APD/GBA (Belgium) - 161/2023

APD/GBA - 161/2023
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 4(11) GDPR Article 6(1)(a) GDPR Article 7 GDPR
Type:	Complaint
Outcome:	Other Outcome
Started:	19.07.2023
Decided:	01.12.2023
Published:
Fine:	n/a
Parties:	Les Editions de l'Avenir Presse
National Case Number/Name:	161/2023
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	French
Original Source:	Autorité de protection des données (in FR)
Initial Contributor:	nzm

The Belgian DPA proposed a settlement to a controller asking them to modify their cookie banner in order to comply with Article 4(11), 6(1)(a) and 7 GDPR.

English Summary

Facts

On 19 July 2023, a data subject lodged a complaint through her representative, noyb, to the Belgian DPA (“APD”) against Les Editions de l’Avenir Presse (“controller”). More specifically, the complaint denounced 4 alleged practices on the controller’s website. Firstly, the fact that there was no 'refuse' option on the first layer of the cookie banner. Secondly, that the "cookie banner" used "misleading button colours". Thirdly, the complaint stated that it is not as easy to withdraw consent as it is to give it. Finally, the data subject called into question the legality of the reference to legitimate interest on the website.

On 21 September 2023, the APD sent a letter to both parties informing them of its intention to propose a settlement in accordance with Belgian law.

The data subject asked for clarifications and/or adjustments on several points. The APD indicated that the proposed settlement would not be modified in accordance with the data subject’s requests.

Holding

Firstly, the APD noted that there was no “refuse” option at the first layer of information in the cookie banner. The first condition of the settlement was that the controller provided a “decline all” button within one month from the date of the settlement decision. The representative of the data subject had asked that the APD explicitly added that this condition meant that the “decline all” option must be provided on the first layer of the cookie banner. The APD rejected this request considering that it was not clear how this request would lead to a different concrete result.

Secondly, the APD indicated that the controller used misleading button colours, and therefore the second condition of the settlement was that the controller would ensure that the “decline all” button would be no less visually appealing than the partial or total acceptance of the installation of cookies that are not strictly necessary.

Thirdly, the APD considered that it was not as easy to withdraw consent as it was to give it under Article 7(3) GDPR. The third condition of the settlement was that the controller guarantee a procedure for withdrawal of consent that would not require more steps (in terms of ‘clicks’) than those required to give consent.

Fourthly, the APD noted that the controller referred to legitimate interest. The fourth condition of the settlement was that the controller use legitimate interest as a legal basis only in the case of the placement of technical or functional cookies that are strictly necessary.

Finally, the representative of the data subject had requested that an administrative fine be imposed as part of the settlement with regard to Article 83(1) GDPR. The APD considered that the settlement was intended to achieve a general resolution without sanctions and highlighted the effectiveness of this process.

The APD indicated that the controller has 30 days from receipt of the transaction proposal to indicate whether or not it accepts it, and the representative of the data subject may comment on the proposal and terms and conditions within 14 days of receipt of the letter.

Comment

This procedure was bought to the DPA through a complaint. Therefore, the parties were a data subject and the controller. It is interesting that the settlement occurs between the controller and the authority rather than between the controller and data subject.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/24




                                                                        Litigation Chamber


                                                  Decision 161/2023 of December 1, 2023



File number: DOS-2023-03284


Subject: settlement decision following a complaint regarding cookies on a site

web of “Les Editions de l’Avenir Presse SRL” (“L’Avenir” website)



The Litigation Chamber of the Data Protection Authority, made up of Mr.

Hielke HIJMANS, president, sitting alone;


Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the

protection of natural persons with regard to the processing of personal data and

to the free movement of these data, and repealing Directive 95/46/EC (General Regulation on the

data protection), (hereinafter “GDPR”);

Having regard to the Law of December 3, 2017 establishing the Data Protection Authority (hereinafter

“LCA”);


Having regard to the Law of July 30, 2018 relating to the protection of individuals with regard to

processing of personal data (hereinafter “LTD”);


Considering the Internal Regulations as approved by the House of Representatives on 20

December 2018 and published in the Belgian Official Gazette on January 15, 2019;

Considering the documents in the file;



Has taken the following decision regarding:



The complainant: Ms. X, […], represented by noyb – European Center for Digital Rights, […], herein
                    after “the complainant”;



The party in transaction: L ESE DITIONSDE L’AVENIR PRESSE SRL, whose head office is established in

                    […] represented by Me Frédéric DECHAMPS and Me Maxime ADAM, whose

                    firm is located […], hereinafter: “the party in transaction”. Decision 161/2023 — 2/24



I. Procedure prior to the transaction



    I.1. The complaints



 1. On July 19, 2023, the complainant, through her representative, filed a complaint

       with the Data Protection Authority (hereinafter “DPA”) against the party in

       transaction. 1


 2. The subject of the complaint concerns several elements linked to the installation of cookies on the site

       web “https://www.lavenir.net/”delapartientransaction (hereinafter “thewebsite” or “thesite

       litigious "). The complainant refers to the legislation which she considers relevant in matters
                            2
       of consent. The complaint refers to “misleading cookie banners” and

       “obscure patterns”. The complaint also mentions reports and communications

        both the European Data Protection Board (hereinafter “EDPB”) and the DPA

        Belgian concerning the obligations relating to the installation of cookies involving the

        processing of personal data.

 3. More specifically, the complainant denounces four alleged practices on the websites

        mentioned above which adversely affect him. First, the fact that there is “no option

        “refuse” at the first level of information in the cookie banner. Secondly, that

        the “cookie banner” would use “misleading button colors”. Third,


        Laplainte indicates that “it is not as easy to withdraw consent as to give it.”

