APD/GBA (Belgium) - 25/2020: Difference between revisions

From GDPRhub
(Created page with "{{DPAdecisionBOX |Jurisdiction=Belgium |DPA-BG-Color= |DPAlogo=LogoBE.png |DPA_Abbrevation=APD/GBA |DPA_With_Country=APD/GBA (Belgium) |Case_Number_Name=DOS-2019-01156 |ECLI...")
 
 
(9 intermediate revisions by 7 users not shown)
Line 7: Line 7:
|DPA_With_Country=APD/GBA (Belgium)
|DPA_With_Country=APD/GBA (Belgium)


|Case_Number_Name=DOS-2019-01156
|Case_Number_Name=25/2020 
|ECLI=
|ECLI=


|Original_Source_Name_1=Belgian DPA
|Original_Source_Name_1=Belgian DPA
|Original_Source_Link_1=https://www.gegevensbeschermingsautoriteit.be/sites/privacycommission/files/documents/Beslissing_GK_25-2020__NL__.pdf
|Original_Source_Link_1=https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-25-2020eng.pdf
|Original_Source_Language_1=Dutch
|Original_Source_Language_1=English
|Original_Source_Language__Code_1=NL
|Original_Source_Language__Code_1=EN


|Type=Complaint
|Type=Complaint
Line 58: Line 58:
}}
}}


The Litigation Chamber analysed  the legal grounds for the various processing activities described in an insurer's privacy statement. The litigation concluded to a violation of the GDPR since the legitimate interests invoked were not further explained by the controller.  
The litigation chamber concluded that the "invite a friend" function of a social media platform violates the GDPR since consent from the users was not collected.  


== English Summary ==
==English Summary==


=== Facts ===
===Facts===
The insurance company had an privacy policy with unspecified legitimate interests were advanced as a legal ground for some of these processing activities. Consent was  requested separately for specific purposes (despite the fact that the defendent claimed during the proceedings that this was based on legitimate interests).
A social media encourages both existing users and new joiners to invite their friends to join the platform via a "invite a friend" option. The Litigation Chamber examined the legal grounds for the "invite a friend" system. The user gave the provider access to his or her list of contacts, so that a message could be sent to those contacts to join the social media platform or, if they were already members of the social media platform, to become part of that user's network of friends on the platform.
===Holding===
The Litigation Chamber stated the "invite a friend" functionality made the provider a controller within the meaning of the GDPR, and such processing of personal data did not fall within the scope of the "household exemption". Therefore, the GDPR applied in full.


=== Dispute ===
Only the data subject whose personal data are processed can validly consent to the processing of this data.
- Is the privacy policy specific enough ?
The collection of contact details can take place only on a compare and forget basis: all data of non users of the platform should be deleted.  That was not the case here.
- Are the legitimate interests that the controller claims to have valid under article 6 GDPR ?
- Should a DPIA be conducted and should it be shared with the complainant ?


=== Holding ===
No consent is required for an e-mail invitation to the user's non-member contacts  under the following conditions (already stated by the Article 29 WP): 
- The Litigation Chamber held that the controller did not demonstrate any legitimate interest that would justify processing for those purposes. In this case, consent was required.


- The privacy statement did not meet some of the requirements of Art. 13 GDPR. For instance, the Litigation Chamber criticised the absence of indication of the right to object to the processing (regarding direct marketing processing activities and other processing activities based on "legitimate interests" ).
* no pressure should be applied to the transmitter or receiver;
* the provider is not allowed to choose the addressees of the message;
* the identity of the user sending the message must be clearly indicated;
* the user sending the message must be aware of the full content of the message to be sent on his behalf.


- The Litigation Chamber considered that the lack of any information on the specific legitimate interests invoked violated article 13.
The social media provider claimed that others social media providers were following the same practices. However, the litigation chamber considered that was not a proper argument.  


- DPIA was not to be conducted but best practice requires that a regular assessment of the policy is done
As conclusion, the litigation chamber imposed a fine of EUR 50,000 for processing personal data of non-members of the website without an appropriate legal basis, as well as personal data of members.
==Comment==


- Heath data cannot be processed on the basis of Article 6.1 b (necessary for the contract) but need another legal basis under Article 9 such as consent.  
The Belgian DPA published the decision also in English, which you may find here: https://www.dataprotectionauthority.be/sites/privacycommission/files/documents/Beslissing_GK_25-2020_EN.pdf.


== Comment ==
In-depth comments can be found here:


*[https://www.nautadutilh.com/en/information-centre/news/belgium-two-new-fines-for-tell-a-friend-and-health-related-gdpr-violations Belgium: two new fines for tell-a-friend and health-related GDPR violations] (20 May 2020)
*[https://www.huntonprivacyblog.com/2020/05/27/belgian-dpa-sanctions-social-media-company-for-unlawful-processing-of-personal-data-in-connection-with-invite-a-friend-function/ Belgian DPA Sanctions Social Media Company for Unlawful Processing of Personal Data in Connection with “Invite-a-Friend” Function] (27 May 2020)


== Further Resources ==
==Further Resources==
''Share blogs or news articles here!''
''Share blogs or news articles here!''


== English Machine Translation of the Decision ==
==English Machine Translation of the Decision==
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.


<pre>
<pre>
File number : DOS-2019-02902
Decision on the substance 25/2020 of 14 May 2020
   
   
Subject : Lack of transparency in the privacy statement of an insurance company.  
File number : DOS-2019-01156    Subject: Legal basis for processing of personal data by social media platform  
   
   
The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke  
The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke  
Line 103: Line 110:
WOG;  
WOG;  
   
   
Having regard to the Internal Rules of Procedure approved by the Court of Auditors of
Having regard to the internal rules of procedure as approved by the Chamber of Representatives on 20 December 2018 and published in the Belgian Official Gazette on 15 January 2019;  
Representatives on 20 December 2018 and published in the Belgian Official Gazette on 15 January 2019;  
   
   
Having regard to the documents in the file;  
Having regard to the documents in the file;  
   
   
has taken the following decision regarding:
                               
- a processing of personal data by the controller: Y ('defendant');
1. Facts and procedure
2. On 28 November 2018, the Management Committee of the Data Protection Authority (hereinafter the GBA) decided to refer a case to the Inspectorate of the GBA on the basis of Article 63, 1° of the WOG. The reason for the aforementioned referral was the practice whereby the social network and website "W" invites its members to add the "friends/contacts" of those members. 
3. The Inspectorate of the GBA informed the defendant of this decision of the Executive Committee of the GBA by letter of 12 March 2019.
4. The Inspectorate sent two letters to the defendant dated 12 March 2019 and 16 May 2019 with questions relating to alleged infringements of Articles 5, 6, 7, 30, 37 and 38 of the AVG. More specifically, the Inspectorate asked questions about the categories of personal data of non-users that were collected as well as the retention period for those data. The Inspectorate also requested an extract from the register of the defendant's processing activities and asked questions about the data protection officer (place in the organisation chart, time spent, professional qualities, involvement in answering the Inspectorate's questions). 
5. The defendant replied to the Inspectorate's questions by letters dated 21 March 2019, 3 April 2019 and 14 June 2019. The defendant clarified the processing of personal data in the invitation functionality on the "W" website as follows: "Here, the personal data we collect will depend on the platform used: if a user chooses to upload contacts from the phone book of his or her mobile phone, we will collect phone numbers and the names that the user assigns to these phone numbers. If a user chooses to upload contacts from his or her email account, the basic contact information that will be uploaded will be determined by the user's own email provider, as clearly set out in that provider's upload permissions screen" . If a user chooses to upload his or her contacts from his or her phonebook, the details of these contacts will be synchronized regularly so that the user can invite new contacts who are not yet members of "W" to register.
6. The defendant explains that in addition to the consent button, the following section of information will appear: "At regular intervals we will import and store your contacts so that we can give you
be able to notify when acquaintances register on "W" and so you can invite them to register when your contacts are not yet members of "W". You decide who you add. You can stop the import at any time and delete all contacts. More information".
7. If the user clicks on "more information", he or she will see the following additional information: "When you import your address book, we will periodically import information, such as names, phone numbers and other information as clarified on the provider's permissions screen, about your contacts on our servers. We use this information to inform you about who you already know on W and so that you can invite your contacts who are not yet members. The above suggestions are made directly on the service and via email. We do not store your password and do not email anyone without your permission. You can stop the synchronisation of your address book at any time via your settings. When you do this, all previously imported contacts will be deleted. For more information on how we process your personal data, please refer to our Privacy Policy" .
8. The defendant further explained that the user's contact persons are kept in the defendant's database until the user decides to stop synchronizing the contact persons, or if a user removes certain contact persons. When an account is closed (either deliberately or after 2 years of inactivity), the contact persons are deleted within three months, the defendant further explained3.
9. In his letter of 9 March 2020, the defendant explains that the user can choose to withdraw his consent and thus no longer synchronize contacts, thus removing the existing contacts from the "W" database. If the user does not choose this function, the contact details (including those of third party non-users of the website) will be kept for at least three months .
10. The defendant submitted to the Inspectorate an extract from its register of processing activities, showing which categories of personal data of customers (users of the website) are processed: 'profile information, personal identification, analytical data, user generated content, user account information, contact information and third party information (for users who register via Facebook)'. According to that register, the legal basis invoked for processing is 'the performance of a contract' and 'the
consent of the individual" .
11. As regards the legal basis for the collection of non-users' personal data, the defendant explained that the legal basis 'consent' - in its view - should not be used: 'We are of the opinion that we are not obliged to collect the consent of the contact person. Indeed, we do not send promotional messages because it is the user who sends personal communications to his or her contact through our platform. This interpretation is in line with the vision set out in the Article 29 Working Party's Opinion 5/2009 on Online Social Networking  and we have ensured that our process fully complies with the four criteria set out in [this] Opinion" 8.
12. The defendant responded in detail to the Inspectorate's questions about the activities and competence of its Data Protection Officer . The defendant refers, inter alia, to the professional experience of this person, in particular his experience as EMEA Senior Privacy Counsel with a company active in online means of payment and lawyer with the IT service of a law firm. This person also holds an IAPP CIPP/E and CIPM  certification.
13. On 18 June 2019, the Inspectorate submitted its report to the Disputes Chamber on the basis of article 92, 3° of the WOG.
14. The inspection report shall identify potential breaches of Article 5(1). 2 of the AVG, Article 6 of the AVG, Articles 4, 11) and 7 of the AVG as well as Articles 37 and 38 of the AVG.
15. With regard to the alleged breaches of accountability (Article 5(2) of the AVG), of the lawfulness of processing (Article 6 of the AVG), and with regard to the definition and conditions for consent (Articles 4, 11 and 7 of the AVG), the Inspection Report makes a distinction between, on the one hand, the consent relating to the processing of personal data of the user of the website and, on the other hand, the consent required with regard to the processing of personal data of that user's contacts.
16. As regards the defendant's assertion that he is not obliged to collect the consent of the contact persons (non-members of "W"), since it would be "personal".
communication' by the user, the Inspectorate notes that the exception (to the obligation of consent under Article 7 AVG) for personal or household activities may be invoked by social media users but not by the social network 'W' itself, in line with recital 18 of the AVG, which reads as follows: 'Personal or household activities [outside the scope of the AVG] may include social networking and online activities in the context of such activities'. However, this Regulation shall apply to controllers or processors providing the means for processing personal data for such personal or household activities' (Inspection report, p. 4).
17. The reference made by the respondent to Opinion 5/2009 of Group 29 on online social networks is not considered relevant by the Inspectorate because this Opinion concerns  the former Data Protection Directive and 'because the AVG imposes more far-reaching obligations on data controllers including the accountability in Article 5(2) of the AVG and the requirements of unambiguous expression of will in Articles 4, 11) and 7 of the AVG' (Inspection report, p. 5).
18. With regard to the consent of social media users (members of "W"), the Inspectorate notes that there are pre-ticked options in the process of adding contacts. As a result, the user's consent to use or not use the personal data of his contacts is not valid in a context where recital 32 of the AVG explicitly clarifies that 'already ticked boxes' do not count as consent. The Inspectorate notes that the respondent is prepared to "continue his practice of pre-assessing contacts' personal data".
selects to stop", which has happened in the meantime. According to the defendant, the adjustment
place 2 working days after receipt of the inspection report .
19. In the meantime, the defendant has removed the pre-ticked options from the platform 'voluntarily and without any unfavourable acknowledgement' after receiving the second letter from the Inspectorate dated 16 May 2019. However, the defendant states in its conclusion that these pre-ticked options do not relate to obtaining the user's consent to import his contacts, and that, moreover, no consent is necessary in view of the principles set out in the Opinion 5/2009 of Group 29 on online social networks (see defendant's conclusion, p. 13).
20. The Inspectorate also noted that the defendant's privacy policy does not state that consent can be withdrawn, as imposed by Article 7 of the AVG. In its conclusion
(p. 19 and 20) and in his letter of 14 June, the defendant replies that the possibility to withdraw consent is indeed offered on the website. The user is informed that he can stop the import at any time and delete all contacts.
21. Before starting the current procedure, the defendant had been in contact with the GBA in response to a complaint received regarding the working method of the "W" platform. The complaint referred to the fact that the information about the protection of personal data could only be read after creating one's own account and accepting the terms of use and privacy policy. The GBA had pointed out to "W" that this was not a valid way to obtain permission for the "invite a friend" e-mail, as far as this was the legal basis used by "W".
22. At a hearing on 9 July 2019, the Disputes Chamber decided on the basis of Article 98 of the WOG that the file was ready to be dealt with on the merits.
23. On 10 July 2019, the defendant was informed by registered mail of this decision, of the inspection report, and of the inventory of the documents in the file that the Inspectorate sent to the Chamber of Disputes. At the same time, the defendant was informed of the provisions as mentioned in article 98 of the WOG and the defendant was informed of the time limits to submit his defence under article 99 of the WOG. The deadline for receiving the defendant's response was set at 4 September 2019.
24. By letter and e-mail dated 15 July 2019, the defendant asked to be heard. By letter dated 30 August 2019, the Chamber of Disputes informed the defendant of the date of the hearing.
25. On 4 September 2019, the Chamber of Disputes received the conclusion of the defendant's response.
26. The hearing took place on 1 October 2019. The file was resumed with other members of the Dispute Chamber. The data controller was heard and given the opportunity to present his arguments, in response to the questions put to him by the members of the Disputes Chamber, concerning the foreign scope of the 'W' website, the legal basis for processing personal data of users and non-users of the 'W' website and the role and working methods of the Data Protection Officer.
27. At the hearing, the defendant made the following statements in addition to his conclusion:
- The defendant offers a platform to get to know new people in the private sphere without limitation (friend or relationship); there are 4.5 million active users per month, spread all over the world, 1.5 million of whom are in the EU. There are 33 people working at "W" (see also defendant's conclusion, p. 3) and 100 people in various places in the world working for the helpdesk (not Y employees, but only contractual service providers, as clarified by defendant's letter of 4 November 2019 to the Chamber of Disputes).
- The defendant complains that the constitutive elements of the offence imputed to "W" are not indicated in the Inspection Report (see also defendant's conclusion, p. 6); the defendant considers that in this case the charge was made without a prior detailed explanation of the alleged infringement. The defendant finds that the allegations with regard to "accountability" are very unclear.
28. The defendant then explains how the invitation process takes place on the "W" website:
- The website users will be informed - as shown above - about the processing that will take place in the context of the "invite a friend" functionality.
- Under the message "W is better with friends" the internet user gets the possibility to import an address book of different service providers (Outlook, Google mail, Yahoo, Facebook, Telenet, Skynet). The user is not obliged to select a service provider and can skip the "invite a friend" functionality in its entirety. If the user wants to make use of this functionality, one of the service providers must be selected. Then a screen of this service provider will be displayed, on which the internet user can allow his contact addresses to be read. This is, as explained by the defendant, "the provider's permissions screen". If the internet user agrees, all addresses listed in the address book are then stored by "W". The functionality offered by such service providers consists of allowing users to share limited contact information with the "W" platform, for limited purposes.
- In a next step, the Internet user is given the opportunity to choose the recipients of invitation emails.
- In a first version of the website, all addresses were pre-checked, with the possibility to unselect all recipients with a single click. Since July 12, 2019,  no address is pre-checked and the user can choose between two options: pre-select all recipients one by one, or pre-select all his contacts with a single click. In the previous version of the website, the user also had the possibility to deselect the pre-checked recipients one by one.
- By letter of 4 November 2019, the defendant insists that users should have the possibility to obtain their consent regarding the use of the "invite a friend".
functionality" at any time. All previously imported contacts
are then removed, the website announces (cf. above, p. 3).
29. The defendant then argues that the address details of the contact persons are used only for the invitation functionality. According to the defendant, no profiles are created on the basis of these contact details.
30. With regard to the legal basis invoked, the defendant states the following: when a user sends an invitation to his friends, it is a personal communication, not a marketing message subject to the anti-spam rules of the ePrivacy Directive; defendant uses a single legal basis, i.e. the consent of the users; the "AVG does not say that you need the consent of contacts. We have the consent of the user to import his data," the defendant stated in court. To the question of the Dispute Chamber whether, according to the defendant, the user's consent is also valid for non-users of the "W" website, the defendant answers positively, "since it is one and the same
finality' as regards the processing of personal data. Thus, the defendant confirmed the assertions made in his conclusion, which were summarised by the defendant as follows:
"With regard to the legal basis invoked, the defendant claims the following: Y processes the contact details of the user's contact persons for a single purpose: to make the "invite a friend" functionality available. In order to fulfill this single purpose, the user's contacts are uploaded and invitation emails are then sent on behalf of the user to those contacts selected by the user. The legal basis on which Y relies for the processing of personal data within the scope of the "invite a friend" functionality is the consent of the user. Y is of the opinion that it is not mandatory to separately request the consent of the user's contact persons, since the processing of data is already justified by the user's consent under Article 6 of the AVG and since, on the other hand, the invitation message sent does not constitute a direct marketing message that is subject to the ePrivacy Directive. This was explicitly confirmed by the Article 29 Working Party. To the question of the Dispute Chamber whether the consent of the user is also valid for non-users of the "W" website, the defendant answers positively: in the context of the "invite a friend" functionality and, more generally, of all services and functions that enable users to process contact data and other information of people they know (e.g. e-mail providers, messaging systems, operating systems, cloud services where people upload photos that can show their friends and family, ...), the data are primarily that of the user himself." The data is the user's own. (Letter from the defendant to the Chamber of Disputes of 4 November 2019, reaction to the draft PV of the hearing, p. 3).
31. The defendant then shows by means of printed screens of the website that the user can see and change the standard message before it is sent in the context of the invitation e-mail (page 12 of the bundle of pleadings). The defendant reiterates that, in its view, it has taken all measures to ensure that this processing would meet the requirements of "personal communication" as set out in Group 29 Opinion 5/2009 on online social networks. According to the respondent, the Inspectorate wrongly states that this advice predates the AVG and is no longer valid, because the consent requirements have meanwhile become more stringent (see also conclusion, p. 23). The defendant also addresses the question whether or not there is a marketing message within the meaning of Article 13 of the ePrivacy Directive. By letter of 4 November 2019, the defendant wished to provide additional clarification: "Y has never claimed that the AVG would not apply to the processing activities carried out in the context of the W platform. On the contrary, Y considers that the invitation message sent to the user's selected contact persons constitutes personal communication, for which it is not required to obtain the consent of such contact persons on the basis of the ePrivacy Directive".
32. The Chamber of Disputes then asks whether or not the users are informed in the invitation e-mail departing from the "W" platform that their data may be corrected or deleted. The defendant refers to his pleading, which contains a printed version of the screen that the addressee of such an invitation will see: under the message "X. sent
You have a message! "two blue buttons offer the following option: "Register and reply" or
"Read only message." Under these buttons the following explanation is placed: "When you click on 'Register and reply' you agree that an account will be created for you on W and you agree to our [hyperlink] Terms and Conditions. Please also read our [hyperlink] Privacy Policy and our [hyperlink] Cookie Policy". The Respondent explains that the recipient of the invitation email receives information about their rights through "W"'s Privacy Policy and Cookie Policy, and that the recipient also receives the following information in the email itself: "Click here if
you do not wish to receive commercial e-mails about our products or services" (page 17 of the
pleading).
33. As regards the Data Protection Officer, the defendant refers to documents proving that this person was indeed involved in the definition of the invitation functionality, including an e-mail of 13 August 2018 already communicated to the Inspectorate (page 15 of the bundle of pleadings - document 21 of the defendant). The defendant claims that his data protection officer can report to the highest body and that in practice he does so according to the defendant (defendant's letter to the Chamber of Disputes dated 4 November 2019, p. 4). The defendant also states that there is no evidence in the inspection report that this person would not be independent (e.g. that he would receive instructions from the management).
34. The defendant submits a positive and recent evaluation report showing that this person should not fear for his job. According to the defendant, this positive assessment proves that the DPO is able to carry out his tasks in an independent manner and that V was the obvious choice for the DPO. The DPO is based in Dublin but is able to communicate with the defendant's staff in English and French, and there is also a local 'privacy lead' in U. The defendant claims that the DPO meets the Y employees in person on a regular basis and that most of the meetings take place via 'video conferencing' software. This person's professional qualifications are evident from his CV. The data protection officer states that he also works for another social media platform ("Z") and that there is no pre-determined division of time between the two platforms, and that he can rely on a team of 4 full-time employees, in addition to the local privacy lead in U.
35. In view of the cross-border nature of the data processing operations on the defendant's website, the Litigation Chamber decided to submit the case to the Article 56 AVG procedure in order to identify the leading supervisory authority and the supervisory authorities concerned. The GBA identified itself as a potential lead supervisory authority. Authorities from the following countries declared themselves to be concerned: the Netherlands, Germany (Lower Saxony, Baden-Württemberg, Brandenburg, Rhineland-Palatinate, Mecklenburg-Western Pomerania, Bavaria, North Rhine Westphalia, Berlin), Portugal, Sweden, Ireland, Latvia, Italy, Norway, Hungary, Austria, Spain, France, Cyprus, Slovakia, Denmark, Slovenia.
36. On 3 October 2019, the Disputes Chamber sent a registered letter to the defendant enclosing the defendant's annual accounts for the fiscal years 2016, 2017 and 2018, asking whether the defendant could confirm the figures contained therein, including the turnover figure. The turnover figures are as follows:
- financial year 2016: more than XXX EUR;
- financial year 2017: more than XXX EUR, - financial year 2018: almost XXX EUR.
37. On 17 October 2019, the defendant's counsel confirmed on behalf of his client that the annual accounts listed above are accurate. By means of this letter, the defendant wished to draw the attention of the Litigation Chamber to an enclosed forecast for the fiscal year 2019 (see below). 
38. A transcript of the hearing was sent to the defendant for information by e-mail dated 30 October 2019, asking him to respond within 2 working days if he had any comments. The defendant was informed that this does not reopen the debates and that the comments may only refer to the presentation of the oral debates.
39. The defendant submitted his observations to the Dispute Chamber and insisted, among other things, on taking into account "the fact that Y was always willing to cooperate long before the official start of the investigation and that it repeatedly asked the GBA for feedback, which was never given". )
40. On 5 November 2019 this case was discussed again at the session of the Disputes Chamber. The Disputes Chamber decided to initiate the cooperation procedure as referred to in article 60.3 AVG.
41. On 8 January 2020, an English translation of the draft decision was submitted to the relevant data protection authorities in accordance with Article 60.3 of the AVG. On 15 January 2020, the respondent was informed by letter.
42. The Netherlands submitted a relevant reasoned objection on 4 February 2020. The Netherlands asked for more references to the case law of the Court of Justice regarding the analysis of the defendant's legitimate interest in sending invitations to third parties who are not members of its social media platform, on the one hand, and contested the relevance of references to a research report from 2013 regarding the legitimate interest of a social medium to send invitation emails, on the other hand.
43. The Dispute Chamber decided on 14 February 2020 to uphold the objection lodged, in particular as regards the assertion that the application of the legal basis justified an interest in
in the present case, an assessment in concreto of all the relevant factual elements, taking into account the case-law of the Court of Justice: the Chamber of Disputes decided to reopen the debates as regards the analysis of the legitimate interest of the defendant.
44. The Disputes Chamber informed the defendant by registered letter of 18 February 2020 of this relevant and substantiated objection, as well as of its content, and invited the defendant to respond by 9 March 2020 at the latest, regarding the possible invocation of the legitimate interest as a legal basis for the disputed data processing operations. The defendant submitted its response by letter of 9 March 2020.   
45. The Disputes Chamber then took note of the defendant's arguments regarding his legitimate interest and, following the Inspection Report and taking into account the defendant's argumentation, ruled that it would impose a fine of EUR 50,000 on the basis of the infringements of the AVG that it had established.
46. In order to give the defendant the opportunity to defend himself on the amount of the fine proposed by the Chamber of Disputes, the Chamber of Disputes decided to list relevant infringements in its standard 'form for reaction against the proposed fine', which was sent by e-mail of 7 April 2020, stating that the defendant was free to further complete this document with its reaction on the particular circumstances of the case, the proposed amount of the fine and the annual figures submitted.  The defendant replied by e-mail of 28 April 2020 with its arguments regarding the amount of the fine as well as new information regarding the turnover for the fiscal year 2019 which exceeds EUR 10.000.000 according to the latest forecast of the defendant.
47. In the meantime, the Chamber of Disputes had decided to submit a revised draft decision to the relevant authorities on 23 April 2020 in accordance with Article 60.5 AVG. This international procedure ended on 8 May 2020, without any substantiated objection.
48. The Dispute Chamber then adjusted its decision to take into account the defendant's arguments regarding the fine.
2. Decision
2.1 Qualification of the controller and of the processing at issue
49. The defendant is responsible for processing the personal data of the users of the social media platform "W", as well as for processing the contact data of non-users (names, telephone numbers or e-mail addresses) and other contact information stored on the servers of "W" as a result of the synchronization of the address book (GSM or e-mail) of the users of the website.
50. After all, under Article 4.7 AVG, the controller is 'a natural or legal person, a public authority, a service or other body, whether or not a third party, to whom/which the personal data are provided'. […]”.
51. The Court of Justice of the European Union has interpreted on several occasions that the term 'controller' refers to 'the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data', with a view to ensuring effective and comprehensive protection of data subjects through a broad definition of the term 'controller'. Moreover, this notion 'does not necessarily refer to a single body and may involve several participants'.
to such processing, each of which is then subject to data protection provisions
fall."
52. In accordance with the Group ' s Opinion 1/2010 on the terms
"The Chamber of Disputes assesses the role and capacity of the 'controller' and 'processor' in concrete terms23. 
53. In the present case, the defendant is responsible for the storage of the contact details of the website users, since the defendant has predetermined the means and purposes of this processing (sending invitation emails). With regard to the means and conditions for this processing, for example, the retention period of contact data is determined by the defendant in Article 11 of its privacy policy. This period shall be 3 months following the closure of the user's account, or immediate deletion when the website user deselects the "Contact Synchronisation".
54. The defendant is also in this case the data controller, which consists of sending invitation emails in the name and on behalf of "W" to contacts of current users.
55. However, the transmission to the recipients of the invitation emails and the processing of personal data in the message itself do not fall under the GCG to the extent that the "household exception" exception applies, i.e. if it concerns a purely personal or household activity within the meaning of Article 2 of the GCG.
56. The defendant himself cannot invoke this 'household exception' as clarified in recital 18 of the AVG: 'This Regulation shall not apply to the processing of personal data by a natural person in the context of a purely personal or domestic activity which as such is unrelated to any professional or commercial activity. Personal or household activities may include conducting correspondence or keeping address records, social networking and online activities in the context of such activities. However, this Regulation shall apply to controllers or processors providing the means for processing personal data for such personal or household activities'. Thus, the defendant is responsible for sending out invitation emails even if the website user could invoke the household exception as regards his own processing of personal data.
57. Moreover, the defendant itself does not dispute that the AVG applies to the contested processing operations and does not invoke the exception for personal or household purposes.
2.2 Clarification with regard to the household exception and the concept of personal communication
58. The defendant claims that he considers the invitation e-mails to be a 'personal communication'. In his conclusion and at the hearing, the defendant clarified that this defence has nothing to do with the 'household exception' and that at no point did he claim that the AVG would not apply. According to the defendant, the notion of 'personal communication' merely refers to the fact that it does not constitute a marketing message within the meaning of Article 13.2 of the ePrivacy Directive, according to the criteria defined by Group 29 in its Opinion 5/2009 on online social networks .
59. Thus, the defendant does not dispute that the AVG is applicable and that he is the controller with regard to the sending of invitation e-mails.
60. De Geschillenkamer adds that certainly if the recipients of the invitation e-mail have been determined in advance by the online social platform (e.g. pre-ticked), the user of the website concerned has no control over an important aspect of the purposes of the processing (indicating the recipients). The pre-check of recipients by the defendant is therefore in this case an additional element to consider the defendant as a data controller.
61. Finally, it is thus established that the defendant is responsible for the processing of personal data of the contact persons of the users of the "W" website, both as regards the storage of those data and the sending of an invitation e-mail.
2.3 Legal basis for processing the contact details of users and non-users of the "W" website
62. As a data controller in the context of the 'invite a friend' functionality, the defendant must ensure that this processing complies with the principles of data processing and is lawful, in the sense that the processing is carried out on an adequate legal basis (Articles 5 and 6 AVG).
63. The processing concerns personal data of users and non-users of the website "W", and is twofold: the storage of contact data on the defendant's servers and the sending of invitation emails.
64. The defendant claims that the procedure elaborated on the "W" website ensures that it obtains free, specific, informed and unambiguous consent from the user of the website, in accordance with the requirements of Articles 4.11, 6.1 and 7 of the AVG, with regard to the "invite a
friend/invite a friend' functionality (defendant's conclusion, p. 19).
65. In particular, the defendant states that the consent of the recipient of the message is not required, neither for the storage of his contact details on the servers of the website, nor for the sending of an invitation e-mail, and this because the user of the website has given his consent for the import of his address book by the defendant:
"First of all, it should be pointed out that importing the contact details of the contacts is a processing of personal data that is part of the purpose of the 'invite a friend' functionality. As explained above, for this purpose Y processes personal data included in the address book of a user who has given his consent. Y can therefore invoke a valid legal basis for importing the personal data of these contacts". (Defendant's conclusion, p. 21).
66. The defendant reiterated this assertion at the hearing, and also clarified that he did not wish to invoke any other legal basis in that respect.
67. The defendant also refers to other online services where users can "upload/upload" their address book (Gmail, Hotmail, Whatsapp and Messenger) as well as operating systems (such as IOS, Android and Windows) where users upload their address book and photos:
"If the Inspectorate tries to demonstrate that whenever a user of a service uploads personal data relating to people he knows, the company operating the service must obtain the consent of these people, this would undermine the operation of online communication services in general. Such a position would apply not only to "invite a friend" functionalities such as Y and other online social networking services, but also to (i) messaging services such as Gmail, Hotmail, Whatsapp and Messenger, where users upload their address book, (ii) operating systems such as iOS, Android and Windows, where users upload their address book and photos, and (iii) other services such as booking services and aircraft check-in services, where users can upload personal data of people they know, etc. "”  .
 
