APD/GBA (Belgium) - 20/2023

APD/GBA - 20/2023
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 2(4) GDPR Article 21(3) GDPR Article 24 GDPR Article 58(2)(c) GDPR Article 95 LCA
Type:	Complaint
Outcome:	Upheld
Started:	21.02.2023
Decided:
Published:	08.03.2023
Fine:	n/a
Parties:	n/a
National Case Number/Name:	20/2023
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	French
Original Source:	APD (in FR)
Initial Contributor:	Fahim.h.i.

A complaint for unsolicited direct marketing. The Belgian DPA affirms the importance of a data subject’s right to objection for data processing under Article 21 GDPR and the principle of liability under Article 2(4) GDPR and Article 24 GDPR.

English Summary

Facts

The complainant, the data subject, had been receiving advertising newsletters to his emails for a period of several years from the data processor, with unsuccessful attempts to unsubscribe. In 2022, upon receiving another promotional email, he replied back, again stating his wish to unsubscribe. He also mentioned failure to comply would push him to complain to the authorities, to which the processor replied “Go Ahead!”. Following this the data subject filed a complaint with the Belgian DPA.

Holding

The Belgian DPA found a breach of Article 21 GDPR, as this provides the data subject the right to object to data processing. According to Article 21(3) GDPR, when a data subject objects to the processing for the specific purposes of direct marketing, the relevant data can no longer be processed for that purpose. There was an additional breach in Article 2(4) GDPR and Article 24 GDPR, which relates to the principle of liability. This puts an obligation on the data processor to comply with the principles of the GDPR and be capable of demonstrating this compliance.

Therefore due to the above violations, pursuant to Article 58(2)(c) of the GDPR and national law, the Belgian DPA issued a warning to the data processor with regards to their obligations under the provisions. Also included in the decision was an order to comply with their existing requests for objection to processing, within a period of 30 days after this decision was rendered.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/5







                                                                     Litigation Chamber


                                                       Decision 20/2023 of March 8, 2023





File number: DOS-2023-00605



Subject: Complaint for non-respect of the right of opposition


The Litigation Chamber of the Data Protection Authority, constituted by Mr.

Hielke Hijmans, President,



Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 relating to

the protection of natural persons with regard to the processing of personal data
personal data and the free movement of such data, and repealing Directive 95/46/EC (Regulation

General on Data Protection), hereinafter GDPR;



Having regard to the Law of 30 July 2018 relating to the protection of natural persons with regard to

processing of personal data (hereinafter LTD);


Having regard to the law of 3 December 2017 establishing the Data Protection Authority (hereinafter

ACL);



Having regard to the internal regulations as approved by the House of Representatives on 20
December 2018 and published in the Belgian Official Gazette on January 15, 2019;



Considering the documents in the file;



Made the following decision regarding:


The complainant: X, hereinafter “the complainant



The data controller: Y, hereinafter “the defendant”; Decision 20/2023- - 2/5



 I. Facts and procedure


  1. Under the terms of the complaint, the complainant indicates that on several occasions he requested the exercise

      of its right of opposition to the defendant. He explains that he tried 5 to 10 times to unsubscribe

      advertising newsletters from the defendant, without success, and having made his first request

      objection (as provided for in Article 21 of the GDPR) in 2020. However, a promotional email
      was sent by the defendant to the plaintiff on December 24, 2022.


  2. Following this, the Complainant sent an email to the Respondent dated December 26, 2022,

      clearly indicating that he no longer wishes to receive advertising emails, failing which he

      would complain. The defendant simply answered “Go ahead! ".

  3. On February 5, 2023, the complainant filed a complaint with the Authority for the Protection of

      data. On February 21, 2023 the complaint was declared admissible by the Service de Première

      line of the Data Protection Authority and the complaint was forwarded to the same

      date to the Litigation Chamber under Article 60 and 62, § 1 LCA.




II. Motivation


  4. The GDPR does not define what is meant by “marketing processing” or

      for the purposes of "direct marketing" according to the English terminology. In its Recommendation

      01/2020 of January 17, 2020 relating to the processing of personal data to
      for direct marketing purposes, the APD indicates that it should be understood as “direct marketing”

      as “any communication, whether solicited or unsolicited, aimed at promoting a

      organization or a person, services, products, whether paid for or

      free, as well as marks or ideas, sent by an organization or a person

      acting in a commercial or non-commercial context, directly to one or more

      natural persons in a private or professional context, by any means,
      involving the processing of personal data” (page 8 of the Recommendation

      - definition).


  5. The processing of the complainant's e-mail address by the defendant is, with regard to this

      definition, personal data (article 4.1 of the GDPR) processed for the purposes of
      marketing (direct marketing) within the meaning of Article 21 of the GDPR. The latter was therefore based on

      exercise their right to object pursuant to Article 21.2 of the GDPR.