        Finally, the complainant's fourth complaint calls into question the legality of the "reference to

        legitimate interest” on the website.

 4. On August 4, 2023, the APD Front Line Service (hereinafter “SPL”) contacted the

        complainant to request information “as to the interest of the complainant in the introduction

        of the complaint”. Subsequently, exchanges took place between the representative of the complainant and the

        SPL regarding this issue.


 5. On August 25, 2023, the complaint was declared admissible by the SPL under articles 58 and 60

        of the LCA and is transferred to a file in the Litigation Chamber under article

       62(1) of the ACA .4


 6. On September 1, 2023, the representative of the complainant sends the SPL a document

       explaining in more detail the complainant's interest.


1During the proceedings it was mentioned that the complaint was initially filed on July 18, as indicated in the
complaint filed by the complainant herself. However, it should be clarified that the complaint is not officially

2Arrival at the APD until the following day.
 In particular, article 10/2 of the law of July 30, 2018 relating to the protection of individuals with regard to
processing of personal data, M.B. 05/09/2018 (implementing provisions of the “e-Privacy Directive”) and
3 Article 6.1.a. of the GDPR.
 In accordance with article 61 of the LCA, the Litigation Chamber informs the parties that the complaint has been declared admissible.
4In accordance with article 95 §2 of the LCA, the Litigation Chamber informs the parties that the file has been transmitted to it
following this complaint. Decision 161/2023 — 3/24


 7. In the document dated September 1, 2023, the representative of the complainant makes

       reference to the conditions of admissibility set out in the LCA - to which the complaint

       satisfied - and declares that "the reason why the front line service of your

       authority requests additional justification of the complainant's interest in filing

       complaints is not clear to [the representative].” The representative emphasizes that the

       data of the complainant have actually been processed and that the complainant is a
       data subject within the meaning of the GDPR.


 8. As part of an efficient procedure, the Litigation Chamber does not pursue

       further examination of the aspects linked to the interests of the complainant which have already been addressed in

       communications between the complainant's representative and the SPL.


    I.2.The transaction proposal



 9. On September 21, 2023, the Litigation Chamber sends a letter to the representative of the

       complaining party and the transacting party, informing them of its intention to offer a

       transaction, in accordance with article 95, § 1, 2° of the LCA. The notification mentions
       also that the Litigation Chamber - through this communication - considers

       that the deadline for contacting the Inspection Service under article 96, § 1 of the LCA is

       interrupted. From this moment, the parties also have the possibility of consulting the

       administrative file, a request that they both subsequently make.


 10. On October 20, 2023, the transaction proposal is sent to the transacting party and
       to the complainant. The content of this transaction proposal is fully reproduced

       in the annex to this settlement decision and forms an integral part thereof. In 5

       particular, this transaction proposal includes all the conditions - of procedure and

       merits - as well as the deadlines to which the parties must respectively respond.



    I.3.The complainant's response


 11. On October 30, 2023, the representative of the complainant sent a letter to the Chamber

       Contentious. On November 3, 2023, the representative of the complainant also transmitted the

       letter to the party in transaction, because it was not clear to him that he also had to provide it

       to the transacting party.

 12. In her response to the proposed settlement, the complainant requests

       clarifications and/or adjustments on several “points”. The complainant concludes

       by the following paragraph: “The complainant emphasizes that if the content of the proposal for



5
 However, it should be noted that an “erratum” was inserted at point f), the initial text wrongly indicating “(in the present case,
there is no complaint underlying the file). Decision 161/2023 — 4/24


       transaction is modified in favor of the defendant party [transacting party] or if the

       above-mentioned requests of the complainant are not satisfied (in their entirety), the

       plaintiff will be forced to appeal the formal settlement decision.”

 13. The Litigation Chamber reiterates - for the sake of decisional clarity - the requests for

       the complainant set out in section II of this decision, then the Litigation Chamber

       responds concretely to requests.

 14. On November 6, 2023, the Litigation Chamber responded by confirming that the proposal for

       transaction will not be modified in accordance with the requests of the complainant. However,

       the Litigation Chamber specifies that it intends to publish the decision without omitting the

       identification data of the party in transaction, in accordance with article 95, §1, 8° of the
       LCA.



    I.4. Requests of the transacting party and conclusion of the transaction


 15. On November 17, 2023, the transacting party confirms that it fully accepts

       all the conditions of the transaction proposal. On November 20, 2023, the Chamber

       Litigation confirms that the notification of the party in transaction formalizes the conclusion
       of a transaction, thus resulting in this transaction decision.



II. Conditions of the transaction and grounds for rejecting the plaintiff's requests



    II.1General considerations


 16. During the transaction process, no changes were made to the terms of the transaction.

       transaction as set out in the transaction proposal. These terms

       remain fully valid under the transaction. Although they are not repeated

       in this section, they are annexed to this decision.

 17. The Litigation Chamber further specifies that the acceptance of a proposal for

       transaction will in no case be interpreted as an admission of guilt, and

       cannot therefore be used as an aggravating circumstance to determine the

       sanctions in future proceedings before the Litigation Chamber.

 18. The Litigation Chamber specifies that, in the interest of adequate procedure, the procedure

       transaction is divided into two distinct stages, namely the transaction proposal

       on the one hand, and the transaction decision on the other hand. This clear division allows all
       parties concerned to understand precisely the starting and stopping points of the

       procedure, while retaining the possibility of appealing at each stage thanks to the inclusion Decision 161/2023 — 5/24


       appeal clauses. This approach also aims to promote transparency in the

       transaction process, a principle to which the Litigation Chamber fully adheres.