3.  Motivation regarding the processing of personal data of users versus non-users
3.1 With regard to the processing of personal data of non-users
3.1.1 No valid consent
68. The Disputes Chamber does not follow the defendant in his assertion that the user of the social media website himself can give his consent for the import by the website of personal data of third parties in his address book, with a view to sending an invitation e-mail.
69. Under the GCAU, only the data subject whose personal data are processed can validly consent to the processing of these data, except in cases of parental consent (Art. 8.1 GCAU) or another legal power of attorney . In the event that data of a third party is used, this third party must give permission in accordance with the conditions of Article 7 in conjunction with Article 4.11 of the AVG, as interpreted by
Group 29.  There is no such consent here. In addition, such consent can de facto only be given by existing members of "W" if and to the extent that they would give their consent to the use of their personal data in accordance with the terms and conditions of the AVG at the time they enter the platform.
70. In this context, the Disputes Chamber also refers to an investigation by the Dutch Data Protection Authority into Whatsapp, dating from before the entry into force of the AVG. In the context of the mobile application Whatsapp, this authority ruled that the social media user cannot give valid consent in the name and on behalf of a non-user of the social media platform: 'Whatsapp users cannot give (unambiguous) consent on behalf of the non-users in their address book to have the contact details relating to them processed by WhatsApp, without being authorised to do so by the non-users concerned. Only the affected non-users themselves (or their legal representatives) may give such consent. Because WhatsApp does not obtain the unambiguous consent of non-users in Whatsapp users' address books for the processing of their personal data and yet processes them, and WhatsApp has no other basis for such data processing, WhatsApp is in violation of Article 8 of the (Dutch) Data Protection Act ".
3.1.2 Possibility of invoking a legitimate interest
71. In the present case, no legal basis other than 'consent' is invoked by the defendant. The defendant only invoked the basis "legitimate interest" in a subordinate capacity, in response to the questions raised by the Disputes Chamber following the objection lodged by the Netherlands. The Disputes Chamber therefore investigates whether the disputed processing of personal data of non-users can have a legal basis under Article 6 of the AVG, and whether or not the processing is therefore 'lawful' within the meaning of Article 5.1 of the AVG.
72. In the absence of any possibility to request permission with regard to the processing of personal data of non-users, the Disputes Chamber investigated to what extent the social media platform "W" could process the data of third party non-users on the basis of its legitimate interest (art. 6.1.f) AVG, with a view to very limited purposes, as explained below.
73. De Geschillenkamer understands that the website "W" has an interest in processing third party non-users' personal data in order to stimulate an increase in the number of members of the platform. 
74. In this case, the data of third party non-users are not processed solely for the purpose of identifying members of the "W" website. However, the data of contact persons (including third party non-users) are potentially kept by the Website for 3 months after a "W" account has been closed by the user .
75. The website "W" also processes more data than necessary to send an invitation e-mail as these data are not restricted by the website itself: not only contact data determined by the website itself (e.g. names, telephone numbers and e-mail addresses) but on the contrary possibly other categories of personal data such as from third party providers of information society services, i.e. "other information as clarified on the permissions screen of the provider, about your contacts imported on our servers". 
76. Article 6.1.f of the AVG provides that the legal basis may be used in so far as 'the processing is necessary in order to protect the legitimate interests of the controller or of a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child'. 
77. The case law of the Court of Justice of the European Union requires that recourse to Article 6(1)(f) of the AVG must meet three cumulative conditions: "namely, in the first place, the furtherance of a legitimate interest of the controller or of the third party or parties to whom the data are disclosed, in the second place, the necessity of processing the personal data for the purposes of pursuing the legitimate interest and, in the third place, the condition that the fundamental rights and freedoms of the data subject do not prevail" .
   
   
78. In other words, the person responsible for processing must demonstrate that:  
.  
1) the interests it pursues in the processing may be recognised as legitimate (the 'purpose test');
has taken the following decision regarding:  
2) the intended processing is necessary for the purposes of pursuing those interests (the 'necessity test'); and
- X, hereinafter referred to as 'complainant';  
3) weighing these interests against the interests, fundamental freedoms and fundamental rights of data subjects in favour of the controller or of a third party (the 'balancing test').  
- Y, hereinafter referred to as "defendant".  
   
   
   
   
(a) Facts and procedure
The target key
1. On 14 June 2019, the complainant filed a complaint with the Data Protection Authority against the defendant.
   
   
2. The subject of the complaint concerns the use of health data obtained from the person concerned by the insurance company within the framework of hospitalisation insurance for other purposes without the express consent of the insured person concerned. The complainant states that he has no problem with his health data being processed for the execution of obligations under the hospitalization insurance taken out with the defendant, but does have a problem when the same health data are processed for the purposes listed in point 4.3. of the privacy statement and for the transfer to third parties as mentioned in point 9 of the same privacy statement (it concerns point 6, but the reference to point 9 is a material error) as mentioned in the privacy statement of the defendant. He asks that specifically for those purposes, as well as for the transfer, the defendant gives the data subject the choice whether or not to consent to the processing of his health data. Finally, the complainant indicates that he wishes to receive a data protection impact assessment from the defendant, as it concerns the processing of data with a high risk for the data subjects.  
79. The Court of Justice clarifies that the legitimate interest must also be "existing, current and not hypothetical at the date of processing".    
   
   
3. On 26 June 2019, the complaint will be declared admissible pursuant to Sections 58 and 60 of the WOG, the complainant will be notified pursuant to Section 61 of the WOG and the complaint will be submitted to the Disputes Chamber pursuant to Section 62(1) of the WOG.  
80. The Dispute Chamber also refers to the recent Guidelines 3/2019 on the processing of personal data by camera , in which the EDPB reiterated that the controller or third parties may pursue legitimate interests of various kinds, in particular, interests of a legal, economic or immaterial nature . In this context, the EDPB also refers to the judgment of the Court of Justice that "the interest of a third party in obtaining personal data from a person who has caused damage to his property, in order to recover the damage from that person before the courts, is a legitimate interest
is".  
   
   
4. On 23 July 2019, the Disputes Chamber will decide on the basis of art. 95, §1, 1° and art. 98 WOG that the file is ready for treatment on the merits.  
81. On the basis of the case law of the Court of Justice and the guidelines of the EDPB, the Disputes Chamber rules that the concept of legitimate interest can have a broad scope, on the understanding that an interest invoked by a data controller is sufficiently specific. In the context of the present case, the Disputes Chamber does not rule on the question whether an economic interest can be regarded as a legitimate interest within the meaning of Article 6.1.f of the AVG.  
   
   
5. On 24 July 2019, the parties concerned will be informed by registered mail of the provisions as mentioned in article 95, §2, as well as of these provisions in art. 98 WOG. On the basis of art. 99 WOG, the parties concerned were also informed of the time limits for submitting their defences. The deadline for receiving the conclusion of the complainant's reply was set at 7 October 2019 and for the defendant at 7 November 2019.  
82. In the present case, the defendant points out that 'the purpose of the W platform is essentially to allow users to connect with each other and to have interesting conversations and exchanges with the other users' and that
o Y, as processing manager, has an interest in offering users of the W platform the possibility to find contacts who are already users and/or invite other contacts who are not yet users to become members;
o the user of W, as a third party or as a data controller using the platform under the household exception (recital 18 AVG), has an interest in finding or inviting persons he knows in order to build up his network more easily" .  
83. The defendant also invokes that the development of the "invite a friend" functionality was driven by the fact that certain users asked for an easy way to find or invite acquaintances, and that the "experience" of the user on the social platform "W" is made more pleasant by this "invite a friend" function. The defendant also stresses that this interest is "an actual and present interest that is neither vague nor speculative in nature".  
   
   
6. On 29 July 2019, the defendant notifies the Chamber of Disputes that she has taken note of the complaint, requests a copy of the file (art. 95, §2, 3° WOG) and accepts electronically all communication concerning the case (art. 98, 1° WOG).  
84. The Disputes Chamber holds that, on the basis of these facts and motives, the defendant demonstrates the existence of an interest to be taken into account, that this interest is present and sufficiently specific, as is apparent from the detailed statements of the defendant.  
   
   
7. A copy of the file shall be transmitted to the defendant on 30 July 2019.  
The necessity test
85. The Court of Justice has clarified that, in order to review this condition, it must be verified "that the legitimate interest of processing of data sought ... cannot reasonably be achieved as effectively by other means which are less prejudicial to the fundamental freedoms and rights of data subjects, in particular the right to respect for private life and the right to the protection of personal data.
personal data as guaranteed by Articles 7 and 8 of the Charter' .  
   
   
8. On 2 August 2019, the Disputes Chamber receives a letter in which the defendant indicates that he wishes to be heard by the Disputes Chamber (art. 98, 2° WOG).  
86. The Court of Justice has also clarified that the condition relating to the necessity of the processing must also be examined in conjunction with the principle of minimum data processing laid down in Article 5(1)(c) of the AVG.  
   
