APD/GBA (Belgium) - 87/2024

APD/GBA - 87/2024
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 5(1)(a) GDPR Article 17 GDPR Article 21 GDPR Article 21(2) GDPR Article 38(2) GDPR
Type:	Complaint
Outcome:	Upheld
Started:	14.02.2023
Decided:	03.06.2024
Published:
Fine:	172,431 EUR
Parties:	n/a
National Case Number/Name:	87/2024
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	French
Original Source:	APD/GBA (in FR)
Initial Contributor:	nzm

The DPA fined a controller for, among other things, failing to erase a data subject’s personal data in the context of direct marketing and for having an overloaded part-time DPO, which could not effectively perform their tasks. The DPA initially issued a €245,000 fine, which was reduced to €172,431 due to the controller’s difficult financial situation.

English Summary

Facts

On 30 June 2022, the data subject purchased a product from the controller and discovered an unexpected charge of €1,50 relating to an ‘energy contribution’ on his bill of May 2022. The data subject asked to be reimbursed of this surcharge and that all his personal data be deleted. The controller refused to reimburse this surcharge but acknowledged receipt of the deletion request and confirmed it would be dealt with promptly.

The data subject continued to receive advertising communications from the controller. On 18 November 2022, the data subject requested mediation from the Belgian DPA (‘APD’). On 14 February 2023, in the absence of any response from the controller, the Mediation Service of the APD informed the data subject that he could convert his request for mediation into a complaint. The data subject did so on the same day.

During the hearing, the controller explained that regarding the erasure of the data subject’s data, the process took place in several stages: the data subject initially complained about an excessive energy charge but this complaint evolved into an erasure request to terminate the customer relationship. The former DPO misunderstood that this was a GDPR issue. They then ordered their German processor to delete the data subject’s data using ‘code 43’. However, this code was used to restrict the processing rather than delete the personal data. The controller acknowledged this mistake made by the former DPO and also explained that (i) the absence of response to the DPA during the mediation was due to the former DPO, and that neither the current DPO, nor the management were aware of these problems and (ii) the former DPO did not process correspondence with the DPA or the data subject, nor did they share this information internally. They took measures to limit the processing of the data subject’s data without communicating with the latter, or with the DPA.

Despite the use of ‘code 43’ to limit the processing and the cessation of commercial calls to the data subject, newsletters continued to be sent until December 2022. In December 2022, the former DPO rectified the situation.

The controller also explained that it took initiatives to improve its responsiveness and comply with the DPA’s decisions, in particular with the hiring of a new DPO who worked full-time with a team of two people, and the current DPO regretted that the former DPO had not informed the data subject of this rectification.

On 11 November 2023, the controller informed the APD that it had received an email from the German processor confirming that the data subject’s data had been deleted, and that it had sent an email to the latter informing him of this deletion.

On 15 March 2024, the APD informed the controller of its intention to impose an administrative fine and the amount of the fine, in order to give the controller, the opportunity to defend itself. On 5 April 2024, the APD received the controller’s response.

Holding

Violation of Articles 17 and 21 GDPR

Regarding the breach of Articles 17 and 21 GDPR, Article 17 GDPR establishes the right to erasure which allows data subjects to request deletion of their personal data if certain conditions are met. However, the right to erasure is not absolute: Article 17(3) GDPR provides for certain exceptions in which this right does not apply.

Article 21(2) establishes that the data subject has the right to refuse any processing of their personal data for direct marketing purposes by indicating that they do not consent to receive marketing communications. The APD indicated that when the purpose pursued by the controller is ‘direct marketing’, the right to object is automatic and the controller may no longer process the data for such purposes once the data subject has expressed their objection. The APD added that Article 21(2) GDPR applies at all times and is not subject to any conditions. The DPA considered that withdrawing consent and objecting to the processing for direct marketing purposes should, in principle, lead to the same end: the immediate cessation of the processing of data for direct marketing purposes and the automatic deletion of those data.

In the present case, the data subject made an erasure request by revoking his consent, under Article 17(1)(b) GDPR. The APD considered that it was clear from reading the data subject’s request that he expressed a firm desire to end all commercial relations with the controller. In addition to requesting the total deletion of his personal data, the data subject firmly objected to his data being processed for the purposes of direct marketing, which was later confirmed during the request for mediation he submitted.

First, the APD noted that on the basis of the statements made by the controller at the hearing, the controller had still not taken any concrete steps to respond to the data subject’s request for erasure and objection. The controller sent an email on 11 November 2023 informing the DPA that the data had been deleted, but the APD decided not to take this information into account as the proceedings had already been closed.

Second, the APD held that the application of ‘code 43’ restricted access to the data subject’s data within its system, but did not lead to their deletion. Therefore, certain processing operations such as telephone calls were restricted, however it did not stop the sending of newsletters.

Third, the controller implicitly invoked the exception provided for in Article 17(3)(b) GDPR, namely the retention of personal data in order to comply with legal obligations (‘tax audits’). The APD stated that the controller should have invoked this exception to justify the non-erasure. Nevertheless, the DPA found that this exception could not justify the processing of data for direct marketing purposes, whether by telephone or by email.

Therefore, the APD concluded that the controller failed to comply with Articles 17 and 21 GDPR.

Violation of Article 5(1)(a) GDPR

Regarding the breach of Article 5(1)(a) GDPR, the APD indicated that the principle of fairness, lawfulness and transparency laid down in this article is not limited to the simple information and transparency obligations listed in the GDPR, but is a general principle and philosophy which must be respected for all processing.

First, the APD took into account the fact that the sending of advertising messages and newsletters was based on the data subject’s consent by ticking a box. However, the DPA found that there was a contradiction in the timelines regarding the processing: the data subject exercised his right to erasure and objection in June 2022. Nonetheless, the controller used ‘code 43’ only in April 2023 which suggested that the data subject’s data was processed, even in a limited manner, at least until April 2023. Therefore, the processing of his personal data continued without any legal basis since the data subject withdrew his consent, thus, violating Article 6 GDPR. The APD did not take into account the argument that the consent box ticked by the data subject suggested perpetual consent.

Second, the APD noted that on the day of the hearing the controller had still not informed the data subject of the measures taken in response to his requests. Hence, the controller did not comply with its information and communication obligations under Article 12 GDPR.

Therefore, the APD concluded that the controller breached the principles of lawfulness and transparency set out in Article 5(1)(a) GDPR by failing to comply with the requirements of Articles 6 and 12 GDPR.

Violation of Articles 5(2) and 24 GDPR

Regarding the breach of Articles 5(2) and 24 GDPR, the APD indicated that the controller must implement appropriate technical and organisational measures to ensure that it is able to demonstrate that the processing is carried out in accordance with the GDPR.

First, the APD explained that with regard to Article 38(2) GDPR, which states that the controller shall assist the DPO by providing the resources necessary to carry out their tasks, among other things, the following must be taken into account: (i) the DPO must be involved, where appropriate, in all matters relating to data protection, (ii) the controller must recognize and enhance the DPO’s role by management, (iii) the controller must allocate adequate time for the DPO to carry out its duties, (iv) the controller must communicate the appointment of the DPO to all staff to ensure that their role within the organisation is widely known, (v) the controller must ensure ongoing training to keep the DPO’s knowledge up to date.

Second, the APD considered that in the present case, the inability of the controller to verify or conclusively confirm the actual deletion of the data subject’s data raised concerns about the effectiveness of the technical and organisational measures in place. Additionally, the DPA also took into account the fact that the former DPO worked part-time and was overloaded, which prevented him from responding effectively to the requests and considered that this highlighted the failure to put in place measures to ensure compliance with the GDPR. The APD also noted that the controller’s decision to hire a new full-time DPO was taken in response to the DPA’s investigation. However, such measures should have been put in place prior to the DPA’s intervention.

Therefore, the DPA concluded that the controller failed to comply with Articles 5(2) and 24 GDPR.

Alleged violation of Article 31 GDPR

Regarding the alleged breach of Article 31 GDPR, which states that the controller must cooperate with the DPA at its request, the DPA noted that the controller did not respond to the APD’s requests. The DPA indicated that this negligence appeared to result mainly from a confusion due to the fact that the controller was also subject to an investigation by another service of the APD. However, the latter held that the controller is obliged to cooperate with all the departments of the DPA. The APD considered that although the controller increased the number of staff and replaced the former DPO, these measures did not appear to be fully effective, in particular with regard to the examination of all the previous requests from the DPA.

Therefore, the DPA held that the controller did not fully cooperate with the DPA during the mediation procedure, but it was not able to determine whether this lack of response was the result of confusion generated by the ongoing inspection or the result of a deliberate intention or gross negligence not to cooperate.

Imposition of a fine

Regarding the imposition of a fine, the DPA indicated that although it was not able to establish that the infringements had an impact on several of the persons concerned, it emphasized that the controller’s negligence justified the imposition of a fine. Therefore, the APD decided to impose a €245,000 fine, which was reduced to €172,431 due to the controller’s difficult financial situation which would have devastating consequences for it, namely putting the jobs of 400 people at risk, and even leading to the cessation of activities in Belgium.

Comment

This decision was quite interesting in two regards:

1) The Belgian DPA recalled what a controller is supposed to do with its DPO, particularly with regard to ensuring the DPO's ongoing training. Moreover, the extra workload of the DPO does not exempt the controller from his obligation to cooperate with the DPA's services.

2) This decision is also interesting for its considerations on the principle and methods of calculating an administrative fine (§§97-165) for which the Belgian DPA extensively used the EDPB guidelines on the calculation of administrative fines under the GDPR.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/55



                                                                        Litigation Chamber


                                            Decision on merits 87/2024 of June 3, 2024


File number: DOS-2022-04748

Subject: Complaint for non-compliance with the right to erasure and opposition after the

receipt of commercial messages for direct marketing purposes




The Litigation Chamber of the Data Protection Authority, made up of Mr.
Hielke HIJMANS, president, and gentlemen Romain Robert and Frank De Smet, members;


Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the

protection of natural persons with regard to the processing of personal data and
to the free movement of these data, and repealing Directive 95/46/EC (General Regulation on the

data protection), (hereinafter “GDPR”);


Having regard to the Law of December 3, 2017 establishing the Data Protection Authority (hereinafter

“LCA”);

Considering the internal regulations as approved by the House of Representatives on

December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;


Considering the documents in the file;


Has taken the following decision regarding:



The complainant:


The defendant: Company Y, hereinafter “the defendant”.                                                                        Decision on merits 87/2024 — 2/55



I. Facts and procedure

    1. On November 18, 2022, the complainant filed a request for mediation with the Authority of

        data protection (hereinafter “DPA”) against the defendant, which is transformed

        filed a complaint on February 14, 2023 due to his lack of response.


    2. The complaint relates to the receipt of regular, unsolicited commercial messages to

        direct marketing purposes on the part of the defendant, despite the exercise by the plaintiff of

        its right to erasure and opposition.

    3. On June 30, 2022, the plaintiff, having purchased the defendant's products from his

        representative, discovers an unexpected charge of €1.50 linked to an “energy contribution”

        on his invoice dated May 31, 2022. Faced with the refusal to reimburse this surcharge by the

        defendant, the complainant requests the deletion of all of his data

        personal. He sends this request by email to the address “…”, indicating that he does not

        no longer wishes to be a client of the defendant.

    4. On July 1, 2022, the defendant acknowledges receipt of the plaintiff's requests and confirms

        rapid processing of these.


        Despite the assurance given by the defendant regarding the consideration of requests
        made on June 30, 2022, the complainant continues to receive communications

        advertising by the defendant.


    5. On November 18, 2022, the complainant requests a mediation procedure with the Service

        of First Line (hereinafter “SPL”) of the APD. In the request form addressed to

        ODA, the complainant reiterates his wish to no longer have commercial relations with the

        defendant, explaining: “[...] I therefore requested a reimbursement which I did not have

        obtained I then requested, on July 1st, that all my data be erased which I do not
        would never order from them again. [...] Today, 4 and a half months later, I receive

        always advertising messages. » .


    6. On November 24, 2022, the SPL confirms receipt of the request for mediation and declares it

        admissible.

    7. On December 7, 2022, the SPL informed the defendant of the request for mediation, inviting her to

        respond to the complainant's request regarding the exercise of his rights, and to transmit

        a copy of his response to the SPL.


    8. On January 11, 2023, the complainant requested the status of the request for mediation and

        informal SPL that he continues to receive calls and emails from the defendant. THE
        January 13, 2023, the SPL responds by indicating that the file is being processed, that a




1Exhibit 1 – The request for mediation and its annexes.                                                                        Decision on merits 87/2024 — 3/55



        letter was sent to the defendant on December 7, 2022, granting it a period of one

        months to respond, and that a reminder would be issued to the defendant.

    9. On January 17, 2023, the SPL sends a registered letter with acknowledgment of receipt to the

        defendant, inviting it to respond to the initial request of December 7, 2022.


    10. On February 14, 2023, due to the lack of response from the defendant, the SPL informed the

        complainant that he can commute his request for mediation into a complaint in accordance with article

        62, §2, paragraph 4 of the LCA. The complainant requests this transformation on the same day.

    11. On February 20, 2023, the SPL notified the defendant that the mediation had failed due to

        his lack of reaction, then transmits the complainant's complaint to the Litigation Chamber

        in accordance with article 62, § 1 of the LCA.


    12. On May 15, 2023, the Litigation Chamber decides, under Article 95, § 1, 1° and

        Article 98 of the LCA, to process the file on its merits. The parties concerned are notified

        by registered mail of the provisions as set out in article 95, § 2 as well as in

        article 98 of the LCA. They are also informed, under article 99 of the LCA, of the

        deadlines for transmitting their conclusions. That same day, the Litigation Chamber clarified
                                                                                                   3
        that the language of the proceedings would be French, in accordance with the language policy.

        On May 15 and 19, 2023, the defendant and the plaintiff respectively acknowledged receipt

        some mail.


        The deadlines are June 26, 2023 for the submissions in response to the

        defendant; by July 17, 2023 for the complainant's reply conclusions; and August 7

        2023 for the defendant's reply submissions.


    13. On September 29, 2023, in the absence of conclusions filed by the parties, the Chamber
        Litigation summons, in accordance with article 52 of the ROI, the parties concerned to a

        hearing on October 12, 2023, to allow them to present their arguments orally.

        The defendant confirms its presence on October 3, 2023, while the plaintiff expresses

        his inability to attend the hearing in an email dated October 11, 2023.


    14. On October 12, 2023, the defendant was heard by the Litigation Chamber. During

        of this hearing, the defendant presents the following arguments:


            a) The responsibility of the data protection officer (hereinafter “DPO”): the

                problems with the APD began under the management of the former DPO, Mr. Z1 (hereinafter
                after “the former DPO”). Neither the current DPO, Mr. Z2 (hereinafter “the current DPO”) nor the

                management were not informed of these problems. The defendant justified the absence




2Art. 95, § 1, 1° and art. 98 of the aforementioned law of December 3, 2017.
3Data Protection Authority, “Note relating to the linguistic policy of the Litigation Chamber”, 01/07/2021,
available at https://www.autoriteprotectiondonnees.be/publications/note-relative-a-la-politique-linguistique-de-la-
chamber-contentious.pdf.                                                                  Decision on merits 87/2024 — 4/55


            response from the former DPO due to his work overload, emphasizing that the

            management was not informed of this overload.


        b) Inadequate management of letters: the former DPO did not process letters from

            the APD nor the complainant and did not share this information internally. The former DPO
            has taken measures to limit the processing of the complainant's data, without

            contact the complainant or the APD.


        c) The data erasure process: the defendant described the process

            erasure of the complainant's personal data, explained the error of the former

            DPO, mentioned the confusion around data localization and “code

            43”, and undertook to comply with the GDPR by informing the complainant of
            the erasure of its data.


        d) Responsibility for data processing: responsibility for processing

            data between “Y B ELGIUM” (hereinafter “the defendant”) and “Y LLEMAGNE” (hereinafter

            after “the German subcontractor”) was discussed, with reference to a contract of

            subcontracting.

        e) Organizational improvements: the contract of the old DPO ended, and the DPO

            currently works full-time with a team of two people to manage the company

            email “privacy@Y.be”. The defendant is committed to taking initiatives to

            improve its responsiveness and comply with APD decisions.


15. On October 27, 2023, the Litigation Chamber submits the minutes of the hearing to the
    parts.


16. On November 3, 2023, the defendant provided details in the minutes at the

    Litigation Chamber, which will be taken into consideration in this

    decision. The defendant further requests that, taking into account the circumstances
    specific to the case, the Litigation Chamber opts either for a suspension of the

    pronounced, as permitted by article 100, § 1, 3° of the LCA, either for a warning or

    a reprimand according to article 100, § 1, 5° of the same law.