 19. Finally, this decision is a prima facie decision taken by the Litigation Chamber
       in accordance with article 95 of the LCA on the basis of the complaint filed by the complainant,

       within the framework of the “procedure prior to the decision on the merits” and not a decision on

       the merits of the Litigation Chamber within the meaning of article 100 of the LCA.



    II.2 Complainant's requests rejected


 20. The complainant made several requests to the Litigation Chamber, which were not

       resulted in a modification of the transaction proposal. However, the Chamber

       Contentious will proceed to the publication of this transaction decision on the website of

       the Data Protection Authority (see section III of this decision), in accordance

       at the request of the complainant, which constitutes a decision distinct from the transaction under

       of article 95, §1, 8° of the LCA.

 21. The Litigation Chamber sets out below the reasons why the others

       requests are not accepted. It should be noted that these patterns are integrated into the

       this decision, so that they fall clearly within the framework of the economy

       generally established procedural procedure.

 22. Firstly, with regard to the first condition of the proposed transaction, the

       complainant requests “[to] explicitly add to the first condition of the proposal

       transaction that this condition means that the option ‘refuse all’ must be provided on the

       same, first ‘layer’ as the ‘accept and close’ option. ".

        • The Litigation Chamber rejects this request for the following reason. He is not

            clear how this request would lead to a different concrete result on the sites

            contentious in relation to the current wording of the first and fifth conditions.

            The Litigation Chamber considers that the proposed modification would not improve the

            stipulated condition (see section c.1. of the transaction proposal).

 23. Secondly, with regard to the second condition, the complainant requests “[to]

       explicitly add to the second condition of the transaction proposal that

       ‘no less (visually) attractive’ display includes, but is not limited to, that the option

       ‘refuse all’ and the ‘accept and close’ option must have the same size, color,

       same shape, same contrast and same location of the button/option. »

        • The Litigation Chamber rejects this request for the following reason.

            neither the Litigation Chamber nor the plaintiff to determine that the buttons must


6
 Section 3, subsection 2 of the LCA (articles 94 to 97). Decision 161/2023 — 6/24


           have (exactly) the same characteristics. This choice is made by the person responsible for

           treatment. It is true that buttons with exactly the same characteristics

           are clearly identical for the purposes of consent. Conversely, it is not excluded

           the data controller decides to make the “refuse all” option more attractive
           or to innovate in the use of colors (which, for example, display options

           essentially equivalent) in order to facilitate the choice of the person concerned. There

           condition formulated more generally in the transaction proposal

           regarding the display "no less (visually) attractive" is therefore sufficient to

           the Litigation Chamber.

24. Thirdly, with regard to the third condition, the complainant proposes the

      following text modification:


       “The defendant undertakes to develop and implement, within a period of one
       month, a mechanism on the website of “https://www.lavenir.net/” in accordance with the

       requirements

       defined in the above-mentioned policy documents, aimed at achieving an outcome

       equivalent. The data controller also guarantees that the processing procedure

       revocation of consent (withdrawal of consent) will not require further

       steps (in terms of 'clicks') than those required to give consent.
       permanently visible and visually identifiable option must be available on

       all pages of the website to reopen cookie settings with a single click.

       The same number of steps for withdrawal of consent will be counted from

       from the moment the end user reopens the cookie settings. This will be done in

       following an equivalent number of steps from the moment the end user

       reaches the cookie settings page, which should be clearly accessible from
       all pages of the website in question. All technical changes

       made by the defendant for this purpose must be recorded in a

       summary document, which will be developed during implementation and transmitted to the

       Litigation Chamber and the complainant. Implementation of these changes

       techniques, as well as the preparation and transmission of the summary document,

       must be carried out within a period [sic] of one month from the decision of
       transaction. » (The underlined part does not appear in the current proposals)


       • The Litigation Chamber completely rejects this request for modification of the

           condition for the following reason. The Contentious Chamber takes note of the point of view

           of the complainant according to which she wants an “option permanently visible and
           visually identifiable” on all web pages of the disputed site. Bedroom

           Contentious, seeking to reach a reasonable and technically sound transaction Decision 161/2023 — 7/24


           achievable with the transaction, considers that it is not appropriate to require such

           changes as part of a transaction.

25. Fourth, the plaintiff requests that “an injunction of

      cease unlawful processing”, which should read as follows:


       “The controller undertakes to erase all personal data processed

       due to cookies that have not been placed in accordance with the content herein
       formal decision of transaction on the website of “https://www.lavenir.net” and at

       communicate this erasure obligation

       to all recipients to whom the personal data has been provided

       in this context. Proof of erasure of personal data and

       the communication of this obligation to erase personal data to

       all recipients will be recorded in a summary document at the time of
       implementation and transmitted to the Litigation Chamber and to the complainant.

       The erasure of personal data and the communication of this

       obligation to erase personal data to all recipients, including

       including the preparation and transmission of the document, must take place within a time limit

       one month after the formal transaction decision has been taken. »

       • The Litigation Chamber rejects this request for the following reason. On the base

           of the elements available in the administrative file, the complainant did not

           addressed to the controller due to the alleged violation of their rights.

           The Litigation Chamber therefore considers that it is not appropriate, in this case, to

           propose such a condition, much less address an order on this subject to the
           party in transaction. The complainant is of course free to contact anyone

           controller with respect to which it can exercise its rights within the framework of

           the legislation in force.


26. Fifth, the complainant requests the imposition of an administrative fine in the context of
      of the transaction “having regard to article 83, paragraph 1, of the GDPR law”.


