APD/GBA (Belgium) - 170/2022

APD/GBA - 170/2022
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 5(1)(b) GDPR Article 5(1)(c) GDPR Article 5(1)(a) GDPR Article 6(1) GDPR Article 12(1) GDPR Article 12(2) GDPR Article 13 GDPR Article 14 GDPR Article 21 GDPR Article 25 GDPR
Type:	Complaint
Outcome:	Upheld
Started:	15.10.2018
Decided:
Published:	22.11.2022
Fine:	n/a
Parties:	Mister X (the data subject) La Radio Télévision Belge de la Communauté française (RTBF) (the controller)
National Case Number/Name:	170/2022
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	French
Original Source:	Autorité de Protection des Données (ADP) (in FR)
Initial Contributor:	n/a

The Belgian DPA closed the procedure because of a prior settlement decision between the DPA and a press organisation regarding the use of cookies

English Summary

Facts

The controller was a press organisation/public service broadcaster. The data subject filed a complaint with the Belgian DPA on 18 June 2018 because the controller’s live service for web streaming was only accessible on Belgian territory, and only for data subjects who would provide their personal data (such as email address, Facebook - or Google accounts). The data subject also complained that it was not possible to connect to the live service if he disabled cookies and trackers of third-party companies on the controller’s website.

The investigation service of the DPA (the investigation service) started an investigation into the controller. In its report, the investigation service reported the following findings:

Finding 1: The investigation service determined that the processing of registration data was based on legitimate interest, while the processing of data related to personalisation (profiling) was based on legitimate interest and/or consent. However, the investigation service considered that because the controller was likely an ‘autonomous public undertaking’ (Article 5 LTD (Data protection act)), legitimate interest could not be used as a legal basis. According to the investigation service, legitimate interest of the controller could not be used for processing carried out by public authorities in the performance of their tasks (Article 6(1) GDPR). Moreover, legitimate interest as a legal basis requires a balancing of the interests involved and the controller did not prove that such a balancing exercise was conducted. Finally, the DPA held that the controller could not switch from consent to legitimate interest as a legal basis for the processing of data for personalisation purposes.

Finding 2, 3 and 4: Regarding the processing for advertising profiling and the possibility of objecting, the controller's management contract allowed the controller to use 'content recommendation algorithms. However, the definition of ‘content recommendation algorithms' did not include advertising, according to the investigation service. Because of this lacking definition, the investigation service questioned compliance with Article 5(1)(b) GDPR). Additionally, the provisions of Articles 12(2), 21 and 25 GDPR did not appear to be satisfied because the data subject could not refuse advertising profiling at the time of registration. The controller also did not appear to allow easy opposition to this profiling after registration. Finally, the controller was supposed to update the purposes on the registration form to add the purpose of advertising profiling. However, the controller did not modify the registration form as of 9 January 2020, which resulted in a breach of Articles 12(1), 13 and 14 GDPR).

Finding 5 and 6: The investigation service also held that there was a difference between the mechanism of connection to the live service and registration to the platform of the controller using social networks (Facebook and Google). This difference lacked clarity and explanation, which was incompatible with Articles 12(1), 13 and 14 GDPR, according to the investigation service. Moreover, the mechanism used (under the guise of logging in using a Facebook account) was in fact the creation of a user account at the controller, using the data subject’s Facebook data. The data subject was not informed about the workings of this mechanism, which breached articles 5(1)(a), 5(1)(b) and 5(1)(c) GDPR as well as Articles 12(1), 13 and 14 GDPR.

However, in decision 168/2022, the Belgian DPA had agreed to a settlement with the same controller, regarding the use of cookies on it’s website, pursuant of Article 100(1)(4) WOG (Law establishing the DPA). This settlement extended to potential infringements of the law of 13 June 2005 (WEC – Wet Elektronische Communicatie) as well as potential infringements of the GDPR with regards to cookies, in the period from 25 May 2018 to 11 November 2020.

Holding

Despite the findings by the investigation service, the DPA closed the proceedings regarding some findings, while for other findings the DPA stated that it would continue to investigate.

For findings 1 (concerning advertising profiling only) and findings 2, 3 and 4, the DPA closed the proceedings because it had reached a settlement with the same controller regarding the use of cookies. According to the DPA, the subject matter of the current complaint with regard to cookies was also covered by the settlement. Because of this settlement, the DPA stated that it would not take action regarding findings 1 (concerning advertising profiling only) and findings 2, 3 and 4. The DPA closed the proceedings with regard to these findings pursuant of Article 100(1)(1) WOG. For findings 1 (with regards to the processing of registration data), 5 and 6, the DPA stated that it would continue to examine the substance of the complaint.