17. On November 11, 2023, the defendant notifies, after the close of the debates, the Chamber

    Litigation having received an email from the German subcontractor, confirming the deletion of
    data of the complainant, and having sent an email to the complainant to inform him of this

    deletion.


18. On March 15, 2024, the Litigation Chamber informed the defendant of its intention

    to proceed with the imposition of an administrative fine as well as the amount thereof, in order
    to give the defendant the opportunity to defend herself before the sanction is

    actually inflicted.                                                                         Decision on merits 87/2024 — 5/55



    19. On April 5, 2024, the Litigation Chamber received the defendant's reaction concerning

        the intention to impose an administrative fine and the amount thereof. This response is
        examined by the Litigation Chamber as part of its deliberations.



II. Motivation



    II.1. Introductory points


        II.1.1. On the joining of files


    20. During the hearing, the defendant emphasized that she was the subject of an investigation

        carried out by the Inspection Service (hereinafter “SI”) of the APD as part of a file

        distinct. This assertion was reiterated as part of his reaction to the hearing minutes of 3
                         4
        November 2023.

    21. On April 5, 2024, as part of its reaction to the sanction form of March 15, 2024, the

        defendant requested the joinder of the file (…)(subject of the IS investigation) with the file

        currently subject to this decision.


    22. Firstly, the defendant should be reminded that the IS is required to maintain secrecy

        the investigation, in accordance with article 64§3 of the LCA, which specifies that “the investigation is secret

        unless there is a legal exception, until the time of submission of the inspector general's report to

        of the Litigation Chamber”.

    23. Secondly, the Litigation Chamber emphasizes that it does not have the power to

        self-report an ongoing investigation carried out by the IS. It refers the defendant to

        Article 92 of the LCA for the conditions of referral. This article specifies that the IS can enter

        the Litigation Chamber after the closure of an investigation in accordance with article 91 §2 of

        the LCA.


    24. Thirdly, the Litigation Chamber recalls that the sanction form aims to

        allow the alleged perpetrator of the offense, in this case the defendant, to give
        his views on the amount of the proposed fine before its imposition and its

        effective execution. This defense process, provided through the sanction form

        on the amount of the proposed fine, does not open new debates on the

        findings already established by the Litigation Chamber, the latter being closed.


    25. In conclusion, the Litigation Chamber rejects the request to join the file (…) with

        the current file which is the subject of this decision.





4In its reaction to the hearing minutes of November 3, 2023 and the sanction form of April 5, 2024, the defendant specifies
that the file being inspected corresponds to the referenced file number (…).
5Sanction form dated March 15, 2024; reaction of the respondent to the sanction form dated April 5, 2024. Decision on merits 87/2024 — 6/55


        II.1.2. On the interpretation of article 21.2 of the GDPR


    26. In this case, the Litigation Chamber notes that the complainant made his request

        erasure (total deletion of their data) on June 30, 2022 by revoking their

        consent, in accordance with article 17.1.b) of the GDPR. Furthermore, it is clear, upon reading

        of the complainant's request, that the latter expresses a firm desire to put an end to any

        commercial relationship with the defendant. To the extent that the complainant exercised his

        right to erasure under Article 17.1.b) of the GDPR, by revoking consent,

        the defendant should have granted the erasure request, delete all of the

        personal data of the complainant and stop direct marketing, since the legal basis

        invoked for this data processing is consent.

    27. Next, the Litigation Chamber emphasizes that article 21 of the GDPR covers two forms

        different from the right of opposition. On the one hand, in article 21.1, a possibility of opposing

        processing based on the legitimate interest of the data controller or on a

        public interest mission of the data controller (general opposition subject to

        weighting of interests).

    28. Furthermore, in accordance with article 21.2, the person concerned has the right to refuse

        any processing of their data for direct marketing purposes (opposition to marketing

        direct), thus indicating that it does not consent to receive marketing communications.

        When the purpose pursued by the data controller is direct marketing, the

        right of opposition is automatic: the data controller can no longer

        process data for such purposes, including profiling, to the extent it is related

        for this purpose, when the person concerned has expressed their opposition.

    29. The Litigation Chamber takes the position that article 21.2 applies at all times,

        since Article 21.2 grants an unconditional right to the data subject to object

        “at any time” to the processing of their personal data for the purposes of

        prospecting, including profiling to the extent that it is linked to such prospecting.
                                                                                         6
        The exercise of the right under Article 21.2 is not subject to any conditions. This item

        applies independently of the legal basis of the processing, and without any weighting

        interest is required. This position can also be deduced from the distinction between
        recitals 69 and 70 of the GDPR.


    30. The Litigation Chamber admits that a different reading of article 21.2, according to which

        this provision would be limited to the same legal bases for processing as Article 21.1

        GDPR [Article 6.1(e) and Article 6.1(f)], is not excluded. However, such a reading




6See WP29, Guidelines for automated individual decision-making and profiling for the purposes of
regulation (EU) 2016/679, WP251, rev.01, p21; Zanfir-Fortuna in The EU General Data Protection Regulation (GDPR): A
Commentary, OUP 2000, p. 518. Decision on merits 87/2024 — 7/55


    would change nothing in the defendant's obligations, because the withdrawal of consent under

    of article 17.1.b of the GDPR implies that all processing must cease.

31. The preceding points show that the withdrawal of consent (legal basis invoked

    by the defendant to justify direct marketing) and the opposition to the processing of

    data for direct marketing purposes should in principle lead to the same purpose:

    immediate cessation of data processing for direct marketing purposes and the

    automatic deletion of this data.


II.2. As for the alleged breaches of the GDPR


    II.2.1. Alleged violation of Articles 17 and 21 of the GDPR


        II.2.1.1.   Position of the defendant


32. The following arguments were raised by the defendant only during the hearing:


        a) Regarding the erasure of the complainant's data, the process was

            carried out in several stages. Initially, the complainant complained about energy costs
            excessive, but this complaint evolved into a request to terminate the relationship

            customer and erasure of data. The former DPO misinterpreted the situation, did not

            not understanding that this was a GDPR issue.


            The former DPO then ordered the German subcontractor to erase the data from
            complainant, using “code 43”. However, this code did not result in the removal

            complete data. The current DPO admitted that “code 43” was intended to

            limit processing rather than deleting data, recognizing an error

            of the former DPO.

            Despite the implementation of “code 43” to limit the processing of data and

            the cessation of commercial calls to the complainant, the sending of newsletters continued

            until December 2022. The defendant specified that the plaintiff had consented

            to receive these newsletters, which were managed by a separate network.

            It was not until December 2022 that the former DPO rectified the situation in response

            to SPL mail, making the data inaccessible to the defendant, but

            they were always present and accessible to other entities, notably to

            purposes of tax audits. The current DPO regretted that the former DPO did not

            informed the complainant of this rectification.

            On the day of the hearing, the defendant could not guarantee that the data had been

            actually deleted, due to lack of written confirmation from the German subcontractor to

            this subject. The current DPO offered to contact the German subcontractor to

            verify the deletion of the complainant's data.                                                                        Decision on merits 87/2024 — 8/55


            b) Regarding the request made by the current DPO on the obligation

                to inform the complainant of the measures taken in response to his request for

                deletion of data, the Litigation Chamber recalled the provisions of

                Article 12 of the GDPR. In response, the defendant undertook, during the hearing,

                to regularize the situation in accordance with article 17 of the GDPR and inform the

                complaining about the erasure of his data.

            c) With regard to the location of the complainant's data and the identification of the

                responsible for the processing, the defendant raised that the IS was investigating these

                questions in a separate file. Finally, the defendant indicates that it is

                the “sole” controller, according to the information available to it.

    33. On November 3, 2023, as part of his reaction to the minutes of the hearing (hereinafter “

        reaction to the PV)"), the defendant specified that the former DPO had requested activation

        of “code 43” for the complainant’s data from the German subcontractor on April 11

        2023, a fact that he recorded in a correspondence addressed to SI on April 18, 2023 in

        the context of the current Inspection (see Title II.1.1). However, the former DPO failed to

        inform the complainant and the SPL.


            II.2.1.2.   Position of the ChamberContentious


    34. Article 17 of the GDPR establishes the right to erasure which allows data subjects

        to request the deletion of their personal data if one of the conditions

        following is fulfilled: the data are no longer necessary for the purposes for which they were

        have been collected or processed (art. 17.1.a) of the GDPR); the person concerned withdraws their

        consent on which the processing was based, and there is no other legal basis

        for processing (art. 17.1.b) of the GDPR); the data subject objects to the processing

        under article 21.1, and there is no overriding legitimate reason for the processing (art. 17.1.c)

        of the GDPR); the data was processed unlawfully (art.17.1.d) of the GDPR); data
        must be deleted to comply with a legal obligation (art. 17.1.e) of the GDPR); THE

        data has been collected from a child in connection with the company's services

        information (art. 17.1.f) of the GDPR).


        However, the right to erasure is not absolute. Article 17.3 of the GDPR provides for certain

        exceptions in which this right does not apply, in particular when the processing of
        data is necessary to guarantee the exercise of the right to freedom of expression and

        information (art. 17.3.a) of the GDPR), to comply with a legal obligation or carry out a

        mission of public interest (or relating to the exercise of public authority vested in the

        responsible for the processing) (art. 17.3.b) of the GDPR), to carry out a mission of interest



7See point 21 of this decision.                                                                          Decision on merits 87/2024 — 9/55


        public in the field of public health (art. 17.3.c) of the GDPR), for archival purposes

        (art. 17.3.d) of the GDPR), or to establish, exercise or defend legal rights (art. 17.3.e)

        of the GDPR).


    35. Pursuant to Article 19 of the GDPR, the data controller is required to notify

        each recipient to whom the personal data has been communicated

        any rectification or erasure of personal data or any limitation

        of the processing carried out in accordance with Articles 16, 17.1 and 18 of the GDPR, unless a

        such communication proves impossible or requires disproportionate effort. THE

        controller provides the data subject with information about these

        recipients if they request it.


    36. Article 21 of the GDPR governs the right of opposition of data subjects. When the

        personal data are processed for prospecting purposes, the person

        concerned “has the right to object at any time to the processing of personal data

        personal data concerning it (...)” (art. 21.2 of the GDPR). If the data subject “objects to the

        processing for prospecting purposes, personal data is no longer

        processed for these purposes. » (art. 21.3 of the GDPR).


        When a person objects to the processing of data for prospecting purposes

        (opposition to direct marketing), it must not provide any justification for its request

        opposition. Consequently, the opposition must immediately result in the cessation of all

        processing of personal data for direct marketing purposes for the individual

        concerned, without the need for additional examination (see Title II.1.2).  10


    37. Articles 15 to 22 of the GDPR are intrinsically linked to article 12 of the GDPR which imposes

        obligations of the data controller, particularly with regard to the

        transparency of information and communications as well as the methods of exercise

        of the rights of the data subjects (art. 17 juncto 12 of the GDPR and art. 21.2 juncto 12 of the

        GDPR).


        The exercise of these rights, in this case the right to erasure (art. 17 of the GDPR) and the right

        opposition to direct marketing by the complainant (art. 21.2 of the GDPR) as well as respect for these

        rights by the data controller, who must demonstrate his response to the requests of the


8
 In the absence of a legal definition of the notion of prospecting, the APD has defined it as “Any communication, solicited or
unsolicited, aimed at promoting an organization or a person, services, products, whether paid
or free, as well as brands or ideas, sent by an organization or a person acting within a framework
commercial or non-commercial, directly to one or more natural persons in a private or professional context,
by any means, involving the processing of personal data. », see Recommendation No. 1/2020 of
January 17, 2020 relating to the processing of personal data for direct marketing purposes, page 8, available
on the APD website.
9 CJEU, Google Spain and Google, C-131/12, May 13, 2014, ECLI:EU:C:2014:317; CJEU, Manni, C-398/15, March 9, 2017,
ECLI:EU:C:2017:197; CJEU, Google), C‑507/17, September 24, 2019, ECLI:EU:C:2019:772; APD, Litigation Chamber,

Decisions 28/2020 of May 29, 2020, 32/2020 of June 16, 2020, 19/2021 of February 12, 2021, 109/2023 of August 9, 2023, 157/2023
10 November 27, 2023”, available on the APD website.
  See Recommendation No. 1/2020 of January 17, 2020 relating to the processing of personal data for the purposes of
direct marketing, page 53,.                                                                     Decision on merits 87/2024 — 10/55


        persons concerned, must be assessed and examined in accordance with the provisions

        of article 12 of the GDPR.


    38. Article 12 of the GDPR imposes on the data controller the obligation to take

        appropriate measures to communicate concisely, transparently,
        understandable and easily accessible, in clear and simple terms, all

        information relating to data processing to the data subject, in particular

        when it comes to responding to the rights set out in articles 15 to 22 of the GDPR (art. 12.1 of the GDPR

        GDPR). When a data subject makes a request in accordance with Articles

        15 to 22 of the GDPR, the data controller is required to respond within one month,

        with the possibility of a two-month extension, while informing the person concerned

        the reasons for this extension (art. 12.3 of the GDPR). If no response is provided to the

        request of the data subject, the controller must promptly
        inform, and at the latest within one month of receipt of the request,

        the person concerned of the reasons for his inaction but also of his right to file a

        complaint to a supervisory authority or to seek legal recourse (art.

        12.4 of the GDPR).


    39. In conclusion, non-compliance by the person responsible for processing a request made in
        under Articles 15 to 22 of the GDPR, in particular the right of erasure when the

        conditions of article 17 of the GDPR are met, or of the right of opposition when the

        conditions of article 21.2 of the GDPR are satisfied, may result in a violation not

        only Articles 17 and 21 of the GDPR, but also Article 12 of the GDPR due to

        non-compliance with communication and information obligations.


    40. In the present case, as mentioned above in Title II.1.2. of this decision, the Chamber
        Litigation notes that the complainant made his request for erasure (deletion

        total of his data) on June 30, 2022 by revoking his consent, in accordance with

        Article 17.1.b) of the GDPR. Furthermore, it is clear, upon reading the complainant's request, that

        this expresses a firm desire to end any commercial relationship with the

        defendant. In addition to requesting the total deletion of their data (art. 17.1.b) of the

        GDPR), the complainant strongly objects to his data being processed for the purposes of

        direct marketing (art. 21.2 of the GDPR). To dispel any doubt regarding the requests of the

        complainant, the request for mediation introduced on November 18, 2022 and communicated on November 7
        December 2022 to the defendant clarifies the plaintiff's demands. These requirements

        relate both to the erasure of their data under Article 17.1.b) of the GDPR and to

        opposition to the processing of their data under articles 21.2 and 21.3 of the GDPR,





1GDPR, art. 12.1. ; This information may be provided in writing or by other means, including, where appropriate, by
electronic.                                                                     Decision on merits 87/2024 — 11/55



        which may lead to the application of articles 17.1 b) of the GDPR, as requested by
        complainant.


    41. In the present case, firstly, the Litigation Chamber finds, on the basis of the

        statements made by the defendant during the hearing which took place on October 12, 2023,

        i.e. more than a year after the complainant exercised his rights, the defendant has not

        still not taken concrete measures to respond to the erasure request and

        opposition of the complainant.

        The Litigation Chamber would like to point out that as of November 11, 2023, the defendant has

        notified the sending of an email to the complainant informing him of the overpressure of his data, without

        provide proof and clearly specify whether the opposition request had been processed.

        Litigation Chamber decided not to take this information into account in its

        deliberations because the debates had already been closed.

    42. Secondly, the Litigation Chamber notes that the application of “code 43” by the

        defendant on April 11, 2023 limited access to the plaintiff's data within its

        system, but did not lead to their deletion. This measure restricted certain

        treatments, including telephone calls, but she did not interrupt the sending of

        newsletters, which persisted until December 2022. Finally, the promise made by the

        defendant in an email of November 3, 2023, even after the close of the debates,

        concerning the erasure of the complainant's data, remains unsatisfactory in relation to

        to the complainant's requests. The latter had expressly opposed any treatment

        later of its data, in particular for prospecting purposes and had required the deletion

        full of its data.

    43. Thirdly, the Litigation Chamber notes an inconsistency in the chronology of the

        events, as presented during the hearing of October 12, 2023 and in the

        email in reaction to the hearing minutes. It seems unlikely that data processing

        for direct marketing purposes ended in December 2022 while the defendant

        indicates that “code 43”, at the origin of the limitation of data processing, is not

        only occurred in April 2023 (see point 33). This suggests that the complainant's data

        were accessible at least until April 2023 and not until December 2022.

