Court of Appeal of Brussels - 2021/AR/320: Difference between revisions

Latest revision as of 09:08, 10 September 2021

Court of Appeal of Brussels - 2021/AR/320

Court:	Court of Appeal of Brussels (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 5(1)(a) GDPR Article 6 GDPR Article 12 GDPR Article 13 GDPR Article 14 GDPR Article 31 GDPR
Decided:	07.07.2021
Published:	07.07.2021
Parties:	Family service ADP/GBA
National Case Number/Name:	2021/AR/320
European Case Law Identifier:
Appeal from:	APD/GBA (Belgium) 04/2021
Appeal to:
Original Language(s):	Dutch
Original Source:	Hof van Beroep Brussel 07082021 (in Dutch)
Initial Contributor:	Matthias Smet

The Court of Appeal held that an appeal against a decision of the litigation chamber is not a second chance for the parties to have the case reassessed. The Court should not interfere with the assessment of the administration. Decisions of the SA do not create precedent for future cases. The Court, exercising a review with full jurisdiction, conducts a legality and proportionality review of the administrative fine. The Court will reduce or cancel the fine only in case of serious and proven circumstances which have not or not sufficiently been taken into account by the litigation chamber of the SA.

English Summary

Facts

On 27 January 2021 the Belgian DPA imposed an administrative fine of 50.000 EUR on plaintiff (a company that offers gift boxes to (expectant) mothers) for not complying with the core data protection principles of processing personal data in a fair, lawful and transaparent manner.

The plaintiff appealed the decision and claimed that several procedural principles have been violated in the decision of the Belgian DPA.

Both parties referred to former decisions of the litigation chamber or the Court of Appeal to support their positions. However, according to the Court of Appeal, unlike the Anglo-saxon system, the Belgian legal system does not assign any binding precedent value to decisions.

The most important aspects are shortly described hereafter:

Violation of rights of defence

Although the litigation chamber admits that the file was not fully complete when the case was initiated, the Court stated that plaintiff did not report during the proceedings that documents were still missing afterwards, and therefore that plaintiff did not sufficiently demonstrate that its rights on this point were violated.

Violation of duty to state reasons (facts/violations)

Plaintiff argues that the Belgian DPA can only base its decision on reasons whose factual existence has been duly proven. The court reminds the parties that it is not up to the court to re-examine the facts and substitute its views to the ones of the Belgian DPA. It can only verify whether the facts on which the decision is based are accurate.

Violation of duty to state reasons (legal basis)

Plaintiff complained about the content and motivation of the contested decision with regard to 'consent' or 'legitmate interest' as a legal basis, but the court clearly states that the plaintiff could not sufficiently demonstrate that the consent met all the requirements (free, specific, unambiguous, informed). The Court also points to the absence of a 'balancing test' in which plaintiff had objectively considered beforehand whether the interests of the plaintiff outweigh the reasonable expectations, interests and rights of those involved.

Art. 13 & 14 GDPR vs. confidentiality/trade secret

Plaintiff did not mention the third parties to whom personal data was disclosed on its website and justified the absence of this info by the rules of trade secret and confidentiality. However, it has been conclusively proven in the contested decision that the plaintiff's core activities consist of disclosing personal data of its 'customers' to third parties, and thus touches the core of GDPR. The court confirms that the contested decision is sufficiently reasoned (both on factual and legal grounds).

Publication measures after substantive hearing

Plaintiff asks the Court to order the Belgian DPA to remove the publication of the contested decision, which would not be provided in the national legislation regulating the organization and powers of the DPA, nor in the DPA's policy on publication. The Court considers that the basic principle should be that identification data of legal entities that have been proved wrong should be pseudonymised, except:

- if the publication is imposed as a sanction

- the legal entity itself requests to keep the identification

- the identification of the legal person is a matter of public interest.

Dispute

Holding

The Brussels Court of Appeal declares the appeal admissible but unfounded.

The key take-aways of the decision of the Brussels Court of Appeal are:

The appeal against a decision of the litigation chamber is not a second chance to the party against whom the complaint is directed. It is important to note that this is not an ordinary appeal and therefore is not a second chance as we know it in the ordinary courts. The appeal to the Court of Appeal against decisions of the litigation chamber is an administrative appeal, comparable to the powers of the Council of State. The Court should not interfere with the assessment of the administration. That would violate the separation of powers between the administration and the courts.
The Belgian legal system does not assign any binding precedent value, either to administrative or judicial decisions. Any decision of an administration is specific and does not extend to a case other than the one under consideration. The court always relies on concrete facts of the submitted case.
The Court, exercising its powers with full jurisdiction, conducts a legality and proportionality review of the administrative fine and will reduce or cancel the fine only in case of serious and proven mitigating circumstances (see article 82, paragraph 2 GDPR) which have not or not sufficiently been taken into account by the litigation chamber.