   
9. On 6 September 2019, the Disputes Chamber receives the conclusion of the response from the defendant. The defendant states in its conclusion that the processing of special categories of personal data, in this case health data, by the health care insurer is lawful. The processing of these special categories of personal data (Article 9 of the AVG) is in principle prohibited. For the processing, the defendant invokes the exception ground of article 9 paragraph 2, a AVG. This is the legal basis for the explicit consent of the data subject. Second, the defendant argues that no separate consent is required for every transfer of personal data. Third, according to the defendant, there is no question of requesting consent for the processing of data other than health data. Finally, according to the defendant, a data protection impact assessment was not necessary in this case as it concerns already existing processing operations and not new processing operations that started after 25 May 2018.  
87. The defendant claims that the "W " platform processes only the basic contact data of its users' contacts. However, it appears from the factual data that the defendant keeps these data in principle for 3 months, unless the user of the platform decides to stop the synchronisation of his contacts.  
   
   
10. The complainant did not exercise the right to submit a reply.  
88. De Geschillenkamer is of the opinion that the collection of these contact data - with regard to both users and non-users of the website - only passes the necessity test if these data are immediately deleted after initial use.  
   
   
11. The defendant does not submit a new conclusion and on 7 November 2019 submits only productions in support of the conclusion of reply submitted on 6 September 2019.  
89. As far as non-users are concerned, the Disputes Chamber decides that it should be possible for the social media platform "W" to invoke the legitimate interest, but only to process the personal data of the existing "W" members, in order to help those users to identify their contacts who are already "W" users and who have therefore agreed to use the "W" website's messaging function as a communication medium.  
   
   
12. On 9 January 2020, the parties are informed that the hearing will take place on 28 January 2020.  
90. It is important to note that these members have previously given their unambiguous consent to "W" to collect and process their mobile phone number or email for this purpose. In addition, 'W' must take appropriate technical and organisational measures in order to meet the data protection requirement by design and by default as set out in Article 4 of the Directive.
25 AVG to comply.  
   
   
13. On 28 January 2020, the defendant will be heard by the Chamber of Disputes. The complainant, although duly summoned, did not appear. Among other things, the defendant answers questions from the Disputes Chamber about the legal basis for the processing of personal data, other than health data. After this, the debates are closed.  
91. In this context, the Disputes Chamber also refers to Group 29's Opinion 5/2009 on online social networks. This opinion states in this respect that social media networks have no basis for processing data of non-users other than the legitimate interest, and that, moreover, it is not possible to invoke this basis to extract contact details of non-members from uploaded address books and then use them to create new social media profiles: 'Many social network services let their members contribute data about others, such as adding a name to an image, rating people, drawing up lists of people who want to meet or have met members. These tags can also be used to identify non-members. However, the processing of such data about non-members by a social network service is only allowed if one of the criteria laid down in Article 7 of the Data Protection Directive [now Article 6.f AVG "legitimate interest"] is met. There is no legal basis for creating ready-made profiles of non-members by collecting data provided independently by members, including relationship data derived from uploaded address books'. .  
   
   
14. On 29 January 2019, the oral hearing will be verbally presented to the parties.  
92. This opinion is, in principle, still relevant since the legal basis of legitimate interest has not been substantially changed by the entry into force of the AVG. The fact that, according to his allegations, the defendant does not create 'profiles', but only sends out invitation e-mails using the contact details of non-members, does not alter the fact that the sending of these e-mails is not necessary for the purpose intended by the defendant.  
   
   
15. On 31 January 2020, as requested at the hearing, the defendant provides the annual turnover for the last three financial years. Over the years 2016-2018, these always amount to a turnover between 500 and 600 million Euros.
93. The Group 29 has refined this opinion and defined the general interest of social media networks in the context of invitation emails, taking into account the fundamental rights and freedoms of third party non-users. In its Opinion No 06/2014 on the concept of legitimate interest, the Working Party 29 explained the limitations of the legitimate interest in relation to third party contact details by means of an example :
   
   
16. On 6 February 2020, the Chamber of Disputes receives some comments from the defendant concerning the minutes, which it decides to include in its deliberations.
"Example 25: Access to mobile phone numbers of users and not app users: 'compare and forget':
   
   
17. On 25 March 2020, the Disputes Chamber informed the defendant of its intention to impose an administrative fine, as well as the amount thereof, in order to give the defendant the opportunity to defend himself before the sanction is effectively imposed.  
Personal data of individuals are processed to check whether they have already given unambiguous consent in the past (i.e. "compare and forget" as a guarantee).
An app developer is required to obtain unambiguous consent from data subjects for the processing of their personal data: for example, the app developer wants to access and collect the entire electronic address book of app users, including mobile phone numbers of contacts who do not use the app. In order to do so, it must first assess whether the holders of the mobile phone numbers in the address books of the users of the app have given their unambiguous consent (in accordance with Article 7(a)) to have their data processed. For this limited initial processing (i.e. short-term access for reading the full address book of an app user), the app developer may rely on Article 7(f) as the legal basis, subject to the necessary safeguards.
Technical and organisational measures should be part of the safeguards to ensure that the company only uses this access to help identify which of its contact persons are already users, and who have therefore in the past given their unambiguous consent to the company to collect and process telephone numbers for this purpose.
The mobile phone numbers of non-users may only be collected and used for the strictly limited purpose of verification whether they have already given their unambiguous consent to the processing of their data and must be deleted immediately afterwards'.  
   
   
18. On 8 May 2020, the Disputes Chamber will receive the defendant's response to the intention to impose an administrative fine, as well as the amount thereof.  
94. In summary, Group 29 believes that - in the circumstances described in the above example - the contact details of third party non-users should only be used to check whether or not they are already members of the website, and thus have already given their consent to their contact details being used for communications via the website in question. As stated above, the Chamber of Disputes bases its decision partly on this consideration of Group 29, and considers that the storage of contact details of non-users of Y may only be necessary in the context of "compare and forget" under certain strict requirements and safeguards.  
   
   
19. The defendant argues that the alleged infringements as included in the intention of the Chamber of Disputes are completely new and that he has not been able to defend himself in this respect. However, the Chamber of Disputes must establish that it is irrefutable from the documents in the file that the defendant has been able to fully exercise his right of defence.  
95. However, the Disputes Chamber notes that the retention period of contact details of non-members exceeds what is strictly necessary to identify existing contacts. The website "W" also processes more data than necessary to send an invitation e-mail as these data are not restricted by the website itself: not only contact data determined by the website itself (e.g. names, telephone numbers and e-mail addresses) but, on the contrary, possibly other categories of personal data such as those of third party providers of information society services, i.e. "other information as clarified on the website".
permissions screen of the provider, about importing your contacts on our servers".  
   
   
20. The defendant also disagrees with the imposition of a fine, or the proposed level of the fine. It does not, however, put forward any (new) arguments in support of this assertion. Therefore, the defendant's response does not give cause for the Disputes Chamber to amend the intention to impose an administrative fine, nor does it change the amount of the fine as intended.  
96. Pursuant to the above, the Dispute Chamber finds that the storage of contact information of non-Y users may only be necessary in the context of "compare and forget" under certain strict requirements and guarantees. These requirements and safeguards are not met.  
   
   
(b) Legal basis
   
   
• Lawfulness of processing
The weighting test
   
   
Art. 6.1. AVG
96. The Court of Justice clarifies that: "the assessment of that condition involves a balancing of the conflicting rights and interests at issue, which depends on the particular circumstances of a particular case and which must take account of the importance of the rights of the person concerned under Articles 7 and 8 of the Charter".  
   
   
1. Processing shall only be lawful if and insofar as at least one of the following conditions is met:
97. The criterion relating to the seriousness of the infringement of the rights and freedoms of the person concerned is an essential part of the case-by-case assessment required by Article 6.1.f of the AVG. In
a) the data subject has given his or her consent to the processing of his or her personal data for one or more specific purposes;
according to the Court of Justice, this connection must take account in particular of 'the nature of the personal data concerned, in particular their possible sensitivity, as well as the nature and the practical arrangements for processing them, in particular the number of persons having access to them and the ways in which they may be accessed'.
b) processing is necessary for the performance of a contract to which the data subject is party, or to take measures at the request of the data subject prior to the conclusion of a contract;
98. As highlighted by the Court, 'also relevant in this balancing exercise' are 'the data subject's reasonable expectations that his personal data will not be processed where, in the circumstances of the case, he cannot reasonably expect further processing'51. In this context, the Disputes Chamber also refers to recital 47 AVG which states that what is relevant is what 'the data subject may reasonably expect, at the time and in the context of the collection of the personal data, that processing may take place for that purpose'. ”
c) the processing is necessary to comply with a legal obligation incumbent on the controller;
[…]
(f) processing is necessary for the purposes of pursuing the legitimate interests of the controller or of a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.  
   
   
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the exercise of their functions.  
99. In the present case, as regards the seriousness of the infringement, the defendant invokes the following special circumstances: "The nature of the personal data processed by Y in the context of its 'invite a friend' functionality was not excessive. Y has never processed sensitive data, only the absolute minimum of personal data (i.e. basic contact data) with only one purpose, namely to send the invitation e-mail at the request of and on behalf of the user of the W platform'.  However, the Dispute Resolution Chamber again notes that the
retention period of contact details of non-members exceeds what is strictly necessary to identify existing contacts. Moreover, the data processed are not defined in an exhaustive manner by the defendant. Among other things, the defendant refers to "other information, as clarified on the provider's permissions screen, about importing your contacts into our servers".
   
   
• Transparent information
100. With regard to the reasonable expectations of the data subject, the defendant refers to services provided by online email service providers such as Google, or services provided by operating system providers such as Android, IoS and Windows, or providers of social networks such as LinkedIn54. The Litigation Chamber discusses the relevance of practices of these other providers in section 3.1.3 and finds that the arguments concerning these practices fall outside the scope of the current proceedings.
   
   
Art. 5.1. AVG:
101. In view of the above, the Disputes Chamber decides that the third condition imposed by Article 6.1(f) AVG and the case law of the Court of Justice has not been met in the present case.  
Personal data must be: 
Conclusion 
(a) processed in a way that is lawful, adequate and transparent as regards the data subject ('lawfulness, adequacy and transparency');
100. The defendant could not validly invoke the 'legitimate interest' as a legitimate ground for the (further) processing of the personal data of the data subject for direct marketing purposes. The defendant is thus in breach of Article 6.1(f) of the AVG.
[…]
   
   
101. Furthermore, the Disputes Chamber rules in this case that the legitimate interest in this case only allows the processing of data of non-users for the purpose of a "compare & compare".
forget' action, in order to select existing users under the contact details, and
send any invitation email to those existing users.
   
   
Art. 5.2. AVG:
102. More specifically, in this case the Chamber of Disputes is of the opinion that the processing must be limited to the data strictly necessary for the purpose of the 'invitation to lodge an application'.  
website" and insofar as it is technically impossible to distinguish between members and non-members in a user's address book without first processing these data as a minimum. In addition, in accordance with Article 32 of the AVG, the defendant should take appropriate technical and organisational measures to secure the processing properly. Only under these conditions could this processing take place on the basis of the defendant's legitimate interest.
   
   
2. The controller shall be responsible for ensuring compliance with paragraph 1 and shall be able to demonstrate ('accountability')  
103. The Chamber of Disputes takes into account the fact that the user of the website "W" is still free to send invitations via other channels (social media website or e-mail provider), which the third party already uses.
   
   
Art. 12.1. AVG.
   
   
1. The controller shall take appropriate measures to ensure that the data subject receives the information referred to in Articles 13 and 14 and the communication relating to the processing referred to in Articles 15 to 22 and Article 34 in a concise, transparent, comprehensible and easily accessible form, in clear and simple language, in particular when the information is specifically intended for a child. The information shall be provided in writing or by other means, including, where appropriate, by electronic means. If the data subject so requests, the information may be provided orally, provided that the identity of the data subject is proven by other means.
3.1.3 Defence in relation to the processing of data of third persons by other information society service providers
   
   
104. The defendant compares its practices with the processing of data of third parties by other service providers such as " Whatsapp " and " Gmail ", "Windows", "LinkedIn".  The defendant argues, inter alia, that data subjects can reasonably expect their contact data to be processed by different types of online service providers, since, according to the defendant, it is "the normal course of business" for a person to have their contact data processed.
of other persons in an address book in order to facilitate communication".
   
   
Art. 13.1. and 2. AVG.  
105. The Chamber of Disputes rules that the defence regarding the processing of the data of third persons by service providers does not stand up.  
   
   
1. Where personal data relating to a data subject are collected from that person, the controller shall provide the data subject with all of the following information when the personal data are obtained:
106. First, the practices of other service providers are not at issue in the present case.  
[…]
c) the processing purposes for which the personal data are intended and the legal basis for the processing;
d) the legitimate interests of the controller or of a third party where the processing is based on Article 6(1)(f);
[…]
2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following additional information when the personal data are obtained in order to ensure proper and transparent processing:
[…]
(b) that the data subject shall have the right to obtain from the controller access to, and the right to rectify or erase, personal data or to restrict processing operations concerning him/her, as well as the right to object to such processing and the right to obtain the transfer of data;
[…]
   
   
107. Secondly, the requirement of a proper legal basis for the processing of non-users' data for all service providers, including those referred to by the defendant in its conclusion.
   
   
e) Reason
108. Thirdly, these service providers may not process personal data of third parties in a way that would infringe their rights and freedoms, whatever the legal basis of the processing. As clearly explained by the Working Party 29 in the context of the right to portability, information society service providers and telecommunication service providers may not infringe the rights and freedoms of non-users of their services if a user gives his consent to store on their servers personal data of non-users . Moreover, in this context, the Working Party has also reiterated that the user's consent is not sufficient to process data of non-users: a different legal basis must be laid down, and the legitimate interest of the service provider appears to be the most appropriate basis58.
   
   
a) Purposes in 4.3. of the Privacy Statement - Ground for processing (Art. 6.1. AVG)
109. The Disputes Chamber ruled that these views of the Group 29 support the earlier finding of non-compliance - in this case - with the AVG. In summary, the unlawfulness of the data processing of the website "W" results from the fact that this website processes the data of non-members without a proper legal basis, to the extent that this processing was not limited to a "compare & forget" action as set out above.  
   
   
21. The Disputes Chamber notes that the issue raised by the complainant relates to point 4.3. of the defendant's privacy statement, which states that personal data are processed on the basis of the legitimate interest of the insurance company, for the following purposes:
• Performing computer tests;
• Monitoring the quality of service;
• Training personnel;
• Monitoring and reporting;
• Preventing abuse and fraud;
• The storage of video surveillance recordings during the legal period
• Compiling statistics of coded data, including big data;
• Providing information, regardless of the means of communication, on the commercial actions, products and services of the insurance company and of the group to which it belongs.
   
   
22. The complainant argues in this regard that the customer should be given a choice as to whether he agrees to the processing of sensitive data relating to him that he has provided to the defendant in the context of carrying out the obligations relating to his hospitalisation insurance, for the purposes listed in point 4.3 above. The complainant contends that the defendant does not offer him this option.
   
   
23. In this regard, the defendant argues that the processing operations listed in 4.3. of the Privacy Statement do not require consent, since the defendant invokes the legitimate interest as a legal basis for the processing for the purposes stated therein in accordance with Article 6.1.f) of the AVG. The defendant argues that he can rely on that legal ground, since only 'ordinary' personal data are processed for those purposes and no consent of the data subject is required as in the case of health data as referred to in Article 9 AVG.
   
   
24. The defendant argues that for the purposes mentioned in point 4.3. of the Privacy Statement, personal data are processed, but not health data.
3.1.4 Use personal data of non-users to send invitation emails
   
   
25. The Disputes Chamber notes that for the processing of personal data, other than health data, the lawfulness of the processing must be assessed in the light of article 6.1. AVG which contains six ancillary processing grounds, including the legitimate interest (art. 6.1(f) AVG) invoked by the defendant in the present case.  
110. De Geschillenkamer is of the opinion that the storage of contact details of non-users of a website for the purpose of sending an invitation e-mail is only permitted in the context of a "compare & forget" action, as explained above. It follows that it is only possible to send invitation emails to existing members via the "W" website. The Dispute Resolution Chamber will therefore only consider the availability of a legal basis for sending invitation emails to non-users in the future of this decision.  
   
   
26. However, the Disputes Chamber emphasises that, according to the jurisprudence of the European Court of Justice, when a controller relies on the legitimate interest to consider a processing operation to be lawful, 'three cumulative conditions must be met for the processing of personal data to be lawful, that is to say, in the first place, the protection of a legitimate interest of the controller or of the third party or parties to whom the data are disclosed, secondly, the necessity of the processing of the personal data for the protection of the legitimate interest and, thirdly, the fact that the fundamental rights and freedoms of the data subject do not prevail.”
111. As mentioned above, the defendant argues that the invitation e-mails constitute a "personal communication" on the part of the user of the "W" website, so that no separate legal basis is required for sending this message. However, the defendant stated in its conclusion and confirmed at the hearing that it does not intend to invoke the 'domestic processing' exception in recital 18 AVG.  
27. In doing so, the interests or fundamental rights and freedoms of the person concerned must be weighed up (Article 6(1)(f) of the AVG) and the considerations of the AVG in relation to Article 6(1)(f) must be taken into account. AVG should be taken into account, in particular Recital 47.  
   
   
28. Thus, the Disputes Chamber is of the opinion that, for each of the purposes mentioned in point 4.3. of the privacy statement, the extent to which the defendant can invoke the legitimate interest as a legal ground on which the processing is based should be examined. Recital 47 of the AVG states centrally that a careful assessment is required to determine whether there is a legitimate interest, as well as to determine whether a data subject may reasonably expect that processing can take place for that purpose at the time and in the context of the collection of the personal data.  
112. By 'personal communication', the defendant means that these invitation emails do not constitute a marketing message, on the understanding that advertising messages by email may - subject to exception - only be sent after prior consent (see also Article 13.2 of the ePrivacy Directive  and its implementation in Article VI.110 § 2 of the Economic Law Code ).  
   
   
29. On the basis of the elements available to the Chamber of Disputes, it is of the opinion that the defendant can base the data processing on the legitimate interest for the objective 'prevention of abuse and fraud' as mentioned in section 5 of point 4.3. of the Privacy Statement. Indeed, it is undisputed that the processing of personal data for this purpose is necessary to protect the legitimate interest of the defendant and that this interest outweighs the interest of the complainant in the protection of his personal data. In this respect, the Disputes Chamber refers to consideration 47 of the AVG, which states that the processing of personal data that is strictly necessary for the prevention of fraud is a legitimate interest of the controller.
113. In its Opinion 5/2009 on online social networks, the Group 29 indicated the conditions under which invitation messages sent via a social media platform do not constitute an online advertising message under the platform:
30. The Litigation Chamber adds that notwithstanding the defendant's assertion that no health data are processed for the purposes set out in 4.3. of the Privacy Statement, including the purpose of 'preventing abuse and fraud', it is clear from the consent form that explicit consent is sought to process health data for, inter alia, 'prevention, detection and investigation of insurance fraud'. The Litigation Chamber finds here that there is an inconsistency between what the defendant asserts in its conclusion and what the consent form determines and comes back to this when assessing the obligation of transparency that rests on the defendant.
   
   
31. The purpose included in section 8 of point 4.3. of the privacy statement "providing information, whatever the means of communication, on the commercial actions, products and services of the insurance company and of the group to which it belongs", which must be qualified as direct marketing, is also possible on the basis of the legitimate interest, but must be read in conjunction with Article 21.2. AVG which states that the data subject has the right to object at any time to the processing of personal data relating to him/her for direct marketing purposes, including profiling relating to direct marketing. The Disputes Chamber will also return to this matter when assessing the obligation of transparency on the part of the defendant.  
"Some social networking services let their users send invitations to third parties. The ban on the use of e-mail for direct marketing does not apply to personal communications. The exemption for personal communications only applies if the social network service meets the following criteria: 
– no pressure should be applied to the transmitter or receiver;
– the provider is not allowed to choose the addressees of the message;
– the identity of the user sending the message must be clearly indicated;
– the user sending the message must be aware of the full content of the message to be sent on his behalf'.
   