        Litigation Chamber adds that the complainant indicated, on January 11, 2023, either

        after December 2022, continue to receive calls and emails from the

        defendant (see point 8).

    44. Fourth, the Litigation Chamber emphasizes that the continuous sending of newsletters,

        lasting at least until December 2022, or even until April 2023, despite the

        requests for erasure and opposition made by the complainant on June 30, 2022, under


1Email dated November 3, 2023 sent by the defendant in reaction to the hearing minutes.
13Email dated November 3, 2023 sent by the defendant in reaction to the hearing minutes.                                                                        Decision on merits 87/2024 — 12/55


        pretext of the existence of a separate system for the management of advertising emails, do not

        can justify the continued processing of the complainant's data for marketing purposes

        direct.


    45. Fifthly, the Litigation Chamber understands that the defendant invokes
        implicitly the exception provided for in article 17.3.b) of the GDPR, namely the conservation of

        data of the complainant in the German IT system to respond to

        legal obligations, in this case “tax audit”. The Litigation Chamber

        recalls that it was up to the defendant to invoke one of the exceptions under article 17.3

        of the GDPR, to justify this invocation, and to inform the complainant of the non-deletion in

        precisely reason for this exception (art. 12.1, 12.3 and 12.4 of the GDPR and art. 17.3 of the GDPR),

        which she did not do at that time. Nevertheless, the Litigation Chamber notes that

        this exception cannot justify the continued processing of the complainant's data
        for direct marketing purposes, whether by telephone canvassing or mail

        electronic.


    46. The above-mentioned information reveals that the processing of the complainant's data

        continued for prospecting purposes despite the request for erasure and opposition.

        This lawsuit indicates that the defendant not only did not stop all treatment
        personal data of the complainant for prospecting purposes, but did not

        clearly not deleted the complainant's data as soon as possible nor informed him

        of the response given to his requests.


    47. In view of the above, the Litigation Chamber concludes that the defendant does not

        complied with Articles 17 and 21 of the GDPR, while neglecting to respect the obligations of

        prompt, explicit and transparent response and communication as set out in
        Articles 12.1, 12.3 and 12.4 of the GDPR.



        II.2.2. Alleged violation of article 5.1.a) of the GDPR (principle of lawfulness, fairness and
            transparency)



            II.2.2.1.   Position of the defendant

    48. During the hearing, the defendant argued that direct marketing activities and

        the sending of newsletters was based on the consent of users, obtained via a

        Proactive opt-in mechanism with easy unsubscribe option.

        Other types of processing were mainly based on the need to carry out the

        CONTRACT.






14See minutes of hearing of October 12, 2023, B.2., p.6.                                                                        Decision on merits 87/2024 — 13/55



            II.2.2.2.   Position of the ChamberContentious


    49. The principle of lawfulness is one of the key principles of the GDPR and alone conditions the

        triggering of the other principles of the GDPR governing the processing of data

        personal character. According to this principle, personal data must be processed

        lawful, fair and transparent manner with regard to the person concerned. So that a

        processing of personal data is recognized as lawful, the processing must

        be based on the consent of the data subject or rely on another

        basis provided for by the GDPR in its article 6. 15


    50. Article 6.1 of the GDPR lists six legitimate grounds for processing: in addition to the

        consent (art. 6.1.a) of the GDPR), the processing of personal data may

        be necessary for the execution of a contract (art. 6.1.b) of the GDPR), to comply with an obligation

        legal (art. 6.1.c) of the GDPR), for the execution of a mission of public interest or relating to

        the exercise of public authority (art. 6.1.e) of the GDPR), for the purposes of legitimate interests

        pursued by the data controller or by a third party (art. 6.1.f) of the GDPR), or is

        necessary to safeguard the vital interests of the person concerned (art. 6.1.d) of the

        GDPR). In the absence of an adequate legal basis, the processing of personal data is

        prohibited.

    51. The continued processing of personal data for prospecting purposes, as

        cold calling or sending newsletters, despite a request for erasure

        without any exception provided for in article 17.3 of the GDPR being able to be invoked, or

        despite a request for opposition in accordance with articles 21.2 and 21.3 of the GDPR, may

        lead to a violation of article 6 juncto 5.1.a) of the GDPR when the processing of

        data continues without basis of lawfulness. In other words, non-compliance with requests


        erasure and/or opposition may go beyond the simple violation of Article 17 and/or 21 of the

        GDPR.

    52. The principle of loyalty and transparency established in Article 5.1.a) of the GDPR is not limited to

        to the simple information and transparency obligations listed in the articles of the

        GDPR, but consists of a general principle, the scope and philosophy of which must be

        respected for any treatment. This principle, enshrined in particular by article 12 of





15GDPR, art. 5, paragraph 1, a); art. 6 to 9; recital 40.
16See EPDB decision 01/021 in which it is stated: “Based on the above considerations, the EDPB underlines
that the principle of transparency is not circumscribed by the obligations arising from Articles 12 to 14 of the GDPR, although these
The latter are a concretization of the first. Indeed, the principle of transparency is a general principle that only

reinforces other principles (e.g. fairness, accountability), but from which many other provisions flow
of the GDPR. Furthermore, as noted above, Article 83(5) of the GDPR provides for the possibility of establishing a violation of the
transparency obligations regardless of the violation of the principle of transparency. Thus, the GDPR distinguishes the
broader dimension of the principle of more specific obligations. In other words, transparency obligations do not
do not define the full scope of the principle of transparency. ". (Free translation from the Litigation Chamber) EDPB, Binding
decision1/2021onthedisputerisenonthedraftdecisionoftheIrishSupervisoryAuthorityregardingWhatsAppIrelandunder
Article 65(1)(a) GDPR, July 28, 2021, §192.                                                                      Decision on merits 87/2024 — 14/55


              17
        GDPR aims to ensure that the people concerned are informed in a concise manner,

        transparent, understandable and easily accessible regarding the processing of their

        personal data. In addition, it obliges the data controller to take

        appropriate measures to respond effectively to requests made by

        data subjects pursuant to Articles 15 to 22 of the GDPR. This involves providing

        complete information, written in clear and simple language, and presented in a manner

        concise, easily accessible and easy to understand, with regard to the treatment of
                     18
        their data. By guaranteeing total transparency in data processing

        personal, this principle reinforces confidence in the processing of data and ensures the

        respect for fundamental rights regarding data protection.

    53. Finally, in accordance with article 5.2 of the GDPR, read in conjunction with article 24 of the GDPR, 19

        which enshrines the principle of responsibility (or “accountability”), the person responsible for

        processing is responsible for compliance with the principles of data protection

        personal, in this case the principle of lawfulness and transparency. He must take

        appropriate technical and organizational measures in order to guarantee and be able to

        to demonstrate that the processing of personal data complies with the

        legal obligations provided for by the GDPR; which implies that it must be able to provide

        proof of its compliance in response to any request from the authorities of

        control.


    54. In the present case, firstly, the Litigation Chamber took into account the

        explanations provided by the defendant concerning its direct marketing activities,

        including telephone calls and sending newsletters, which were based on the

        consent of customers under Article 6.1.a) of the GDPR. Furthermore, the Chamber

        Litigation noted that the defendant argued that the plaintiff had initially

        given consent by checking the “consent” box to receive messages

        advertising, and that the sending of newsletters was the subject of a separate management system.

    55. The Litigation Chamber noted that the complainant had exercised his right of erasure

        and opposition on June 30, 2022. During the hearing, the defendant confirmed that the

        complainant continued to receive commercial messages until December 2022.

        paradoxically, the defendant also indicated that the limitation of processing

        data using “code 43” was only implemented on April 11, 2023, which

        suggests that the complainant's data was processed, even in a limited way, at least

        until April 2023, and not December 2022. Thus, the processing of the complainant's data at



17
18See points 38 to 40 of this decision.
  Recitals 58 and 60 of the GDPR specify that “the principle of fair and transparent processing requires that the person
concerned is informed of the existence of the processing operation and its purposes" and that "the principle of transparency
requires that any information addressed to the public or the person concerned be concise, easily accessible and easy to follow
understand, and formulated in clear and simple terms (...)”.
19See Title II.2.3. of this decision.                                                                  Decision on merits 87/2024 — 15/55


    direct marketing purposes continued without basis of lawfulness, or withdrawal by the complainant

    of his consent. Since this consent has been withdrawn by the complainant (by

    the exercise of its right to erasure and opposition), the continued processing of its

    data for direct marketing purposes was carried out without basis of lawfulness, violating the
    principle of lawfulness set out in article 5.1.a) of the GDPR.


56. Furthermore, the Litigation Chamber does not find the argument put forward by the

    defendant according to which the complainant continued to receive messages

    commercial due to a so-called “consent box” initially checked,
    suggesting perpetual consent. The complainant had clearly revoked his

    consent by exercising your rights of erasure and opposition, and by declaring

    explicitly no longer purchase the defendant's products. Therefore, the

    defendant no longer had a legal basis to justify the processing of the data

    for direct marketing purposes, upon exercising your rights of opposition and erasure

    by the complainant. Furthermore, the argument put forward by the defendant, according to which the sending of
    advertising emails was justified by the existence of a separate management system, cannot

    convince the Litigation Chamber, as long as it is up to the person responsible for processing

    to organize yourself in such a way as to comply with the obligations of the GDPR.


57. Secondly, the Litigation Chamber notes that on the date of the hearing, the defendant
    had still not informed the complainant of the measures taken in response to the exercise of his

    rights of erasure and opposition. Furthermore, although she committed on November 3

    2023 to regularize the situation in accordance with article 17 of the GDPR, this declaration

    confirms the defendant's non-compliance with the principle of transparency set out in article

    5.1.a of the GDPR resulting from non-compliance with its obligations to provide information and

    communication, as defined in article 12 of the GDPR. Furthermore, the Chamber
    Litigation highlights that the opposition request remains unprocessed to this day.


58. Considering the time elapsed between the exercise of rights in June 2022 and the commitment to

    inform the plaintiff in November 2023, it is established that the defendant did not take the

    appropriate measures to communicate all information relating to the processing
    data, including responses to the rights of erasure and opposition, such as

    as required by Article 12.1 of the GDPR. Furthermore, the defendant did not provide information on the

    actions taken following erasure and opposition requests within the period of a

    month prescribed by article 12.3 of the GDPR, nor provided any justification to the complainant

    for its inaction contrary to what is required by Article 12.4 of the GDPR.

59. In conclusion, the defendant continued to process the plaintiff's data at

    direct marketing purposes, whether via telephone calls or emailing

    advertising, without legal basis within the meaning of Article 6 of the GDPR, for a period ranging from

    six to ten months after the latter made his request for deletion and opposition, Decision on the merits 87/2024 — 16/55


    violation of the principle of lawfulness. Furthermore, the defendant did not comply with the request

    deletion and opposition of the complainant, these requests having remained unanswered

    for more than one year and five months with regard to the erasure request, and

    still remaining unanswered regarding the opposition request.

60. In view of the above, the Litigation Chamber concludes that the defendant violated

    the principles of lawfulness and transparency set out in article 5.1.a) of the GDPR by not respecting

    not the requirements of Articles 6 and 12 of the GDPR.


    II.2.3. Alleged violation of Articles5. 2 and 24 of the GDPR (principle of liability)


        II.2.3.1.   Position of the defendant


61. The following arguments were raised by the defendant only during the hearing:


        a) Regarding the former DPO and his role, the defendant described him as

            competent in communication and labor law, but noted gaps in
            its management of communications with the IS, the SPL and the Litigation Chamber. These

            shortcomings have generated problems and highlighted weaknesses in its

            management of internal communications within the defendant, which

            ultimately led to his replacement.

        b) Regarding the complainant's request for erasure, although the former DPO

            has taken internal measures to deal with the complainant's requests, including

            using “code 43” and, according to the defendant, informing the IS within the framework

            of the inspection to which it was subject (see Title II.1.1), he however failed to

            respond to the SPL and inform the complainant. The former DPO thought that the data

            placed under the “code 43” category resulted in the deletion of data, and
            not a data limitation. The defendant also clarified that it does not

            could not verify or confirm the deletion of the complainant's data by the

            German subcontractor because no written confirmation had been provided by this

            last. The defendant confirmed that it no longer had control of this data.

            On November 3, 2023, in reaction to the hearing minutes, the defendant clarified that the

            misunderstanding with the German subcontractor regarding the categorization of

            data under “code 43” was the result of a mistaken belief by the former DPO

            and management who believed that this code resulted in the erasure of data

            personal while it actually resulted in their non-accessibility by the front desk
            of their system. This situation would be being rectified with the assistance of the

            new DPO (current DPO).


        c) With regard to the responsibility for data processing between the sub-contractor

            dealing with German and herself, the defendant expressed uncertainty as to the merits of the Decision 87/2024 — 17/55


            structure of this responsibility, while noting a tendency to consider oneself

            as the sole controller.

            In reaction to the hearing report, the defendant clarified that it is linked to the sub-

            German processor through a subcontracting contract (art. 28 GDPR).


        d) Regarding the exclusive access of the former DPO to the “privacy@Y.be” mailbox,

            the defendant explained that this created difficulties, particularly during
            absences due to illness or leave, affecting its ability to process requests for

            efficient manner. She pointed out that the former DPO, being employed part-time

            for three days a week, was often overloaded. The defendant announced

            the end of the contract of the former DPO following a notice period, specifying that

            since July 11, 2023, his successor has operated full time, supported by two

            other collaborators, for shared management of the mailbox which contains all
            emails, including those from APD. This new organization aims to guarantee

            better responsiveness. The defendant undertook to comply with the

            decisions of the APD and not to retain customer data unnecessarily.

            In reaction to the hearing minutes, the defendant reaffirmed its desire to reduce the

            risk of unprocessed correspondence, by taking administrative measures,

            namely the establishment of a team of three people, including the new DPO

            (current DPO), to manage the email box.



        II.2.3.2.   Position of the ChamberContentious

62. With regard to the principle of liability (art. 5.2 of the GDPR), the Chamber

    Litigation reminds that the data controller must implement measures

    appropriate technical and organizational measures to ensure and be able to

    demonstrate that the processing is carried out in accordance with the GDPR and other laws of

    protection of personal data (art. 24.1 of the GDPR). These measures are reviewed and

    updated if necessary. Then, article 24.2 of the GDPR establishes that “when it is
    proportionate to the processing activities, the measures [referred to in Article 24.1.

    of the GDPR] include the implementation of appropriate policies regarding

    protection of data by the data controller” (this is the Litigation Chamber

    which underlines).

63. Recital 74 of the GDPR adds that “it is important, in particular, that the person responsible for the

    processing is required to implement appropriate and effective measures and is

    even demonstrate compliance of processing activities with the [GDPR], including

    the effectiveness of the measures. These measures should take into account the nature, scope, and substance of the decision 87/2024 — 18/55



        context and purposes of the processing as well as the risk that it presents for the

        rights and freedoms of natural persons”.

    64. In execution of the principle of responsibility, it is therefore up to the data controller

        to develop internal procedures allowing the persons concerned to exercise

        effectively their rights, and to integrate respect for GDPR rules into their processing

        and procedures, for example, by ensuring the existence and effectiveness of procedures for

        processing of requests from data subjects (art. 25 of the GDPR).


    65. Measures implemented in accordance with the principle of accountability, read

        jointly with the principle of transparency (art.5.1.a) of the GDPR), aim to enable
                                                                              20
        data subjects to control the processing of their data.

    66. With regard to the data protection officer (DPO), Chamber 21

        Litigation reminds that the GDPR clearly defines the responsibilities of the manager

        data processing, in particular Article 38.2 of the GDPR. This article states that “

        the data controller and the processor assist the data protection officer

        data to carry out the missions referred to in Article 39 by providing the resources

        necessary to carry out [its] missions, as well as access to personal data

        personnel and processing operations, and allowing it to maintain its

        specialized knowledge” (emphasis added by the Litigation Chamber).


    67. In this regard, the Litigation Chamber is of the opinion that the following aspects, in particular,
                                           22
        must be taken into consideration:

            - The association of the DPO or, where applicable, his team, in all questions relating

                to data protection. This includes informing and consulting the DPO as soon as

                that a data processing project is envisaged, thus promoting compliance with the

                GDPR and encouraging an approach oriented towards data protection from

                design (known as “by design”). The DPO must naturally

                become a central interlocutor within the organization, for example by participating

                to working groups dedicated to data processing activities within

                the company;


            - Recognition and promotion of the DPO function by management

                senior (e.g. board level);

            - Adequate time allocation so that the DPO can perform effectively

                of its tasks is essential. This aspect is of particular importance when

                The DPO carries out his role part-time, whether internal or external to the organization.



