APD/GBA (Belgium) - 109/2023

APD/GBA - 109/2023
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 12(3) GDPR Article 21(2) GDPR
Type:	Complaint
Outcome:	Upheld
Started:	20.06.2023
Decided:	09.08.2023
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	109/2023
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	French
Original Source:	APD/ GBA (Belgium) (in FR)
Initial Contributor:	n/a

The Belgian DPA found a violation of Article 21(2) GDPR when a controller did not respect the data subject's right to object to direct marketing.

English Summary

Facts

Following the receipt of unwanted direct marketing emails, on 15 June 2022, the data subject had requested the controller (an estate agent) to remove him from its real estate mailing list. The controller did not respond to these requests.

After contacting the controller several more times by email on 27 June 2022, and 4 May 2023 to request the removal of his email from their database to no effect, the data subject lodged a complaint with the Data Protection Authority on 20 June 2023.

Holding

The Belgian DPA found a violation of Article 21(2) GDPR and Article 12(3) GDPR.

Firstly, Article 21(2) establishes the right for a data subject to object to processing for direct marketing purposes. The Belgian DPA held that the controller was in violation of this provision by disregarding the data subject’s multiple objections to processing.

Secondly, the Belgian DPA found that the controller was in breach of Article 12(3) GDPR. Article 12(3) GDPR establishes a one-month time limit for facilitating requests made under Articles 15-22 GDPR. The controller failed to respond to the data subject’s request within this timeframe.

No fine was issued in this case. However, the controller was ordered to comply with Article 21(2) GDPR and to consider the erasure request under Article 17 GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/6





                                                                          Litigation Chamber


                                                            Decision 109/2023 of August 9, 2023





File number: DOS-2023-02708


Subject: Deletion of e-mail address from a mailing list for the purpose of

marketing




The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke
Hijmans, chairman;


Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and

to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the
data protection), hereinafter “GDPR”;


Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, hereinafter

“ACL”;

Having regard to the internal regulations as approved by the House of Representatives on 20

December 2018 and published in the Belgian Official Gazette on January 15, 2019;


Considering the documents in the file;


Made the following decision regarding:



The plaintiff: X, hereinafter “the plaintiff”; .

                                                                                                          .
                                                                                                          .
The defendant: Y, hereinafter: “the defendant”. Decision 109/2023 – 2/6


I. Facts and procedure


 1. The subject of the complaint concerns the non-respect of the right of opposition exercised by the complainant

        following the receipt of unwanted e-mails for direct marketing purposes.

        asked the defendant – a real estate agency – on several occasions and without success

        to remove it from its mailing list of real estate advertisements, but the defendant would not have

        did not respond to these requests.


 2. On June 20, 2023, the complainant lodged a complaint with the Data Protection Authority

        given against the defendant.


 3. On June 30, 2023, the complaint is declared admissible by the Front Line Service on the
                                                 1
        basis of Articles 58 and 60 of the LCA and the complaint is forwarded to the Litigation Chamber
                                     st 2
        pursuant to Article 62, § 1 of the LCA.


 4. Pursuant to article 95 § 2, 3° of the LCA as well as article 47 of the rules of order

        inside the DPA, a copy of the file may be requested by the parties. If one of

        parties wishes to make use of the possibility of consulting the file, the latter is required to

        contact the secretariat of the Litigation Chamber, preferably via the address

        litigationchamber@apd-gba.be.



II. Motivation


    II.1. Applicable right


 5. Article 21.2 of the GDPR provides that any data subject, whose personal data

        personal are used for prospecting purposes, "has the right to oppose at any time

        to the processing of personal data concerning him for such purposes of

        prospecting, including profiling insofar as it is linked to such prospecting”. THE

        third paragraph of the same article provides that "when the data subject


        objects to processing for prospecting purposes, the personal data are

        no longer processed for these purposes. » When a person objects to the processing of personal data

        prospecting purposes, it must not provide any justification for its request for opposition.