   
32. For the other purposes included in 4.3. of the privacy statement, the Disputes Chamber is of the opinion that there is no question of a legitimate interest on the part of the defendant that would outweigh the interests and fundamental rights of the complainant to the protection of his personal data.  
114. The defendant refers to these four terms and conditions , and therefore believes that he may send these messages without prior consent.  
   
   
33. Recital 47, which states that a legitimate interest may exist where there is a relevant and appropriate relationship between the data subject and the controller, in situations where the data subject is a customer, does not imply, according to the Litigation Chamber, that in the context of that relationship where the complainant is acting as a customer of the defendant, data processing would be possible for any purpose. The defendant does not demonstrate in any way what his legitimate interest would consist of and also fails to demonstrate to what extent his interest would outweigh the interests and fundamental rights of the complainant, although he is obliged to do so by virtue of his accountability (art. 5.2. AVG).
115. The fact that the sending of marketing e-mails is partly regulated by the ePrivacy Directive does not affect the competence of the Dispute Resolution Chamber to supervise the application of the AVG with regard to the consent requirement or the conditions for invoking the legitimate interest .  
34. The Disputes Chamber is therefore of the opinion that the infringement of art. 6.1. AVG is proven, since the data processing for the purposes mentioned in sections 1, 2, 3, 4, 6 and 7 of point 4.3. of the Privacy Statement, without any demonstrated legitimate interest, should be based on the consent of the complainant in the absence of any other potentially applicable legal basis in art. 6.1. AVG. The diversity of the purposes listed in 4.3. of the privacy statement leads the Disputes Settlement Chamber to decide that, for each of these purposes separately, the possibility must be offered to the complainant, and by extension to all data subjects using the service offered by the defendant, whether or not they consent to the processing of their personal data. In this regard, the Chamber of Disputes refers to the Guidelines on consent in accordance with Regulation 2016/679 , which provide that a service may involve multiple processing operations for multiple purposes. In such cases, data subjects should be free to choose which purpose they accept, rather than having to give their consent for a set of processing purposes. In a particular case, according to the AVG, it may be justified to obtain multiple consents before starting to provide a service.  
   
   
(b) Purposes in point 6. of the Privacy Statement - Ground for processing (Art. 6.1. AVG)
116. In this context, the Disputes Chamber decides that the social media network "W" should in principle not request permission to send e-mail messages from users to other users, if the 4 conditions of the Social Media Advice are respected, provided that all other AVG principles such as article 25 (data protection at design and at default settings) are respected.
   
   
35. In addition to 4.3. of the privacy statement, the complainant states that also with regard to point 6 of the privacy statement, which deals with the transfer of personal data to third parties, a problem arises because here too he is not offered the choice of whether or not to consent to the transfer of his personal data to third parties. The complainant states that transfers to third parties are not permitted without consent, unless there is a legal obligation to do so.  
117. In that case, "W" could - as previously stated - invoke its legitimate interest, including for the storage of the data on its servers, provided that the data of non-members are immediately deleted as soon as it appears that the user has not selected this addressee with a view to sending an invitation e-mail.  
   
   
36. The defendant claims not only to rely on consent as the legal basis for the transfer of personal data to third parties, but also, on the other hand, to invoke, as the case may be, the performance of the contract, the legitimate interest and the legal obligation and specifies, for each of the categories of third parties mentioned in 6. of the Privacy Statement, the legal basis on which the transfer is based.  
118. However, the Litigation Chamber is of the opinion that the strict AVG rules on consent - which also apply in the context of the ePrivacy Directive  - leave no room for such an interpretation, and that the legal basis " legitimate interest" should be interpreted restrictively to the extent that data of third persons are involved.  
   
   
37. The defendant explicitly states that, to the extent that it concerns a transfer of health data, the explicit consent of the data subject is required. This is only the case for the transfer to 'Insurance intermediaries, for data concerning health, in indemnity statements and in the copy of the insurance contract with possible exclusions and/or additional premiums, if the person concerned has given them prior explicit and informed consent' (point 6, second part of the Privacy Statement). For the other transfers mentioned in 6. of the privacy statement, the defendant states that it concerns personal data other than health data, in such a way that the consent of the data subject is not required.  
119. With regard to consent, Article 4(11) in conjunction with Article 7 of the AVG states that consent by the person concerned means the following:
- free;
- specific;
- informed and  
unambiguous expression of will by which the data subject accepts, by means of a declaration or an unambiguous active act, the processing of personal data concerning him/her.  
   
   
38. The Disputes Chamber notes that only in a single case health data are processed and the defendant obtains the consent for the transfer mentioned in point 6, second part, in such a way that no problem arises in this respect and the defendant acts in accordance with art. 9.2. a) AVG.  
120. This permission must be obtained prior to processing, as is evident from the opening words of Article 6.1 of the AVG: 'processing is only lawful if and insofar as at least one of the following conditions is met: (a) the data subject has given his or her consent to the processing of his or her personal data for one or more specific purposes [...]' .  
   
   
39. The defendant relies on the performance of the agreement (art. 6.1. b) AVG) as the legal basis for the transfer to the following third parties: "Health insurance funds, for enabling compensation; One or more insurance companies in case of co-insurance, assistance and/or recovery of costs in case of liability of a third party in the occurrence of the damage; Banking institutions; Postal, transport and delivery companies in order to be able to better send our mail" (6., third, fourth, eighth and ninth part of the privacy statement). The Dispute Chamber rules that these transfers are based on a valid legal basis.
121. Therefore, the Disputes Chamber decides that the AVG does not allow the sending of e-mails to third persons with a view to obtaining their consent. This reasoning applies to the requirement of consent under the AVG (requirement of a legal basis) and under the ePrivacy Directive (requirement of "opt-in" for sending marketing messages) . In addition, in its Opinion 5/2009 on online social media, the Working Party stated that sending third parties who are not members of a social media website an e-mail invitation to access their data violates the prohibition in Article 13(4) of the ePrivacy Directive:
   
   
40. The same applies to transfers to third parties that are based on a legal obligation (art. 6.1. c) AVG), i.e. transfers to third parties: "The insurance ombudsperson in the event of a dispute; Tax and social administrations, because of the statutory obligations of the health care insurer; The public supervisory and controlling authorities, because of the statutory obligations of the insurance company' (section 6., seventh, tenth, eleventh and twelfth sections of the privacy declaration).  
122. "There is no legal basis for creating ready-made profiles of non-members by collecting data provided independently by members, including relationship data derived from uploaded address books.  
Even if the social networking service were able to inform the non-user of the existence of personal data relating to him or her, a possible e-mail invitation to become a member in order to access those personal data would be contrary to the prohibition in Article 13(4) of the e-Privacy Directive on sending unsolicited e-mail for the purposes of direct marketing'.
   
   
41. For the transfer to 'Insurance intermediaries for statistical purposes of encrypted data which they will explain and produce at the request of the person concerned' (point 6, first part of the Privacy Statement), the defendant argues that it would be purely statistical information which does not contain personal data. The Chamber of Disputes does not have any document to the contrary.  
123. With regard to the legitimate interest, the Litigation Chamber considers that this legal basis does not allow the sending of such e-mails, in view of the impossibility for the third party to exercise control over his data, in the context where those data have first been uploaded to the website servers and then used in the context of an invitation e-mail.  
   
   
42. However, the Litigation Chamber finds that for both the transfer to 'The W companies to which the insurance company belongs, for monitoring and reporting' and the transfer to 'Subcontractors in the European Union or abroad, responsible for processing activities defined by the insurance company', the defendant relies on its legitimate interest as the legal basis for the processing.
   
   
43. However, the defendant does not demonstrate in any way what his legitimate interest would consist of and also fails to show to what extent his interest would outweigh the interests and fundamental rights of the complainant, although he is obliged to do so by virtue of his duty of accountability (Articles 5.2 and 24 AVG). In this connection, the Disputes Chamber also reiterates the requirements for the use of the processing basis justified interest arising from the aforementioned case law of the European Court of Justice.
3.2 Store personal data of existing users under the contact persons and send invitation emails to existing users (contacts)  
   
   
44. The Disputes Chamber is therefore of the opinion that also with regard to the transfer of personal data to third parties, the infringement of article 6.1. AVG has been proven, since the data processing for the transfers to third parties mentioned in sections 5 and 6 under 6. of the privacy statement, without any demonstrated legitimate interest, should be based on the consent of the complainant in the absence of any other potentially applicable legal basis in art. 6.1. AVG.  
124. The defendant seeks the consent of the users to store the contact details of other users on its servers and to process those data in the context of invitation emails.  
   
   
125. However, the Chamber of Disputes found that the consent of the users was not free to the extent that the first version of the website pre-selected the recipients of the invitation e-mails. This follows directly from Recital 32 of the AVG. The Court of Justice has recently confirmed in the Planet judgment49 as follows that consent is not validly obtained if pre-selected boxes are used:
"“51. "Article 2(h) of the above-mentioned Directive [95/46] defines 'the data subject's consent' as 'any free, specific and informed expression of consent by which the data subject accepts that personal data relating to him/her are processed'.
52.      Thus, as the Advocate General pointed out in paragraph 60 of his Opinion, the requirement of a 'statement of will' by the person concerned clearly refers to active rather than passive conduct. Consent by means of a standard checkbox, however, does not imply active behaviour on the part of the user of a website'. 71
   
   
(c) Transparent information (Articles 5(1)(a), 12(1), 13(1) and 13(2). AVG)
126. Thus, as long as the recipients of e-mails were pre-checked, the defendant could not invoke the legal basis "consent" with regard to the storage of the contact details of existing users and the sending of invitation e-mails to existing users.  
   
   
127. The Disputes Chamber rules that the processing in question is not necessarily unlawful within the meaning of Article 5.1 of the AVG, and that the social media network "W" should in principle not ask the AVG for permission to send e-mail messages from users to other users, in so far as such messages would fall under the basis "necessary for the performance of a contract" or "legitimate interest" pursuant to "W" (Article 6.1.b or Article 6.1.f of the AVG).
   
   
- Point 4.3. privacy statement
128. In particular, the website may invoke its legitimate interest if the emails do not constitute a marketing message within the meaning of Article 13.2 of the ePrivacy Directive, provided therefore that the defendant complies with the conditions set out by Group 29 (such as e.g.
do not let the recipients be chosen by the website itself). 
   
   
45. Pursuant to the AVG, the data controller is obliged to inform the data subject in a concise, transparent, comprehensible and easily accessible form and in clear and simple language (Articles 5.1. a), 12.1. and 13.1. AVG). The Disputes Chamber finds that, with regard to 4.3. and 6. of the Privacy Statement, the defendant is in breach of that obligation.  
129. In this case, the Chamber of Disputes notes that the recipients of the invitation e-mails were originally ticked beforehand.  
   
   
46. First of all, the defendant fails to make a clear distinction between the processing of health data on the one hand, and the processing of other 'ordinary' personal data on the other hand, both for each of the purposes of 4.3. of the privacy statement, and for each of the transfers of 6. of the privacy statement. However, such a distinction is of fundamental importance in order to determine on what legal basis the processing can be based for a specific purpose or transfer to a third party (art. 13.1. c) AVG).  
130. Even if the defendant does not invoke these principles, the Chamber of Disputes notes that ticking the addressees in advance would be problematic in the context of the legal basis 'legitimate interest' or 'performance of a contract': after all, the sending of bulk e-mails does not comply with the principle of minimum data processing (Article 5.1.c AVG) and with the principles of Article 25 AVG (data protection by design and by default settings). The fact that, in the previous version of the website, the website user had the possibility to deselect the pre-checked recipients one by one does not matter.  
   
   
47. The defendant states in 4. of the privacy statement: 'Personal data are processed for the following purposes:' However, health data are also personal data, so it can be deduced, as the complainant states, that section 4.3. relates to health data. Indeed, consent is sought for the processing of health data and then the defendant invokes in 4.3. of the Privacy Statement the legitimate interest in processing 'personal data' for the purposes stated therein. The defendant makes no distinction in 4.3. between 'ordinary' personal data and health data.  
131. Finally, since the defendant has voluntarily removed the pre-ticked options - in response to the Inspectorate's grievances in that regard - the data controller 'W' is eligible to send such e-mails to other users in the name and on behalf of its users on the basis of its legitimate interest.  
   
   
48. Moreover, the defendant creates ambiguity by claiming not to process health data for the purpose 'prevention of abuse and fraud' referred to in 4.3. the consent form, however, states that explicit consent is sought to process health data for, inter alia, 'prevention, detection and investigation of insurance fraud'.  
132. As an alternative to the justified interest, the Disputes Chamber is of the opinion that the social media network "W" should in principle not have requested AVG permission to send e-mail messages from users to other users, to the extent that such messages under "W" could fall under the basis "necessary for the performance of a contract" (art. 6.1.b AVG). The possibility to invoke such a basis obviously depends on the definition of the service provided and the extent to which the persons concerned have been informed about it . The Disputes Chamber does not have sufficient factual data at its disposal to assess the lawfulness of the processing under the legal basis 'performance of a contract'.  
a contract', but decides that the processing could in any case be carried out under the legal basis 'legitimate interest', and therefore was not unlawful, after removal of the pre-checked addressees of the invitation e-mails. Needless to say, the Disputes Chamber also notes that the defendant must, of course, be transparent about the processing grounds used by him.  
   
   
   
   
49. In addition, the privacy statement only states that for the purposes mentioned in 4.3. personal data will be processed on the basis of the legitimate interest of the defendant without indicating exactly what this legitimate interest would consist of, whereas Article 13(1)(d). AVG does require that the controller is obliged to provide the data subject with information about his or her legitimate interests if the processing is based on Article 6(1)(f).
3.3 Letters from the inspectorate concerning the Data Protection Officer
   
   
50. The Litigation Chamber also refers to the Guidelines on Transparency in accordance with Regulation (EU) 2016/679 , which emphasise the need to identify the specific interest in question for the benefit of the person concerned.  
133. The Litigation Chamber decides not to respond to the Inspectorate's grievances about the Data Protection Officer, given that the prima facie expertise of this person is apparent from the CV submitted, and given that the documents and the hearing show that this person was duly involved in developing the 'invite a friend' functionality. Moreover, the defendant adequately explained the role and position of the DPO at the hearing.  
   
   
51. As a best practice, the controller may also, prior to the collection of personal data from the data subject, provide the data subject with information on the consideration to be given to use Article 6(1)(f) as the legal basis for the processing. In order to avoid information fatigue, this information may be included in a tiered privacy statement/notification.  The information provided to data subjects should make it clear that they can receive information on the balancing upon request. This is essential for effective transparency where data subjects have doubts about the fairness of the assessment made or wish to lodge a complaint with a supervisory authority.
   
   
52. In addition, the Disputes Chamber finds that the privacy statement does not mention the possibility for the data subject to exercise their right of objection. This constitutes an infringement of article 12.1. AVG which stipulates that the data controller must take appropriate measures to inform the data subject about, among other things, the right to object guaranteed in article 21.2. AVG.
3.4 The defence on the lack of concrete recommendations from the GBA or the Inspectorate Service
   
   
53. For the purpose included in section 8 of 4.3. of the privacy statement 'the provision of information, irrespective of the means of communication, about the commercial actions, products and services of the insurance company and of the group to which it belongs', which must be qualified as direct marketing, Article 21.2. AVG requires that the data subject has the right to object at any time to the processing of personal data relating to him/her for direct marketing purposes, including profiling relating to direct marketing. No document shows that the complainant has been informed of his or her right to object to the processing of his or her personal data for direct marketing. This constitutes an infringement of Article 13.2. b) AVG.  
134. The defendant reproaches the GBA for not having made any concrete recommendations or comments on the "invite function" following a letter of 12 October 2018  in which the GBA reminded the defendant of the requirement to obtain a valid consent under the AVG with regard to the "invite a friend" functionality (defendant's conclusion, p. 3). The defendant makes the same reproach to the Inspectorate (Conclusion, p. 5). As the defendant rightly points out (Conclusion, p. 4), the Inspectorate made no recommendation regarding the invitation functionality and chose to ask for information.  
   
   
- Point 6. privacy statement
135. The Inspectorate's task is to gather evidence of indications of practices which may give rise to a breach of the fundamental principles of personal data protection (Article 63 et seq. of the WOG). The Inspectorate is
not charged with providing tailor-made advice on the infringements under investigation. More generally, under Articles 5.2 and 24 AVG 4, the controller is responsible for accountability. This accountability is a core element of the AVG. A data controller cannot evade this accountability by claiming that he has not received sufficient instructions from the supervisor. Admittedly, pursuant to Article 57.1.d) AVG, it is a duty of the GBA to make responsible parties and processors better aware of their obligations in respect of the AVG. However, in performing this task, the GBA - of which the Inspectorate is part - has a great deal of discretion whether or not to draw a data processor's attention to a possible infringement.  
   
   
54. Also point 6. of the privacy statement does not always mention the legal basis for the transfer to each of the different categories of third parties. Only in point 6, second part, is consent mentioned as a legal basis (art. 6.1. a) AVG); in point 6, tenth part, consent is mentioned as a legal basis.
and eleventh part refers to the defendant's legal obligations, point 6., twelfth part refers to the legal obligation to which the person concerned is subject for the payment of the international tax, if any (Art.
6.1. (c) AVG).
   
   
55. In other cases of transfers to third parties, point 6. of the privacy statement does not mention the legal basis.
3.5 Decision concerning the sanction
   
   
56. This is, however, the case in the conclusion provided by the defendant in the context of the proceedings before the Dispute Settlement Chamber, in which the processing basis is stated for each transfer mentioned in 6. of the privacy statement. For the sake of transparency, the processing basis for all transfers must be stated in the privacy statement in order for the defendant to comply with his obligation under art. 13.1 c) AVG. However, this is not the case, so that the Disputes Chamber is of the opinion that there is a breach of art. 13.1 c) AVG.
136. As a result of the Inspection Report and taking into account the defendant's argumentation, the Disputes Chamber established the following infringements of the AVG:
13.1. (c) AVG.
   
   
57. Also with regard to 6. the privacy statement, the defendant does not indicate in its reasoning what its legitimate interest, invoked by the defendant, would be in processing personal data of the complainant for the purpose of transfer to 'The W companies to which the insurance company belongs, for monitoring and reporting purposes' and 'Subcontractors in the European Union or abroad, responsible for processing activities defined by the insurance company'. However, Art. 13.1. d) requires AVG does require the controller to provide the data subject with information about his or her legitimate interests if the processing is based on Article 6(1)(f). The Chamber of Disputes refers again to the Guidelines on transparency in accordance with Regulation (EU) 2016/679  and the above.  
1. The defendant has no legal basis for storing and further processing the personal data of non-users of the website "W" in its files with a view to sending an invitation e-mail: this constitutes an infringement of Articles 5 and 6 of the AVG;
2. The defendant has no legal basis to send invitation e-mails to existing users of the website during the period in which the addressees of the invitation e-mails were checked in advance: infringement of article 5.1 in conjunction with 6.1.a), 7 AVG and 4.11 AVG.  
   
   
58. As a result of all these findings, the Disputes Chamber is of the opinion that the defendant has failed to fulfil its obligations under Article 13.1(c) and (d) AVG, as well as Article 13.2. b) AVG by failing to provide the required information to the complainant and by failing to take the appropriate measures to ensure that the complainant would receive the information referred to in Article 13 and the communication referred to in Article 21.2 AVG in connection with the processing, as required by Article 12.1. AVG.
   