20See recital 78 of the GDPR.
21Litigation Chamber, decision 41/2020, paragraphs 87 and 88.
22WP29, “Guidelines for Data Protection Officers (DPDs)”, 16/FR WP, 243 rev.01, April 5, 2017,
p. 16. Decision on merits 87/2024 — 19/55


                The lack of time allocated to the DPO to carry out his duties could

                cause conflicts of priorities and compromise its ability to accomplish its

                missions. To remedy this situation, WP29 recommends determining,

                jointly with the DPO, the estimate of the time necessary to exercise its

                function (the need is greater when entering the function). He can be

                useful to establish a work plan that prioritizes the DPO's tasks to ensure that he

                has the time necessary to fully assume his responsibilities. Of
                Furthermore, it is essential that the allocation of resources for the DPO be proportional

                the size, complexity, structure and risks associated with the activities of

                data processing. As a result, the more processing operations are

                complex or sensitive, the more resources allocated to the DPO must be

                substantial;

            - An official communication of the designation of the DPO to all staff

                to ensure that its role within the organization is widely known;


            - Adequate support in terms of financial resources (including

                budget for awareness-raising actions or recruitment of a team

                temporary or permanent), and infrastructure (premises, installations,
                equipment) and personnel, if applicable;


            - Default access to legal documentation related to data processing

                personal involving the organization with third parties, in particular partners and

                The subcontractors ;

            - Access to internal communication tools in the accomplishment of its

                missions in order to be able to raise awareness and train on the requirements of the GDPR, including

                raising awareness of good practices and managing incidents such as e-

                fraudulent emails or data breaches;

            - Access to other services, such as human resources, legal department,

                IT department, security, etc., to enable the DPO to receive the

                support, contributions and essential information from these other services 23;


            - Continuing training to maintain the specialized knowledge of the DPO

                day ;

            - Depending on the size and structure of the organism, it may be necessary to constitute

                a team around the DPO. In such cases, it is appropriate to clearly establish the

                internal structure of the team as well as the tasks and responsibilities of each

                member.Similarly, when the DPO function is outsourced to a service provider

                services, a team of people working on behalf of that entity can

23Bergt, in Kühling, Buchner, DS-GVO BDSG, Article 38 GDPR, margin number 20 (C.H. Beck 2020, 3rd Edition).                                                                 Decision on merits 87/2024 — 20/55


            assume the missions of the DPO as a group, under the responsibility of a

            designated primary contact person for the customer.

68. Ultimately, the DPO function must be exercised effectively to ensure effective management practices.

    effective and GDPR-compliant data protection. The data controller is

    legally required to put in place the necessary structures and measures to facilitate

    the work of the DPO and guarantee the protection of personal data. This involves

    provide the DPO with adequate resources depending on the nature of the processing

    data carried out and the associated risks, as well as the provision of time and
    access necessary to facilitate and support the role within the organization.


69. On the basis of the factual elements present in the file, the Litigation Chamber

    notes the following:

        a) With regard to the request for deletion and opposition made as of

            June 30, 2022:

                i. The defendant restricted the processing of data by using the “code

                   43”, thus making the data inaccessible from the front desk of their

                   system. However, this measure does not respond to initial requests

                   of the complainant, who requested the total deletion of his data and

                   objected to any further processing for prospecting purposes, placing

                   thus highlighting a clear gap in technical measures and
                   organizational structures in place.


                ii. The complainant's personal data was, in any event

                   until the date of the closure of the debates, always kept by the deputy

                   German treatment of the defendant despite his request for deletion and
                   opposition. The inability to conclusively verify or confirm

                   the effective deletion of this data raises concerns about

                   the effectiveness of the internal procedures currently in place, both in

                   regarding the deletion of data that coordination between

                   various entities of the defendant to comply with the GDPR.

        b) With regard to responses to requests for deletion and

            objection of the complainant:

                i. Until the date of the close of the proceedings, the defendant had still not

                   not responded to the complainant's requests for deletion and opposition,

                   thus revealing a major flaw in the implementation of measures

                   appropriate technical and organizational measures to ensure compliance with

                   rights of data subjects under the GDPR.                                                                   Decision on merits 87/2024 — 21/55


                   ii. The justification for receiving newsletters based on the

                      consent of the complainant, even when he has exercised his right

                      erasure and opposition, reveals a failure in the measures

                      aimed at guaranteeing transparency, respect for consent, and

                      deletion and opposition of data, including in entities

                      distinct within the defendant's network, in contradiction with the

                      GDPR requirements.

           c) With regard to the DPO and the new measures taken by the defendant,


                    i. The defendant admitted that the former DPO worked part-time and
                      was in an overload situation, which prevented him from responding

                      effectively multiple letters. This situation is worrying, because the

                      DPO plays a vital role in ensuring GDPR compliance.

                      In accordance with the GDPR, the data controller must

                      provide the DPO with all the necessary means to enable him to accomplish

                      its tasks and obligations adequately in accordance with Article 38

                      of the GDPR (see points 66 to 68). The fact that the former DPO worked on time

                      partial while being overloaded highlights a failure in the implementation
                      appropriate organizational measures to ensure the

                      GDPR compliance.


                   ii. The Litigation Chamber notes that the defendant's decision

                      to hire a new full-time DPO was taken following

                      the inspection carried out by the IS (see Title II.1.1). These corrective measures taken

                      in reaction to the IS investigation (see Title II.1.1), highlight a
                      breach of the principle of liability arising from article 5.2 juncto

                      24 of the GDPR. Such measures should have been put in place

                      prior to APD intervention to ensure compliance

                      continues with the GDPR.


                   iii. Despite the communication problems of the former DPO, the lack of
                      response to requests from the SP and the investigation carried out by the SI (see Title II.1.1),

                      the defendant did not adopt a more cautious approach by taking

                      adequate measures to improve its processes and ensure compliance

                      to the GDPR, both for past and future requests from individuals

                      concerned. For example, it would have been wise to ask the new DPO,

                      engaged since July 11, 2023 and assisted by two administrators,

                      consult all the emails still present in the mailbox «



24See also points 64 to 70. Decision on merits 87/2024 — 22/55


                   privacy@Y.be” in order to process unresolved requests. To hide behind

                   behind an alleged ignorance of the content of the emails

                   precedentand lay the responsibility on the formerDPWe do not exonerate it in any way

                   responsibility of the defendant, especially since it was, according to the
                   declarations of the defendant, the subject of an investigation by the SI and was immediately

                   aware of the problems of the former DPO. Although the defendant

                   has taken certain measures to remedy the situation, in particular by

                   hiring a new full-time DPO and strengthening the team, these

                   measures remain insufficient in the eyes of the Litigation Chamber.

                   The defendant, by virtue of the principle of liability, should have taken into account
                   given the contentious context and the need to respect the provisions of the

                   GDPR, take proactive measures to improve its processes and

                   ensure GDPR compliance.


70. Furthermore, the absence of technical or organizational measures, such as the absence of
    measures limiting the retention of data beyond what is necessary or the

    lack of knowledge of the codes used in requests for deletion of

    data or opposition, may compromise the confidentiality and security of the data

    personal data of the persons concerned. Consequently, the Litigation Chamber attracts

    the defendant's attention to the imperative of respecting the principle of security and

    confidentiality set out in Article 5.1.f) of the GDPR, in conjunction with Article 32 of the GDPR.
    Finally, the Litigation Chamber strongly encourages the defendant to continue its

    efforts in implementing measures to effectively support the function of the DPO.


71. In view of the above, the Litigation Chamber concludes that the defendant does not

    complied with articles 5.2 and 24 of the GDPR.


    II.2.4. Alleged violation of Article 31 of the GDPR (cooperation with the data protection authority
        control)


        II.2.4.1.  Position of the defendant


72. During the hearing, the defendant raised several arguments:


        a) The problems with the APD began under the management of the former DPO. Neither the DPO

            nor management were informed of the APD requests (see Title II.2.3)

        b) The current DPO discovered the correspondence from the Litigation Chamber

            only two weeks before the hearing, and only the former DPO was informed of the

            ODA correspondence.                                                                       Decision on merits 87/2024 — 23/55


            c) The defendant clarified that the former DPO had not transmitted internally the

                information including the invitation to conclude and the mediation emails sent

                by the SPL, thus hindering any appropriate response.


            d) The former DPO had not properly processed letters from the APD nor those from the

                complainant, and had not shared this information internally, due to his

                work overload (see Title II.2.3).

            e) Despite measures taken to limit the processing of the complainant's data,

                no contact has been made with the complainant or the APD, and the emails from the APD are

                remained unprocessed in the “privacy@Y.be” mailbox.

    73. In reaction to the minutes, the defendant specified that the former DPO had not responded to the

        APD communications due to its workload from December 2022 to March

        2023, a justification emanating from the former DPO himself, and not from the defendant. Of

        Furthermore, the former DPO would not have informed management of this work overload. This same

        argument of non-reaction was also invoked to justify the lack of response to the

        IS communications during this period.



            II.2.4.2.   Position of the ChamberContentious


    74. Article 31 of the GDPR states that the controller, the processor, and the case

        Where applicable, their representatives must cooperate with the supervisory authority, upon request.
        the latter, in the execution of its missions. This cooperation is of crucial importance

        to enable the supervisory authority to effectively carry out its functions and missions

        in the field of data protection. In this regard, it is appropriate to read article 31 of the

        GDPR in conjunction with Articles 57 and 58 of the GDPR, which define the missions and

        the investigative powers of the supervisory authority.


    75. The general duty of cooperation set out in Article 31 of the GDPR is reinforced by Article
        83.4.a) of the GDPR which qualifies this cooperation as “an obligation incumbent on the person responsible for the

        treatment and the subcontractor. ". Failure to comply with this obligation of cooperation

        furthermore constitutes a full-fledged infringement of the GDPR, as set out in Article 83 of the GDPR.

        GDPR:


        “Violations of the following provisions are subject, in accordance with paragraph 2,

        administrative fines of up to EUR 10,000,000 or, in the case of
        company, up to 2% of the total annual worldwide turnover of the preceding financial year, the

        the highest amount being retained: a) the obligations incumbent on the person responsible for

        processing and the subcontractor under Articles 8, 11, 25 to 39, 42 and 43; […]”.



25Article 57 of the GDPR defines the extended missions assigned to supervisory authorities, while Article 58 of the GDPR
specifies the broad investigative powers conferred on them under the Regulation.                                                                      Decision on merits 87/2024 — 24/55


    76. Article 83 of the GDPR also sets out the criteria used to decide on the imposition

        a fine and its amount. Significantly, the degree of cooperation

        is explicitly mentioned as one of the eleven criteria influencing the determination of

        these sanctions (art. 83.2 of the GDPR).


    77. Recital 82 of the GDPR also reinforces this obligation of cooperation by requiring

        including the keeping of records of processing activities, as well as the obligation to
        make these records available to the supervisory authority upon request. This consideration

        aims to enable the supervisory authority to verify and control the operations of

        processing, as well as to carry out its missions in accordance with Article 57 of the GDPR.


    78. The Litigation Chamber recalls that both those responsible for processing and those responsible for processing

        processors report directly to the supervisory authorities under the obligations

        to maintain and provide appropriate documents upon request, to cooperate with
        investigations and to comply with administrative injunctions. More precisely, the duty

        general cooperation 26 implies that the controller and the processor

        must :


            a) Respond to requests from the supervisory authority: When the supervisory authority,

                such as ODA, requests information, data or responses relating to

                to the processing of personal data, the controller and the subcontractor
                processing party must provide this information completely and on time.

                outsourced;


            b) Collaborate actively: The controller and the processor must

                work closely with the supervisory authority to help it carry out

                its missions, in particular by providing information on the practices of

                processing of data and taking measures to remedy possible

                GDPR violations;

            c) Comply with the instructions of the supervisory authority: If the supervisory authority gives

                specific instructions for complying with the GDPR, the controller

                processing and the subcontractor must follow them appropriately.

                It is important to note that this list is not intended to be exhaustive.


    79. In summary, the fundamental objective of this general obligation of cooperation imposed on

        each controller and processor aims to ensure effective supervision

        and scrupulous compliance with data protection rules. THE

        controllers and processors must actively cooperate and collaborate

        fully with the supervisory authority to ensure compliance with the provisions of the


26CEPD, Guidelines 07/2020 concerning the notions of controller and processor in the GDPR,
Version 2.0, Adopted on July 7, 2021, point 9. Substantive decision 87/2024 — 25/55


    GDPR and protecting the data rights of data subjects

    personal. This obligation, combined with the principle of responsibility set out in article

    5.2 of the GDPR, reinforces the role of the supervisory authority in the exercise of its powers

    with a view to effective application of the rules for the protection of personal data.

80. Failure to comply with this obligation exposes you to separate administrative fines.

    in accordance with article 83.4.a) of the GDPR. Finally, the violation of this obligation to

    cooperation can also be considered a violation of the principle of

    liability (art. 5.2 of the GDPR).

81. In this case, the Litigation Chamber notes that the SPL has taken steps

    to the defendant with a view to mediation. More specifically, the SPL addressed

    two requests dated December 7, 2022 and January 17, 2023, to which the

    defendant did not respond. Furthermore, the SPL included the complainant's request in the
    request for mediation, thus reminding the defendant of its duty to respect

    in particular the right to erasure of the complainant. However, despite these steps, the SPL

    had to notify the failure of mediation on February 20, 2023, due to the lack of reaction

    of the defendant, both at mediation and at the request of the plaintiff (see points 4 to 11).

82. Concerning the emails and letters from the SPL addressed to the defendant, the Chamber

    Litigation notes the absence of technical and organizational measures which

    would allow the defendant to have an overview of the issues related to the

    GDPR processed by the former DPO and/or to verify the correct processing of requests

    addressed to the former DPO, which highlights the negligence of the defendant (see Title II.2.3).

83. On the one hand, the Litigation Chamber notes that this negligence seems to result

    mainly from confusion due to the fact that the defendant was subject to a

    inspection carried out by the IS (see Title II.1.1), which remains secret in accordance with article

    63§3 of the LCA. In this context, the Litigation Chamber emphasizes that the defendant
    is required to cooperate with all APD services. Lack of response to a letter

    sent by one of the APD services, in this case an invitation to cooperate in mediation

    by the SPL, could be interpreted as a refusal of cooperation and potentially

    be considered a violation of Article 31 of the GDPR.

84. On the other hand, the Litigation Chamber observes that the defendant is trying to clear its

    liability by attributing negligence for not responding to SPL communications,

    of the IS, the Litigation Chamber and the complainant to his former DPO. The defendant

    maintains that she was not informed of the latter's excessive workload, which

    would have hampered its ability to respond favorably to requests for ODA and

    complainant.                                                                Decision on merits 87/2024 — 26/55


    It should be remembered that the GDPR sets out several articles establishing the obligations

    of a data controller or a subcontractor, in particular articles 5, 6, 9, 25, 32,

    33, 37 or even 38 of the GDPR. By virtue of the principle of responsibility (see Title II.2.3), the

    data controller must demonstrate compliance with the provisions of the GDPR by
    adopting appropriate technical and organizational measures to protect the

    rights and freedoms of natural persons. In the event that the data controller

    would appoint a DPO for its litigation department or use an email address

    generic like “privacy@Y.be” to respond to people’s requests

    concerned, it is our responsibility to ensure that emails are addressed to this address

    are regularly consulted and processed, even in the event of resignation of a person having
    worked in the department in question and/or the DPO, or in the event of work overload of the DPO.

    On this last point, the Litigation Chamber recalls that it is up to the person responsible for

    processing to comply with the provisions of Article 38 of the GDPR.


85. Taking into account the particular context surrounding the current inspection (see Title II.1.1) and
    the overload of work observed at the former DPO, the Litigation Chamber notes that

    the defendant did not properly verify the processing of requests addressed to

    the former DPO. Although measures were taken, such as increasing the workforce

    and the replacement of the old DPO, they did not seem fully effective, in

    particular regarding the review of all previous ODA requests, including

    including those of the complainant, which remained unanswered, as well as potentially
    other previous requests. To remedy this situation, the defendant could have

    consider taking additional measures, such as upgrading with the

    new data protection team, emphasizing the need

    to examine the contents of the aforementioned email address, with the aim of correcting

    possible breaches of the former DPO and to guarantee an adequate response to all

    the requests of the people concerned. In any case, compliance with the GDPR
    is the responsibility of the data controller, and not the skills and responsibilities of a DPO.