       • The Litigation Chamber rejects this request for the following reason. Taxation

           of an administrative fine is a competence which can be exercised by the

           Litigation Chamber under article 100, §1, 13° of the LCA. In this sense, no
           administrative fine as requested by the complainant cannot be imposed on this

           stage before substantive processing under Article 95 of the ACL. It is true that

           Article 107 of the LCA indicates that the legislator intended that transactions - without

           clarify whether this can also be done under section 95 of the ACL - allow

           also to receive sums of money, but this is not a condition of

           the instrument of the transaction, as already indicated by the Litigation Chamber in the
           transaction proposal. The transaction aims to achieve a general resolution of Decision 161/2023 — 8/24


            grievances of the complainant, without it being necessary to sanction him. Bedroom

            Litigation highlights the effectiveness of the process in this regard.

 27. Sixth, the plaintiff requests that the settlement decision “include

       also the fact that the responsible party [transacting party] waives any claim

       civil or other related to the formal transaction decision, for example, but not limited to,

       the possibility of negative publicity regarding this formal transaction decision."

        • The Litigation Chamber rejects this request for the following reason.

            of an essential request with regard to the grievances formulated by the complainant in her

            complaint.

 28. Seventh, the complainant requests that the settlement decision be published on the website

       website of the Data Protection Authority.

        • The Litigation Chamber can grant this request, through section III

            of this decision.



III. Publication of the decision


 29. Given the importance of transparency regarding the decision-making process of the Chamber

       Contentious, this settlement decision is published on the Authority’s website
       data protection. However, it is not necessary for this purpose that the data

       identification of the complainant are directly communicated, since they are not

       relevant.

 30. However, the Litigation Chamber chooses to publish the names of the representative of the

       complainant and the transacting party. Indeed, it is in the public interest that the citizen

       can become aware, in the most transparent manner possible, of the procedures

       transactions that lead to (visual) changes on websites frequently

       visited, such as the disputed sites. Indeed, the journalistic publications on these websites

       are by nature aimed at a wide audience, and visitors to these sites have an interest in being informed of
       aspects related to data protection. For the sake of completeness, the Litigation Chamber

       underlines that the representative of the complainant himself gave publicity to the complaints.



    FOR THESE REASONS   ,


    The Litigation Chamber of the Data Protection Authority decides:
        - under article 95, §1,2° of the LCA, validate the transaction as accepted

            by the transacting party on November 17, 2023, subject to the conditions

            fixed and specified in this decision and its annex. Decision 161/2023 — 9/24



In accordance with article 108, § 1 of the LCA, an appeal against this decision may be lodged,

within thirty days from its notification, to the Court of Markets (court

of Appeal of Brussels), with the Data Protection Authority as defendant.


Such an appeal may be introduced by means of an interlocutory request which must contain the

information listed in article 1034ter of the Judicial Code. The interlocutory request must be

filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 8

via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. judic.).


















    (s.) Hielke H IJMANS


    President of the Litigation Chamber



































7
 The request contains barely any nullity:
  1° the indication of the day, month and year;
  2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualifications and his national register number or
     Business Number ;
  3° the surname, first name, address and, where applicable, the status of the person to be summoned;

  4° the object and summary of the means of the request;
  5° indication of the judge who is seized of the request;
  6° the signature of the applicant or his lawyer.
8 The request, accompanied by its annex, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court registry. Decision 161/2023 — 10/24



Annex – transaction proposal Decision 161/2023 — 11/24






        Litigation Chamber BY EMAIL




                                                         To the attention of Les Editions de l’Avenir Presse srl,
                                                         […]


Secretariat
                                                         Represented by Me Frédéric DECHAMPS, whose firm
T: +32 (0)2 274 48 56 is located […]
Email: litigationchamber@apd-gba.be

                                                         Via the email address: […]

                                                         Respondent


                                                         BY EMAIL


                                                         To the attention of NOYB – European Center for Digital Rights,
                                                         representative of Mrs.


                                                         Via the email address […]


                                                         Complainant









      Your references Our references Annex(es) Date
      NOYB: C-062-12 DOS-2023-03284 1 10/20/2023



     Subject: Application of article 95, § 1, 2° of the LCA - Transaction proposal in the file


     complaint from Mrs.

     on its website “https://www.lavenir.net/”



     Dear,


                                                                     9
     The Litigation Chamber first refers to the letter it previously sent to the

     defendant and the plaintiff, informing them of his intention to send a settlement proposal

     in the current case. This document contains said transaction proposal. Being

     given the large volume of files awaiting examination by the Litigation Chamber, which

     causes considerable delays in the processing of all files, the Chamber

     Litigation decided, under article 95, §1, 2° of the law creating the Authority of

                                                     10
     data protection (hereinafter “LCA”), to explore the possibility of a proposal for

     transaction in the file referred to under heading (“transaction proposal”) through the


     9
     10registered letter dated September 21, 2023.
      M.B., January 10, 2018. Decision 161/2023 — 12/24




this letter. In addition, the Litigation Chamber takes into account the fact that it deals with –

currently – a large number of complaints about cookies. Although the question of

“cookies” is a priority of the Data Protection Authority, the Litigation Chamber must


exercise careful selection of the files to be processed in order to guarantee that it can address

various matters relevant to the company with due diligence. In this regard, the legislator

Belgian underlined the need for the Litigation Chamber to be able to act selectively

                                                                                         12
with a view to ensuring effective implementation of their skills.




This proposed transaction is formulated without any prejudicial acknowledgment and

does not commit the Litigation Chamber as to a position that it could adopt in the event of

refusal of the said proposal. If the receiving party of this transaction proposal refuses it


expressly, the Litigation Chamber will continue the procedure. In the event of findings of

violations, the Litigation Chamber will be able to exercise the sanctioning powers provided for by

European and Belgian law. 14


In casu, the Litigation Chamber retains the possibility of pursuing the case otherwise in the event

refusal of the proposal or if it is withdrawn by the Litigation Chamber itself.