Belgian DPA and publication on social media:

Although in essence the litigation chamber decides in each of its cases whether or not to pseudonymise the decision, the citizen or the legal person concerned should not be exposed to arbitrariness in this regard.

It seems advisable for the SA to have a consistent policy of pseudonymising decisions for publication. The chance of reputational damage, competition damage and the possible size thereof are elements that the litigation chamber must take into account when considering whether or not to omit certain identifiers. However, the Court of Appeal itself has no jurisdiction to order the GBA or its employees to withdraw press releases or posts on social media.

Comment

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

Court of Appeal Brussels -2021/AR/320- p. 4

In this context, various companies that offer products and services are
(future) mothers turn to NDPK so that there is an advertisement, a sample or promotion

will be included in the magazine, guide or Pink Box that is offered.

NDPK states that it only transfers the email addresses of (expectant) mothers to
its long-term partners, namely [...], [...] and [...].

In addition to these three partnerships, NDPK offers other companies that offer products and
offer services to (expectant) mothers, the data (after permission) for the

decision, on a temporary basis and for one-time use. NDPK states

that it is not possible to name all potential partners
when she asks the permission of (future) mothers. Only the activities

can be indicated.

On September 19, 2019, the Data Protection Authority received a complaint from a
courage there who had registered by filling in a reply card for the receipt

of the Pink Boxes.

The complaint followed a call the complainant received on her mobile number, in which a
Dutch company called "Kinderfeest" offered her a package of children's books. It

Dutch company knew her name, her date of birth, the name and date of birth of

her son, her e-mail address and her mobile number. Kinderfun informed the complainant that
her details were communicated to Kinderfun by NDPK. The complainant argues that the

transfer of its data was done in a non-transparent manner, in particular to companies

which she could not find anywhere in NDPK's privacy policy, and that she did not
was aware that NDPK sold its data to commercial partners who

could contact by telephone after submitting its details to NDPK.

The complainant has requested NDPK to remove her data from its files and to

to stop the transmission of its data. However, the complainant notes that even after the

submitting an objection to NDPK still commercial offers from third partners

from NDPK.

On September 30, 2019, the First-line Service of the GBA declares the complaint admissible on

pursuant to Articles 58 and 60 of the Law of 3 December 2017 'establishing the
Data Protection Authority' (hereinafter: "WOG"). She will forward the complaint to the

Disputes Chamber, in accordance with Article 62, § 1, WOG. The complainant will be informed of this at 30

September 2019 pursuant to Article 61 WOG.