86. Concerning the absence of submission of conclusions, the Litigation Chamber considers that the

    defendant has the freedom to choose whether she wishes to defend herself, present her arguments

    and support its position in a formal and structured manner. In the absence of such
    approach, the Litigation Chamber could be forced to render a decision by

    default. In this case, the defendant had the opportunity to orally present its

    arguments when summoned to the hearing.


87. In view of the above, the defendant did not fully cooperate with the APD, in
    particularly with the SPL, during the mediation procedure. However, the Chamber

    Litigation was not able to determine whether this lack of response was the

    result of confusion generated by the inspection in progress (see Title II.1.1), or the result Decision on merits 87/2024 — 27/55


        a deliberate intention or gross negligence not to cooperate, which leads to

        conclude that there is no violation of Article 31 of the GDPR.



III. As for corrective measures and sanctions


    III.1. Corrective measures and sanctions


    88. Under the terms of article 100 of the LCA, the Litigation Chamber has the power to:

       1° close the complaint without further action;


       2° order the dismissal of the case;

       3° pronounce a suspension of the sentence;

       4° propose a transaction;


       5° issue warnings or reprimands;

       6° order to comply with the requests of the person concerned to exercise these rights;


       7° order that the person concerned be informed of the security problem;

       8° order the freezing, limitation or temporary or definitive ban on processing;


       9° order compliance of the processing;

       10° order the rectification, restriction or erasure of the data and the notification of

       these to the recipients of the data;

       11° order the withdrawal of the approval of certification bodies;


       12° give fines;

       13° issue administrative fines;


       14° order the suspension of cross-border data flows to another State or a
       international body;


       15° transmit the file to the public prosecutor of the King of Brussels, who informs him of the

       follow-up given to the case;

       16° decide on a case-by-case basis to publish its decisions on the website of the Authority of

       Data protection.

    89. The aforementioned article 100 specifies the list of sanctions in article 58.2 of the GDPR.


    90. As for the administrative fine which may be imposed in execution of article 83 of the

        GDPR and articles 100, 13° and 101 LCA, article 83 of the GDPR provides: Decision on the merits 87/2024 — 28/55


"1. Each supervisory authority shall ensure that administrative fines imposed in

under this article for violations of this regulation, referred to in paragraphs 4,

5 and 6 are, in each case, effective, proportionate and dissuasive;

2. Depending on the specific characteristics of each case, administrative fines are

imposed in addition to or in place of the measures referred to in Article 58(2),

points a) to h), and j). To decide whether to impose an administrative fine and to

decide the amount of the administrative fine, it is duly taken into account, in each case

of species, of the following elements:

(a) the nature, seriousness and duration of the violation, taking into account the nature, scope or

the purpose of the processing concerned, as well as the number of data subjects affected

and the level of damage they suffered;

(b) the fact that the violation was committed deliberately or negligently;


(c) any measures taken by the controller or processor to mitigate the
damage suffered by the persons concerned;


(d) the degree of responsibility of the controller or processor, taking into account

technical and organizational measures that they have implemented under the

articles 25 and 32;

(e) any relevant breach previously committed by the controller or

the subcontractor ;

(f) the degree of cooperation established with the supervisory authority with a view to remedying the violation

and to mitigate possible negative effects;


g) the categories of personal data affected by the violation;

(h) the manner in which the supervisory authority became aware of the violation, in particular whether, and

to what extent the controller or processor has notified the violation;

(i) where measures referred to in Article 58(2) have been previously ordered

against the controller or subcontractor concerned for the same purpose,

compliance with these measures;

(j) the application of codes of conduct approved pursuant to Article 40 or

certification mechanisms approved pursuant to Article 42; And


k) any other aggravating or mitigating circumstance applicable to the circumstances of
the species, such as financial benefits obtained or losses avoided, directly or

indirectly, as a result of the violation.”                                                                             Decision on merits 87/2024 — 29/55


    III.2. Violations noted


    91. The Litigation Chamber notes that there are, in this case, serious violations of the rights

         fundamentals of the persons concerned (see Title II.2). More specifically, the Chamber


         Litigation notes the violations of the following provisions of the GDPR, all attributable
                                       27
         to a single behavior of the defendant giving rise to several violations described

         below :

             a) Violation of articles 17 and 21 of the GDPR (see Titles II.1.2 and II.2.1)


                 The defendant violated Articles 17 and 21 of the GDPR by failing to respond within

                 deadlines for a request for erasure of personal data and

                 opposition to the processing of this data for direct marketing purposes, 28

                 more than a year after the complainant exercised his rights. Note that these data

                 were still present on the defendant's servers at the time of


                 hearing, including those processed for direct marketing purposes.

             b) Violation of Article 5, paragraph 1, point a) of the GDPR (see Title II.2.2)


                 The defendant did not inform the plaintiff of the measures taken in response to his

                 requests for erasure and opposition, as required by its obligations

                 information and communication set out in Article 12 of the GDPR, violating the

                 principle of transparency set out in article 5.1.a) of the GDPR. Furthermore, the pursuit

                 processing data for direct marketing purposes in the absence of a basis

                 legal, as required by GDPR, constitutes a violation of the principle of


                 lawfulness established in article 5.1.a) of the GDPR. In this case, the defendant invoked

                 consent as a legal basis. However, since this consent has

                 been removed by the complainant (by exercising his or her right of opposition and erasure),

                 the continued processing of their data for direct marketing purposes is unlawful,

                 violating the principle of lawfulness set out in Article 5.1.a) of the GDPR.


             c) Violation of articles 5.2 juncto 24 of the GDPR (see Titles II.2.3 and II.2.4)




27EDPB - Guidelines 04/2022 on the calculation of administrative fines under the GDPR (v2.1), adopted on May 24
2023 (v2.1), available on the website https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-042022-
calculation-administrative-fines-under fr.
28See points 5 and 40 of this decision.
29
  Group 29, Guidelines on transparency within the meaning of Regulation (EU) 2016/679, WP 260, points 1, 7 or 54;
These Article 29 Working Group (G29) Guidelines provide practical guidance and assistance
to the interpretation concerning the new obligation of transparency applicable to the processing of personal data
personnel under the General Data Protection Regulation (hereinafter “GDPR”). Transparency is an obligation
global within the meaning of the GDPR which applies to three central areas: 1) communication to data subjects
information relating to the fair processing of their data; 2) the way in which data controllers
communicate with data subjects about their rights under the GDPR; and 3) the way in which those responsible for
treatment facilitates the exercise by the persons concerned of their rights. These guidelines set out the general principles
relating to the exercise of the rights of the persons concerned rather than dealing with specific modalities for each of the rights

of these people under the GDPR. In other words, they provide guidance on the concepts and principles
underlying rules to be respected when exercising the rights of data subjects, rather than providing instructions
details on how to exercise each specific right in a practical manner.                                                                    Decision on merits 87/2024 — 30/55



               To the extent that the defendant did not respond within the prescribed time limits to the
               requests for erasure of personal data and opposition to processing

               of this data for direct marketing purposes, this resulted in the maintenance of the

               processing of the complainant's personal data without respecting the

               data protection principles set out in article 5.1 of the GDPR (see above). This

               failure highlights faulty management of requests from

               data subjects, in particular with regard to the right of erasure and

               opposition of the complainant. In addition, this gap in the management of requests from

               persons concerned is reinforced by the inadequacy of the measures taken by the

               defendant, such as the use of “code 43” to restrict processing

               data, deemed inadequate to respond to the initial requests of the

               complainant. This situation also highlights a lack of control over possible

               codes used to respond to requests from data subjects. By
               elsewhere, the persistence of data in the defendant's servers as well as

               the problems linked to the DPO highlight a defect in the implementation of

               technical and organizational measures necessary for compliance with the GDPR,

               thus revealing an additional gap in technical procedures and

               organizational. Consequently, the defendant violated Article 5.2 juncto 24

               of the GDPR.



    III.3. Corrective measures and sanctions imposed by the Litigation Chamber.


    92. As an independent administrative authority, the Litigation Chamber has the power

        exclusive right to determine appropriate corrective measures and sanctions

        in accordance with the relevant provisions of the GDPR and the ACL. This skill

        arises specifically from Articles 58 and 83 of the GDPR, as confirmed by the

        jurisprudence of the Court of Markets in its judgments of July 7, 2021, September 6, 2023
                                        30
        or even December 20, 2023, which clearly highlighted the extent of power
        discretion of the Litigation Chamber concerning the choice and scope of sanctions.


    93. In this perspective, the Litigation Chamber will take into consideration all the

        relevant circumstances of the case, including – within the limits set out below in

        Title III.3.2. – the reaction of the defendant dated April 5, 2024 to the sanctions

        envisaged which were communicated to him via the sanction form of March 15
             31
        2024.

        However, the Litigation Chamber recalls that the sanction form aims to

        allow the alleged perpetrator of the offense, in this case the defendant, to



30Cour des Marchés, 2021/AR/320, p. 37-47; 2020/AR/1160, p. 34; 2023/AR/817, p. 57, 61 and 62.
31Sanction form dated March 15, 2024; reaction of the respondent to the sanction form dated April 5, 2024. Decision on merits 87/2024 — 31/55


        defend against the amount of the proposed fine before its imposition and execution

        effective. The defense process provided for through the sanction form on the

        amount of the proposed fine does not open new debates on the findings already

        established by the Litigation Chamber, the latter being closed. In addition, the mail

        accompanied by the sanction form does not constitute a decision likely to

        appeal before the Market Court under article 108 of the law of December 3, 2017

        establishing the Data Protection Authority.

    94. Continuing this explanation, the Litigation Chamber invites the defendant to

        consult section “Title II.1.1” of this decision for further explanations

        detailed and recalls that it rejects the request to join the file (…) with the file

        subject to this decision. Likewise, the Litigation Chamber rejects

        the considerations set out in points 2.2.1 to 2.2.4 of the reaction to the sanction form
        submitted on April 5 by the defendant, arguing that the debates are closed; and that the

        corrective measures envisaged and pronounced are compliant in concreto. However,

        these considerations will be taken into account when calculating the fine, because the fine form

        sanction aims to allow the defendant to contest the amount of the fine

        proposed.



        III.3.1. Corrective measures


    95. In reaction to the sanction form, the defendant claims to have carried out the erasure

        data and have notified the recipients concerned, in particular the subcontractor
        German ; it also supports setting up processing operations in

        compliance with the provisions of the GDPR. Consequently, it requests the deletion of

        the warning issued. However, the Litigation Chamber reminds the defendant that

        these notifications were received on November 11, 2024 or April 5, 2024, after the closing

        debates. Consequently, the Litigation Chamber is not able to verify the

        veracity of the arguments put forward by the defendant and is forced to reject these

        arguments, the debates being closed.

    96. The Litigation Chamber adopts the following corrective measures:


            a) In accordance with article 58.2. c) of the GDPR and article 100, § 1, 6° of the LCA,

                order the defendant, due to the violation of articles 17 and 21 of the
                GDPR, to satisfy the complainant's requests for erasure and opposition, and this

                within 30 days from notification of this decision.







32Sanction form dated March 15, 2024; reaction of the respondent to the sanction form dated April 5, 2024. Decision on merits 87/2024 — 32/55


               b) In accordance with article 58.2.g) of the GDPR and article 100, §1, 10° of the ACL,


                   to order the defendant to erase the data and notify them

                   here to the recipients of the data, in accordance with article 19 of the GDPR.


               c) In accordance with article 58.2. d) of the GDPR and article 100, § 1, 9° of the LCA,

                   order the defendant, due to the violation of Article 5.1 a) as well

                   that of articles 5.2 juncto 24 of the GDPR, to put the processing operations in

                   compliance with the provisions of the GDPR.


               d) In accordance with article 58.2. a) of the GDPR and article 100, § 1, 5° of the LCA,

                   issue a warning to the defendant party, due to the violation of the

                   articles17,21,5.1. a), 5.2 juncto24 of the GDPR, aiming to improve the management of future

                   processing of requests from data subjects made under the

                   articles 15 to 22 of the GDPR.




          III.3.2. Administrative fines


     97. According to Article 83 of the GDPR, the supervisory authority has the discretionary power to impose a

          fine. This power is explained in the EDPB guidelines.                33


     98. In accordance with recital 148 of the GDPR, sanctions, including fines

          administrative measures, may be imposed in addition to or in place of measures

          appropriate in the event of a serious breach, even when it is a first

          finding of a breach. Thus, the fact that this is a first observation of a

          infringement does not prevent the Litigation Chamber from being able to impose a fine


          administrative, in accordance with article 58.2. i) GDPR. The administrative fine does not aim




33EDPB - Guidelines 04/2022 on the calculation of administrative fines under the GDPR (v2.1), points 15, 20, 69, 84,
144. See also the judgment of 7 December 2023, SCHUFA Holding C-26/22 and C-64/22, ECLI:EU:C:2023:958), conclusions
of Advocate General Pikamae in the TR case (C-768/21, EU:C:2024:291), as well as “Guidelines on the application and

setting administrative fines for the purposes of the [GDPR]” of the Article 29 Data Protection Working Group,
adopted on October 3, 2017, p.5 (hereinafter the “guidelines on the application and setting of administrative fines to
purposes of the GDPR).
34Recital 148 of the GDPR states that: “In order to strengthen the application of the rules of this regulation, sanctions,
including administrative fines, should be imposed for any violation of the Regulation, in addition to or instead of
appropriate measures imposed by supervisory authorities under this Regulation. When the offense is minor
or that the likely fine would impose a disproportionate burden on a natural person, blame may be preferred to
fine. However, it is appropriate to take into account the nature, seriousness and duration of the violation, and the intentional nature

the violation, harm reduction measures, degree of liability or relevant prior violations,
the manner in which the violation was brought to the attention of the supervisory authority, compliance with the measures taken
against the controller or subcontractor, compliance with a code of conduct and any other circumstances
aggravating or mitigating. The imposition of sanctions, including administrative fines, should be subject to
appropriate procedural guarantees in accordance with the general principles of Union law and the Charter, including a
effective remedy and due process” (emphasis added).
35CJEU, December 5, 2023, C-807/21, Deutsche Wohnen (ECLI:EU:C:2023:950), paragraph 38: “[…] the principles, prohibitions and

The obligations set out in the GDPR are aimed in particular at "data controllers" who, as highlighted in the
recital 74 of the GDPR, are responsible for any processing of personal data carried out by them or for
their account and who must therefore not only implement appropriate and effective measures, but also be in
able to demonstrate that their processing activities comply with the GDPR, which includes the effectiveness of the measures they
have taken to ensure this compliance. Where an infringement referred to in Article 83(4) to (6) of this Regulation has
been committed, this responsibility constitutes the basis for the imposition of an administrative fine on the controller
in accordance with this article 83. » Decision on the merits 87/2024 — 33/55


                                                 36
        in no way to put an end to the offenses, but above all aims to guarantee rigorous respect

        rules set out in the GDPR.


    99. The GDPR requires each supervisory authority to ensure that fines

        administrative measures imposed are effective, proportionate and dissuasive in each

        case in point (art. 83.1 of the GDPR). In addition, when determining the amount of the fine,

        the supervisory authority must take due account, for each specific case, of several

        specific elements, such as the nature, seriousness and duration of the violation, taking into account

        the nature, scope or purpose of the processing concerned, as well as the number of

        data subjects affected and the level of damage they suffered (art. 83.2. a) of the

        GDPR); as well as the intentional or negligent nature of the violation (art.83.2.b) of the GDPR)

        ; and the categories of personal data affected by the violation (art. 83.2.

        g) GDPR). Consequently, article 83.2 provides that in order to decide whether it is appropriate to impose

        an administrative fine and to decide the amount of the administrative fine, a

        authority must take into account all the factors set out in Article 83.2(a)

        to k), without exceeding the legal maximum amount set in article 83.4 to 83.6 of the
               37
        GDPR.



            III.3.2.1.  Grounds for imposing a fine


   100. The Guidelines on the application and setting of administrative fines for the purposes
                                      38
        of Regulation (EU) 2016/679 emphasize that, to ensure a harmonized approach to

        sanctions, supervisory authorities must assess the appropriateness of imposing a fine in

        based on a set of criteria specified in article 83.2 of the GDPR. These lines

        guidelines specify that administrative fines are “remedial measures”

        whose objective may be “to restore respect for the rules or to sanction a

        unlawful conduct (or both).”