1Under article 61 LCA, the Litigation Chamber informs the parties by this decision, of the fact that the complaint has been
declared admissible.
2
 Pursuant to Article 95, § 2 LCA, by this decision, the Litigation Chamber informs the parties of the fact that following
this complaint, the file was forwarded to him.
3 In the absence of a legal definition of the notion of prospecting or direct marketing, the APD has defined it as “Any
communication, whether solicited or unsolicited, aimed at promoting an organization or a person, services, products,
whether paid or free, as well as brands or ideas, addressed by an organization or a person

acting in a commercial or non-commercial context, directly to one or more natural persons in a
private or professional, by any means, involving the processing of personal data. ", see
Recommendation n°1/2020 of January 17, 2020 relating to the processing of personal data for the purposes of
direct marketing, page 8, available at https://www.autoriteprotectiondonnees.be/publications/recommandation-n-01-
2020.pdf Decision 109/2023 – 3/6


 6. Article 12.3 of the GDPR provides that the controller needs to respond to the

       request from a data subject exercising their rights under Articles 15 to 22 of the GDPR

       within one month of receipt of the request. The manager of

       processing also informs within the same period if it needs an extension of the period

       orifthecontrollerdoesnotfollowupontherequestmadebytheperson

       concerned (article 12.4 GDPR).



    II.2. Application to the present case


 7. On June 15, 2022, after receiving an email purporting to promote real estate in

       location, the complainant had expressed his wish to be removed from the “email loop” of the

       defendant.

 8. Subsequently, it appears from the documents in the file that the defendant continued to send

       prospecting emails to the complainant. 4


 9. On June 27, 2022, the Complainant again contacted the Respondent by email for him

       ask to be removed from their real estate ad mailing list.

 10. The defendant did not comply with this second request either, because the exhibits of the

       record show that the defendant continued to send the same type of emails to the

       complainant.5


 11. On May 4, 2023, the complainant again expressed his wish to be removed from the list of

       recipients of the emails in question. The defendant did not respond to this

       request.

 12. In the Complaint Form, the Complainant indicates that the Respondent would also have

       contacted by phone. During this telephone call, the complainant allegedly reiterated his

       requests to no longer appear on the list of recipients of real estate advertisements of the

       defendant. However, the Litigation Chamber does not have evidence proving

       the existence of this phone call.

 13. The Litigation Chamber finds that the complainant's data (his email address

       containing his first and last name) have been used for direct marketing purposes. There

       Litigation Chamber also considers that the requests submitted by the plaintiff

       constitute opposition requests within the meaning of Article 21 of the GDPR because their requests

       intended to ensure that his contact details were no longer used for a particular purpose, namely

       direct marketing purposes.




4According to the documents provided by the complainant, the complainant was contacted on May 23, 2022, May 31, 2022, June 1, 2022, June 9,
2022, June 13, 2022, June 15, 2022, June 17, 2022 and June 27, 2022.
5According to the documents provided by the complainant, the complainant was contacted on July 12, 2022, July 22, 2022, August 26, 2022, July 7,
September 2022, October 25, 2022, November 4, 2022, November 9, 2022 and January 10, 2023. Decision 109/2023 – 4/6


 14. It is the responsibility of the Respondent, in its capacity as controller, to follow up on the

       the exercise of the rights of the persons concerned, in compliance with the conditions of

       Article 12 of the GDPR, mentioned in point 6 of this decision.


 15. The Litigation Chamber considers that on the basis of the aforementioned facts, there is reason to
       conclude that the defendant may have committed a violation of the provisions of the GDPR,

       which justifies that in this case, the Litigation Chamber takes a decision

       in accordance with Article 95, § 1, 5° of the LCA, more specifically to order the

       respondent to comply with the complainant's request to object to the processing of his

       data for direct marketing purposes under Article 21.2 of the GDPR.

 16. This decision is based on the fact that the complainant provides evidence of the disputed emails from

       direct marketing, the exercise of its right on several occasions as well as proof of

       persistent processing of his data despite his requests and after the expiry of a

       month provided for in Article 12.3 of the GDPR.


 17. Furthermore, in his complaint form, the complainant expressed the wish that all of the
       his personal data is erased from any of the defendant's servers.

       As this request was not made directly to the defendant, the

       Litigation Chamber invites the defendant to consider this request

       erasure within the meaning of Article 17 of the GDPR.