Comment

This decision is a consequence of a settlement decided in decision 168/2022 by the Belgian DPA. Decision 168/2022 is one of the 10 cases opened by the Belgian DPA on "Cookie on press websites". For a summary of one of these settlement decisions and some context for all of these decisions, click this link.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/9





                                                                        Litigation Chamber


                                      Decision on the merits 170/2022 of 22 November 2022





File number: DOS-2018-04762


Subject: Complaint relating to the use of the "Auvio" service of RTBF


The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke

Hijmans, chairman, and Messrs. Dirk Van Der Kelen and Christophe Boeraeve, members;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and

to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the

data protection), hereinafter "GDPR";

Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter

ACL);


Having regard to the Law of 30 July 2018 relating to the protection of natural persons with regard to

processing of personal data (hereinafter the LTD);

Having regard to the internal regulations as approved by the House of Representatives on 20

December 2018 and published in the Belgian Official Gazette on January 15, 2019;


Considering the documents in the file;

Having regard to decision 168/2022 of November 22, 2022 of the Litigation Chamber;



Made the following decision regarding:


The plaintiff: Mr. X, hereinafter “the plaintiff”;



The defendant: The Belgian Radio Television of the French Community (RTBF), a company

                    autonomous public of a cultural nature,


                    Hereinafter “the RTBF” or “the defendant”;



                    Counsel for Maître Peter Craddock and Maître Eline Van Bogget, Decision on the merits 170/2022 - 2/9




I. Facts and procedure


 1. On June 18, 2018, the complainant lodged a complaint with the Data Protection Authority

       data (APD) against the defendant.


 2. Under the terms of the complaint, the complainant denounces the fact that the RTBF live service (web
       streaming – Auvio) is accessible on Belgian territory only if visitors

       provide their personal data (e-mail address/login via their Facebook accounts

       or Google). He also points out that the process of connecting to the live service does not

       does not work if the user deactivates cookies and trackers from third-party companies

       used by the RTBF website.

 3. On October 15, 2018, the complaint was declared admissible on the basis of Articles 58 and 60 of the

       LCA and the complaint is forwarded to the Litigation Chamber under Article 62, § 1 of the

       ACL. The complainant is informed of this on the same date.


 4. On October 23, 2018 the Litigation Chamber decides to request an investigation from the Service

       d'Inspection (SI), pursuant to Articles 63, 2° and 94, 1° of the LCA.

 5. On October 29, 2018, in accordance with Article 96, § 1 of the LCA, the Chamber's request

       Litigation to proceed with an investigation is forwarded to the IS. The complainant is informed of this at

       this same date.

 6. On January 28, 2020, the IS investigation is closed, the report is attached to the file and the file is

       transmitted by the Inspector General to the President of the Litigation Chamber (art. 91, § 1 and §

       2 of the ACL). The investigation report is based on two technical analysis reports

       July 1, 2019 and January 9, 2020 respectively.


 7. According to its report, the IS makes the following observations:

       - As to the legal basis underlying the processing of registration data of a

           part and data related to personalization (profiling) on the other hand (finding 1):

           The SI notes that the RTBF declares that it bases the lawfulness of the processing of registration data

           on the legitimate interest on the one hand and the legality of the processing of data related to the

           personalization on legitimate interest and/or consent on the other hand. The IS reminds
           that according to Article 6.1. of the GDPR, the legitimate interest of the data controller cannot

           constitute a basis for the lawfulness of the processing carried out by the public authorities in

           the execution of their missions. The IS refers to article 5 of the LTD whose definition

           "of public authority" is broad and seems to him to encompass the defendant as

           as an autonomous public enterprise. The IS also adds that the use of interest

           legitimate requires balancing the interests involved and underlines

           that the defendant does not provide any element which tends to show that this balance Decision on the merits 170/2022 - 3/9


          was realized. Finally, with regard to the consent invoked in addition with regard to the

          lawfulness of personalization-related data processing, the IS recalls that the

          data controller cannot switch from the basis of lawfulness of consent to that of

          of legitimate interest.