@@ Line 45: / Line 45: @@
 |Party_Link_5=
-|Appeal_From_Body=ADP/GBA
+|Appeal_From_Body=APD/GBA (Belgium)
 |Appeal_From_Case_Number_Name=04/2021
 |Appeal_From_Status=
@@ Line 57: / Line 57: @@
 |
 }}
+The Court of Appeal held that an appeal against a decision of the litigation chamber is not a second chance for the parties to have the case reassessed. The Court should not interfere with the assessment of the administration. Decisions of the SA do not create precedent for future cases. The Court, exercising a review with full jurisdiction, conducts a legality and proportionality review of the administrative fine. The Court will reduce or cancel the fine only in case of serious and proven circumstances which have not or not sufficiently been taken into account by the litigation chamber of the SA.
-The Brussels Court of Appeal ruled the appeal and all eight pleas of the defendant are unfounded and states that the appeal to the Market Court does not offer a second chance to the party against whom the complaint is directed. It also remind the parties that it is not for the Court of Appeal to repeat the fact-finding process in order to substitute itself for a national DPA and that
 == English Summary ==
 === Facts ===
-The Belgian Data Protection Authority received a complaint from a mother who had filled in a reply card in order to receive a gift box from the family service (defendant). The personal data of the mother (and her child) was disclosed to several third parties without her knowing. The mother argued that the disclosure had taken place in a non-transparent manner, in particular to companies that were not mentioned in the privacy policy of defendant. As a consequence mother asked the defendant to delete her personal data from its databases and to cease the disclosure of her personal data to third parties.
+On 27 January 2021 the Belgian DPA imposed an '''administrative fine''' of 50.000 EUR on plaintiff (a company that offers gift boxes to (expectant) mothers) for not complying with the core data protection principles of processing personal data in a fair, lawful and transaparent manner.
+The plaintiff appealed the decision and claimed that several procedural principles have been violated in the decision of the Belgian DPA.
+Both parties referred to former decisions of the litigation chamber or the Court of Appeal to support their positions. However, according to the Court of Appeal, unlike the Anglo-saxon system, '''the Belgian legal system does not assign any binding precedent''' value to decisions.
+The most important aspects are shortly described hereafter:
+* '''Violation of rights of defence'''
+Although the litigation chamber admits that the file was not fully complete when the case was initiated, the Court stated that plaintiff did not report during the proceedings that documents were still missing afterwards, and therefore that plaintiff did not sufficiently demonstrate that its rights on this point were violated.
+* '''Violation of duty to state reasons (facts/violations)'''
+Plaintiff argues that the Belgian DPA can only base its decision on reasons whose factual existence has been duly proven. The court reminds the parties that it is not up to the court to re-examine the facts and substitute its views to the ones of the Belgian DPA. It can only verify whether the facts on which the decision is based are accurate.
+* '''Violation of duty to state reasons (legal basis)'''
+Plaintiff complained about the content and motivation of the contested decision with regard to  'consent' or 'legitmate interest' as a legal basis, but the court clearly states that the plaintiff could not sufficiently demonstrate that the consent met all the requirements (free, specific, unambiguous, informed).  The Court also points to the absence of a 'balancing test' in which plaintiff had objectively considered beforehand whether the interests of the plaintiff outweigh the reasonable expectations, interests and rights of those involved.
+* '''Art. 13 & 14 GDPR vs. confidentiality/trade secret'''
+Plaintiff did not mention the third parties to whom personal data was disclosed on its website and justified the absence of this info by the rules of trade secret and confidentiality. However, it has been conclusively proven in the contested decision that the plaintiff's core activities consist of disclosing personal data of its 'customers' to third parties, and thus touches the core of GDPR. The court confirms that the contested decision is sufficiently reasoned (both on factual and legal grounds).
-The mother filed a complaint with the Belgian DPA which initiated an investigation at the premises of the defendant and discovered several violations against the GDPR. The ligitation chamber imposed an administrative fine of 50.000 EUR in its original decision.
+* '''Publication measures after substantive hearing'''
-The family service appealed this decision on following grounds:
+Plaintiff asks the Court to order the Belgian DPA to remove the publication of the contested decision, which would not be provided in the national legislation regulating the organization and powers of the DPA, nor in the DPA's policy on publication. The Court considers that the basic principle should be that identification data of legal entities that have been proved wrong should be pseudonymised, except:
-- infringement of the rights of the defence;
-- infringement of the principle of impartiality;
+- if the publication is imposed as a sanction
-- excess of competence;
-- failure to state reasons;
+- the legal entity itself requests to keep the identification
-- breach of the principle of proportionality;
+- the identification of the legal person is a matter of public interest.
 === Dispute ===
@@ Line 78: / Line 98: @@
 === Holding ===
-The defendant relied on no less than eight pleas in law to support the appeal. However, the court held all eight pleas to be unfounded;
+The Brussels Court of Appeal declares the appeal admissible but unfounded.
+The '''key take-aways''' of the decision of the Brussels Court of Appeal are:
-As a consequence, the Brussels Court of Appeal declares the appeal admissible but unfounded.
+* The appeal against a decision of the litigation chamber is '''not a second chance''' to the party against whom the complaint is directed. It is important to note that this is not an ordinary appeal and therefore is not a second chance as we know it in the ordinary courts. The appeal to the Court of Appeal against  decisions of the litigation chamber is an administrative appeal, comparable to the powers of the Council of State. The Court should not interfere with the assessment of the administration. That would violate the separation of powers between the administration and the courts.
+* The '''Belgian legal system does not assign any binding precedent''' value, either to administrative or judicial decisions. Any decision of an administration is specific and does not extend to a case other than the one under consideration. The court always relies on concrete facts of the submitted case.
+* The Court, exercising its powers with full jurisdiction, conducts a '''legality and proportionality review''' of the administrative fine and will reduce or cancel the fine only in case of serious and proven mitigating circumstances (see article 82, paragraph 2 GDPR)  which have not or not sufficiently been taken into account by the litigation chamber.
+'''Belgian DPA and publication on social media:'''
-The key take-aways of the decision of the Brussels Court of Appeal are:
+Although in essence the litigation chamber decides in each of its cases whether or not to pseudonymise the decision, the citizen or the legal person concerned should not be exposed to arbitrariness in this regard.
-* an appeal against a decision of the litigation chamber does not offer a second chance to the party against whom the complaint is directed. A judge who would interfere with the assessment of the appropriateness of the administrative decision would violate the separation of powers between the administration and the courts.
+It seems advisable for the SA to have a consistent policy of pseudonymising decisions for publication. The chance of reputational damage, competition damage and the possible size thereof are elements that the litigation chamber must take into account when considering whether or not to omit certain identifiers. However, the Court of Appeal itself has no jurisdiction to order the GBA or its employees to withdraw press releases or posts on social media.
-* The Belgian legal system does not assign any binding precedent value, either to administrative or judicial decisions
-* It is not for the Court of Appeal to repeat the fact-finding process in order to substitute itself for the national DPA.
-* The Court, adjudicating with full jurisdiction, conducts a legality and proportionality review of the administrative fine and will reduce or cancel the fine only in case of serious and proven circumstances which have not or not sufficiently been taken into account by the litigation chamber.
 == Comment ==
-''Share your comments here!''
 == Further Resources ==