   
59. It follows that the defendant has not respected the basic principle that personal data must be processed in a way that is lawful, adequate and transparent in relation to the data subject (Art. 5.1(a) AVG). Moreover, to the extent that the defendant invokes his legitimate interest as a legal basis for the data processing operations specified above, he does not comply with his accountability obligation (Art. 5.2 AVG) and thus the legitimate interest cannot be considered as a valid legal basis within the meaning of Art. 6.1. AVG.
3.5.1 Competence of the Dispute Settlement Chamber with regard to sanctions
   
   
(d) Data protection impact assessment
137. By virtue of article 100 WOG, the Disputes Chamber is authorised to order that the processing be brought into conformity (art. 100.9 WOG) as well as to impose periodic penalty payments (art. 100.2° WOG). The Disputes Chamber is also competent to impose administrative fines (art. 100.13°, 101 and 102 WOG) and to publish the decision on the website of the Data Protection Authority (art. 100.16° WOG). When determining the level of the fines, the Disputes Chamber must take into account the criteria laid down in Article 83 of the AVG, depending on the circumstances. In this case, the Chamber of Disputes takes into account the following circumstances that it considers sufficient to impose the sanctions listed below:
   
   
60. The complainant wishes to have access to the data protection impact assessment (hereinafter GBEB) of the defendant. According to the complainant, a GBEB is mandatory for the Respondent as it concerns processing operations that involve a high risk to the rights and freedoms of natural persons.  
- the nature, seriousness and duration of the infringement: this is a lack of legal basis, which the Chamber of Disputes considers to be a serious infringement, in particular as regards the right of non-members of the 'W' website to retain control over their data and not to run the risks associated with data processing (recital 75 AVG);
- the intentional nature of the breach: the defendant was aware of a problem regarding the processing of personal data on the website since the first letter of the GBA dated 12 October 2018.  
   
   
61. However, the defendant stresses that it is not obliged to carry out an EIO, since it has a long history of processing health data in the context of its insurance activities, and EIOs are, in principle, required only if the risks to the rights and freedoms of natural persons change after 25 May 2018. The defendant argues that there has been no such change. The defendant relies on the Recommendation of the Data Protection Authority No 01/2018 of 28 February 2018 on data protection impact assessments and prior consultation , and the Guidelines on data protection impact assessments and determining whether a processing operation is 'likely to present a high risk' within the meaning of Regulation 2016/679 .
3.5.2 The attenuating circumstances invoked
   
   
62. The Disputes Chamber is of the opinion that to the extent that the defendant is processing health data, it is indeed an existing processing operation with a high risk, but that there is no indication that the risks to the rights and freedoms of natural persons have changed after 25 May 2018, taking into account the nature, scope, context and purposes of the processing, which would necessitate a GBE. There is therefore no question of any infringement of art. 35 and/or art. 36 AVG.  
138. The defendant considers, in a subsidiary order, that the penalties imposed should take account of the following attenuating circumstances (Conclusion, p. 42):
   
   
63. However, the Chamber of Disputes adds that, on this point too, it will apply the abovementioned
• The defendant would have been 'not negligent' and would have acted in good faith taking into account the Opinion 5/2009 on social networks of Group 29. In this respect, the Disputes Chamber states that the defendant cannot simply rely on an opinion of 2009, long before the AVG came into being, which moreover - as described above - is insufficiently clear. Moreover, the data controller could have been aware of the discussions surrounding the use by social media sites of data of non-members, as reflected in Group 29's Opinion 06/2014 on the concept of "legitimate interest";
Guidance on data protection impact assessments follows, which states that  
• The possible infringements would not have caused any material damage: Here the Dispute Chamber points out that the right to data protection is a fundamental right and that it is irrelevant for the violation of this right whether infringements cause material damage . The infringement in this case leads to the loss of control over the data by many persons, which is mentioned in recital 75 of the AVG as a potential cause of immaterial damage;
it is good practice to continuously review and regularly reassess a data protection impact assessment. Therefore, even if a data protection impact assessment is not required on 25 May 2018, it is necessary that the controller carries out a data protection impact assessment at the appropriate time as part of its overall accountability.  
• The defendant has stopped using pre-checked options. The defendant was aware of the infringement since 3 April 2019 (Conclusion, p. 42) and waited to receive a second letter from the Inspectorate (May 2019) to stop this practice (Conclusion, p. 13). The Disputes Chamber is of the opinion that this infringement was deliberate or, at any rate, largely due to negligence, since recital 32 of the AVG makes it clear that consent is not validly obtained if the options offered have been ticked beforehand. ) The defendant therefore had to know that the consent of the users of the website to process their data with a view to sending out invitation e-mails was not valid with regard to the selection of recipients. In addition, the defendant also had to know that a user of the website could not consent to the use of data by third parties.  
   
   
64. With regard to the complainant's request to receive the GBEB in question, the Disputes Chamber points out that the AVG contains no obligation for the data controller to publish a GBEB. The data controller decides autonomously whether or not to publish the GBEB, with the aim of creating confidence in the data controller's processing and to demonstrate accountability and transparency without, however, publishing the full GBEB . However, the Litigation Chamber considers that it is particularly good practice that data controllers consider publishing at least parts, such as a summary or a conclusion of their data protection impact assessment.  
139. In his response to the form dated 28 April 2020, the defendant developed additional arguments with regard to the sanction proposed by the Chamber of Disputes.  
   
   
65. The fact that there is no obligation to communicate the GBEB under the defendant and, as a result, there is no right for the complainant to have access to a GBEB, cannot therefore be accepted by the Dispute Chamber as a result of which the complainant could obtain the GBEB.  
140. The defendant argues that he was not negligent and that the alleged infringements did not constitute a clear infringement of the AVG, but rather "a problem of interpretation about which
even the supervisory authorities adopt different interpretations'. The defendant wrongly deduced this from the fact that the Dutch authority had adopted a relevant and substantiated objection. The Dutch authority did not object to this final decision, and all authorities concerned have validated the reasoning set out above with respect to the amount of the fine.  
   
   
(e) Breaches of the AVG and penalties to be imposed
141. The Disputes Chamber agrees with the defendant that a discussion was possible on the extent to which the defendant could or could not invoke a legitimate interest to address third party non-users by means of an invitation e-mail.
   
   
66. The consequences of the failure to fulfil the responsibilities as controller constitute a risk to the rights and freedoms of the complainant. Recital 75 of the AVG states that any 'social disadvantage' resulting from the processing of personal data can be considered relevant under the AVG.  
142. However, the Chamber of Disputes found that no discussion was possible and ruled that the legal basis invoked by the defendant was invalid: the existing users of a website cannot give permission for third party non-users . Thus, the defendant misapplied the legal basis "consent" (or exemption from consent), and in any case it is not allowed to subsequently invoke the legal basis "legitimate interest" to justify a certain processing already started .  
   
   
67. The Disputes Chamber finds that an infringement of art. 5.1. a), art. 5.2., art. 6.1., art. 12.1., art. 13.1. c) and d) and 13.2. b) AVG has been proven and it is appropriate to order that the processing be brought into conformity with these articles of the AVG (Art. 58.2.d) AVG and art. 100, §1 9° WOG), as well as to impose an administrative fine in addition to this corrective measure (art. 83.2. AVG; art. 100, §1, 13° WOG and art. 101 WOG).  
143. For the sake of clarity, the Disputes Chamber reminds the defendant that it did not invoke the basis 'legitimate interest' (and did not examine its conditions of application) in its original privacy policy, nor later in the context of its arguments before the Disputes Chamber, despite a clear question from the Disputes Chamber in that respect at the hearing, and up to and including the reopening of the debates by the Disputes Chamber on that point. This constitutes a clear breach of its information obligations under art. 12-13 of the AVG and of the requirement to have an appropriate legal basis under art. 5-6 of the AVG before the data processing starts.  
   
   
144. It is also beyond dispute that, with regard to invitations sent to existing members of the social media platform "W", the defendant could not invoke the legal basis "consent" as long as the addressees of the invitation e-mails were originally ticked in advance .
   
   
68. More specifically, the Chamber of Disputes finds the following infringements:   
145. For this reason, the Disputes Chamber decides that the defendant has been negligent and deserves a fine with regard to the sending of invitation e-mails both to members and third non-members of the social media platform "W", and that a fine is justified, even if there was a possible debate regarding the limits and conditions of the defendant's justified interest with regard to the sending of invitation e-mails by social media to third non-members, which debate the Disputes Chamber, in view of the circumstances presented to it, decides in this case.
   
   
• Infringement of Article 6.1. AVG :
146. In determining the amount of the fine, the Disputes Chamber shall take into account the circumstances invoked under 3.5.1 and 3.5.2 of this decision.  
o the data processing for the purposes mentioned in sections 1, 2, 3 4, 6 and 7 of point 4.3. of the Privacy Statement, without any demonstrated legitimate interest, is wrongly not based on the consent of the complainant in the absence of any other potentially applicable legal basis in Article 6.1. AVG.
o the data processing for the transfers to third parties mentioned in sections 5 and 6 under 6. of the privacy statement, without any demonstrated legitimate interest, is wrongfully not based on the consent of the complainant in the absence of any other potentially applicable legal basis in article 6.1. AVG.
• Infringement of the principles set out in Article 5.2. AVG in so far as the defendant invokes its legitimate interest as a legal basis for the data processing operations specified above. 
• Infringement of Articles 12(1), 13(1)(c) and (d) AVG and 13(2)(b) AVG in so far as the defendant failed to provide the complainant with the required information and failed to take the appropriate measures to ensure that the complainant would receive the information referred to in Article 13 and the communication referred to in Article 21(2) AVG in connection with the processing, in particular.
o points 4.3 and 6 of the privacy statement do not make a clear distinction between the processing of health data on the one hand, and the processing of other 'ordinary' personal data on the other hand.  
o no information is given to the data subject about his or her legitimate interests.
o no appropriate measures have been taken to inform the person concerned of
a.o. the right of objection guaranteed in art. 21.2. AVG.
o the processing basis for all transfers is not mentioned in the privacy statement.
• Infringement of the basic principle laid down in Article 5(1)(a) that personal data must be processed in a way that is lawful, adequate and transparent in relation to the data subject.  
   
   
69. In addition to the corrective measure to bring the processing in line with Articles 5.1. a), 5.2., 6.1., 12.1., 13.1. c) and d) and 13.2. b) AVG, the Disputes Settlement Chamber also decides to impose an administrative fine that is not intended to end a violation committed, but to enforce the rules of the AVG vigorously. As can be seen from Recital 148, the AVG requires that, in the case of serious infringements, penalties, including administrative fines, should be imposed in addition to or instead of appropriate measures.  The Disputes Chamber does this in application of Article 58.2(i) AVG. The instrument of an administrative fine is therefore in no way intended to bring infringements to an end. To this end, the AVG and the WOG provide for a number of corrective measures, including the orders referred to in Article 100, §1, 8° and 9° WOG.  
147. The Disputes Chamber also takes note of the fact that, according to the information provided in its response dated 28 April 2020, the defendant stopped sending out invitation e-mails as of 7 February 2020.  
   
   
70. Taking into account article 83 AVG and the case law of  the Market Court, the Disputes Chamber justifies the imposition of an administrative sanction in concrete terms:
148. However, the Chamber of Disputes did not require such a far-reaching measure and reopened the debates on the legitimate interest in order to allow the defendant to properly carry out the assessment of his legitimate interest.  
- Seriousness of the infringement: the above reasoning shows the seriousness of the infringement.
- The duration of the infringement: the defendant's submissions in the proceedings before the Chamber of Disputes do not show that the infringement has ceased and thus continued until 25 January 2020. In doing so, the Disputes Chamber does not take into account adjustments made after the debates concerning the findings have been closed. 
- The necessary deterrent effect to prevent further infringements.
71. With regard to the nature and seriousness of the infringement (Article 83(2)(a) of the CPC), the CPC stresses that compliance with the principles laid down in Article 5 of the CPC - in particular the principles of transparency and lawfulness, as well as accountability in the present case - is essential, since they are fundamental principles of data protection. The Chamber therefore considers the defendant's breach of the principle of lawfulness laid down in Article 6 of the CPC and the principle of transparency laid down in Articles 12 and 13 of the CPC as a serious breach.  
   
   
72. Although no health data of the data subjects are processed without the express consent required for that purpose and the defendant invokes a different processing legal basis with regard to the data not covered by a special protection regime in the AVG, the Disputes Chamber is of the opinion that the relatively large impact of the observed infringements concerning all insured persons who have joined the insurance company via a hospitalisation insurance must be taken into account when determining the administrative fine.  
149. In the original draft decision, as submitted to the relevant
In the context of the cooperation procedure provided for in Article 60.5 of the AVG, the Litigation Chamber had ordered that the processing would be brought into compliance with Articles 5 and 6 of the AVG within 3 months of the date of this decision, by ensuring that the storage and processing of personal data for the purpose of sending invitation e-mails to third non-members of the website is either discontinued or based on a legal basis (e.g. consent, legitimate interest). However, this envisaged injunction no longer has a raison d'être, as the defendant - according to the statements of his legal counsel in his response dated 28 April 2020 - has spontaneously stopped sending out invitations e-mails since 7 February 2020.  
   
   
73. All the elements set out above justify an effective, proportionate and dissuasive sanction as referred to in art. 83 AVG, taking into account the assessment criteria set out therein. The Chamber of Disputes points out that the other criteria of art. 83.2. AVG in this case are not of the nature that they result in an administrative fine other than that established by the Disputes Chamber in the context of this decision.  
150. The fact that the defendant stopped sending invitation e-mails is a sign of good will but does not alter the fact that the defendant was negligent in determining a legal basis, not only for the start of the data processing in question but also in the context of his argumentation with regard to the Disputes Chamber despite the reopening of the debates by the Disputes Chamber. The fact that the defendant stopped using pre-ticked options only has a positive impact on the legal basis "consent" for the invitation e-mails sent to existing users, but not with regard to the third non-users of the website.  
   
   
151. Nevertheless, the above shows a willingness on the part of the defendant to pay attention to the AVG when developing the processing operations. This is important for determining the level of the sanction. 
   
   
(f) Legislative framework: relationship between free consent and provision of health data in the context of hospitalisation insurance
152. The Data Protection Authority considers that the annual turnover of the defendant from 2017 onwards (including for the financial year 2019 for which the closure is still ongoing) will still exceed €10,000,000. The Disputes Chamber decided that the amount of the fine should be set at 0.5% of the annual turnover and therefore set the amount of the fine at €50,000. 
   
   
74. For the sake of completeness, the Disputes Chamber wishes to draw attention to the broader issue that must be raised in connection with the complaint, namely the collection of health data by insurers from potential policyholders via their explicit consent (art. 9.2. a) AVG) in the context of taking out and carrying out hospitalization insurance and the associated question to what extent the consent of those policyholders may be free. The question arises whether, other than explicit consent, there are other possible processing grounds on the basis of which the health data can be processed by the defendant in the execution of the hospitalization insurance.  
153. In view of the importance of transparency with regard to the decision-making of the Disputes Chamber, this decision shall be published on the website of the  
Data Protection Authority. Publication of the present decision is also in the interest of legal development and consistent application of the AVG in the European Union. However, it is not necessary for the identification data of the defendant to be published directly for this purpose.  
   
   
75. Article 9(4) of the AVG provides that Member States may impose additional conditions on the processing of, inter alia, health data. The Act of 30 July 2018 on the protection of individuals with regard to the processing of personal data, which implements the AVG, does not contain any specific provisions regulating the processing of sensitive personal data in the context of insurance. The defendant notes that there is no national legislative framework in this respect. At the moment, the Disputes Chamber can only endorse this position and note that the legislator should intervene in that respect in order to provide a legal basis specifically for the insurance sector that allows for the collection of health data within well-defined limits in the context of the (pre)contractual relationship between the insurer and the policyholder.
   
   
(g) Publication of the decision
   
   
76. Given the importance of transparency in relation to the decision of the Disputes Chamber, this decision is published on the website of the Data Protection Authority. However, it is not necessary for the identification of the parties to be published directly for this purpose.
   
   
   
   
FOR THESE REASONS,  
FOR THESE REASONS,  
   
   
the Data Protection Authority's Litigation Chamber, after deliberation, shall decide:
the Data Protection Authority's Disputes Chamber shall decide after deliberation,  
- Pursuant to art. 100, §1, 9° WOG, order the defendant to bring the processing into conformity with art. 5.1.a); art. 5.2, art. 6.1, art. 12.1. and 13.1. c) and d) and 13.2. b) AVG.
- to impose an administrative fine of EUR 50,000 on the basis of Article 100, §1, 13° WOG and Article 101 WOG.
   
   
This decision may be appealed against under Article 108 §1 of the WOG within a period of thirty days from the date of notification to the Cour des Markten, with the following notice
- to impose a fine of EUR 50,000 for processing personal data of non-members of the website "W" without an appropriate legal basis, as well as personal data of members, the latter during the period in which the recipients of such e-mails were pre-checked;
Data protection authority as defendant.
   
   
An appeal against this decision may be lodged, pursuant to Article 108 §1 of the Act of 3 December 2017, with the GBA as defendant, within a period of thirty days from service of the notification at the Market Court.
   
   
 
   
   
(get.) Hielke Hijmans  
Hielke Hijmans  
President of the Chamber of Disputes  
President of the Chamber of Disputes  


</pre>
</pre>

Latest revision as of 16:56, 12 December 2023

APD/GBA - 25/2020
LogoBE.png
Authority: APD/GBA (Belgium)
Jurisdiction: Belgium
Relevant Law: Article 5 GDPR
Article 6 GDPR
Article 7 GDPR
Article 30 GDPR
Article 37 GDPR
Article 38 GDPR
Type: Complaint
Outcome: Upheld
Started:
Decided: 14.05.2020
Published: 14.05.2020
Fine: 50000 EUR
Parties: n/a
National Case Number/Name: 25/2020
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): English
Original Source: Belgian DPA (in EN)
Initial Contributor: n/a

The litigation chamber concluded that the "invite a friend" function of a social media platform violates the GDPR since consent from the users was not collected.

English Summary

Facts

A social media encourages both existing users and new joiners to invite their friends to join the platform via a "invite a friend" option. The Litigation Chamber examined the legal grounds for the "invite a friend" system. The user gave the provider access to his or her list of contacts, so that a message could be sent to those contacts to join the social media platform or, if they were already members of the social media platform, to become part of that user's network of friends on the platform.

Holding

The Litigation Chamber stated the "invite a friend" functionality made the provider a controller within the meaning of the GDPR, and such processing of personal data did not fall within the scope of the "household exemption". Therefore, the GDPR applied in full.

Only the data subject whose personal data are processed can validly consent to the processing of this data. The collection of contact details can take place only on a compare and forget basis: all data of non users of the platform should be deleted. That was not the case here.

No consent is required for an e-mail invitation to the user's non-member contacts under the following conditions (already stated by the Article 29 WP):

  • no pressure should be applied to the transmitter or receiver;
  • the provider is not allowed to choose the addressees of the message;
  • the identity of the user sending the message must be clearly indicated;
  • the user sending the message must be aware of the full content of the message to be sent on his behalf.

The social media provider claimed that others social media providers were following the same practices. However, the litigation chamber considered that was not a proper argument.

As conclusion, the litigation chamber imposed a fine of EUR 50,000 for processing personal data of non-members of the website without an appropriate legal basis, as well as personal data of members.

Comment

The Belgian DPA published the decision also in English, which you may find here: https://www.dataprotectionauthority.be/sites/privacycommission/files/documents/Beslissing_GK_25-2020_EN.pdf.

In-depth comments can be found here:

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details. 

Decision on the substance 25/2020 of 14 May 2020 
 
 
 
File number : DOS-2019-01156    Subject: Legal basis for processing of personal data by social media platform  
 
The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke 
Hijmans, chairman and Messrs Dirk Van Der Kelen and Jelle Stassijns, members; 
 
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter AVG; 
 
Having regard to the Act of 3 December 2017 establishing the Data Protection Authority, hereinafter referred to as 
WOG; 
 
Having regard to the internal rules of procedure as approved by the Chamber of Representatives on 20 December 2018 and published in the Belgian Official Gazette on 15 January 2019; 
 
Having regard to the documents in the file; 
 
 has taken the following decision regarding: 
                                 	 
- 	a processing of personal data by the controller: Y ('defendant'); 
 
1. Facts and procedure 
2.	On 28 November 2018, the Management Committee of the Data Protection Authority (hereinafter the GBA) decided to refer a case to the Inspectorate of the GBA on the basis of Article 63, 1° of the WOG. The reason for the aforementioned referral was the practice whereby the social network and website "W" invites its members to add the "friends/contacts" of those members.   
 
3.	The Inspectorate of the GBA informed the defendant of this decision of the Executive Committee of the GBA by letter of 12 March 2019. 
 