      - As to the legitimacy of the processing of personal data for the purposes of

          advertising profiling and the possibility of opposition (findings 2, 3 and 4): the IS falls

          that if the RTBF management contract allows it to use algorithms for

          content recommendation, the definition of this term does not include advertising. His
          concludes that the legitimacy of the advertising profiling purpose of the processing in the

          of the RTBF (and therefore compliance with Article 5.1.b) of the GDPR) can therefore be implemented.

          doubt. Since at the time of registration, the user cannot refuse profiling

          advertising and that the platform does not seem to allow easy opposition to this

          below, the IS concludes that the stipulations of articles 12.2., 21 and 25 of the GDPR

          do not seem to be encountered. Finally, the IS observes that updating the purposes
          in the registration form by including the purpose of advertising profiling has, at the

          dated January 9, 2020, not carried out even though the defendant was there

          engaged. the IS concludes that this appears to be inconsistent with the provisions of Articles 12.1.

          13 and 14 GDPR.

      - Regarding the use of social network data for login/registration purposes

          (findings 5 and 6): the IS concludes that the difference between the connection mechanism

          to Auvio on the one hand and registration to the platform via social networks (Facebook,

          Google) on the other hand lacks clarity and explanations in contravention with the articles

          12.1, 13 and 14 GDPR. The IS adds that the mechanism used (under cover of the connection

          via a Facebook account) is in fact the creation of an RTBF account with the provision of
          Facebook data of the user, without the latter being informed. The IS concludes

          that this process is in contradiction with articles 5.1.a), 5.1.b) and 5.1.c) of the GDPR as well as

          as Articles 12.1, 13 and 14 of the GDPR.

                                                                                            er
8. On March 17, 2020, the Litigation Division decides, pursuant to Article 95, § 1, 1° and
      article 98 of the LCA, that the case can be dealt with on the merits.


9. On the same date, the parties concerned are informed by registered letter of the

      provisions as set out in article 95, § 2 as well as in article 98 of the LCA. They are
      also informed, pursuant to Article 99 of the LCA, of the deadlines for transmitting their

      submissions, i.e. April 14 and May 14, 2020 for the defendant and April 29 for the

      complainant.


10. On March 19, 2020, the defendant requested a copy of the file (art. 95, §2, 3° LCA),
      which is transmitted to it on March 25, 2020. It also expresses the wish to be Decision on the merits 170/2022 - 4/9


       heard by the Litigation Chamber in accordance with Article 51 of the Rules of Procedure

       domestic ODA.

 11. On April 14, 2020, the Litigation Chamber receives the submissions in response from the

       defendant. On May 14, 2020, she received the conclusions of the summary of this last.

       argument can be summarized as follows.

       The first part of the defendant's conclusions tends to show that the

       findings of the IS investigation must be discarded as soon as the establishment of the said

       report and technical analysis reports has not been made in accordance with the principles

       of good administration.

       As to the merits, the defendant denies that there was any breach in its

       chief.

 12. On April 28, 2020, the Litigation Chamber received the complainant's submissions in response.

       In general, the complainant denounces the attitude of the defendant and insists

       in particular on the practice of cookies, the lack of transparency and the question of the

       relevance of the collection of personal data as a mandatory step to access

       online news content.



II. Motivation


13. Under Article 100 LCA, the Litigation Chamber has the power to:

    1° dismiss the complaint without follow-up;

    2° order the dismissal;

    3° order a suspension of the pronouncement;

    4° propose a transaction;

    (5) issue warnings or reprimands;
    6° order to comply with requests from the data subject to exercise these rights;

    (7) order that the person concerned be informed of the security problem;

    8° order the freezing, limitation or temporary or permanent prohibition of processing;

    9° order the processing to be brought into conformity;

    10° order the rectification, restriction or erasure of the data and the notification of

    these to the recipients of the data;
    11° order the withdrawal of accreditation from certification bodies;

    12° to issue periodic penalty payments;

    13° to impose administrative fines;

    14° order the suspension of cross-border data flows to another State or a

    international body; Decision on the merits 170/2022 - 5/9



    15° forward the file to the public prosecutor's office of the Brussels Court, who informs it of the follow-up

    data on file;

    16° decide on a case-by-case basis to publish its decisions on the website of the Protection Authority

    Datas



14. When a complaint is forwarded to it by the First Line Service (SPL) which declared it
    admissible, or by the IS after an investigation report as in the present case, the Chamber

    Litigation will first examine whether it is technically possible to render a decision

    with regard to said complaint. Otherwise, this complaint will necessarily be closed.

    not followed up for technical reasons.


15. In support of the arguments which follow and on the basis of the powers conferred on him

    granted by the legislator under section 100.1. of the LCA, the Litigation Chamber

    decides to proceed with the dismissal of the complaint in accordance with article 100.1., 1° of

    the ACL.