   101. As the CJEU highlighted in its judgment in case C-311/18 (Facebook Ireland and

        Schrems), “the choice of the appropriate and necessary means falls to the supervisory authority”, which

        must make this choice taking into account all the circumstances of the concrete case, which

        the Litigation Chamber makes throughout its development in Title III.3 of the

        this decision.

   102. In its Deutsche Wohnen judgment, the CJEU ruled as follows:





36
  To this end, the GDPR and the LCA provide for several corrective measures, including the orders mentioned in article 100, §
37 5°, 6° and 9° of the LCA.
  In two judgments of December 5, 2023, the CJEU answers these questions by specifying the conditions allowing
national supervisory authorities to impose an administrative fine on one or more controllers: Deutsche
Wohnen, C-807/21, ECLI:EU:C:2023:950, and Nacionalinis visuomenės sveikatos centras, C-683/21, ECLI:EU:C:2023:949.
38WP29, “Guidelines Guidelines on the application and setting of administrative fines for the purposes of
Regulation (EU) 2016/679), 17/FR, WP 253, October 3, 2017 (hereinafter “WP253 Guidelines”), p.6.                                                                         Decision on merits 87/2024 — 34/55


       “The existence of a system of sanctions making it possible to impose, when circumstances

       specific to each specific case justify it, an administrative fine in application

       of article 83 of the GDPR creates, for data controllers and subcontractors, a

       incentive to comply with this regulation. Through their dissuasive effect, fines

       administrative measures contribute to strengthening the protection of individuals


       with regard to the processing of personal data and therefore constitute an element

       key to guaranteeing respect for the rights of these people, in accordance with the purpose of this

       regulation to ensure a high level of protection of such persons with regard to the
                                                          39
       processing of personal data. »


   103. In the same judgment, the CJEU notes “that Article 83 of the GDPR does not allow the imposition of

        an administrative fine for a violation referred to in paragraphs 4 to 6 thereof, without it being

        established that this violation was committed deliberately or negligently speaking responsibly

        of the processing, and that, therefore, a culpable violation constitutes a condition for the imposition
                              40
        of such a fine. »


   104. In his conclusions in the Land Hessen case, Advocate General Pikamae explains that the

        GDPR allows supervisory authorities to impose sometimes very high fines,

        constituting an effective element of their arsenal for enforcing regulations, in

        in addition to the other corrective measures provided for in Article 58.2 of the GDPR. So,

        the supervisory authority enjoys a margin of maneuver and is free to choose among these

        measures to remedy the violation noted.    41


   105. Although the Litigation Chamber was unable to note that the offenses impact

        several people concerned, she emphasizes that the negligence of the defendant

        justifies the imposition of a fine.


   106. In accordance with the obligation of Article 83.2 of the GDPR, the Litigation Chamber examined

        all the factors set out in Article 83.2, points a) to k), to justify both the fine

        that its amount. This detailed examination is presented in Title III.3.2.2 of this decision.

        For the sake of clarity and readability, the Litigation Chamber refers the defendant to this




39CJEU, 5 December 2023, C-807/21, Deutsche Wohnen (ECLI:EU:C:2023:950), paragraph 73.
40Paragraph 75 of the judgment.
41Conclusions of Advocate General Pikamäe in the Land Hessen case, C-768/21, ECLI:EU:C:2024:291. The general advocate
underlines that when a supervisory authority finds a personal data breach when examining a

complaint, it is obliged to intervene to respect the principle of legality and define appropriate corrective measures
to remedy the violation. This obligation is in accordance with article 57.1 a) of the GDPR, which tasks the authority with controlling
application of the regulations and ensuring compliance. Ignoring an established offense would be inconsistent with this mandate. He
also recalls that the supervisory authority acts in the interest of the person or entity whose rights have been infringed
(§41). To effectively deal with infringements, article 58.2 of the GDPR provides for a “catalogue of corrective measures”
which the authority must use to re-establish a situation consistent with Union law, regardless of the seriousness of the offense (§42).
The Advocate General specifies that Article 58.2 of the GDPR must be interpreted in the light of recital 129 of this regulation, according to
which “any measure[must][...]be appropriate, necessary and proportionate in order to guarantee compliance with this Regulation,
taking into account the circumstances of the case.” In other words, the power conferred on the supervisory authority to use

corrective measures is subject to the condition that the measure is “appropriate”, that is to say that it must be able to restore
a situation consistent with Union law (§45). The Advocate General also indicates that Article 58.2 of the GDPR is limited to
state that each supervisory authority “has the power” to adopt all of the corrective measures listed.                                                            Decision on merits 87/2024 — 35/55


title, specifying that the results of this examination not only justify the amount of

the fine, but also the decision to impose a fine on the defendant. Bedroom

Litigation summarizes below the reasons why it decides on the imposition

of a fine and refers the defendant to Titles II.2 and III.3.2.2 of this decision.

    a) Nature, seriousness and duration of the violation (art.83.2.a) of the GDPR): The case subject to the

        Litigation Chamber concerns a prolonged violation of the provisions

        essential elements of the GDPR, affecting the fundamental rights of the complainant in matters

        data protection.

            i. The request for erasure and opposition was still not respected

               more than a year after the exercise of the rights by the complainant, thus violating the

               articles 17 and 21 of the GDPR.

            ii. The lack of response to these requests led the defendant to process the

               data of the complainant to send promotional emails during

               a period of at least six months.

           iii. Despite the absence of conclusions filed by the defendant, the Chamber

               Contentieuse summoned the latter to a hearing where she confirmed

               Her presence. The defendant was informed of the matter and could not

               ignore the complainant's requests recalled by the invitation to the hearing

               sent by the Litigation Chamber. Upon receipt of this summons,
               the defendant should have been proactive in consulting her

               email containing all exchanges, check the status of requests and

               respond.The Litigation Chamber recalls that the defendant indicated

               during the hearing that she had access to the electronic mailbox of the former DPO,

               managed since then by the new DPO, and that she held all the emails

               sent by ODA. However, today at the hearing, the defendant still had not
               did not respond to the complainant's requests and even questioned the

               need to respond to it, ultimately promising to do so as soon as possible.

               promptly. This approach is interpreted by the Litigation Chamber

               as a demonstration of flagrant negligence, in violation of the

               articles 17 and 21 of the GDPR. The defendant had, thanks to this

               summons, an additional period to respond to requests from the
               complainant, and attempt to demonstrate, even belatedly, compliance with the

               provisions of the GDPR.


    b) Negligence or intentional nature of the violation (art. 83.2. b) of the GDPR):

        Several elements demonstrate manifest negligence on the part of the
        defendant in the management of requests from data subjects. This

        negligence is aggravated by prolonged non-compliance with erasure requests Substantive decision 87/2024 — 36/55


    and opposition of the complainant, the inappropriate use of “code 43” to limit the

    processing of data and the prolonged maintenance of processing of data of the

    complainant for direct marketing purposes, even after their erasure requests

    and opposition. During the hearing, the defendant had still not taken any
    appropriate measures to remedy the situation, indicating the seriousness and

    persistence of the violation. This manifest negligence results from procedures

    inadequate internal systems and ignorance of GDPR obligations, particularly in

    blaming his former DPO.

c) Degree of responsibility of the defendant taking into account the measures

    technical and organizational measures implemented in accordance with Articles 25

    (art. 83.2. d) of the GDPR): The defendant is entirely responsible for the

    management of requests from data subjects, including requests

    erasure and opposition of the complainant.

         i. The defendant places responsibility on the former DPO, which does not justify

            under no circumstances prolonged non-compliance with an erasure request and

            opposition, nor non-compliance with the provisions of the GDPR in a more

            general. This attitude raises serious questions about the management

            responsibilities and internal governance of the defendant.

        ii. The Litigation Chamber recalls that a data controller cannot

            can evade its obligations by invoking the responsibility of the DPO

            to justify breaches of the GDPR. Even if the House
            Litigation had to follow the defendant's argument, it

            recalls that the defendant had been alerted of the situation on two occasions

            : on the one hand, by being the subject of an investigation by the IS (as part of a

            other file), and on the other hand, by the invitation to the hearing sent by the

            Litigation Chamber. In such a context, continuing to claim that the

            DPO is responsible raises serious doubts about the management by the

            defending its obligations under the GDPR and calls into question its
            ability to meet these obligations.


        iii. By using “code 43”, the defendant demonstrated a lack of

            mastery of its own codes and nomenclatures, which led to
            limitation of processing instead of responding adequately to requests

            erasure and opposition of the complainant. Such a lack of control is

            concerning. Furthermore, the defendant was unable to determine the existing link

            between it and the German subcontractor before concluding that there was a

            subcontracting contract. This confusion over the role of the subcontractor and

            inability to determine whether data has been erased raises merits Decision 87/2024 — 37/55



                        doubts about the management of future requests from data subjects and

                        compliance with articles 15 to 22 of the GDPR.

            d) Other aggravating and mitigating circumstances (art. 83.2. k) of the GDPR):

                time of the hearing, the defendant had still not responded to the

                requests from the complainant, despite the obligation to respond within one month.


        For the remainder, in particular the categories of personal data concerned

        by the violation (art. 83.2. g) of the GDPR) or the measures taken to mitigate the damage suffered
        by the complainant (art. 83.2. c) of the GDPR), the Litigation Chamber refers the defendant

        in Titles II.2 and III.3.2.2 of this decision, as well as the summary in section

        III.3.2.2.7. All the factors set out in Article 83.2, points a) to k), were examined there,

        and it appears that the result of this examination ultimately applies, in the present case, to

        justify the imposition of the fine as well as its amount.


   107. The defendant thus adopted behavior giving rise to several violations of the

        provisions of the GDPR (art. 83.3 of the GDPR), these violations being precisely identified in
                               42
        Article 83.5 of the GDPR: Non-compliance with requests for a significant period

        erasure and opposition of the complainant, leading to continued processing of his

        personal data for direct marketing purposes, even after its requests

        erasure and opposition; and highlighting the absence of guarantees allowing

        to ensure compliance with the fundamental principles of the GDPR.

   108. These elements fully justify the imposition of an administrative fine to guarantee

        respect for the rights of the people concerned and strengthen the dissuasive effect of sanctions

        provided for by the GDPR.



            III.3.2.2.  Starting amount of calculation


   109. To determine the amount of the fine in the case submitted to it, the Chamber

        Litigation recalls that it takes into account the EDPB guidelines on the calculation of
                                  43
        administrative fines.

   110. In order to impose an effective, proportionate and dissuasive fine in all circumstances

        cause, the supervisory authorities, of which the Litigation Chamber is a part, are supposed to

        adjust administrative fines while remaining within the range provided for in the

        EDPB guidelines up to the legal maximum amount. This can lead to

        significant increases or reductions in the fine, depending on the circumstances of the case

        of species.




42CJEU, Judgment of December 5, 2023, Deutsche Wohnen, C-807/21, ECLI:EU:C:2023:950, points 61 to 79.
43EDPB - Guidelines 04/2022 on the calculation of administrative fines under the GDPR (v2.1), adopted on May 24
2023 (v2.1), in particular points 49 and 50. Decision on the merits 87/2024 — 38/55


             III.3.2.2.1.    Classification of violations under Article 83.4 and 83.5 of the
                 GDPR


111. The GDPR distinguishes two categories of violations: those punishable according to article 83.4 of the

     GDPR, on the one hand, and those punishable under Article 83.5 and 83.6 of the GDPR, on the other

     go. The first category of violations carries a maximum fine of 10 million

     EUR or 2% of the company's annual turnover, whichever is higher.

     retained. As for the second category, it can give rise to a maximum fine of 20
     million EUR or 4% of the company’s annual turnover, the highest amount

     also being retained.


112. In this case and based on the violations set out in Title III.2 of this decision,
     the Litigation Chamber notes that the highest fine applies in accordance with

     in article 83.5 of the GDPR. Indeed, in the event of violation of the basic principles of processing

     under article 5 of the GDPR as well as the rights of the persons concerned in accordance with

     Articles 17 and 21 of the GDPR, the Litigation Chamber may impose a fine

     administrative tax of up to EUR 20,000,000 or, in the case of a company, up to 4%

     of its total global annual turnover for the previous financial year, the highest amount
     high being retained, as provided for in the provisions of section 83.5. a) and b) of the GDPR.



             III.3.2.2.2.    Seriousness of the violation in the present case


113. Nature, seriousness and duration of the violation (art. 83.2.a) of the GDPR) – The case subject to the

     Litigation Chamber concerns a prolonged violation of the essential provisions of the

     GDPR, which aim to protect the fundamental rights of individuals with regard to
     concerns the processing of their personal data. The GDPR establishes a solid framework for

     responsibility for data controllers, in particular in Chapter III, which is

     dedicated to the rights of data subjects. These rights, set out in articles 15 to 22,

     give individuals direct control over their personal data, ensuring

     thus effective protection of their privacy. Thus, violations of articles 17 and 21 of the

     GDPR are particularly serious because they infringe fundamental rights

     of individuals regarding the protection of personal data.

114. Despite the rights exercised by the complainant, who expressly requested the deletion of

     his personal data and objected to the processing for direct marketing purposes, the

     defendant did not respond to these requests for more than a year, lacking this
     manner to its obligations established by the GDPR. This behavior resulted in the maintenance

     the processing of the complainant's data for direct marketing purposes, whether via

     telephone calls or sending advertising emails, over a period of six to ten

     months, even after his requests for erasure and opposition, thus violating the principles

     set out in article 5.1.a) of the GDPR.                                                                 Decision on merits 87/2024 — 39/55


115. In reaction to the sanction form and therefore after the closure of the debates, the defendant

     underlines that the complainant did not “explicitly mention Article 21 of the GDPR in his

     request ". On this point, the Litigation Chamber, on the one hand, refers the defendant to

     paragraph 34 of its present decision, and on the other hand, adds that it would be excessive to
     ask a concerned person to explicitly mention the articles of the GDPR because

     this could make the exercise of rights more difficult for individuals who are not

     familiar with legal terminology. The main thing is that the request is formulated

     in a clear and understandable manner, what a data controller, or his DPO, should

     be able to clarify in case of doubt, and thus treat it in accordance with the

     provisions of the GDPR.

     Next, the defendant emphasizes that after following up on the erasure request

     based on Article 17(a), (b) and (c) of the GDPR, there is no additional obligation to

     notification to the data subject of the further use of the data for purposes

     direct marketing. Unfortunately, as noted by the Litigation Chamber, the
     defendant was late in responding to the plaintiff's erasure request, which allowed

     the continuation of the processing of data for direct marketing purposes for a period

     significant, in contradiction with his request for opposition.


     Even following the defendant's reasoning, according to which the plaintiff would not have
     formulated as a request for erasure without explicit mention of Article 21 of the GDPR,

     concerning the right to object to the processing of data for prospecting purposes, the

     Chambre Litigation underlines that the right of erasure has been ignored for more than a

     year, thus resulting in a continued violation of the complainant's rights. This finding is crucial, because

     even in the absence of an explicit mention of Article 21, the processing of data for

     prospecting purposes – as for other purposes – should have been interrupted as soon as
     receipt of the erasure request. Consequently, maintaining the processing of

     data of the complainant for direct marketing purposes – even following the arguments of

     the defendant according to which this period would have only been 2 weeks (see point 118)

     – violates the rights of the complainant. For the remainder, the Litigation Chamber returns the

     defendant in paragraph 36 of its decision.

116. The Litigation Chamber emphasizes that direct marketing is crucial for the activities

     of the defendant, which sells its products nationally. The treatment

     data for direct marketing purposes therefore represents an essential component

     of its commercial model, directly affecting its customer relations and therefore its turnover

     business. Failure to respect the rights enshrined in the GDPR, such as the rights
     erasure and opposition, can lead to harmful consequences for life

     privacy of the persons concerned. This results in exposure to advertisements Decision on merits 87/2024 — 40/55


        targeted and intrusive, as well as by disruptions in their daily lives caused by

        unsolicited telephone calls or emails.


   117. It appears from the hearing that the use of incorrect codes was systematic and does not appear

        be limited to the complainant. However, the number of people whose data would have been
        processed in violation of the aforementioned provisions (see Title II.2) remains unknown. By

        Consequently, the Litigation Chamber cannot determine the exact number of people

        concerned, which could have confirmed the systemic nature of the violations

        mentioned above and increase their severity. Thus, the Litigation Chamber is limited to

        examine the case of the complainant, the only person concerned identified as being affected

        by violation of the provisions in question.

        In response to the sanction form, the defendant confirms that the violation did not affect

        only one person concerned and that they are limited to a single territory, in this case

        Belgium.