4.	The Inspectorate sent two letters to the defendant dated 12 March 2019 and 16 May 2019 with questions relating to alleged infringements of Articles 5, 6, 7, 30, 37 and 38 of the AVG. More specifically, the Inspectorate asked questions about the categories of personal data of non-users that were collected as well as the retention period for those data. The Inspectorate also requested an extract from the register of the defendant's processing activities and asked questions about the data protection officer (place in the organisation chart, time spent, professional qualities, involvement in answering the Inspectorate's questions).   
 
5.	The defendant replied to the Inspectorate's questions by letters dated 21 March 2019, 3 April 2019 and 14 June 2019. The defendant clarified the processing of personal data in the invitation functionality on the "W" website as follows: "Here, the personal data we collect will depend on the platform used: if a user chooses to upload contacts from the phone book of his or her mobile phone, we will collect phone numbers and the names that the user assigns to these phone numbers. If a user chooses to upload contacts from his or her email account, the basic contact information that will be uploaded will be determined by the user's own email provider, as clearly set out in that provider's upload permissions screen" . If a user chooses to upload his or her contacts from his or her phonebook, the details of these contacts will be synchronized regularly so that the user can invite new contacts who are not yet members of "W" to register. 
 
6.	The defendant explains that in addition to the consent button, the following section of information will appear: "At regular intervals we will import and store your contacts so that we can give you 
be able to notify when acquaintances register on "W" and so you can invite them to register when your contacts are not yet members of "W". You decide who you add. You can stop the import at any time and delete all contacts. More information". 
 
7.	If the user clicks on "more information", he or she will see the following additional information: "When you import your address book, we will periodically import information, such as names, phone numbers and other information as clarified on the provider's permissions screen, about your contacts on our servers. We use this information to inform you about who you already know on W and so that you can invite your contacts who are not yet members. The above suggestions are made directly on the service and via email. We do not store your password and do not email anyone without your permission. You can stop the synchronisation of your address book at any time via your settings. When you do this, all previously imported contacts will be deleted. For more information on how we process your personal data, please refer to our Privacy Policy" . 
 
8.	The defendant further explained that the user's contact persons are kept in the defendant's database until the user decides to stop synchronizing the contact persons, or if a user removes certain contact persons. When an account is closed (either deliberately or after 2 years of inactivity), the contact persons are deleted within three months, the defendant further explained3. 
 
9.	In his letter of 9 March 2020, the defendant explains that the user can choose to withdraw his consent and thus no longer synchronize contacts, thus removing the existing contacts from the "W" database. If the user does not choose this function, the contact details (including those of third party non-users of the website) will be kept for at least three months . 
 
10.	The defendant submitted to the Inspectorate an extract from its register of processing activities, showing which categories of personal data of customers (users of the website) are processed: 'profile information, personal identification, analytical data, user generated content, user account information, contact information and third party information (for users who register via Facebook)'. According to that register, the legal basis invoked for processing is 'the performance of a contract' and 'the 
consent of the individual" . 
 
11.	As regards the legal basis for the collection of non-users' personal data, the defendant explained that the legal basis 'consent' - in its view - should not be used: 'We are of the opinion that we are not obliged to collect the consent of the contact person. Indeed, we do not send promotional messages because it is the user who sends personal communications to his or her contact through our platform. This interpretation is in line with the vision set out in the Article 29 Working Party's Opinion 5/2009 on Online Social Networking  and we have ensured that our process fully complies with the four criteria set out in [this] Opinion" 8. 
 
12.	The defendant responded in detail to the Inspectorate's questions about the activities and competence of its Data Protection Officer . The defendant refers, inter alia, to the professional experience of this person, in particular his experience as EMEA Senior Privacy Counsel with a company active in online means of payment and lawyer with the IT service of a law firm. This person also holds an IAPP CIPP/E and CIPM  certification. 
 
13.	On 18 June 2019, the Inspectorate submitted its report to the Disputes Chamber on the basis of article 92, 3° of the WOG. 
 
14.	The inspection report shall identify potential breaches of Article 5(1). 2 of the AVG, Article 6 of the AVG, Articles 4, 11) and 7 of the AVG as well as Articles 37 and 38 of the AVG. 
 
15.	With regard to the alleged breaches of accountability (Article 5(2) of the AVG), of the lawfulness of processing (Article 6 of the AVG), and with regard to the definition and conditions for consent (Articles 4, 11 and 7 of the AVG), the Inspection Report makes a distinction between, on the one hand, the consent relating to the processing of personal data of the user of the website and, on the other hand, the consent required with regard to the processing of personal data of that user's contacts. 
 
16.	As regards the defendant's assertion that he is not obliged to collect the consent of the contact persons (non-members of "W"), since it would be "personal". 
communication' by the user, the Inspectorate notes that the exception (to the obligation of consent under Article 7 AVG) for personal or household activities may be invoked by social media users but not by the social network 'W' itself, in line with recital 18 of the AVG, which reads as follows: 'Personal or household activities [outside the scope of the AVG] may include social networking and online activities in the context of such activities'. However, this Regulation shall apply to controllers or processors providing the means for processing personal data for such personal or household activities' (Inspection report, p. 4). 
 
17.	The reference made by the respondent to Opinion 5/2009 of Group 29 on online social networks is not considered relevant by the Inspectorate because this Opinion concerns  the former Data Protection Directive and 'because the AVG imposes more far-reaching obligations on data controllers including the accountability in Article 5(2) of the AVG and the requirements of unambiguous expression of will in Articles 4, 11) and 7 of the AVG' (Inspection report, p. 5). 
 
18.	With regard to the consent of social media users (members of "W"), the Inspectorate notes that there are pre-ticked options in the process of adding contacts. As a result, the user's consent to use or not use the personal data of his contacts is not valid in a context where recital 32 of the AVG explicitly clarifies that 'already ticked boxes' do not count as consent. The Inspectorate notes that the respondent is prepared to "continue his practice of pre-assessing contacts' personal data".
selects to stop", which has happened in the meantime. According to the defendant, the adjustment 
place 2 working days after receipt of the inspection report . 
 
19.	In the meantime, the defendant has removed the pre-ticked options from the platform 'voluntarily and without any unfavourable acknowledgement' after receiving the second letter from the Inspectorate dated 16 May 2019. However, the defendant states in its conclusion that these pre-ticked options do not relate to obtaining the user's consent to import his contacts, and that, moreover, no consent is necessary in view of the principles set out in the Opinion 5/2009 of Group 29 on online social networks (see defendant's conclusion, p. 13). 
 
20.	The Inspectorate also noted that the defendant's privacy policy does not state that consent can be withdrawn, as imposed by Article 7 of the AVG. In its conclusion 
(p. 19 and 20) and in his letter of 14 June, the defendant replies that the possibility to withdraw consent is indeed offered on the website. The user is informed that he can stop the import at any time and delete all contacts. 
 
21.	Before starting the current procedure, the defendant had been in contact with the GBA in response to a complaint received regarding the working method of the "W" platform. The complaint referred to the fact that the information about the protection of personal data could only be read after creating one's own account and accepting the terms of use and privacy policy. The GBA had pointed out to "W" that this was not a valid way to obtain permission for the "invite a friend" e-mail, as far as this was the legal basis used by "W". 
 
22.	At a hearing on 9 July 2019, the Disputes Chamber decided on the basis of Article 98 of the WOG that the file was ready to be dealt with on the merits. 
 
23.	On 10 July 2019, the defendant was informed by registered mail of this decision, of the inspection report, and of the inventory of the documents in the file that the Inspectorate sent to the Chamber of Disputes. At the same time, the defendant was informed of the provisions as mentioned in article 98 of the WOG and the defendant was informed of the time limits to submit his defence under article 99 of the WOG. The deadline for receiving the defendant's response was set at 4 September 2019. 
 
24.	By letter and e-mail dated 15 July 2019, the defendant asked to be heard. By letter dated 30 August 2019, the Chamber of Disputes informed the defendant of the date of the hearing. 
 
25.	On 4 September 2019, the Chamber of Disputes received the conclusion of the defendant's response. 
 
26.	The hearing took place on 1 October 2019. The file was resumed with other members of the Dispute Chamber. The data controller was heard and given the opportunity to present his arguments, in response to the questions put to him by the members of the Disputes Chamber, concerning the foreign scope of the 'W' website, the legal basis for processing personal data of users and non-users of the 'W' website and the role and working methods of the Data Protection Officer. 
 
27.	At the hearing, the defendant made the following statements in addition to his conclusion: 
 
-	The defendant offers a platform to get to know new people in the private sphere without limitation (friend or relationship); there are 4.5 million active users per month, spread all over the world, 1.5 million of whom are in the EU. There are 33 people working at "W" (see also defendant's conclusion, p. 3) and 100 people in various places in the world working for the helpdesk (not Y employees, but only contractual service providers, as clarified by defendant's letter of 4 November 2019 to the Chamber of Disputes). 
 
-	The defendant complains that the constitutive elements of the offence imputed to "W" are not indicated in the Inspection Report (see also defendant's conclusion, p. 6); the defendant considers that in this case the charge was made without a prior detailed explanation of the alleged infringement. The defendant finds that the allegations with regard to "accountability" are very unclear. 
 
28.	The defendant then explains how the invitation process takes place on the "W" website: 
 
-	The website users will be informed - as shown above - about the processing that will take place in the context of the "invite a friend" functionality. 
 
-	Under the message "W is better with friends" the internet user gets the possibility to import an address book of different service providers (Outlook, Google mail, Yahoo, Facebook, Telenet, Skynet). The user is not obliged to select a service provider and can skip the "invite a friend" functionality in its entirety. If the user wants to make use of this functionality, one of the service providers must be selected. Then a screen of this service provider will be displayed, on which the internet user can allow his contact addresses to be read. This is, as explained by the defendant, "the provider's permissions screen". If the internet user agrees, all addresses listed in the address book are then stored by "W". The functionality offered by such service providers consists of allowing users to share limited contact information with the "W" platform, for limited purposes. 
 
-	In a next step, the Internet user is given the opportunity to choose the recipients of invitation emails. 
 
-	In a first version of the website, all addresses were pre-checked, with the possibility to unselect all recipients with a single click. Since July 12, 2019,  no address is pre-checked and the user can choose between two options: pre-select all recipients one by one, or pre-select all his contacts with a single click. In the previous version of the website, the user also had the possibility to deselect the pre-checked recipients one by one. 
 
-	By letter of 4 November 2019, the defendant insists that users should have the possibility to obtain their consent regarding the use of the "invite a friend". 
functionality" at any time. All previously imported contacts 
are then removed, the website announces (cf. above, p. 3). 
 
29.	The defendant then argues that the address details of the contact persons are used only for the invitation functionality. According to the defendant, no profiles are created on the basis of these contact details. 
 
30.	With regard to the legal basis invoked, the defendant states the following: when a user sends an invitation to his friends, it is a personal communication, not a marketing message subject to the anti-spam rules of the ePrivacy Directive; defendant uses a single legal basis, i.e. the consent of the users; the "AVG does not say that you need the consent of contacts. We have the consent of the user to import his data," the defendant stated in court. To the question of the Dispute Chamber whether, according to the defendant, the user's consent is also valid for non-users of the "W" website, the defendant answers positively, "since it is one and the same 
finality' as regards the processing of personal data. Thus, the defendant confirmed the assertions made in his conclusion, which were summarised by the defendant as follows: 
 
"With regard to the legal basis invoked, the defendant claims the following: Y processes the contact details of the user's contact persons for a single purpose: to make the "invite a friend" functionality available. In order to fulfill this single purpose, the user's contacts are uploaded and invitation emails are then sent on behalf of the user to those contacts selected by the user. The legal basis on which Y relies for the processing of personal data within the scope of the "invite a friend" functionality is the consent of the user. Y is of the opinion that it is not mandatory to separately request the consent of the user's contact persons, since the processing of data is already justified by the user's consent under Article 6 of the AVG and since, on the other hand, the invitation message sent does not constitute a direct marketing message that is subject to the ePrivacy Directive. This was explicitly confirmed by the Article 29 Working Party. To the question of the Dispute Chamber whether the consent of the user is also valid for non-users of the "W" website, the defendant answers positively: in the context of the "invite a friend" functionality and, more generally, of all services and functions that enable users to process contact data and other information of people they know (e.g. e-mail providers, messaging systems, operating systems, cloud services where people upload photos that can show their friends and family, ...), the data are primarily that of the user himself." The data is the user's own. (Letter from the defendant to the Chamber of Disputes of 4 November 2019, reaction to the draft PV of the hearing, p. 3). 
 
31.	The defendant then shows by means of printed screens of the website that the user can see and change the standard message before it is sent in the context of the invitation e-mail (page 12 of the bundle of pleadings). The defendant reiterates that, in its view, it has taken all measures to ensure that this processing would meet the requirements of "personal communication" as set out in Group 29 Opinion 5/2009 on online social networks. According to the respondent, the Inspectorate wrongly states that this advice predates the AVG and is no longer valid, because the consent requirements have meanwhile become more stringent (see also conclusion, p. 23). The defendant also addresses the question whether or not there is a marketing message within the meaning of Article 13 of the ePrivacy Directive. By letter of 4 November 2019, the defendant wished to provide additional clarification: "Y has never claimed that the AVG would not apply to the processing activities carried out in the context of the W platform. On the contrary, Y considers that the invitation message sent to the user's selected contact persons constitutes personal communication, for which it is not required to obtain the consent of such contact persons on the basis of the ePrivacy Directive". 
 
32.	The Chamber of Disputes then asks whether or not the users are informed in the invitation e-mail departing from the "W" platform that their data may be corrected or deleted. The defendant refers to his pleading, which contains a printed version of the screen that the addressee of such an invitation will see: under the message "X. sent 
You have a message! "two blue buttons offer the following option: "Register and reply" or 
"Read only message." Under these buttons the following explanation is placed: "When you click on 'Register and reply' you agree that an account will be created for you on W and you agree to our [hyperlink] Terms and Conditions. Please also read our [hyperlink] Privacy Policy and our [hyperlink] Cookie Policy". The Respondent explains that the recipient of the invitation email receives information about their rights through "W"'s Privacy Policy and Cookie Policy, and that the recipient also receives the following information in the email itself: "Click here if 
you do not wish to receive commercial e-mails about our products or services" (page 17 of the 
pleading). 
 
33.	As regards the Data Protection Officer, the defendant refers to documents proving that this person was indeed involved in the definition of the invitation functionality, including an e-mail of 13 August 2018 already communicated to the Inspectorate (page 15 of the bundle of pleadings - document 21 of the defendant). The defendant claims that his data protection officer can report to the highest body and that in practice he does so according to the defendant (defendant's letter to the Chamber of Disputes dated 4 November 2019, p. 4). The defendant also states that there is no evidence in the inspection report that this person would not be independent (e.g. that he would receive instructions from the management). 
 
34.	The defendant submits a positive and recent evaluation report showing that this person should not fear for his job. According to the defendant, this positive assessment proves that the DPO is able to carry out his tasks in an independent manner and that V was the obvious choice for the DPO. The DPO is based in Dublin but is able to communicate with the defendant's staff in English and French, and there is also a local 'privacy lead' in U. The defendant claims that the DPO meets the Y employees in person on a regular basis and that most of the meetings take place via 'video conferencing' software. This person's professional qualifications are evident from his CV. The data protection officer states that he also works for another social media platform ("Z") and that there is no pre-determined division of time between the two platforms, and that he can rely on a team of 4 full-time employees, in addition to the local privacy lead in U. 
 
35.	In view of the cross-border nature of the data processing operations on the defendant's website, the Litigation Chamber decided to submit the case to the Article 56 AVG procedure in order to identify the leading supervisory authority and the supervisory authorities concerned. The GBA identified itself as a potential lead supervisory authority. Authorities from the following countries declared themselves to be concerned: the Netherlands, Germany (Lower Saxony, Baden-Württemberg, Brandenburg, Rhineland-Palatinate, Mecklenburg-Western Pomerania, Bavaria, North Rhine Westphalia, Berlin), Portugal, Sweden, Ireland, Latvia, Italy, Norway, Hungary, Austria, Spain, France, Cyprus, Slovakia, Denmark, Slovenia. 
 
36.	On 3 October 2019, the Disputes Chamber sent a registered letter to the defendant enclosing the defendant's annual accounts for the fiscal years 2016, 2017 and 2018, asking whether the defendant could confirm the figures contained therein, including the turnover figure. The turnover figures are as follows: 
-	financial year 2016: more than XXX EUR; 
-	financial year 2017: more than XXX EUR, - 	financial year 2018: almost XXX EUR. 
 
37.	On 17 October 2019, the defendant's counsel confirmed on behalf of his client that the annual accounts listed above are accurate. By means of this letter, the defendant wished to draw the attention of the Litigation Chamber to an enclosed forecast for the fiscal year 2019 (see below).   
 
38.	A transcript of the hearing was sent to the defendant for information by e-mail dated 30 October 2019, asking him to respond within 2 working days if he had any comments. The defendant was informed that this does not reopen the debates and that the comments may only refer to the presentation of the oral debates. 
 
39.	The defendant submitted his observations to the Dispute Chamber and insisted, among other things, on taking into account "the fact that Y was always willing to cooperate long before the official start of the investigation and that it repeatedly asked the GBA for feedback, which was never given". ) 
 
40.	On 5 November 2019 this case was discussed again at the session of the Disputes Chamber. The Disputes Chamber decided to initiate the cooperation procedure as referred to in article 60.3 AVG. 
 
41.	On 8 January 2020, an English translation of the draft decision was submitted to the relevant data protection authorities in accordance with Article 60.3 of the AVG. On 15 January 2020, the respondent was informed by letter. 
 
42.	The Netherlands submitted a relevant reasoned objection on 4 February 2020. The Netherlands asked for more references to the case law of the Court of Justice regarding the analysis of the defendant's legitimate interest in sending invitations to third parties who are not members of its social media platform, on the one hand, and contested the relevance of references to a research report from 2013 regarding the legitimate interest of a social medium to send invitation emails, on the other hand. 
 
43.	The Dispute Chamber decided on 14 February 2020 to uphold the objection lodged, in particular as regards the assertion that the application of the legal basis justified an interest in 
in the present case, an assessment in concreto of all the relevant factual elements, taking into account the case-law of the Court of Justice: the Chamber of Disputes decided to reopen the debates as regards the analysis of the legitimate interest of the defendant. 
 
44.	The Disputes Chamber informed the defendant by registered letter of 18 February 2020 of this relevant and substantiated objection, as well as of its content, and invited the defendant to respond by 9 March 2020 at the latest, regarding the possible invocation of the legitimate interest as a legal basis for the disputed data processing operations. The defendant submitted its response by letter of 9 March 2020.     
 
45.	The Disputes Chamber then took note of the defendant's arguments regarding his legitimate interest and, following the Inspection Report and taking into account the defendant's argumentation, ruled that it would impose a fine of EUR 50,000 on the basis of the infringements of the AVG that it had established. 
 
46.	In order to give the defendant the opportunity to defend himself on the amount of the fine proposed by the Chamber of Disputes, the Chamber of Disputes decided to list relevant infringements in its standard 'form for reaction against the proposed fine', which was sent by e-mail of 7 April 2020, stating that the defendant was free to further complete this document with its reaction on the particular circumstances of the case, the proposed amount of the fine and the annual figures submitted.  The defendant replied by e-mail of 28 April 2020 with its arguments regarding the amount of the fine as well as new information regarding the turnover for the fiscal year 2019 which exceeds EUR 10.000.000 according to the latest forecast of the defendant. 
 
47.	In the meantime, the Chamber of Disputes had decided to submit a revised draft decision to the relevant authorities on 23 April 2020 in accordance with Article 60.5 AVG. This international procedure ended on 8 May 2020, without any substantiated objection. 
 
48.	The Dispute Chamber then adjusted its decision to take into account the defendant's arguments regarding the fine. 
 
 
 
2. Decision 
2.1 Qualification of the controller and of the processing at issue 
 
49.	The defendant is responsible for processing the personal data of the users of the social media platform "W", as well as for processing the contact data of non-users (names, telephone numbers or e-mail addresses) and other contact information stored on the servers of "W" as a result of the synchronization of the address book (GSM or e-mail) of the users of the website. 
 