16. In matters of dismissal, the Litigation Chamber must justify its decision by

    step and:


    - to pronounce a classification without technical continuation if the file does not contain or not

        sufficient elements likely to lead to a sanction or if it includes a

        technical obstacle preventing him from rendering a decision;



    - or pronounce a classification without continuation of opportunity, if in spite of the presence of elements

        likely to lead to a sanction, the continuation of the examination of the file does not seem to him

        timely given its priorities.


17. If the dismissal takes place on the basis of more than one reason (respectively technical or

    opportunity), the reasons for dismissal must be dealt with in order
    important.


18. In the present case, the Litigation Chamber issues a decision without any technical follow-up

    application of article 100.1., 1° of the LCA on the basis of the reasoning which follows (points 19 to 27) and

    within the limits of the grievances concerned.


19. On November 22, 2022, the Litigation Chamber took decision 168/2022 with regard to the

    defendant. Pursuant to this decision, the Litigation Chamber adopted, with regard to

    facts identical to those reported in the second part of the complaint by the complainant

    of the findings 1 (with regard to advertising profiling only) 2, 3 and 4 of the report


1
   See. the dismissal policy note from the Litigation Chamber, point 3.1.
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
litigation.pdf Decision on the merits 170/2022 - 6/9



    investigation of the IS – point 7), one of the measures listed in article 100.1 of the LCA recalled below

    above, or a transaction (article 100.1.4° LCA).


20. Said settlement decision 168/2022 extends “to potential infringements under the law of 13

    June 2005 (in force at the time of the findings of the APD Inspection Service in the
            2
    file), as well as potential violations of the General Data Protection Regulation.

    data (GDPR), with regard to cookies and, more generally, the storage and

    consent to the placement and further processing of information on the device of

    the user as a data subject. The transaction decision relates to the websites

    involved and mentioned in the file and concerns the party to which the proposal of
                                3
    transaction is addressed”.


21. This settlement decision 168/2022 is addressed to the same party as the defendant of the

    this decision, or to RTBF.


22. The object of the transaction also relates, as has just been mentioned, to “the offenses

    potential GDPR, with regard to cookies and, more generally, the storage and

    consent to the placement and further processing of information on the device of

    the user as a data subject”. The settlement thus covers the “cookies” grievance

    as a whole raised by the complainant under the terms of his complaint (second part) as well as

    findings 1 (only for advertising profiling), 2, 3 and 4 of the IS investigation report

    as recalled in point 7 above.


23. Finally, Decision 168/2022 specifies that “the transaction relates only to a specific period:
                                                                 4
    the period from May 25, 2018 to November 11, 2020”, i.e. the date of submission of the last

    IS report in said file.

24. Within the limits of this decision 168/2022, the Litigation Chamber has thus exhausted its referral

    as to the facts denounced by the complainant and as to the corresponding "cookie" grievances. The


    Dispute Chamber therefore dismisses the plaintiff's complaint with regard to these grievances.

    for technical reasons and this, within the same material and temporal limits.

25. Decision 168/2022 specifies in the same way that “the transaction exhausts the powers of the

    Litigation Chamber to take corrective measures in respect of infractions

    within the limits of the legal elements and provisions described above and in the

    transaction proposal, as well as within the period [read the period] referred to above. The

    Chambre Litieuse stresses that the transaction does not affect the powers of the courts and




2The settlement decision comes in the context of an own initiative investigation carried out by the Inspection Service on the
problem of data processing via cookies in the Belgian media sector, including those operated by the

defendant.
3Point 19 of decision 168/2022 of the Litigation Chamber.

4Point 20 of decision 168/2022 of the Litigation Chamber. Decision on the merits 170/2022 - 7/9



    courts nor those of other authorities to examine infringements where appropriate. The

    transaction in this case binds only the Litigation Chamber of the Authority of
                                    5
    Belgian data protection”.

26. As mentioned above, the object of the transaction formalized in the decision

    168/2022 is limited to the period from May 25, 2018 to November 20, 2020, the date on which the SI has

    closed its findings in the said file, which exceed the date of January 28, 2020 on which

    the IS closed its investigation initiated following the complainant's complaint (point 7).


27. For the period from November 20, 2020 to date, the Litigation Chamber does not have

    findings that support the grievances invoked by the complainant. For this reason, the Chamber

    Litigation is therefore not in a position to find any breach in the head

    of the defendant and classifies the complaint without follow-up as regards this technical reason also to

    support of criterion A.1. of its classification policy note without follow-up.


