Court of Appeal of Brussels - 2020/AR/1111

Hof van Beroep - 2020/AR/1111
Court:	Cour d'appel de Bruxelles/ Hof van beroep Brussel (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 3(1) GDPR Article 3(2) GDPR Article 17(1)(c) GDPR Article 58(2) GDPR
Decided:	30.06.2021
Published:	30.06.2021
Parties:
National Case Number/Name:	2020/AR/1111
European Case Law Identifier:
Appeal from:	APD/GBA (Belgium) 37/2020
Appeal to:	Unknown
Original Language(s):	French
Original Source:	APD (in French)
Initial Contributor:	n/a

The Brussels Court of Appeal ruled that the corrective measures imposed by the Belgian DPA in a case of delisting of search results should have been imposed on the controller (Google LLC) and not on Google Belgium, since the APD did not sufficiently motivate how the activities of the Belgian establishment (Google Belgium) were inextricably linked to Google LLC. Moreover, the Court of Appeal regrets that the APD communicates in the press about its decisions but recognises that its does not have jurisdiction to adopt any decision in this respect.

English Summary

Facts

The complainant, an executive at an unnamed large company, had requested the removal of 12 URLs. As Google had refused to remove several of the concerned links, the complainant referred the case to the Belgian DPA. Building on the principles developed by the CJEU in the Google Spain and Google/CNIL cases, the Belgian DPA decided that Google Belgium is an establishment of Google LLC , triggering the applicability of the GDPR under article 3.1. Moreover, the DPA referred to a latter sent on 23 June 2020 by Google LLC to the Irish DPC stating it would no longer object to local (non-lead) supervisory authorities exercising local data protection jurisdiction when it comes to the scope of Google LLC's responsibilities. As a result, despite the designation of the Irish DPC as lead supervisory authority, the Belgian DPA considered it had jurisdiction because the case did not relate to Google Ireland Ltd's processing activities, but to Google LLC. Therefore, the one-stop-shop procedure did not apply.

On these grounds, the Belgian DPA: - ordered Google Belgium to de-reference the concerned search results - imposed an administrative fines of EUR600,000, based on Alphabet's (Google's mother company) annual turnover in the three previous years; and - ordered Google to clarify the ambiguity concerning the roles of the different entities involved, and in particular to clearly and precisely clarify which entity is the data controller for Belgium and for which processing activity.

Google Belgium appealed the decisions before the Court of appeal on the grounds that - the order was addressed to Google Belgium which is not the controller in this case - the APD did not sufficiently motivate how it could be established that Google Belgium was linked to the activities of Google LCC as the controller - article 58 GDPR does not provide the possibility to impose a corrective measure on another entity than the controller (ie Google LLC) - the APD published the decision without removing Google's name and even communicated in the press on its decision

Holding

The Court annulled the decision on the grounds that the decision imposed a corrective measure on Google Belgium whereas the controller at stake is Google LLC (against which the complaint should be filed), without motivating enough how Google Belgium's activities would be inextricably linked to the controller (Google LLC). Google Belgium could only be subject to a corrective measure if the APD can prove the link between both companies. Moreover, the Court confirms the decision to publish the decision without removing the name of Google. However, the Court recognises that it does not have jurisdiction to annul any communication of the APD around the case, nor to impose any action in this respect. Nevertheless, the Court regrets that the APD and its members communicate in the press on a case which is still pending.