 18. This decision is a prima facie decision taken by the Litigation Chamber
       pursuant to Article 95 of the LCA on the basis of the complaint lodged by the complainant/the

       complainant, in the context of the "procedure prior to the substantive decision" and not a

       decision on the merits of the Litigation Chamber within the meaning of Article 100 of the LCA.


 19. The purpose of this decision is to inform the defendant, allegedly responsible for the

       processing, because it may have violated the provisions of the GDPR,

       in order to enable it to still comply with the aforementioned provisions.

 20. If, however, the defendant does not agree with the content of this decision

       prima facie and believes that it can make factual and/or legal arguments that

       could lead to another decision, it may send the Litigation Chamber a

       request for treatment on the merits of the case via the e-mail address litigationchamber@apd-

       gba.be, within 30 days of notification of this decision. The case
       applicable, the execution of this decision is suspended for the period

       aforementioned.


 21. In the event of further processing of the case on the merits, pursuant to Articles 98, 2° and 3°

       juncto article 99 of the LCA, the Litigation Chamber will invite the parties to introduce their



6Section 3, Subsection 2 of the ACL (sections 94 to 97 inclusive). Decision 109/2023 – 5/6


         conclusions and attach to the file all the documents they deem useful. If applicable, the


         this decision is permanently suspended.

  22. In the interests of transparency, the Litigation Division finally emphasizes that a


         dealing with the case on the merits may lead to the imposition of the measures mentioned in
                                    7
         section 100 of the ACL.



III. Publication of the decision


  23. Given the importance of transparency regarding the decision-making process of the Chamber


         Litigation, this decision is published on the website of the Protection Authority

         Datas. However, it is not necessary for this purpose that the identification data

         of the parties are communicated directly.





































7Art. 100. § 1. The litigation chamber has the power to
  1° dismiss the complaint without follow-up;
  2° order the dismissal;
  3° pronouncing the suspension of the pronouncement;

  4° to propose a transaction;
  5° issue warnings and reprimands;
  6° order to comply with requests from the data subject to exercise his or her rights;
  7° order that the person concerned be informed of the security problem;
  8° order the freezing, limitation or temporary or permanent prohibition of processing;
  9° order compliance of the processing;
  10° order the rectification, restriction or erasure of the data and the notification thereof to the recipients of the

     data ;
  11° order the withdrawal of accreditation from certification bodies;
  12° to issue periodic penalty payments;
  13° to issue administrative fines;
  14° order the suspension of cross-border data flows to another State or an international body;
  15° forward the file to the public prosecutor's office in Brussels, who informs it of the follow-up given to the file;
  16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. Decision 109/2023 – 6/6





    FOR THESE REASONS,


    the Litigation Chamber of the Data Protection Authority decides, subject to

    the introduction of a request by the defendant for treatment on the merits in accordance with

    to articles 98 e.s. of the ACL:


       - pursuant to Article 58.2.c) of the GDPR and Article 95, § 1, 5° of the LCA, to order

           the defendant to comply with the request of the person concerned to exercise

           his rights, more specifically the right of opposition for direct marketing purposes (article

           21.2 of the GDPR), and this within 30 days from the date of notification of this

           decision ;

       - to order the defendant to inform by e-mail the Data Protection Authority

           data (Litigation Chamber) of the follow-up given to this decision, in the

           same deadline, via the e-mail address litigationchamber@apd-gba.be; And


       - if the defendant does not comply in good time with what is requested of it

           above, to deal ex officio with the case on the merits, in accordance with articles 98 e.s. of

           the ACL.







In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged,

within thirty days of its notification, to the Court of Markets (court

d'appel de Bruxelles), with the Data Protection Authority as defendant.


Such an appeal may be introduced by means of an interlocutory request which must contain the
                                                                    8
information listed in article 1034ter of the Judicial Code. The interlocutory motion must be
                                                                                                       9
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , Or

via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).




(se). Hielke HIJMANS

President of the Litigation Chamber



8
 The request contains on pain of nullity:
 (1) indication of the day, month and year;
 2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
     Business Number;
 3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
 (4) the object and summary statement of the means of the request;
 (5) the indication of the judge who is seized of the application;
 6° the signature of the applicant or his lawyer.

9The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.