28. With regard to grievances related to data processing in the context of connection and

    registration on the Auvio platform (first part of the complainant's complaint and findings 1 (in

    regarding registration)), 5 and 6 of the inspection report), the Litigation Chamber decides

    to continue examining it, as these grievances are not covered by its settlement decision

    168/2022. The defendant having requested to be heard in this case, the

    Litigation Chamber will schedule a hearing in the presence of the parties in due course.


29. With regard to the settlement decision (168/2022) for which it opted as

    decision to classify this complaint without action for part, the Litigation Chamber calls
    that it is sovereignly incumbent upon it as an independent administrative authority - in the

    compliance with the relevant articles of the GDPR and the LCA - to determine the measure(s)

    corrector(s) and appropriate sanction(s).


30. Thus, it is not for the plaintiff to ask the Litigation Chamber to order

    such or such corrective measure or sanction. If, notwithstanding the foregoing, the Complainant

    nevertheless had to ask the Litigation Chamber to pronounce one or the other

    measure and/or sanction, it is therefore not for the latter to justify why it does not

    would not accept one or the other request made by the complainant. These considerations

    leave intact the obligation for the Litigation Chamber to justify the choice of measures and

    sanctions which it deems (among the list of measures and sanctions made available to it by

    articles 58 of the GDPR and 95.1 and 100.1 of the ACL) appropriate to condemn the complaining party






55
  Point 21 of decision 168/2022 of the Litigation Chamber.
6In this sense, Decision 168/2022, like this decision to close without further action, leaves the jurisdiction of the
the DPA to decide, for the period after November 20, 2020, if it were to be newly seized of it, on
any shortcomings that would persist to this day with regard to the facts denounced by the complaint Decision on the merits 170/2022 - 8/9


          7
    cause . In this case, the Litigation Chamber refers to points 19-27 above concerning

    its decision to dismiss the complainant's complaint on a technical ground.

III. Publication of the decision


31. Given the importance of transparency with regard to the decision-making process

    and the decisions of the Litigation Chamber, this decision will be published on the website of

    the DPA by deleting the direct identification data of the complainant and the

    named persons, whether natural or legal, excluding the defendant.


32. The Litigation Chamber judges that the identification of the defendant is necessary since

    that this Decision refers to Decision 168/2022 adopted by the Chamber

    Litigation against the defendant and whose operative part (transaction) is the basis of this

    classification decision without technical follow-up. The identity of the defendant having been published

    under this decision 168/2022, the omission of the identity of the same defendant in the

    terms of this decision would make no sense. Its explicit mention allows

    overwhelmingly the better understanding and coherence of these two decisions of the

    Litigation Chamber.






    FOR THESE REASONS,


    the Litigation Chamber of the Data Protection Authority decides, after deliberation:


    - to close the complaint without further action under article 100.1.1° of the LCA with regard to

        concerns grievances covered by decision 168/2022 of the Litigation Chamber

    - to continue the examination of the merits of the complaint for the remainder (point 28 above).





In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged,

within thirty days of its notification, to the Court of Markets (Court

d'appel de Bruxelles), with the Data Protection Authority (DPA) as a party

defendant.






7 Litigation Chamber, Decision on the merits 81/2020. See also the note from the Litigation Chamber relating to the
complainant's position (point D. page 4 in fine). https://www.autoriteprotectiondonnees.be/publications/note-relative-a-la-
position-of-the-complainant-in-the-procedure-within-the-litigation-chamber.pdf: “The conclusions of the complainant must

deal with the content of the complaint and not, for example, the nature of the sanction that the Litigation Chamber must impose
according to the complainant. The complainant is of course free to give an opinion on the sanction to be imposed, but the Chamber
Litigation is not obliged to adopt this opinion, nor to refute the arguments of the plaintiff concerning the imposition of the
sanction”. Decision on the merits 170/2022 - 9/9



Such an appeal may be introduced by means of an interlocutory request which must contain the

information listed in article 1034ter of the Judicial Code. 8


The interlocutory request must be filed with the registry of the Market Court in accordance with

article 1034quinquies of the C. jud. , or via the e-Deposit information system of the Ministry of

Justice (article 32ter of the C. jud.).












(Sr.) Hielke H IJMANS

President of the Litigation Chamber















































8
 The request contains on pain of nullity:
  (1) indication of the day, month and year;
  2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
     Business Number;

  3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
  (4) the object and summary of the grounds of the application;
  (5) the indication of the judge who is seized of the application;
  6° the signature of the applicant or his lawyer.

9 The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.