50.	After all, under Article 4.7 AVG, the controller is 'a natural or legal person, a public authority, a service or other body, whether or not a third party, to whom/which the personal data are provided'. […]”. 
 
51.	The Court of Justice of the European Union has interpreted on several occasions that the term 'controller' refers to 'the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data', with a view to ensuring effective and comprehensive protection of data subjects through a broad definition of the term 'controller'. Moreover, this notion 'does not necessarily refer to a single body and may involve several participants'. 
to such processing, each of which is then subject to data protection provisions 
fall." 
 
52.	In accordance with 	the 	Group	'	s 	Opinion 	1/2010 	on 	the 	terms 
"The Chamber of Disputes assesses the role and capacity of the 'controller' and 'processor' in concrete terms23.   
 
53.	In the present case, the defendant is responsible for the storage of the contact details of the website users, since the defendant has predetermined the means and purposes of this processing (sending invitation emails). With regard to the means and conditions for this processing, for example, the retention period of contact data is determined by the defendant in Article 11 of its privacy policy. This period shall be 3 months following the closure of the user's account, or immediate deletion when the website user deselects the "Contact Synchronisation". 
 
54.	The defendant is also in this case the data controller, which consists of sending invitation emails in the name and on behalf of "W" to contacts of current users. 
 
55.	However, the transmission to the recipients of the invitation emails and the processing of personal data in the message itself do not fall under the GCG to the extent that the "household exception" exception applies, i.e. if it concerns a purely personal or household activity within the meaning of Article 2 of the GCG. 
 
56.	The defendant himself cannot invoke this 'household exception' as clarified in recital 18 of the AVG: 'This Regulation shall not apply to the processing of personal data by a natural person in the context of a purely personal or domestic activity which as such is unrelated to any professional or commercial activity. Personal or household activities may include conducting correspondence or keeping address records, social networking and online activities in the context of such activities. However, this Regulation shall apply to controllers or processors providing the means for processing personal data for such personal or household activities'. Thus, the defendant is responsible for sending out invitation emails even if the website user could invoke the household exception as regards his own processing of personal data. 
 
57.	Moreover, the defendant itself does not dispute that the AVG applies to the contested processing operations and does not invoke the exception for personal or household purposes. 
 
 
2.2 Clarification with regard to the household exception and the concept of personal communication 
 
58.	The defendant claims that he considers the invitation e-mails to be a 'personal communication'. In his conclusion and at the hearing, the defendant clarified that this defence has nothing to do with the 'household exception' and that at no point did he claim that the AVG would not apply. According to the defendant, the notion of 'personal communication' merely refers to the fact that it does not constitute a marketing message within the meaning of Article 13.2 of the ePrivacy Directive, according to the criteria defined by Group 29 in its Opinion 5/2009 on online social networks . 
 
59.	Thus, the defendant does not dispute that the AVG is applicable and that he is the controller with regard to the sending of invitation e-mails. 
 
60.	De Geschillenkamer adds that certainly if the recipients of the invitation e-mail have been determined in advance by the online social platform (e.g. pre-ticked), the user of the website concerned has no control over an important aspect of the purposes of the processing (indicating the recipients). The pre-check of recipients by the defendant is therefore in this case an additional element to consider the defendant as a data controller. 
 
61.	Finally, it is thus established that the defendant is responsible for the processing of personal data of the contact persons of the users of the "W" website, both as regards the storage of those data and the sending of an invitation e-mail. 
 
2.3 Legal basis for processing the contact details of users and non-users of the "W" website 
 
62.	As a data controller in the context of the 'invite a friend' functionality, the defendant must ensure that this processing complies with the principles of data processing and is lawful, in the sense that the processing is carried out on an adequate legal basis (Articles 5 and 6 AVG). 
 
63.	The processing concerns personal data of users and non-users of the website "W", and is twofold: the storage of contact data on the defendant's servers and the sending of invitation emails. 
 
64.	The defendant claims that the procedure elaborated on the "W" website ensures that it obtains free, specific, informed and unambiguous consent from the user of the website, in accordance with the requirements of Articles 4.11, 6.1 and 7 of the AVG, with regard to the "invite a 
friend/invite a friend' functionality (defendant's conclusion, p. 19). 
 
65.	In particular, the defendant states that the consent of the recipient of the message is not required, neither for the storage of his contact details on the servers of the website, nor for the sending of an invitation e-mail, and this because the user of the website has given his consent for the import of his address book by the defendant: 
 
"First of all, it should be pointed out that importing the contact details of the contacts is a processing of personal data that is part of the purpose of the 'invite a friend' functionality. As explained above, for this purpose Y processes personal data included in the address book of a user who has given his consent. Y can therefore invoke a valid legal basis for importing the personal data of these contacts". (Defendant's conclusion, p. 21). 
 
66.	The defendant reiterated this assertion at the hearing, and also clarified that he did not wish to invoke any other legal basis in that respect. 
 
67.	The defendant also refers to other online services where users can "upload/upload" their address book (Gmail, Hotmail, Whatsapp and Messenger) as well as operating systems (such as IOS, Android and Windows) where users upload their address book and photos: 
"If the Inspectorate tries to demonstrate that whenever a user of a service uploads personal data relating to people he knows, the company operating the service must obtain the consent of these people, this would undermine the operation of online communication services in general. Such a position would apply not only to "invite a friend" functionalities such as Y and other online social networking services, but also to (i) messaging services such as Gmail, Hotmail, Whatsapp and Messenger, where users upload their address book, (ii) operating systems such as iOS, Android and Windows, where users upload their address book and photos, and (iii) other services such as booking services and aircraft check-in services, where users can upload personal data of people they know, etc. "”  . 
  
 
3.  Motivation regarding the processing of personal data of users versus non-users 
 
3.1 With regard to the processing of personal data of non-users 
 
3.1.1 No valid consent 
 
68.	The Disputes Chamber does not follow the defendant in his assertion that the user of the social media website himself can give his consent for the import by the website of personal data of third parties in his address book, with a view to sending an invitation e-mail. 
 
69.	Under the GCAU, only the data subject whose personal data are processed can validly consent to the processing of these data, except in cases of parental consent (Art. 8.1 GCAU) or another legal power of attorney . In the event that data of a third party is used, this third party must give permission in accordance with the conditions of Article 7 in conjunction with Article 4.11 of the AVG, as interpreted by 
Group 29.  There is no such consent here. In addition, such consent can de facto only be given by existing members of "W" if and to the extent that they would give their consent to the use of their personal data in accordance with the terms and conditions of the AVG at the time they enter the platform.
 
70.	In this context, the Disputes Chamber also refers to an investigation by the Dutch Data Protection Authority into Whatsapp, dating from before the entry into force of the AVG. In the context of the mobile application Whatsapp, this authority ruled that the social media user cannot give valid consent in the name and on behalf of a non-user of the social media platform: 'Whatsapp users cannot give (unambiguous) consent on behalf of the non-users in their address book to have the contact details relating to them processed by WhatsApp, without being authorised to do so by the non-users concerned. Only the affected non-users themselves (or their legal representatives) may give such consent. Because WhatsApp does not obtain the unambiguous consent of non-users in Whatsapp users' address books for the processing of their personal data and yet processes them, and WhatsApp has no other basis for such data processing, WhatsApp is in violation of Article 8 of the (Dutch) Data Protection Act ". 
 
 
3.1.2 Possibility of invoking a legitimate interest 
 
71.	In the present case, no legal basis other than 'consent' is invoked by the defendant. The defendant only invoked the basis "legitimate interest" in a subordinate capacity, in response to the questions raised by the Disputes Chamber following the objection lodged by the Netherlands. The Disputes Chamber therefore investigates whether the disputed processing of personal data of non-users can have a legal basis under Article 6 of the AVG, and whether or not the processing is therefore 'lawful' within the meaning of Article 5.1 of the AVG. 
 
72.	In the absence of any possibility to request permission with regard to the processing of personal data of non-users, the Disputes Chamber investigated to what extent the social media platform "W" could process the data of third party non-users on the basis of its legitimate interest (art. 6.1.f) AVG, with a view to very limited purposes, as explained below. 
 
73.	De Geschillenkamer understands that the website "W" has an interest in processing third party non-users' personal data in order to stimulate an increase in the number of members of the platform.   
 
74.	In this case, the data of third party non-users are not processed solely for the purpose of identifying members of the "W" website. However, the data of contact persons (including third party non-users) are potentially kept by the Website for 3 months after a "W" account has been closed by the user . 
 
75.	The website "W" also processes more data than necessary to send an invitation e-mail as these data are not restricted by the website itself: not only contact data determined by the website itself (e.g. names, telephone numbers and e-mail addresses) but on the contrary possibly other categories of personal data such as from third party providers of information society services, i.e. "other information as clarified on the permissions screen of the provider, about your contacts imported on our servers".   
 
76.	Article 6.1.f of the AVG provides that the legal basis may be used in so far as 'the processing is necessary in order to protect the legitimate interests of the controller or of a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child'.  
 
77.	The case law of the Court of Justice of the European Union requires that recourse to Article 6(1)(f) of the AVG must meet three cumulative conditions: "namely, in the first place, the furtherance of a legitimate interest of the controller or of the third party or parties to whom the data are disclosed, in the second place, the necessity of processing the personal data for the purposes of pursuing the legitimate interest and, in the third place, the condition that the fundamental rights and freedoms of the data subject do not prevail" . 
 
78.	In other words, the person responsible for processing must demonstrate that: 
1)	the interests it pursues in the processing may be recognised as legitimate (the 'purpose test'); 
2)	the intended processing is necessary for the purposes of pursuing those interests (the 'necessity test'); and 
3)	weighing these interests against the interests, fundamental freedoms and fundamental rights of data subjects in favour of the controller or of a third party (the 'balancing test'). 
 
 
The target key 
 
79.	The Court of Justice clarifies that the legitimate interest must also be "existing, current and not hypothetical at the date of processing".     
 
80.	The Dispute Chamber also refers to the recent Guidelines 3/2019 on the processing of personal data by camera , in which the EDPB reiterated that the controller or third parties may pursue legitimate interests of various kinds, in particular, interests of a legal, economic or immaterial nature . In this context, the EDPB also refers to the judgment of the Court of Justice that "the interest of a third party in obtaining personal data from a person who has caused damage to his property, in order to recover the damage from that person before the courts, is a legitimate interest 
is". 
 
81.	On the basis of the case law of the Court of Justice and the guidelines of the EDPB, the Disputes Chamber rules that the concept of legitimate interest can have a broad scope, on the understanding that an interest invoked by a data controller is sufficiently specific. In the context of the present case, the Disputes Chamber does not rule on the question whether an economic interest can be regarded as a legitimate interest within the meaning of Article 6.1.f of the AVG. 
 
82.	In the present case, the defendant points out that 'the purpose of the W platform is essentially to allow users to connect with each other and to have interesting conversations and exchanges with the other users' and that 
o	Y, as processing manager, has an interest in offering users of the W platform the possibility to find contacts who are already users and/or invite other contacts who are not yet users to become members; 
o	the user of W, as a third party or as a data controller using the platform under the household exception (recital 18 AVG), has an interest in finding or inviting persons he knows in order to build up his network more easily" . 
83.	The defendant also invokes that the development of the "invite a friend" functionality was driven by the fact that certain users asked for an easy way to find or invite acquaintances, and that the "experience" of the user on the social platform "W" is made more pleasant by this "invite a friend" function. The defendant also stresses that this interest is "an actual and present interest that is neither vague nor speculative in nature". 
 
84.	The Disputes Chamber holds that, on the basis of these facts and motives, the defendant demonstrates the existence of an interest to be taken into account, that this interest is present and sufficiently specific, as is apparent from the detailed statements of the defendant. 
 
The necessity test 
85.	The Court of Justice has clarified that, in order to review this condition, it must be verified "that the legitimate interest of processing of data sought ... cannot reasonably be achieved as effectively by other means which are less prejudicial to the fundamental freedoms and rights of data subjects, in particular the right to respect for private life and the right to the protection of personal data. 
personal data as guaranteed by Articles 7 and 8 of the Charter' . 
 
86.	The Court of Justice has also clarified that the condition relating to the necessity of the processing must also be examined in conjunction with the principle of minimum data processing laid down in Article 5(1)(c) of the AVG. 
 
87.	The defendant claims that the "W " platform processes only the basic contact data of its users' contacts. However, it appears from the factual data that the defendant keeps these data in principle for 3 months, unless the user of the platform decides to stop the synchronisation of his contacts. 
 
88.	De Geschillenkamer is of the opinion that the collection of these contact data - with regard to both users and non-users of the website - only passes the necessity test if these data are immediately deleted after initial use. 
 
89.	As far as non-users are concerned, the Disputes Chamber decides that it should be possible for the social media platform "W" to invoke the legitimate interest, but only to process the personal data of the existing "W" members, in order to help those users to identify their contacts who are already "W" users and who have therefore agreed to use the "W" website's messaging function as a communication medium. 
 
90.	It is important to note that these members have previously given their unambiguous consent to "W" to collect and process their mobile phone number or email for this purpose. In addition, 'W' must take appropriate technical and organisational measures in order to meet the data protection requirement by design and by default as set out in Article 4 of the Directive. 
25 AVG to comply.   
 
91.	In this context, the Disputes Chamber also refers to Group 29's Opinion 5/2009 on online social networks. This opinion states in this respect that social media networks have no basis for processing data of non-users other than the legitimate interest, and that, moreover, it is not possible to invoke this basis to extract contact details of non-members from uploaded address books and then use them to create new social media profiles: 'Many social network services let their members contribute data about others, such as adding a name to an image, rating people, drawing up lists of people who want to meet or have met members. These tags can also be used to identify non-members. However, the processing of such data about non-members by a social network service is only allowed if one of the criteria laid down in Article 7 of the Data Protection Directive [now Article 6.f AVG "legitimate interest"] is met. There is no legal basis for creating ready-made profiles of non-members by collecting data provided independently by members, including relationship data derived from uploaded address books'.  . 
 
92.	This opinion is, in principle, still relevant since the legal basis of legitimate interest has not been substantially changed by the entry into force of the AVG. The fact that, according to his allegations, the defendant does not create 'profiles', but only sends out invitation e-mails using the contact details of non-members, does not alter the fact that the sending of these e-mails is not necessary for the purpose intended by the defendant. 
 
93.	The Group 29 has refined this opinion and defined the general interest of social media networks in the context of invitation emails, taking into account the fundamental rights and freedoms of third party non-users. In its Opinion No 06/2014 on the concept of legitimate interest, the Working Party 29 explained the limitations of the legitimate interest in relation to third party contact details by means of an example : 
 
"Example 25: Access to mobile phone numbers of users and not app users: 'compare and forget': 
 
Personal data of individuals are processed to check whether they have already given unambiguous consent in the past (i.e. "compare and forget" as a guarantee). 
An app developer is required to obtain unambiguous consent from data subjects for the processing of their personal data: for example, the app developer wants to access and collect the entire electronic address book of app users, including mobile phone numbers of contacts who do not use the app. In order to do so, it must first assess whether the holders of the mobile phone numbers in the address books of the users of the app have given their unambiguous consent (in accordance with Article 7(a)) to have their data processed. For this limited initial processing (i.e. short-term access for reading the full address book of an app user), the app developer may rely on Article 7(f) as the legal basis, subject to the necessary safeguards. 
Technical and organisational measures should be part of the safeguards to ensure that the company only uses this access to help identify which of its contact persons are already users, and who have therefore in the past given their unambiguous consent to the company to collect and process telephone numbers for this purpose. 
The mobile phone numbers of non-users may only be collected and used for the strictly limited purpose of verification whether they have already given their unambiguous consent to the processing of their data and must be deleted immediately afterwards'. 
 
94.	In summary, Group 29 believes that - in the circumstances described in the above example - the contact details of third party non-users should only be used to check whether or not they are already members of the website, and thus have already given their consent to their contact details being used for communications via the website in question. As stated above, the Chamber of Disputes bases its decision partly on this consideration of Group 29, and considers that the storage of contact details of non-users of Y may only be necessary in the context of "compare and forget" under certain strict requirements and safeguards.    
 
95.	However, the Disputes Chamber notes that the retention period of contact details of non-members exceeds what is strictly necessary to identify existing contacts. The website "W" also processes more data than necessary to send an invitation e-mail as these data are not restricted by the website itself: not only contact data determined by the website itself (e.g. names, telephone numbers and e-mail addresses) but, on the contrary, possibly other categories of personal data such as those of third party providers of information society services, i.e. "other information as clarified on the website". 
permissions screen of the provider, about importing your contacts on our servers". 
 
96.	Pursuant to the above, the Dispute Chamber finds that the storage of contact information of non-Y users may only be necessary in the context of "compare and forget" under certain strict requirements and guarantees. These requirements and safeguards are not met. 
 
 
The weighting test 
 
96.	The Court of Justice clarifies that: "the assessment of that condition involves a balancing of the conflicting rights and interests at issue, which depends on the particular circumstances of a particular case and which must take account of the importance of the rights of the person concerned under Articles 7 and 8 of the Charter". 
 
97.	The criterion relating to the seriousness of the infringement of the rights and freedoms of the person concerned is an essential part of the case-by-case assessment required by Article 6.1.f of the AVG. In 
according to the Court of Justice, this connection must take account in particular of 'the nature of the personal data concerned, in particular their possible sensitivity, as well as the nature and the practical arrangements for processing them, in particular the number of persons having access to them and the ways in which they may be accessed'. 
98.	As highlighted by the Court, 'also relevant in this balancing exercise' are 'the data subject's reasonable expectations that his personal data will not be processed where, in the circumstances of the case, he cannot reasonably expect further processing'51. In this context, the Disputes Chamber also refers to recital 47 AVG which states that what is relevant is what 'the data subject may reasonably expect, at the time and in the context of the collection of the personal data, that processing may take place for that purpose'. ” 
 
99.	In the present case, as regards the seriousness of the infringement, the defendant invokes the following special circumstances: "The nature of the personal data processed by Y in the context of its 'invite a friend' functionality was not excessive. Y has never processed sensitive data, only the absolute minimum of personal data (i.e. basic contact data) with only one purpose, namely to send the invitation e-mail at the request of and on behalf of the user of the W platform'.  However, the Dispute Resolution Chamber again notes that the 
retention period of contact details of non-members exceeds what is strictly necessary to identify existing contacts. Moreover, the data processed are not defined in an exhaustive manner by the defendant. Among other things, the defendant refers to "other information, as clarified on the provider's permissions screen, about importing your contacts into our servers".  
 
100.	With regard to the reasonable expectations of the data subject, the defendant refers to services provided by online email service providers such as Google, or services provided by operating system providers such as Android, IoS and Windows, or providers of social networks such as LinkedIn54. The Litigation Chamber discusses the relevance of practices of these other providers in section 3.1.3 and finds that the arguments concerning these practices fall outside the scope of the current proceedings. 
 
101.	In view of the above, the Disputes Chamber decides that the third condition imposed by Article 6.1(f) AVG and the case law of the Court of Justice has not been met in the present case. 
Conclusion  
100.	The defendant could not validly invoke the 'legitimate interest' as a legitimate ground for the (further) processing of the personal data of the data subject for direct marketing purposes. The defendant is thus in breach of Article 6.1(f) of the AVG. 
 
101.	Furthermore, the Disputes Chamber rules in this case that the legitimate interest in this case only allows the processing of data of non-users for the purpose of a "compare & compare". 
forget' action, in order to select existing users under the contact details, and 
send any invitation email to those existing users. 
 
102.	More specifically, in this case the Chamber of Disputes is of the opinion that the processing must be limited to the data strictly necessary for the purpose of the 'invitation to lodge an application'. 
website" and insofar as it is technically impossible to distinguish between members and non-members in a user's address book without first processing these data as a minimum. In addition, in accordance with Article 32 of the AVG, the defendant should take appropriate technical and organisational measures to secure the processing properly. Only under these conditions could this processing take place on the basis of the defendant's legitimate interest. 
 
