


                                                             5
       cookie banners (“Cookie Banner Taskforce”), in which the supervisory authorities

       European countries have notably adopted a common position on the ban on the use

       pre-selected preferences authorizing the placement and reading of cookies

       essential, as well as the obligation to provide the possibility for users to withdraw their

       consent at any time, and easily. The Litigation Chamber notes that the

       data controller has, in this case, configured the cookies banner so

       complies with the requirements listed in the above-mentioned report.


 12. Finally, the Litigation Chamber specifies that it is not necessary to rule on

       the complainant's interest in taking action in the specific case, given the reasons for dismissal

       stated above.



III. Publication and communication of the decision


 13. Considering the importance of transparency regarding the process

       decision-making and the decisions of the Litigation Chamber, this decision will be published on the

       website of the Data Protection Authority. However, it is not necessary for this

       so that the identification data of the parties are directly communicated.


 14. In accordance with its policy of dismissal, the Litigation Chamber
                                                 6
       will communicate the decision to the defendant. Indeed, the Litigation Chamber decided to

       communicate the decisions of dismissal to the defendants by default. There

       Chambre Litigation, however, refrains from such communication when the complainant

       requested anonymity vis-à-vis the defendant and when the communication of the decision to the
                                                                                               7
       defendant, even pseudonymized, nevertheless risks allowing his reidentification. This

       is not the case in the present case.



    FOR THESE REASONS   ,


    the Litigation Chamber of the Data Protection Authority decides, after

    deliberation, to classify this complaint without further action in application of article 95,§ 1, 3°

    of the LCA.











5
 EDPB – Report on the work undertaken by the Cookie Banner Taskforce (adopted on 17 January 2023), available at the link
following: https://edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf.
6Cf.Title 5–Will the classification without further action be published? Will the opposing party be informed? of the classification policy
without further action by the Contentious Chamber.

7Ibidem. Decision 37/2024 — 6/6



                                          er
In accordance with article 108, § 1 of the LCA, an appeal against this decision may be lodged,

within thirty days from its notification, to the Court of Markets (court

of Appeal of Brussels), with the Data Protection Authority as defendant.


Such an appeal may be introduced by means of an interlocutory request which must contain the

information listed in article 1034ter of the Judicial Code. The interlocutory request must be

                                                                                                                       9
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , Or

via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. judic.).


To enable it to consider any other possible course of action, the Litigation Chamber refers

the complainant to the explanations provided in its policy of dismissal. 10








(sé). Hielke HIJMANS



President of the Litigation Chamber


































8The request contains barely any nullity:

  1° indication of the day, month and year;
  2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualifications and his national register number or

     Business Number;
  3° the surname, first name, address and, where applicable, the status of the person to be summoned;

  4° the object and summary of the grounds of the request;

  5° indication of the judge who is seized of the request;
  6° the signature of the applicant or his lawyer.

9 The request, accompanied by its annex, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court registry.

10Cf. Title 4 – What can I do if my complaint is closed? of the Chamber's policy of dismissal
Contentious.