If the party to whom the transaction proposal is addressed expressly refuses this

proposal, the Litigation Chamber will continue the procedure on the merits and will deal with the case


other than by a transaction.



     a) Procedural situation of the transaction proposal




The proposed transaction presented here is part of the “procedure prior to the

                                                                                                          15
substantive decision” before the Litigation Chamber, considered by the legislator. Therefore,

the Litigation Chamber does not take here and now a position as to the need for measures

investigations 16 carried out by the APD Inspection Service nor to the question of the need to


(subsequently) pursue the case in accordance with the provisions of Article 95 of the LCA.








11 See the press release from the Data Protection Authority on this subject, accessible via:
https://www.autoriteprotectiondonnees.be/lapd-definit-ses-priorites-pour-lannee-2023.
12The House of Representatives, Explanatory memorandum in the bill establishing the Human Rights Protection Authority
data, Doc. 2648/001 (54th Legislature Session), available via:
https://www.dekamer.be/kvvcr/showpage.cfm?section=/flwb&language=fr&cfm=/site/wwwcfm/flwb/flwbn.cfm?lang=N&legislat=54&doss
ierID=2648, 51; see also: E. Degraeve, “Title 11. Control authority” in C. DE TERWANGNE in K. ROSIER, The Protection Regulation

data (RGPD/GDPR) – 1st edition, Larcier, 2018, (593)607: “[The supervisory authority] can thus exercise its control and
13prescribe the follow-up to be given to any complaints that are addressed. »
  See article 58 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals
with regard to the processing of personal data and the free movement of such data, and repealing Directive
95/46/EC (General Data Protection Regulation), hereinafter “GDPR”;
14See also article 100 of the LCA.
15See section 6.3.2. and sections 94-97 of the LCA.
16 Cfr. Article 94, 1° and 2° of LCA; also compare the following paragraph in the notification letter dated. 09/21/2023 to the parties: “This
notification interrupts the 30-day period as referred to in article 96, § 1 of the LCA to refer the matter to the Inspection Service until the moment when the

Litigation Chamber notes that the proposed transaction does not or cannot lead to a real transaction. » Decision 161/2023 — 13/24


Given the nature of the procedure before the Litigation Chamber of the Authority of

data protection, it should be emphasized that the "transaction" provided for under article 95,

§1, 2° of the LCA cannot be assimilated to a “transaction” within the meaning of criminal law..7 Indeed, the

transaction within the meaning of the ACL has a sui generis character.



In addition, the Litigation Chamber mentions the precise facts, situating them in time and in

space, on the basis of which the transaction proposal occurs (infra). Although, like

specified above, the Litigation Chamber does not rule hic et nunc on the existence of

violations, it must however formulate the proposal for transactions on elements exposed in


the folder. These are elements perceived as offensive by the complainant. The proposal of

transaction therefore concerns the facts, the period and the (technical) context, the facts which are not
                                                                                       18
covered by this period and this context not being included by the transaction. The disputed deadline

concerns only the period between the date of filing of the complaint and the date of the

formal transaction decision following this transaction proposal.



Generally speaking, the Litigation Chamber supervises the transaction on the procedural level of the

following way:



    1. The transaction provided for by the LCA is a transaction between:

        - on the one hand, the Litigation Chamber which undertakes to put an end to the procedure, in

             waiving, among other things, the potential imposition of corrective measures,

        - and, on the other hand, the defendant who undertakes to pay a sum and/or to respect

             certain conditions.

    2. A transaction in principle implies an acknowledgment of the facts on the part of the party

        which compromises, but is not an acknowledgment of a violation of the law in force.

    3. The scope of the transaction is in all cases limited to the facts and deadlines

        expressly mentioned in the transaction proposal or the (decision of)

        transaction itself.

                                                                                                      19
    4. The complainant is heard when concluding any transaction following a complaint. THE

        complainant is heard regarding his point of view on the use of the instrument

        of the transaction and on the content of the transaction proposal. The complainant has the

        possibility of taking a position on the transaction proposal no later than 14 days after



17See in particular articles 216bis and 216ter of the Code of Criminal Procedure (“CIC”) concerning the termination of public action for
certain offenses upon the fulfillment of certain conditions (respectively the payment of a sum of money and the execution of
measures and compliance with conditions); A. RIGLOLET, Transaction contract, Larcier, Brussel, 2021; A. RAES, T. VAN WYNSBERGE, S. DE
KEULENAER, E. DEVEUX, K. DECRAMER, A. DELADRIERE, “De verruimde minnelijke schikking: een ‘meerwaarde’ of ‘win-win’ situation?
Evaluatievandepraktijk.”,Panopticon,nr.36(2),2015,(88);M.FERNANDEZ-BERTIERenN.VANDEREECKEN,“The expanded criminal transaction
declared unconstitutional: towards a motivation of the transaction and a sufficient and effective judicial control”, Criminal Law of
Company, 2016, nr. 3, (213)213.
18In this sense, the ne bis in idem principle does not apply to facts which do not fall within this scope.
19In the ratio legis of article 77 of the GDPR, the complainant has a more extensive role with respect to transaction procedures before others
regulators, see for example the simple communication to the complainant in the transaction procedure before the Belgian Authority of
Competition, cf. article IV.59 in fine of the Code of Economic Law of February 23, 2013 (M.B. 03/29/2013). Decision 161/2023 — 14/24


    having received it. This deadline does not exclude the possibility for both parties to obtain

    clarifications regarding the transaction proposal in writing or orally (infra).

5. The transaction is formalized by a transaction decision, which clearly sets out
    transparently the progress of the procedure prior to the transaction, and resumes

    explicitly the terms of the transaction proposal as well as the terms of the

    transaction finally negotiated (in principle by referring to the transaction proposal

    annexed to the final settlement decision).
6. All parties concerned retain the right to comment, in principle in writing, on the

    transaction proposal and its content.