103.	The Chamber of Disputes takes into account the fact that the user of the website "W" is still free to send invitations via other channels (social media website or e-mail provider), which the third party already uses. 
 
 
3.1.3 Defence in relation to the processing of data of third persons by other information society service providers 
 
104.	The defendant compares its practices with the processing of data of third parties by other service providers such as " Whatsapp " and " Gmail ", "Windows", "LinkedIn".  The defendant argues, inter alia, that data subjects can reasonably expect their contact data to be processed by different types of online service providers, since, according to the defendant, it is "the normal course of business" for a person to have their contact data processed. 
of other persons in an address book in order to facilitate communication". 
 
105.	The Chamber of Disputes rules that the defence regarding the processing of the data of third persons by service providers does not stand up. 
 
106.	First, the practices of other service providers are not at issue in the present case. 
 
107.	Secondly, the requirement of a proper legal basis for the processing of non-users' data for all service providers, including those referred to by the defendant in its conclusion. 
 
108.	Thirdly, these service providers may not process personal data of third parties in a way that would infringe their rights and freedoms, whatever the legal basis of the processing. As clearly explained by the Working Party 29 in the context of the right to portability, information society service providers and telecommunication service providers may not infringe the rights and freedoms of non-users of their services if a user gives his consent to store on their servers personal data of non-users . Moreover, in this context, the Working Party has also reiterated that the user's consent is not sufficient to process data of non-users: a different legal basis must be laid down, and the legitimate interest of the service provider appears to be the most appropriate basis58. 
 
109.	The Disputes Chamber ruled that these views of the Group 29 support the earlier finding of non-compliance - in this case - with the AVG. In summary, the unlawfulness of the data processing of the website "W" results from the fact that this website processes the data of non-members without a proper legal basis, to the extent that this processing was not limited to a "compare & forget" action as set out above. 
 
 
 
 
3.1.4 Use personal data of non-users to send invitation emails 
 
110.	De Geschillenkamer is of the opinion that the storage of contact details of non-users of a website for the purpose of sending an invitation e-mail is only permitted in the context of a "compare & forget" action, as explained above. It follows that it is only possible to send invitation emails to existing members via the "W" website. The Dispute Resolution Chamber will therefore only consider the availability of a legal basis for sending invitation emails to non-users in the future of this decision. 
 
111.	As mentioned above, the defendant argues that the invitation e-mails constitute a "personal communication" on the part of the user of the "W" website, so that no separate legal basis is required for sending this message. However, the defendant stated in its conclusion and confirmed at the hearing that it does not intend to invoke the 'domestic processing' exception in recital 18 AVG. 
 
112.	By 'personal communication', the defendant means that these invitation emails do not constitute a marketing message, on the understanding that advertising messages by email may - subject to exception - only be sent after prior consent (see also Article 13.2 of the ePrivacy Directive  and its implementation in Article VI.110 § 2 of the Economic Law Code ). 
 
113.	In its Opinion 5/2009 on online social networks,  the Group 29 indicated the conditions under which invitation messages sent via a social media platform do not constitute an online advertising message under the platform: 
 
"Some social networking services let their users send invitations to third parties. The ban on the use of e-mail for direct marketing does not apply to personal communications. The exemption for personal communications only applies if the social network service meets the following criteria:  
–	no pressure should be applied to the transmitter or receiver; 
–	the provider is not allowed to choose the addressees of the message; 
–	the identity of the user sending the message must be clearly indicated; 
–	the user sending the message must be aware of the full content of the message to be sent on his behalf'.  
 
114.	The defendant refers to these four terms and conditions , and therefore believes that he may send these messages without prior consent.   
 
115.	The fact that the sending of marketing e-mails is partly regulated by the ePrivacy Directive does not affect the competence of the Dispute Resolution Chamber to supervise the application of the AVG with regard to the consent requirement or the conditions for invoking the legitimate interest . 
 
116.	In this context, the Disputes Chamber decides that the social media network "W" should in principle not request permission to send e-mail messages from users to other users, if the 4 conditions of the Social Media Advice are respected, provided that all other AVG principles such as article 25 (data protection at design and at default settings) are respected.
 
117.	In that case, "W" could - as previously stated - invoke its legitimate interest, including for the storage of the data on its servers, provided that the data of non-members are immediately deleted as soon as it appears that the user has not selected this addressee with a view to sending an invitation e-mail. 
 
118.	However, the Litigation Chamber is of the opinion that the strict AVG rules on consent - which also apply in the context of the ePrivacy Directive  - leave no room for such an interpretation, and that the legal basis " legitimate interest" should be interpreted restrictively to the extent that data of third persons are involved. 
 
119.	With regard to consent, Article 4(11) in conjunction with Article 7 of the AVG states that consent by the person concerned means the following: 
-	free; 
-	specific; 
-	informed and 
unambiguous expression of will by which the data subject accepts, by means of a declaration or an unambiguous active act, the processing of personal data concerning him/her. 
 
120.	This permission must be obtained prior to processing, as is evident from the opening words of Article 6.1 of the AVG: 'processing is only lawful if and insofar as at least one of the following conditions is met: (a) the data subject has given his or her consent to the processing of his or her personal data for one or more specific purposes [...]' . 
 
121.	Therefore, the Disputes Chamber decides that the AVG does not allow the sending of e-mails to third persons with a view to obtaining their consent. This reasoning applies to the requirement of consent under the AVG (requirement of a legal basis) and under the ePrivacy Directive (requirement of "opt-in" for sending marketing messages) . In addition, in its Opinion 5/2009 on online social media, the Working Party stated that sending third parties who are not members of a social media website an e-mail invitation to access their data violates the prohibition in Article 13(4) of the ePrivacy Directive: 
 
122.	"There is no legal basis for creating ready-made profiles of non-members by collecting data provided independently by members, including relationship data derived from uploaded address books. 
Even if the social networking service were able to inform the non-user of the existence of personal data relating to him or her, a possible e-mail invitation to become a member in order to access those personal data would be contrary to the prohibition in Article 13(4) of the e-Privacy Directive on sending unsolicited e-mail for the purposes of direct marketing'.  
 
123.	With regard to the legitimate interest, the Litigation Chamber considers that this legal basis does not allow the sending of such e-mails, in view of the impossibility for the third party to exercise control over his data, in the context where those data have first been uploaded to the website servers and then used in the context of an invitation e-mail. 
 
 
3.2 Store personal data of existing users under the contact persons and send invitation emails to existing users (contacts) 
 
124.	The defendant seeks the consent of the users to store the contact details of other users on its servers and to process those data in the context of invitation emails. 
 
125.	However, the Chamber of Disputes found that the consent of the users was not free to the extent that the first version of the website pre-selected the recipients of the invitation e-mails. This follows directly from Recital 32 of the AVG. The Court of Justice has recently confirmed in the Planet judgment49 as follows that consent is not validly obtained if pre-selected boxes are used: 
"“51. "Article 2(h) of the above-mentioned Directive [95/46] defines 'the data subject's consent' as 'any free, specific and informed expression of consent by which the data subject accepts that personal data relating to him/her are processed'. 
52.       Thus, as the Advocate General pointed out in paragraph 60 of his Opinion, the requirement of a 'statement of will' by the person concerned clearly refers to active rather than passive conduct. Consent by means of a standard checkbox, however, does not imply active behaviour on the part of the user of a website'. 71 
 
126.	Thus, as long as the recipients of e-mails were pre-checked, the defendant could not invoke the legal basis "consent" with regard to the storage of the contact details of existing users and the sending of invitation e-mails to existing users. 
 
127.	The Disputes Chamber rules that the processing in question is not necessarily unlawful within the meaning of Article 5.1 of the AVG, and that the social media network "W" should in principle not ask the AVG for permission to send e-mail messages from users to other users, in so far as such messages would fall under the basis "necessary for the performance of a contract" or "legitimate interest" pursuant to "W" (Article 6.1.b or Article 6.1.f of the AVG). 
 
128.	In particular, the website may invoke its legitimate interest if the emails do not constitute a marketing message within the meaning of Article 13.2 of the ePrivacy Directive, provided therefore that the defendant complies with the conditions set out by Group 29 (such as e.g. 
do not let the recipients be chosen by the website itself).   
 
129.	In this case, the Chamber of Disputes notes that the recipients of the invitation e-mails were originally ticked beforehand.   
 
130.	Even if the defendant does not invoke these principles, the Chamber of Disputes notes that ticking the addressees in advance would be problematic in the context of the legal basis 'legitimate interest' or 'performance of a contract': after all, the sending of bulk e-mails does not comply with the principle of minimum data processing (Article 5.1.c AVG) and with the principles of Article 25 AVG (data protection by design and by default settings). The fact that, in the previous version of the website, the website user had the possibility to deselect the pre-checked recipients one by one does not matter. 
 
131.	Finally, since the defendant has voluntarily removed the pre-ticked options - in response to the Inspectorate's grievances in that regard - the data controller 'W' is eligible to send such e-mails to other users in the name and on behalf of its users on the basis of its legitimate interest. 
 
132.	As an alternative to the justified interest, the Disputes Chamber is of the opinion that the social media network "W" should in principle not have requested AVG permission to send e-mail messages from users to other users, to the extent that such messages under "W" could fall under the basis "necessary for the performance of a contract" (art. 6.1.b AVG). The possibility to invoke such a basis obviously depends on the definition of the service provided and the extent to which the persons concerned have been informed about it . The Disputes Chamber does not have sufficient factual data at its disposal to assess the lawfulness of the processing under the legal basis 'performance of a contract'. 
a contract', but decides that the processing could in any case be carried out under the legal basis 'legitimate interest', and therefore was not unlawful, after removal of the pre-checked addressees of the invitation e-mails. Needless to say, the Disputes Chamber also notes that the defendant must, of course, be transparent about the processing grounds used by him. 
 
 
3.3 Letters from the inspectorate concerning the Data Protection Officer 
 
133.	The Litigation Chamber decides not to respond to the Inspectorate's grievances about the Data Protection Officer, given that the prima facie expertise of this person is apparent from the CV submitted, and given that the documents and the hearing show that this person was duly involved in developing the 'invite a friend' functionality. Moreover, the defendant adequately explained the role and position of the DPO at the hearing. 
 
 
3.4 The defence on the lack of concrete recommendations from the GBA or the Inspectorate Service 
 
134.	The defendant reproaches the GBA for not having made any concrete recommendations or comments on the "invite function" following a letter of 12 October 2018  in which the GBA reminded the defendant of the requirement to obtain a valid consent under the AVG with regard to the "invite a friend" functionality (defendant's conclusion, p. 3). The defendant makes the same reproach to the Inspectorate (Conclusion, p. 5). As the defendant rightly points out (Conclusion, p. 4), the Inspectorate made no recommendation regarding the invitation functionality and chose to ask for information. 
 
135.	The Inspectorate's task is to gather evidence of indications of practices which may give rise to a breach of the fundamental principles of personal data protection (Article 63 et seq. of the WOG). The Inspectorate is 
not charged with providing tailor-made advice on the infringements under investigation. More generally, under Articles 5.2 and 24 AVG 4, the controller is responsible for accountability. This accountability is a core element of the AVG. A data controller cannot evade this accountability by claiming that he has not received sufficient instructions from the supervisor. Admittedly, pursuant to Article 57.1.d) AVG, it is a duty of the GBA to make responsible parties and processors better aware of their obligations in respect of the AVG. However, in performing this task, the GBA - of which the Inspectorate is part - has a great deal of discretion whether or not to draw a data processor's attention to a possible infringement. 
 
 
3.5 Decision concerning the sanction 
 
136.	As a result of the Inspection Report and taking into account the defendant's argumentation, the Disputes Chamber established the following infringements of the AVG: 
 
1.	The defendant has no legal basis for storing and further processing the personal data of non-users of the website "W" in its files with a view to sending an invitation e-mail: this constitutes an infringement of Articles 5 and 6 of the AVG; 
2.	The defendant has no legal basis to send invitation e-mails to existing users of the website during the period in which the addressees of the invitation e-mails were checked in advance: infringement of article 5.1 in conjunction with 6.1.a), 7 AVG and 4.11 AVG. 
 
 
3.5.1 Competence of the Dispute Settlement Chamber with regard to sanctions 
 
137.	By virtue of article 100 WOG, the Disputes Chamber is authorised to order that the processing be brought into conformity (art. 100.9 WOG) as well as to impose periodic penalty payments (art. 100.2° WOG). The Disputes Chamber is also competent to impose administrative fines (art. 100.13°, 101 and 102 WOG) and to publish the decision on the website of the Data Protection Authority (art. 100.16° WOG). When determining the level of the fines, the Disputes Chamber must take into account the criteria laid down in Article 83 of the AVG, depending on the circumstances. In this case, the Chamber of Disputes takes into account the following circumstances that it considers sufficient to impose the sanctions listed below: 
 
-	the nature, seriousness and duration of the infringement: this is a lack of legal basis, which the Chamber of Disputes considers to be a serious infringement, in particular as regards the right of non-members of the 'W' website to retain control over their data and not to run the risks associated with data processing (recital 75 AVG); 
-	the intentional nature of the breach: the defendant was aware of a problem regarding the processing of personal data on the website since the first letter of the GBA dated 12 October 2018. 
 
 	 	 
3.5.2 The attenuating circumstances invoked 
 
138.	The defendant considers, in a subsidiary order, that the penalties imposed should take account of the following attenuating circumstances (Conclusion, p. 42): 
 
•	The defendant would have been 'not negligent' and would have acted in good faith taking into account the Opinion 5/2009 on social networks of Group 29. In this respect, the Disputes Chamber states that the defendant cannot simply rely on an opinion of 2009, long before the AVG came into being, which moreover - as described above - is insufficiently clear. Moreover, the data controller could have been aware of the discussions surrounding the use by social media sites of data of non-members, as reflected in Group 29's Opinion 06/2014 on the concept of "legitimate interest"; 
•	The possible infringements would not have caused any material damage: Here the Dispute Chamber points out that the right to data protection is a fundamental right and that it is irrelevant for the violation of this right whether infringements cause material damage . The infringement in this case leads to the loss of control over the data by many persons, which is mentioned in recital 75 of the AVG as a potential cause of immaterial damage; 
•	The defendant has stopped using pre-checked options. The defendant was aware of the infringement since 3 April 2019 (Conclusion, p. 42) and waited to receive a second letter from the Inspectorate (May 2019) to stop this practice (Conclusion, p. 13). The Disputes Chamber is of the opinion that this infringement was deliberate or, at any rate, largely due to negligence, since recital 32 of the AVG makes it clear that consent is not validly obtained if the options offered have been ticked beforehand. ) The defendant therefore had to know that the consent of the users of the website to process their data with a view to sending out invitation e-mails was not valid with regard to the selection of recipients. In addition, the defendant also had to know that a user of the website could not consent to the use of data by third parties. 
 
139.	In his response to the form dated 28 April 2020, the defendant developed additional arguments with regard to the sanction proposed by the Chamber of Disputes. 
 
140.	The defendant argues that he was not negligent and that the alleged infringements did not constitute a clear infringement of the AVG, but rather "a problem of interpretation about which 
even the supervisory authorities adopt different interpretations'. The defendant wrongly deduced this from the fact that the Dutch authority had adopted a relevant and substantiated objection. The Dutch authority did not object to this final decision, and all authorities concerned have validated the reasoning set out above with respect to the amount of the fine. 
 
141.	The Disputes Chamber agrees with the defendant that a discussion was possible on the extent to which the defendant could or could not invoke a legitimate interest to address third party non-users by means of an invitation e-mail. 
 
142.	However, the Chamber of Disputes found that no discussion was possible and ruled that the legal basis invoked by the defendant was invalid: the existing users of a website cannot give permission for third party non-users . Thus, the defendant misapplied the legal basis "consent" (or exemption from consent), and in any case it is not allowed to subsequently invoke the legal basis "legitimate interest" to justify a certain processing already started . 
 
143.	For the sake of clarity, the Disputes Chamber reminds the defendant that it did not invoke the basis 'legitimate interest' (and did not examine its conditions of application) in its original privacy policy, nor later in the context of its arguments before the Disputes Chamber, despite a clear question from the Disputes Chamber in that respect at the hearing, and up to and including the reopening of the debates by the Disputes Chamber on that point. This constitutes a clear breach of its information obligations under art. 12-13 of the AVG and of the requirement to have an appropriate legal basis under art. 5-6 of the AVG before the data processing starts. 
 
144.	It is also beyond dispute that, with regard to invitations sent to existing members of the social media platform "W", the defendant could not invoke the legal basis "consent" as long as the addressees of the invitation e-mails were originally ticked in advance . 
 
145.	For this reason, the Disputes Chamber decides that the defendant has been negligent and deserves a fine with regard to the sending of invitation e-mails both to members and third non-members of the social media platform "W", and that a fine is justified, even if there was a possible debate regarding the limits and conditions of the defendant's justified interest with regard to the sending of invitation e-mails by social media to third non-members, which debate the Disputes Chamber, in view of the circumstances presented to it, decides in this case. 
 
146.	In determining the amount of the fine, the Disputes Chamber shall take into account the circumstances invoked under 3.5.1 and 3.5.2 of this decision. 
 
147.	The Disputes Chamber also takes note of the fact that, according to the information provided in its response dated 28 April 2020, the defendant stopped sending out invitation e-mails as of 7 February 2020. 
 
148.	However, the Chamber of Disputes did not require such a far-reaching measure and reopened the debates on the legitimate interest in order to allow the defendant to properly carry out the assessment of his legitimate interest.   
 
149.	In 	the 	original 	draft decision, 	as submitted 	to 	the 	relevant 
In the context of the cooperation procedure provided for in Article 60.5 of the AVG, the Litigation Chamber had ordered that the processing would be brought into compliance with Articles 5 and 6 of the AVG within 3 months of the date of this decision, by ensuring that the storage and processing of personal data for the purpose of sending invitation e-mails to third non-members of the website is either discontinued or based on a legal basis (e.g. consent, legitimate interest). However, this envisaged injunction no longer has a raison d'être, as the defendant - according to the statements of his legal counsel in his response dated 28 April 2020 - has spontaneously stopped sending out invitations e-mails since 7 February 2020. 
 
150.	The fact that the defendant stopped sending invitation e-mails is a sign of good will but does not alter the fact that the defendant was negligent in determining a legal basis, not only for the start of the data processing in question but also in the context of his argumentation with regard to the Disputes Chamber despite the reopening of the debates by the Disputes Chamber. The fact that the defendant stopped using pre-ticked options only has a positive impact on the legal basis "consent" for the invitation e-mails sent to existing users, but not with regard to the third non-users of the website. 
 
151.	Nevertheless, the above shows a willingness on the part of the defendant to pay attention to the AVG when developing the processing operations. This is important for determining the level of the sanction.   
 
152.	The Data Protection Authority considers that the annual turnover of the defendant from 2017 onwards (including for the financial year 2019 for which the closure is still ongoing) will still exceed €10,000,000. The Disputes Chamber decided that the amount of the fine should be set at 0.5% of the annual turnover and therefore set the amount of the fine at €50,000.   
 
153.	In view of the importance of transparency with regard to the decision-making of the Disputes Chamber, this decision shall be published on the website of the 
Data Protection Authority. Publication of the present decision is also in the interest of legal development and consistent application of the AVG in the European Union. However, it is not necessary for the identification data of the defendant to be published directly for this purpose. 
 
 
 
 
 
FOR THESE REASONS, 
 
the Data Protection Authority's Disputes Chamber shall decide after deliberation, 
 
- to impose a fine of EUR 50,000 for processing personal data of non-members of the website "W" without an appropriate legal basis, as well as personal data of members, the latter during the period in which the recipients of such e-mails were pre-checked; 
 
An appeal against this decision may be lodged, pursuant to Article 108 §1 of the Act of 3 December 2017, with the GBA as defendant, within a period of thirty days from service of the notification at the Market Court. 
 
  
 
Hielke Hijmans 
President of the Chamber of Disputes
Retrieved from "https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_25/2020&oldid=37562"
Creative Commons Attribution-NonCommercial-ShareAlike
Powered by MediaWiki