   118. Concerning the duration of the violation (see Title II, as well as paragraph 61 of this
        decision) the Litigation Chamber notes that the latter continued for a

        significant period, which increases the seriousness of the infringement.


        In reaction to the sanction form, the defendant emphasizes that the impact on the

        person concerned during this period was very limited since the complainant would not have

        received only a few advertising messages by e-mail and a limited number of attempts
        of telephone contacts, i.e. “+/- 5 during a very limited period of 2 weeks at

        more (24.11.2022 – 7.12.2022) » . The Litigation Chamber refers the defendant to

        points 8, 21, 30, 31, 33 and 42 of this decision, emphasizing that the defendant has

        made a promise to respond to the complainant's requests dated June 30, 2022

        only on November 3, 2023. This period of silence is undeniably long and does not

        does not respect the one-month time limit provided for in Article 12 of the GDPR. Finally, the Litigation Chamber

        notes that the defendant has not implemented “code 43” to delete data from the

        complainant until April 11, 2023 (see paragraph 33). This suggests that the complainant's data

        were not deleted but remained accessible and were processed, even
        limited manner, at least until April 2023, and not until December 2022 (see points

        32, 33, 40, 43, 42). In this context, the question of the duration of the violation remains

        factually objective, allowing the Litigation Chamber to conclude that the period

        infringement is significant.


   119. Negligence or intentional nature of the violation (art. 83.2.b) of the GDPR) – Several
        elements testify to manifest negligence on the part of the defendant in the

        management of requests from the people concerned. On the one hand, the prolonged non-compliance with



44Reaction of the defendant to the sanction form dated April 5, 2024, p.7.                                                                  Decision on merits 87/2024 — 41/55


     requests for erasure and opposition by the complainant, in particular by not responding

     within the prescribed deadlines; as well as the inappropriate use of “code 43” which resulted in

     a limitation of processing, not only reveal the unsuitable nature of the

     internal procedures, but also ignorance of the rights set out in articles 15 to 22
     of the GDPR and the obligations incumbent on the data controller.


120. This negligence is aggravated by the prolonged continuation of the processing of the data of the

     complainant for direct marketing purposes, even after their requests for erasure and

     opposition. At the time of the hearing, the defendant had still not taken the
     appropriate measures to remedy the situation and respond to the request

     of erasure and opposition of the complainant which demonstrates the serious and persistent nature

     of the violation.


121. All of these elements illustrate serious negligence in the management of requests from
     complainant, indicating that the violation of articles 17, 21, 5.1.a) and 5.2 juncto 24 of the GDPR

     actually arises from negligence on the part of the defendant.


122. In reaction to the sanction form, the defendant emphasizes that she was not
     negligent because she trusted her DPO, who did not inform her of her problems

     resources. Furthermore, given that only the DPO had access to the mailbox and that the

     defendant was not the recipient of the initial correspondence sent by mail

     electronic to the former DPO, she considers that she cannot be accused of negligence.

     However, the Litigation Chamber reminds the defendant that she received a letter

     recommended dated January 17, 2023 (see point 9). Then, the Litigation Chamber
     refers the defendant to points 54 to 57 of this decision before adding that,

     in accordance with article 38.b) of the GDPR which states that “The data protection delegate

     data reports directly to the highest level of manager management

     treatment or subcontractor", the defendant could have identified the problem(s) and the

     resolve rather than placing blind trust in the DPO. Consequently, the

     Litigation Chamber cannot agree with the arguments put forward by the defendant for

     the aforementioned reasons (Title II.I.3, in particular points 55 and 57.c) of this
     decision). The Litigation Chamber confirms that serious negligence in the management of

     claims of the complainant are established, which indicates that the violation of articles 17, 21, 5.1.a)

     and 5.2 juncto 24 of the GDPR does indeed arise from the negligence of the defendant.

123. Categories of personal data affected by the violation (article 83,

     paragraph 2 (g) GDPR) – The data in question concerns contact details

     of the complainant, including his or her last name, first name, postal address, telephone number and

     email address. Although this information is not considered “data

     sensitive” within the meaning of article 9 of the GDPR, they make it possible to identify or contact a

     specific person.                                                                       Decision on merits 87/2024 — 42/55



   124. Classification of the seriousness of the violation and setting the appropriate starting amount –
        The assessment of the above elements – namely the nature, seriousness and duration of the violation,

        as well as the deliberate or negligent nature of the violation and the categories of data to be

        personal nature concerned – helps determine the degree of seriousness of the violation

        in its entirety. According to this assessment, the seriousness of the violation can be described as “

        low”, “medium” or “high”.


            a) For violations of low severity, when calculating the administrative fine,

                the supervisory authority sets a starting amount for the subsequent calculation including

                between 0 and 10% of the applicable legal maximum amount.

            b) For violations of medium severity, when calculating the administrative fine,

                the supervisory authority sets a starting amount for the subsequent calculation including

                between 10 and 20% of the applicable legal maximum amount.

            c) For violations of high severity, when calculating the administrative fine,

                the supervisory authority sets a starting amount for the subsequent calculation including

                between 20 and 100% of the applicable legal maximum amount.


   125. In this case, the seriousness of the violation is considered “medium”, for the

        reasons summarized below: the complainant's rights of erasure and opposition do not have

        been respected; the principle set out in article 5.1.a) of the GDPR was not respected; the violation
                                                                                          46
        has lasted for a prolonged period of at least one year; several elements reveal

        manifest negligence on the part of the defendant, which aggravates the seriousness of
        the offense; although the data in question is not considered sensitive,

        they constitute identification or contact information.


   126. In this context, it is difficult to maintain that the degree of the violation is “low”, but

        rather that it is “medium” or “strong”. It should also be taken into account that

        that only one person is affected by this violation. This circumstance allows the

        Chamber Contentious to deduce that the violation is of “medium” seriousness.

   127. In response to the sanction form, the defendant requests that the violations be

        reclassified as “low” rather than “medium”. Furthermore, it underlines that the former DPO

        took measures and communicated with the APD in April 2023: apparently, the former DPO

        was wrongly convinced that her communication in the context of the inspection she was carrying out

        the subject (see Title II.1.1) would be inserted in the file currently processed by the Chamber

        Contentious. The Litigation Chamber cannot accept the argument according to which a

        response to the SI could be interpreted as a response to requests made in

        under Articles 15 to 22 of the GDPR, as prescribed by Article 12 of the GDPR, which mentions



45EDPB - Guidelines 04/2022 on the calculation of administrative fines under the GDPR (v2.0, May 24, 2023), fn. 60.
46See in particular Title III.3.2.2.2 of this decision.                                                                       Decision on merits 87/2024 — 43/55


        a direct response to the people concerned. Otherwise, a violation

        could be repaired while waiting for a supervisory authority to be informed of a potential

        violation by complaint or on its own initiative. This conclusion is not only

        erroneous in law but would void the exercise of rights by the persons concerned of their

        substance. In this context, it is difficult for the Litigation Chamber to qualify the

        violation of “low”, thus once again confirming the “medium” character of the

        breach.

   128. Consequently, the Litigation Chamber should apply, for violations arising

        of the unique behavior of the defendant (falling under article 83.5 of the GDPR, with a

        medium severity), a theoretical starting amount for the subsequent calculation of the fine

        administrative costs of between €2,000,000 and €4,000,000.


   129. Taking into account the circumstances assessed in light of Article 83.2 a), b) and g) of the GDPR,
        the Litigation Chamber decides to consider a theoretical starting amount of

        2,000,000 EUR.



                III.3.2.2.3.    Turnover of the controller and considerations
                    additional factors taken into account by the Litigation Chamber for

                    determine the amount of the fine


   130. The GDPR requires each supervisory authority to ensure that fines

        administrative measures imposed are effective, proportionate and dissuasive in each
        case in point (art. 83.1 of the GDPR).


   131. To achieve this, supervisory authorities should apply the definition of the concept

        as adopted by the Court of Justice of the European Union (hereinafter “CJEU

        ") for the purposes of Articles 101 and 102 of the TFEU, namely that the concept of enterprise means

        as an economic unit which can be constituted by the parent company and all

        subsidiaries concerned. In accordance with EU law and case law, a company must
        therefore be considered as an economic unit carrying out activities

        commercial/economic, whatever its legal form 47. The objective is to ensure

        that the sanctions are adapted to the size and economic power of the company


   132. Supervisory authorities are expected to adjust administrative fines based on

        the seriousness of the violation, while respecting the range provided in the guidelines





47Recital 150 of the GDPR; WP Guidelines 253, pp. 6-7. The case law of the CJEU gives the following definition: “the
concept of enterprise covers any entity carrying out an economic activity, regardless of its legal status and its
method of financing" (case C-41/90, Höfneret Elser/Macrotron, ECLI:EU:C:1991:161, point 21). The notion of business" must
be understood as designating an economic unit, even if this economic unit is constituted, from a point of view
legal, by different natural or legal persons" (case C-217/05, Confederación Española de Empresarios de
Estaciones de Servicio, ECLI:EU:C:2006:784, paragraph 40). ; CJEU, September 10, 2009, C-97/08 P, Akzo Nobel nv et al. t.
Commission, ECLI:EU:C:2009:536), points 60-61.                                                                      Decision on merits 87/2024 — 44/55



        of the EDPB up to the legal maximum amount. This may lead to surcharges or

        significant reductions in the fine, depending on the circumstances of the specific case

   133. In addition, Articles 83.4, 83.5 and 83.6 of the GDPR provide that the annual turnover

        global total for the previous financial year must be used to calculate the fine

        administrative. In this regard, the term “precedent” must be interpreted in accordance with the

        jurisprudence of the CJEU in matters of competition law, so that the event

        relevant for the calculation of the fine is the decision of the supervisory authority relating to

        the fine, and not the time of the sanctioned offense.48


   134. Consequently, as an extension of the above, the Litigation Chamber

        considers that it can be based on the consolidated turnover figures for the 2023 financial year of the

        defendant is more than 50,000,000 EUR 49to determine the amount of the fine

        administrative burden that it intends to impose on the defendant. The Litigation Chamber

        hereby refers to the annual accounts of the defendant (company Y) as

        deposited with the National Bank of Belgium (BNB) on September 25, 2023, making

        appear a turnover of more than 50,000,000 EUR for the financial year 2023.


   135. Taking into account the minimum and maximum amounts per level set in the directives,

        on the one hand, and the annual turnover of the controller, on the other hand, the

        Litigation Chamber decides concretely to lower the final starting amount for the

        category of offenses (falling under article 83.5 of the GDPR, with a degree of seriousness

        average) to a starting amount adjusted to 245,000 EUR.


                III.3.2.2.4.    Aggravating and mitigating circumstances


                                              50
   136. Taking into account article 83 of the GDPR, the Litigation Chamber must also provide reasons

        the imposition of an administrative fine and its amount in concrete terms, taking into account

        take into account other aggravating or mitigating circumstances listed in article 83.2 of the
        GDPR:


            a) Measures taken to mitigate the damage suffered by the complainant (art. 83.2.c) of the

                GDPR)


                     i. With regard to the measures taken to mitigate the damage suffered by

                        the complainant, the Litigation Chamber recognizes the efforts undertaken by the

                        defendant to remedy the problems encountered with the former DPO,

                        in particular by reacting to its inaction or incompetence. This happened

                        materialized by the establishment of a new team dedicated to the management



48EDPB - Guidelines 04/2022 on the calculation of administrative fines under the GDPR (v2.0, May 24, 2023),
paragraph 131.
49Annual account for the 2023 financial year available on the website: https://consult.cbso.nbb.be/consult-enterprise.
50Cour des Marchés 2020/1471 of February 19, 2020. Decision on the merits 87/2024 — 45/55



                       requests from the people concerned but also to any questions
                       relating to data protection. The objective of this initiative is to

                       strengthen the responsiveness of the defendant in matters of protection of

                       data and guarantee its compliance with the GDPR.


                    ii. However, it should be noted that the Litigation Chamber emphasizes that the

                       defendant had an annual turnover of more than
                                                                51
                       50,000,000 EUR for the financial year 2023, which illustrates that it had the

                       financial means necessary to establish and set up a team

                       dedicated to managing requests from data subjects as well as
                       any questions relating to data protection, consisting of more

                       of somebody. Likewise, these financial resources could have

                       allow a quicker reaction to the incompetence of one's former

                       DPO.


                   iii. In addition, the Litigation Chamber takes into consideration the commitment

                       taken by the defendant during the hearing, where they undertook to regularize

                       the situation in accordance with Article 17 of the GDPR and to inform the complainant

                       the erasure of its data. The Litigation Chamber emphasizes that
                       this commitment only covered part of the complainant's requests (for

                       recall, a request for erasure and opposition), which gives rise to

                       concerns about the defendant's total commitment to respect

                       fully the rights of the persons concerned.


                   iv. Although steps have been taken to remedy the problems

                       previous agreements with the former DPO and to regularize the situation, there are still

                       gaps in the defendant's response to the plaintiff's requests.

            b) Degree of responsibility of the defendant taking into account the measures

               technical and organizational measures implemented in accordance with Articles 25

               (art. 83.2.d) of the GDPR)


                    i. The Litigation Chamber, assessing the level of responsibility of the
                       defendant, notes that it is entirely responsible for the management

                       requests from data subjects, including requests

                       erasure and opposition of the complainant.






5The annual accounts of company Y, filed with the National Bank of Belgium (BNB), reveal a turnover
increasing: ([.. EUR] EUR on February 29, 2020, [.. EUR] on February 28, 2021 [.. EUR] on February 28, 2022. With a turnover
always exceeded 50 million euros over this period, it is obvious that the defendant had the resources
financial necessary to set up a team or department (including several employees and/or DPO)
dedicated to managing requests from data subjects and data protection issues. ; Account
annual available on the site: https://consult.cbso.nbb.be/consult-enterprise.                                                                Decision on merits 87/2024 — 46/55


                 ii. This responsibility encompasses various aspects, including the effectiveness of

                    execution of requests, definition of specific codes for

                    respond appropriately to requests made under the

                    articles 15 to 22 of the GDPR, as well as the understanding and implementation
                    clear and effective procedures by all staff,

                    directors to internal staff.


                iii. The defendant, by using “code 43”, demonstrated a lack of

                    mastery of its own codes and nomenclatures, which resulted in a
                    limitation of processing instead of responding adequately to requests

                    erasure and opposition of the complainant. Furthermore, the fact of not

                    respond to the complainant's requests for more than a year after the exercise

                    of his rights demonstrates an excessively long waiting period for

                    process the requests, but above all, this leads the defendant to process

                    data in contradiction with the fundamental principles of the GDPR
                    set out in Article 5 of the GDPR.


        c) Other aggravating and mitigating circumstances (art. 83.2.k) of the GDPR)

                 i. Regarding the aggravating circumstances, the Chamber

                    Litigation notes that at the time of the hearing, the defendant had not

                    still not responded to the complainant's requests, despite his

                    aware of the obligation to respond within one month to all

                    requests made under articles 15 to 22 of the GDPR,
                    in accordance with Article 12 of the GDPR and the principles of transparency and

                    of loyalty set out in article 5.1.a. of the GDPR. Furthermore, the Chamber

                    Litigation emphasizes that the defendant undertook only to

                    regularize the situation in accordance with article 17 of the GDPR, without

                    mention article 21 of the GDPR, which concerns the right to object to

                    processing of personal data. This omission raises

                    concerns about the defendant's commitment to respect
                    fully the rights of the data subjects, as provided for in the

                    GDPR.


137. The assessment of the elements listed in Article 83.2 of the GDPR – namely the measures
     taken to mitigate the damage suffered by the complainant; the degree of responsibility and all

     other aggravating and mitigating circumstances – are neither likely to increase or

     reduce the amount of the administrative fine.                                                                         Decision on merits 87/2024 — 47/55


                 III.3.2.2.5.    Effective, proportionate and dissuasive


   138. The EDPB guidelines recall that the administrative fine for violations

        of the GDPR referred to in Articles 83.4 to 83.6 must be effective, proportionate and dissuasive in


        each specific case. The supervisory authorities must verify whether the amount meets these

        criteria and adjust if necessary.

   139. Effectiveness – A fine is deemed effective if it achieves the objectives for

        on which it was imposed, such as restoring respect for the rules, sanctioning

                                              52
        illicit behavior or both. In this case, the fine acts as an essential tool

        to restore compliance with GDPR rules, by sanctioning negligent behavior

        and serious of the defendant. Additionally, it aims to deter other violations similar to
                53
        the future . The prolonged violation of the complainant's fundamental rights, despite his

        requests for erasure and opposition, demonstrates the need for a firm response from the

        from the Litigation Chamber. Thus, a fine of 245,000 EUR constitutes a

        effective measure to achieve these objectives, while taking into account the seriousness of the

        breach.