7. An unaccepted or otherwise unsuccessful transaction does not affect the continuation of

    the case and has no impact on a possible alternative treatment of the case.


b) Substantive conditions of the transaction proposal.



    b.1. Complaint against “Les Editions de l’Avenir Presse srl” of July 18, 2023

    b.1.1. First grievance of the complainant in his complaint of July 18, 2023



     The complainant's first grievance is described by the complainant as follows: “Violation

     type 1: no “refuse” option at the first level of information in the banner

     Cookies. »



     In support of this complaint, the complainant attaches the following screenshot:

          Complaint, Annex 2: Decision 161/2023 — 15/24


         Prima facie relevant evidence from policy positions and regulatory documents

         the Data Protection Authority.



              1. The point of view of the working group of the European Health Protection Committee

                  data (“EDPB”) 20 and the APD press release on this subject. An extract

                  press release:



                  The absence of a “refuse all” type button at the same level as the button

                  “accept everything”. The majority of data protection authorities, in this

                  including the APD, considered that this was a breach and that the user

                  of a website should be able to access the option to agree or refuse the

                  deposit/read cookies on your device simultaneously.



                                                                 22
              2. The APD “cookie checklist”:



                  I don't foresee an "accept all cookies" button (or similar) without

                  provide at the same “level” a “refuse all non-essential cookies” button

                  (or similar)


         First condition of the transaction proposal:

         The defendant provides on the website of “https://www.lavenir.net/” an option

         "reject all" where it currently says "accept and close", within a time limit

         of one month from the date of the transaction decision, or implements a

         practice with equivalent effect within the same period. Technical adjustments made

         speaks to the defendant for this purpose will be recorded in a summary document at the time

         of implementation and transmitted to the Litigation Chamber and to the complainant. Setting

         implementation of the technical implementation, as well as the preparation and transmission of the

         document reflecting the implementation, must be carried out within one month to

         from the transaction decision.




        b.1.2. Second grievance of the complainant in his complaint of July 18, 2023



         Complainant's second complaint: “Type 2 violation: Misleading button colors”



20In English,ReportoftheworkundertakenbytheCookieBannerTaskforce, accessiblehere:https://edpb.europa.eu/our-work-

tools/our-documents/other/report-work-undertaken-cookie-banner-taskforce_en.
21 APD press release, February 10, 2023, accessible here:
https://www.autoriteprotectiondonnees.be/citoyen/actualites/2023/02/10/bannieres-cookies-ledpb-publie-des-entreprises-
non-compliant-practices.
22
  You will find, attached to this transaction proposal, a copy of this “cookie checklist”; the document is
also accessible via the APD website: https://www.autoriteprotectiondonnees.be/publications/checklist-cookies.pdf Decision 161/2023 — 16/24


In support of this complaint, the complainant attaches the following two screenshots:



    1. Complaint, annex 2:























    2. Complaint, Annex 3:



























Prima facie relevant evidence from policy positions and regulatory documents

the Data Protection Authority. Decision 161/2023 — 17/24



             1. The point of view of the working group of the European Health Protection Committee

                  data (“EDPB”) 23 and APD press release 24 on this subject.



                  An extract from a press release:

                  Deceptive design. The taskforce drew attention to various types of practices

                  misleading in terms of banner layout.



                  An extract from the report of the EDPB working group:



                  To assess the conformity of a banner, a case-by-case verification must

                  be carried out to ensure that the contrast and colors used are not

                  not obviously misleading to users and do not result in

                  involuntary consent and, therefore, invalid on their part. Consequently,

                  it was also agreed that a case-by-case analysis would be necessary to

                  deal with specific cases, although some examples of characteristics

                  manifestly contrary to the provisions of the directive on privacy and

                  electronic communications have been identified.



             2. The APD “cookie checklist”:



                  I do not use techniques that could be described as “deceptive design” 25

                  (e.g. incentive through the use of color).


         Second condition of the transaction proposal:

         The defendant undertakes to ensure that the option behind which lies an “all” option

         refuse” – following the possible acceptance of condition 1 of this proposal

         transaction – is no less (visually) attractive than partial acceptance or

         total installation of cookies that are not strictly necessary, within the time limit

         of one month from the transaction decision. The technical adjustments made

         speaks to the defendant for this purpose will be recorded in a summary document at the time

         of implementation and transmitted to the Litigation Chamber and to the complainant. Both the stake

         technical implementation as the preparation and transmission of the document reflecting the implementation





23
  In English, Reportoftheworkundertaken bytheCookieBannerTaskforce, accessiblehere:https://edpb.europa.eu/our-work-
tools/our-documents/other/report-work-undertaken-cookie-banner-taskforce_en.
24 APD press release, February 10, 2023, accessible here:
https://www.autoriteprotectiondonnees.be/citoyen/actualites/2023/02/10/bannieres-cookies-ledpb-publie-des-entreprises-
non-compliant-practices.
25
     See also our press release, available via the following link:
https://www.autoriteprotectiondonnees.be/citoyen/actualites/2023/02/24/deceptive-design-patterns-comment-les-
recognize-and-avoid-them-on-social-media. Decision 161/2023 — 18/24


          implemented will be carried out within one month from the decision of

          transaction.




        b.1.3. Third grievance of the complainant in his complaint of July 18, 2023



          Complainant's third complaint: “Type 3 violation: It is not as easy to remove the

          consent than to give it”

          In support of this complaint, the complainant attaches the following screenshot:

          Complaint, Annex 5:





























          Prima facie relevant evidence from policy positions and regulatory documents

          the Data Protection Authority.