  6. In accordance with recital 70 of the GDPR, in the event of the processing of personal data

      personnelforprospectingpurposes,thepersonconcernedhastheright,atanytimeandwithout

      costs, to oppose this processing, and whether or not it is an initial processing or a
      further processing. Article 21.3 of the GDPR provides in this respect that "When the person Decision 20/2023- - 3/5



    concerned opposes processing for prospecting purposes, the personal data

    personal are no longer processed for these purposes”.


7. In the context of direct marketing, such opposition must therefore give rise

    immediatelyandwithoutadditionalexaminationpurelydiscontinuedalltreatmentof

    dataofthepersonconcernedforthesedirectmarketingpurposes(Recommendation
    of the Data Protection Authority n° 01/2020 of January 17, 2020 relating to

    processing of personal data for direct marketing purposes, e.g. 53).


8. The Litigation Division also recalls the principle of liability, and that in its

    quality of data controller, in accordance with articles 5.2 and 24 of the GDPR, the

    defendant is required to comply with the principles of the GDPR and must be able to
    demonstrate.


9. As indicated above, the Complainant indicated that he had tried on numerous occasions to

    unsubscribe from Defendant's advertising email service via the "unsubscribe" button

    you”, without success. It also emerges from the examination of the documents in the file that, at the request of the

    plaintiff to stop sending him advertising mail, failing which he would wear
    complaint, the respondent responded “Go ahead! to the complainant. This response is a

    clear indication of ignorance of its obligations under the GDPR on the part of the

    defendant, as well as the fact that it does not respond to the opposition request of the

    complainant.


10. The Litigation Chamber finds a breach of Articles 21 of the GDPR (right
    opposition), as well as articles 2.4 and 24 GDPR (principle of liability).


11. The purpose of this decision is to inform the defendant, allegedly responsible for the

    processing, because it may have violated the provisions of the GDPR,

    to enable it to comply with the aforementioned provisions.

12. This decision is a prima facie decision taken by the Litigation Chamber

    pursuant to Article 95 of the LCA on the basis of the complaint submitted by the complainant,

    within the framework of the "procedure prior to the substantive decision", to be differentiated from a decision

    on the merits of the Litigation Chamber within the meaning of Article 100 of the LCA.


13. If, however, the controller does not agree with the content of this

    prima facie decision and believes that he can make factual and/or legal arguments
    which could lead to another decision, the latter may address to the Chamber

    Litigation a request for processing on the merits of the case via the e-mail address

    litigationchamber@apd-gba.be, within 30 days of notification of the

    this decision. If necessary, the execution of this decision is suspended.

    during the aforementioned period. Decision 20/2023- - 4/5



14. In the event of further processing of the case on the merits, pursuant to Articles 98, 2° and 3°

    juncto article 99 of the LCA, the Litigation Chamber will invite the parties to introduce their

    conclusions and attach to the file all the documents they deem useful. If applicable, the

    this decision is permanently suspended.

15. With a view to transparency, the Litigation Division finally emphasizes that a

    dealing with the case on the merits may lead to the imposition of the measures mentioned in

    section 100 of the LCA.





III- Publication and communication of the decision


16. Given the importance of transparency with regard to the process

    decision-making and the decisions of the Litigation Chamber, this decision will be published on the

    website of the Data Protection Authority. However, it is not necessary for this

    so that the identification data of the parties are directly communicated.












  FOR THESE REASONS       ,

  THE CONTENTIOUS CHAMBER decides, after deliberation:

  The Litigation Chamber of the Data Protection Authority decides, subject to
  the introduction of a request by the data controller for substantive processing,

  in accordance with articles 98 e.s. of the ACL:



  - pursuant to Article 58.2.c of the GDPR and Article 95, § 1, 5° of the LCA, orders to

      comply with requests from the data subject to exercise their right to object,
      in compliance with article 21 of the GDPR. This compliance is to be carried out in

      within 30 days of notification of this decision, and the Litigation Chamber must

      be informed of its execution within the same period;

  - pursuant to Article 58.2.c) of the GDPR and Article 95, § 1, 4° of the LCA, to formulate a

      admonishment to the defendant to follow up on the exercise requests of the subjects of

      future rights Decision 20/2023- - 5/5






Under article 108, § 1 of the LCA, this decision may be appealed in a


period of thirty days, from the notification, to the Court of Markets, with the Authority of

data protection as defendant.


Such an appeal may be introduced by means of an interlocutory request which must contain the
                                                                                   1
information listed in article 1034ter of the Judicial Code. The interlocutory motion must

be filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C.

jud. , or via the e-Deposit information system of the Ministry of Justice (article 32ter du C.jud.).









      (Sr.) Hielke HIJMANS

      President of the Litigation Chamber










































1The request contains on penalty of nullity:
  (1) indication of the day, month and year;

  2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
      Business Number;
  3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
  (4) the object and summary statement of the means of the request;
  (5) the indication of the judge who is seized of the application;
  6° the signature of the applicant or his lawyer.

2 The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.