   140. Proportionality – The principle of proportionality, as defined in the GDPR, states that

        the measures adopted must not exceed what is appropriate and necessary to

        achieve the legitimate objectives of the regulation in question. In the case of fines,

        this means that their amount must not be disproportionate to the intended goals, 54

        the seriousness of the violation, as well as the size and financial capacity of the company

        concerned. Therefore, supervisory authorities must ensure that the

        amount of the fine is proportionate to the violation, assessed as a whole, in

        taking into account various factors such as the financial capacity of the company to pay.


   141. In certain exceptional circumstances, a reduction in the fine may be

        considered if its imposition would irremediably endanger the viability

        economics of the company concerned. This possibility is possible when

        objective evidence demonstrates an inability to pay. Furthermore, it is essential

        analyze risks by considering the specific social and economic context.


   142. In the present case, several criteria, such as the financial capacity of the defendant

        and the economic and social context in which it operates, indicate that the fine

        proposed is proportionate 56:





52WP 253 Guidelines, p. 6.
53See the development concerning the “dissuasive nature” of this decision, starting from paragraph 145.
54Case T-704/14, MarineHarvest v Commission, paragraph 580, referring to Case T-332/09, Electrabel v Commission, paragraph 279.
55See, to this effect, Case C-387/97, Commission v Greece, paragraph 90, and Case C-278/01, Commission v Spain, paragraph 41, in

which the fine had to be “on the one hand, adapted to the circumstances and, on the other hand, proportionate to the breach
56nstated as well as the payment capacity of the Member State concerned.
  EDPB - Guidelines 04/2022 on the calculation of administrative fines under the GDPR (v2.1), point 140. Substantive decision 87/2024 — 48/55


            a) Economic viability and financial capacity of the company: With a figure

               consolidated annual business of more than 50,000,000 EUR for the financial year 2023, la7

               defendant has sufficient financial capacity to support

               the proposed fine without compromising its economic viability. Therefore,

               a fine of 245,000 EUR remains proportionate to this capacity

               financial.  This measure therefore remains sufficiently dissuasive without

               compromise the economic integrity of the company.

            b) Proof of loss of value: No indication suggests that the imposition

               of the fine would endanger the viability of the company, leading to a loss

               significant to the value of its assets or threatening its ability to continue its

               activities in a viable manner. There must be a direct link between the fine and this loss

               of value, and it is not automatically accepted that bankruptcy or insolvency

               lead to such a loss. In the absence of such tangible evidence demonstrating

               this correlation, a reduction in the fine may not be justified.

            c) Economic and social context: The defendant operates in the sector of

               products “..” in Belgium. In addition, the defendant distributes its products through

               the whole country, which suggests that it is not solely dependent on the situation

               local economy. This national presence also reduces its dependence on

               respect for the local workforce. Therefore, it is unlikely that the

               payment of the fine has a significant impact on the economy or social fabric,

               given that the defendant operates on a national scale and is not

               entirely linked to a specific region.

   143. In response to the sanction form, the defendant requests a reduction in the amount

        of the fine due to the exceptional circumstances she encountered during

        of the last five years, attributable to external factors over which it had no control

        control. These conditions affected its turnover, costs and profitability.

   144. The defendant then presents its financial development from 2019 to 2022, marked by a

        negative growth in turnover and losses in 2019, an increase in 2020

        despite increasing costs, reduced turnover and losses in 2021, and

        further deterioration in 2022 due to the economic crisis, leading to a

        further reduction in turnover and financial losses. For the current financial year

        2023-2024, the defendant still anticipates a significant financial loss, with

        prospects of a difficult financial recovery until 2026-2027. Faced with this


57As a reminder, the annual accounts of company Y, filed with the National Bank of Belgium (BNB), reveal a
turnover increasing: [.. EUR] on February 29, 2020, [.. EUR] on February 28, 2021 and [.. EUR] on February 28, 2022. With a
turnover always greater than 50 million euros over this period, it is obvious that the defendant had the
financial resources necessary to set up a team or department (including several employees
and/or DPO) dedicated to managing requests from data subjects and data protection issues. ;
Annual account available on the website: https://consult.cbso.nbb.be/consult-enterprise.                                                                      Decision on merits 87/2024 — 49/55


        difficult financial situation, a fine of 245,000 EUR would have consequences

        devastating for the defendant. This would compromise the implementation of the measures

        reorganization necessary to guarantee its future viability, putting jobs at risk

        of 400 people and even risking leading to the cessation of activities in Belgium.


   145. Taking into account all these circumstances, the Litigation Chamber agrees that a

        reduction in the amount of the fine appears appropriate to support the defendant and
        prevent endangering the jobs of 400 people as well as the continuity of

        activities in Belgium.


   146. To reach this conclusion, it seems relevant for the Litigation Chamber to

        take into account two essential elements: on the one hand, the use of the contribution of

        shareholders; on the other hand, the evaluation of cumulative losses over a period of three years

        (2023-2024, 2024-2025, 2025-2026) to reduce the amount of the initial fine. This
        approach aims to adequately consider the real financial capacity of the

        defendant to bear this administrative sanction.


   147. The Litigation Chamber notes that the shareholders injected a cash contribution of

        more than 3,000,000 EUR, a sum established taking into account past losses,

        present and future, as well as other financial commitments to which the defendant
                                                                                                 58
        will have to respond, with the aim of ensuring the financial recovery planned for 2026-2027.
        Furthermore, the Litigation Chamber emphasizes that the defendant seems to have anticipated the

        risk of a possible fine, as indicated by the Statutory Auditor in the

        following terms: “we draw attention to note VOL - inb 6. 19 of the financial statements

        (“risks”) which describes the uncertainty associated with the resolution of the GBA investigation. The result of

        This investigation could have a significant impact on the financial situation of the company. ".


   148. Next, the Litigation Chamber considers it relevant to assess the cumulative losses over a

        period of three years (2023-2024, 2024-2025, 2025-2026) since the shareholders have
        paid a cash contribution of more than 3,000,000 EUR based on planning

        multiannual strategy presented in October 2023 (see paragraph 147), aimed at guaranteeing

        financial recovery planned for 2026-2027. It is important to note that losses

        projected for the years 2024-2025 and 2025-2026 are hypothetical, and that the year

        2024-2025 saw the highest loss since 2019 (…EUR).


   149. In this context, the Litigation Chamber, as previously mentioned in its
        paragraph 145, considers it appropriate to reduce the amount of the fine by applying the

        remaining percentage of the more than 3,000,000 EUR contributed by the shareholders, after having

        excluded cumulative losses over a period of three years in relation to this contribution, periods



5The defendant mentions in its email of April 5, 2024 that a multi-year strategic plan was presented
to shareholders in October 2023, resulting in a cash contribution of more than EUR3,000,000 from shareholders
in February 2024. ; page 5 of the email sent by their Council in reaction to the sanction form.                                                                 Decision on merits 87/2024 — 50/55


     for the most part hypothetical. This approach aims to align the reduction of the initial fine

     with the financial situation of the defendant. Thus, the Litigation Chamber considers

     have correctly assessed the financial impact of the fine in relation to the funds provided

     by the shareholders, and considers that the reduction of at least 30% of the initial fine
     takes into account the actual financial capacity of the defendant to bear the fine

     administrative.


150. Following the preceding reasoning, the Litigation Chamber reduces the fine by

     245,000 EUR to 172,431 EUR objectively: The loss for the year 2023-2024
     amounts to [-..EUR], while that forecast for the year 2024-2025 is [-..EUR], and that

     foreseeable for the year 2025-2026 is [-..EUR]. By adding these losses, the loss

     cumulative for the year 2023-2024 as well as those planned for the years 2024-2025 and

     2025-2026 represents a total of more than 1,000,000 EUR [(-.. EUR)] + [(-.. EUR)] + [(-.. EUR)]

     = more than 1,000,000 EUR. The contribution of shareholders to ensure viability is more than

     3,000,000 EUR The percentage of the cumulative loss over a period of three years, i.e.
     2023-2024, 2024-2025 and 2025-2026 (the last two years being hypothetical)

     compared to the shareholders' contribution amounts to +-30% [(more than 1,000,000 EUR / more than

     3,000,000EUR)*100=+-30%].After withdrawing the cumulative loss over a period of three

     years, it is established that the defendant still holds +-70% of the more than 3,000,000 EUR

     contributed by the shareholders.

151. Consequently, the Litigation Chamber decides to apply the percentage of the loss

     cumulative over a period of three years (2023-2024, 2024-2025 and 2025-2026, both

     recent years being hypothetical) as a percentage reduction to the amount

     initial amount of the fine in order to determine the new amount.

     Taking into account all specific circumstances surrounding viability

     economic and financial capacity of the defendant, this represents +- 30% of the

     245,000 EUR, a reduction of more than 70,000 EUR. Thus, the new amount of

     the fine amounts to EUR 172,431, which corresponds to a reduction of approximately 30% per

     compared to the initial amount. Furthermore, the Litigation Chamber emphasizes that the impact of this
     fine on a shareholder contribution established on forecasts until 2026-2027 (see

     point 148) is minimal, representing only 4%.


     Considering these factors, the Litigation Chamber considers that the reduction of
     the fine of 245,000 EUR to 172,431 EUR is a proportionate measure to sanction

     the violations noted in this specific case


152. Dissuasive nature – The dissuasive nature of fines is crucial to guarantee the

     compliance with the rules established by Union law, in particular in the GDPR. This character
     deterrent can manifest itself in two ways: general deterrence, which aims to

     discourage other controllers from committing the same violation in the future, Decision on merits 87/2024 — 51/55



        and specific deterrence, which aims to dissuade the data controllers concerned
        by the fine for breaking the rules again in the future. A fine must be

        sufficiently dissuasive for data controllers to fear that

        Supervisory authorities do apply fines for GDPR violations.


   153. Several factors determine the dissuasive nature of a fine: the nature and

        amount of the fine, as well as the probability of its imposition, are elements

        determining factors in this regard. A fine must be high enough to have an impact

        significant financial impact on the offending company, while remaining proportionate to the seriousness of the

        breach. In other words, the criterion of deterrence overlaps with that of effectiveness.

   154. If a supervisory authority considers that a fine is not sufficiently dissuasive, it

        may consider increasing it. In some cases, it may even apply a multiplier

        deterrence to strengthen its deterrent effect. This multiplier can be adjusted to the

        discretion of the supervisory authority to ensure that deterrence objectives are

        fully achieved.

   155. In this case, the fine of EUR 172,431 imposed on the defendant aims to deter the

        defendant to repeat the violation of the rules of the GDPR. Furthermore, she seeks

        also to deter other companies from committing similar violations. This

        fine, proportionate to the seriousness of the violation 59 and taking into account the turnover

        of the defendant, is designed to have both a specific and general deterrent effect.


   156. Considering all of these aforementioned factors, the fine of EUR 172,431
        seems to meet the dissuasive nature necessary to ensure compliance with the GDPR.



                III.3.2.2.6.    In summary


   157. Firstly, the Litigation Chamber notes that the defendant whose figure

        of business amounts to more than 50,000,000 EUR has not complied for a period

        significant of a complainant's erasure and opposition requests, resulting in a

        continuous processing of personal data for direct marketing purposes, and putting

        highlights the absence of guarantees to ensure compliance with the principles

        fundamentals of the GDPR, thus violating articles 17, 21, 5.1.a), and 5.2 juncto 24 of the GDPR.

   158. Then, after analyzing all the relevant circumstances of the case in question under

        of Article 83.2, a), b) and g) of the GDPR, the Litigation Chamber considered that the violation was

        of “medium” severity. To determine the starting amount, the violation of articles 5,

        17 and 21 of the GDPR is listed in Article 83.5, a) and b) of the GDPR, which provides that the

        maximum legal amount is 20 million EUR (20,000,000 EUR) or 4% of the figure



59See in particular Title III.3.2.2.2. of this decision.
60See in particular Title III.3.2.2.2. of this decision.                                                                      Decision on merits 87/2024 — 52/55



        total global annual sales for the previous financial year. In this case, the turnover of

        the defendant being less than EUR 500 million, the maximum amount and the range

        Fixed prices apply. Therefore, a starting amount of between 10 and 20% of the amount

        maximum applicable legal amount, i.e. between EUR 2 and 4 million, is envisaged. Since the

        violation is considered average, the Litigation Chamber decides that the amount

        The starting price set according to the seriousness of the violation will be 2,000,000 EUR (2 million EUR).

   159. Then, the starting amount set in step 1 is adjusted according to the size of the company.

        The defendant achieves an annual turnover of more than EUR 50,000,000 for

        financial year 2023, falling in the range of EUR 50 to 100 million. That

        results in an adjustment of the starting amount to an amount between 8% and 20%.

        Given that the defendant's turnover is high within this

        range, the Litigation Chamber decides that an adjustment of up to 12.25% of the amount

        starting amount set in step 1 is justified, thus bringing the starting amount after adjustment to

        245,000 EUR in this case.


   160. To ensure that this starting amount after adjustment complies with the lines

        guidelines, it is compared with the ranges in the applicable table

        available in the EDPB guidelines. Since article 83.5 of the GDPR is

        applicable, that the defendant achieves a turnover of between 50 and 100

        million EUR and the severity is medium, the starting amount should be

        between 160,000 and 800,000 EUR. The Litigation Chamber concludes that an amount of

        starting of 245,000 EUR is within this range, and therefore it is in line with the lines

        guidelines.

   161. Taking into account article 83 of the GDPR, the Litigation Chamber must also provide reasons

        the imposition of an administrative fine in concrete terms, taking into account other

        aggravating or mitigating circumstances listed in Article 83.2 of the GDPR. However,

        the assessment of these elements does not justify either an increase or a decrease in the amount

        of the administrative fine. Furthermore, the Litigation Chamber must also justify

        the imposition of this administrative fine in accordance with the guidelines of

        the EDPB, which emphasize that fines for GDPR violations must be effective,

        proportionate and dissuasive in each specific case, in accordance with Articles

        83.4 to 83.6 of the GDPR. The assessment of these elements justifies a reduction between the fine

        initial and the new amount of approximately 30%. Considering all the factors








61EDPB - Guidelines 04/2022 on the calculation of administrative fines under the GDPR (v2.1), adopted on May 24
2023 (v2.1), see the appendices (p.52).
62Cour des Marchés), 2020/1471 of February 19, 2020.
63See in particular Title 3.2.2.4. of this decision.                                                                     Decision on merits 87/2024 — 53/55


        mentioned above, the reduction of the fine from EUR 245,000 to EUR 172,431 is a measure

        effective, proportionate and dissuasive necessary to ensure compliance with the GDPR.64



               III.3.2.2.7.    The decision to impose an administrative fine


   162. All of the above elements justify an effective, proportionate and

        dissuasive under Article 83 of the GDPR, taking into account the assessment criteria therein

        are set out.The Litigation Chamber underlines that the other criteria set out in article

        83.2 of the GDPR are not likely, in this case, to result in an administrative fine

        other than that determined by the Litigation Chamber within the framework of this

        decision.

   163. The Litigation Chamber considers that it is justified to impose an administrative fine,

        taking into account the specific circumstances as well as the position taken by the

        defendant regarding the manner in which the plaintiff's requests were handled, in order to

        to sanction this behavior appropriately and to encourage the defendant

        to refrain from responding to requests to exercise the rights granted under the GDPR

        in this way in the future.

   164. In view of the aforementioned assessment as well as the circumstances specific to this case, the

        Litigation Chamber therefore considers that it is appropriate to impose a fine

        administrative order of EUR 172,431 to the defendant, pursuant to article 58.2. i) of the GDPR as well

        as well as articles 100, § 1, 13° and 101 of the LCA, in accordance with article 83.2 of the GDPR.

   165. The Litigation Chamber considers that the amount of this fine, which otherwise remains

        well below the maximum amount of the authorized range, is proportionate to the severity

        violations noted in the behavior in question.



IV. Publication of the decision


   166. Given the importance of transparency regarding the decision-making process of the Chamber

        Contentious, this decision is published on the website of the Authority of

        Data protection. However, it is not necessary for this purpose that the data

        identification of the parties are directly communicated.













64See in particular Title 3.2.2.5 of this decision.                                                                                    Decision on merits 87/2024 — 55/55


                                                                                                                 66
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , Or

via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. judic.).







(sé). Hielke H IJMANS

President of the Litigation Chamber




































































the signature of the applicant or his lawyer.
66The request, accompanied by its annex, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court registry.