                  1. The point of view of the working group of the European Health Protection Committee

                      data (“EDPB”) 26 and APD press release 27 on this subject.



                      An extract from the report of the EDPB working group:



                      In addition to the conditions required for the collection of consent to be

                      valid in accordance with GDPR and Article 5(3) ePrivacy

                      Directive, three additional cumulative conditions are mandatory (i)




26In English, Reportoftheworkundertaken bytheCookieBannerTaskforce, accessiblehere:https://edpb.europa.eu/our-work-
tools/our-documents/other/report-work-undertaken-cookie-banner-taskforce_en.
27
       APD press release, February 10, 2023, accessible here:
https://www.autoriteprotectiondonnees.be/citoyen/actualites/2023/02/10/bannieres-cookies-ledpb-publie-des-entreprises-
non-compliant-practices. Decision 161/2023 — 19/24



                      the possibility of withdrawing consent, (ii) the possibility of withdrawing the
                      consent at any time, (iii) withdrawal of consent must also be

                      easier than granting consent. 28



                  2. The APD “cookies checklist”:





                      I foresee a mechanism by which it is as simple to remove the

                      consent than giving it, such as placing a link or button

                      clearly visible allowing you to manage the settings of cookies and

                      withdraw consent with one click;

                      I ensure that this withdrawal of consent actually has the desired effect

                      and the cookies concerned are not simply no longer stored in the future.

                      I ensure that this withdrawal of consent actually has the effect
                      expected and that it does not have the sole consequence that this cookie will not be

                      more placed in the future;




         Third condition of the transaction proposal:

         The defendant undertakes to develop and implement, within one month, a

         mechanism on the website “https://www.lavenir.net/” compliant with the defined requirements

         in the above-mentioned policy documents, aimed at achieving an outcome

         equivalent. The data controller also guarantees that the processing procedure

         revocation of consent (withdrawal of consent) will not require further

         steps (in terms of 'clicks') than those required to give consent.

         will be done by following an equivalent number of steps from the moment the user

         final reaches the coolie settings page, which must be clearly accessible
         from all pages of the website in question. All technical changes

         made by the defendant for this purpose must be recorded in a

         summary document, which will be developed during implementation and transmitted to the

         Litigation Chamber and the complainant. Implementation of these changes

         techniques, as well as the preparation and transmission of the summary document,

         must be carried out within one month of the transaction decision.








28Original English text: “In addition to the requirements for the collection of consent to be valid in accordance with the
GDPR and under Article 5(3) ePrivacy Directive, three additional cumulative conditions are mandatory (i) the possibility to
withdraw consent, (ii) the ability to withdraw consent at any time, (iii) withdrawal of consent must be as easy as to give
consent.” Decision 161/2023 — 20/24




        b.1.4. Fourth grievance of the complainant in his complaint of July 18, 2023



          Fourth grievance of the complainant: “Type 4 violation: Reference to legitimate interest”



          In support of this complaint, the complainant attaches the following screenshot:

          Complaint, Annex 4:



























          Prima facie relevant evidence from policy positions and regulatory documents

          the Data Protection Authority.



                  1. The point of view of the working group of the European Health Protection Committee

                       data (“EDPB”) 29 and APD press release 30 on this subject.



                       An extract from the APD press release:



                       Legitimate interest. Some websites appeal to legitimate interest, and not to

                       consent, for data processing subsequent to filing or

                       reading cookies. The report recalls that legitimate interest cannot

                       constitute the legal basis for the deposit of cookies itself, and whether the deposit

                       or reading cookies do not comply with the ePrivacy directive, the

                       subsequent processing resulting therefrom may not comply with the

                       GDPR.



29In English, Reportoftheworkundertaken bytheCookieBannerTaskforce, accessiblehere:https://edpb.europa.eu/our-work-
tools/our-documents/other/report-work-undertaken-cookie-banner-taskforce_en.
30
       APD press release, February 10, 2023, accessible here:
https://www.autoriteprotectiondonnees.be/citoyen/actualites/2023/02/10/bannieres-cookies-ledpb-publie-des-entreprises-
non-compliant-practices. Decision 161/2023 — 21/24




                     2. The APD “cookies checklist”:



                         has. I have checked the categorization of “essential technical cookies”31 (such

                              than those for load balancing);
                         b. I have controlled the categorization of "functional cookies strictly

                              necessary" (such as cookies for the temporary storage of
                              choice of language, cookie preferences or content

                              of the basket). This only includes cookies that are strictly
                              necessary to provide a service 32 explicitly requested by the

                              “visitor”;
                         vs. I have ensured that no other cookies than those above are placed

                              without first obtaining the valid consent of the “visitor”.



           Fourth condition of the transaction proposal:

           The defendants undertake to use legitimate interest as a legal basis only in the case


           the placement of strictly necessary technical or functional cookies. THE

           defendant also ensures that the associated visualization vis-à-vis the site visitor

           web meets transparency requirements, and therefore does not engage in

           practices involving the use of techniques that can be described as "deceptive
                     33
           design" - see also on this point that the complaint in this file deals in general

           misleading cookie banners and “dark templates”. 34 When the visitor

           website does not give consent to the installation of a particular cookie - for

           cookiesrequiringconsent-defendantsagreenottoinvokeinterest

           legitimate to continue installing these cookies. For this purpose, the data controller

           prepares a document, at the time of the technical implementation of this(these)

           adaptation(s), showing the display of cookies that it still (potentially) places on

           the website visitor's device at that time based on legitimate interest. This

           The document is then sent to the Litigation Chamber and to the complainant. Setting





31Article 10/2, § 2 of the law of July 30, 2018 relating to the protection of individuals with regard to data processing
personal data ("framework law"): "the technical recording of information or access to information
stored in the terminal equipment of a subscriber or end user with the sole purpose of sending a

communication via an electronic communications network" (emphasis mine).
32In principle, this therefore does not include the counting of visitors, see also page 10 of opinion 04/2012 of
Article 29 Data Protection Working Group: https://ec.europa.eu/justice/article-29/documentation/opinion-
recommendation/files/2012/wp194_en.pdf ” While they are often considered as a “strictly necessary” tool for website
operators, they are not strictly necessary to provide a functionality explicitly requested by the user (or subscriber). In fact, the
user can access all the functionalities provided by the website when such cookies are disabled.”

Some supervisors (in other Member States) take the position that the placement or procurement
access to such cookies - under certain strict conditions - escapes the requirement of consent. Sometimes it is the
consequence of an adaptation of national legislation (this ground for exception was then explicitly added), sometimes of the
national jurisprudence.

33 See also our press release, available via the following link:
https://www.autoriteprotectiondonnees.be/citoyen/actualites/2023/02/24/deceptive-design-patterns-comment-les-
recognize-and-avoid-them-on-social-media.
34
  Compare the ODA documents listed in section b.1.2. Decision 161/2023 — 22/24


     work, including the preparation and transmission of the document, must take place in a

     period of one month after the transaction decision has been taken.
















c) Written and oral exchanges with the parties



    c.1. written exchanges


    The transaction proposal marks the starting point of the transaction procedure.

    However, the terms of this proposal may be clarified or adjusted during the

    transaction procedure, particularly if these adjustments result in improvements to the

    with regard to data protection legislation. Such requests do not lead

    not automatically to an extension of the deadline.


    In principle, the parties send their requests in writing to the Litigation Chamber if

    they consider it necessary to make adjustments to the terms of the proposed

    transaction. It is up to the Litigation Chamber to make adjustments to the

    proposed transaction based on communications from the parties.



    In this sense, a constructive attitude on the part of the parties is encouraged. There
    Litigation Chamber expects requests to be reasonable and proportionate.

    When, according to the Litigation Chamber, the requests suggest that a transaction is

    improbable or unlikely, this could result in the withdrawal of the proposal of

    transaction.



    c.2. oral exchanges


    To facilitate the efficient conduct of the transaction procedure, the parties have the

    possibility of requesting an oral discussion regarding the transaction proposal. He Decision 161/2023 — 23/24


        is important to note that this option is offered as a favor and that the Chamber

        Litigation offers it in order to ensure the effectiveness of the procedure. 35



        A report will be drawn up at the end of the oral discussion, generally with the aim of

        simply note that the oral explanation has taken place.




        Both parties are free to participate in oral discussions organized by the

        Litigation Chamber. It is essential to emphasize that these discussions are

        confidential, and therefore, the content of the discussions cannot under any circumstances be

        disclosed to third parties.



    d) Deadline

Les Editions de l’Avenir Presse srl has 30 days from receipt of this

transaction proposal to indicate whether he accepts it or not. The (representative of the) complainant has the


possibility of commenting on the initial transaction proposal and the conditions attached to it

arise within 14 days of receipt of this letter.





    e) Existence of other controllers and/or subcontractors

This transaction proposal is addressed solely to Les Editions de l’Avenir Presse srl.

She does not comment on the question of knowledge whether other actors can be responsible for

potential violations leading to this proposed transaction, nor to what extent.



    f) Validation of the transaction



If the transaction proposal results in a formal transaction decision due to

the explicit acceptance or lack of response from the party to whom it is addressed within the time limit

mentioned above, an appeal may be lodged by the “injured party”. 36




It is important to note that the final transaction does not limit the rights of any individuals

affected [ERRATUM] to claim damages before a civil court on the basis

in particular article 82 of the GDPR.




35Conducting discussions with a view to reaching a transaction is a legal practice known in the landscape of regulators, compare
in particular the procedure before the Belgian Competition Authority in articles IV.55 et seq. ("Subsection 4 - Procedure in matters
transaction") of the Code of Economic Law of 02/28/2013 (B.S. 03/29/2013) and the mention of such discussions in this code.
3In accordance with article 108, § 1 of the LCA, an appeal against this decision may be lodged, within thirty days from
explicit acceptance or lack of response, within the aforementioned deadline, to the Cour des Marchés (Brussels court of appeal),
with the Data Protection Authority as the defendant.
Such an appeal may be introduced by means of an interlocutory request which must contain the information listed in article 1034ter of the
Judicial Code. The interlocutory request must be filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C.
judi., or via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.). Decision 161/2023 — 24/24





     g) Appeal against the proposed transaction





In accordance with article 108, §1 of the LCA, an appeal against this decision which results in proposing

a transaction can be introduced, within thirty days from its notification,

with the Court of Markets (Brussels Court of Appeal), with the Protection Authority of

data as defendant.


Such an appeal may be introduced by means of an interlocutory request which must contain the
                                                                             37
information listed in article 1034ter of the Judicial Code. The interlocutory request must be

filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 38

via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. judic.).






Please accept, Madam, Sir, the assurance of my perfect consideration.












Hielke Hijmans

President of the Litigation Chamber






















37
  The request barely contains nullity:
  7° indication of the day, month and year;
  8° the surname, first name, domicile of the applicant, as well as, where applicable, his qualifications and his national register number or
     Business Number;
  9° the surname, first name, address and, where applicable, the status of the person to be summoned;

  10° the object and summary of the means of the request;
  11° the indication of the judge who is seized of the request;
  12° the signature of the applicant or his lawyer.
38The request, accompanied by its annex, is sent, in as many copies as there are parties involved, by letter

recommended to the court clerk or filed with the court registry.