Comment

Share your comments here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

Court of Appeal Brussels-2020 / AR / 1111 p. 2GOOGLE BELGIUM SA, BCE 0878.065.378 represented by Me VANDENDRIESSCHE Gerrit(gerrit.vandendriessche@altius.com) and Me. JOLLY Louis-Dorsan (louisdorsan.iolly@altius.com) lawyers in BRUSSELS,Requesting party,Against Decision n ° 37/2020 pronounced by the contentious chamber of the Authority ofData Protection July 14, 2020 for the purpose of "X c / Google (de-listing)Vs:THE DATA PROTECTION AUTHORITY. BCE 0694.679.950, represented by Me.TATON Xavier (xavier.taton@linklaters.com) and Me VAN OVERSTRAETENTanguy, (tanguy.van overstraeten@linklaters.com) lawyers in BRUSSELS,Defendant,Others:X, who had as advice Me DOUTRELEPONT Carine(carine@doutrelepont.be) and Me. YAHYAOUI lnès (i.yahyaoui@doutrelepont.be), lawyers atBRUSSELS, which filed conclusions but does not appear at the hearing on June 16, 2021 and whichis not represented at this hearing.****1.Referral to the Market Court.1.1.The Markets Court is seized by an appeal from GOOGLE BELGIUM SA against thedecision n ° 37/2020 pronounced by the Litigation Chamber of the Authority for the Protection ofData (after the Litigation Chamber of the APD ”) July 14, 2020 (DOS-2019-03780).By interlocutory judgment of February 17, 2021, the Court decided as follows:“ Holds the appeal of GOOGLE BELG / UM SA admissible ratione temporis;Holds X's voluntary intervention inadmissible except insofar as it is limited to supporting thethesis of / 'APO and to defend the merits of the contested decision and to hear himdeclare joint / 'judgment which will be delivered by the Court of the markets;Holds that there is no need to ask preliminary questions to the Constitutional Court;Holds the request of GOOGLE BELG / UM SA to apply article 748 § 2 of the Judicial Codeinadmissible;Holds that it is appropriate to allow GOOGLE BELGIUM SA, X and / 'APO to put the cause instate as follows:-summary conclusions for GOOGLE BELGIUM SA by March 10, 2021 at the latestrPAGE□ 1- □□□□ 2220406-0002- □□ 41- □ 9- □ 1-i; -iTHE_J
Page 3
Brussels Court of Appeal - 2020 / AR / 1111 p. 3-summary conclusions for X and ODA no later than Th 31 March 2021-pleadings (probably by WEBEX videoconference - unless all measures are abolishedrestrictive COV / D-19) dated Wednesday April 14, 2021 at 9.30 a.m. for 360 minutes.Reservation to be decided on the surplus. "1.2.On March 8, 2021, SA GOOGLE BELGIUM filed additional conclusions andsynthesis.She asks“Declare I appeal by Google Belgium SA admissible and well founded;Declare the voluntary intervention of X inadmissible insofar as it is not limited tosupport the thesis of the Data Protection Authority and defend the merits of Jadecision on the merits 37/2020 of the Litigation Chamber of the Authority for the Protection ofdata as of July 14, 2020 (DOS-2019-03780);Declare requests from X and the Data Protection Authority inadmissibleto the extent that they are based on new elements, arguments and pieces sothat they exceed I objective contentious before Your Court;Annul the decision on the merits 37/2020 of the Contentious Chamber of the Authoritydata protection of 14 Jul / and 2020 {DOS-2019-03780};Following the annulment of the decision Ja decision on the merits 37/2020, orderthe Data Protection Authority to carry out the following measures in the versionsFrench and Dutch languages ​​of its website within I but of the pronouncement:• Publication of / 'judgment to intervene on its website in Ja section PubJications> Decisions>Judgments of the Market Court;• Addition of the following insert, on any publication of the annulled decision available on its siteweb, on the first page of the document, visibly as soon as the document is opened,bold and boxedNote to the reader: the decision on the merits 37/2020 of the Contentious Chamber of the Frenchdata protection of 14 Jul / and 2020 was overturned by / 'judgment of the Court of Appeal ofBrussels from [insert date].For more information, see [insert link to / 'stop] and [insert link to IePress release].rPAGE01-000022204 □ 6- □□□ 3-0 □ 41- □ 9- □ 1-THE_J
Page 4
Court of Appeal Brussels - 2020 / AR / 1111 p. 4• Deletion of any press release or other previous communication relating to/ 'existence and content of the annulled decision available on its website or, at any Ieminus, addition of an insert in accordance with the previous point.• Publication of a press release, to all hands in French, Dutch and English,in the sections " News " and " Press Releases " on its website, with Iefollowing content:" The Market Court annuls the decision of / 'APO which sanctioned Google BelgiumBy a judgment of [insert date], the Cour des marchés annulled the decision on the merits37/2020 of the Litigation Chamber of the Data Protection Authority of July 142020 (OOS-2019-03780). The annulled decision sanctioned Google Belgium for norespect for the right to be forgotten.Following this judgment of the Court of Markets, the corrective measures imposed/ 'APO to Google Belgium have been canceled.INTERESTING LINKSJudgment of the Market Court of [insert date] ”• Publication of a link to the press release referred to above in an apparent manner on thehome page of its website, in the " news " section , for at least 2 months atfrom the publication of said press release;Then, again ruling in place of the Data Protection Authority, on thebasis of Article 100, § L st , 2 ° of the law establishing the Protection Authoritydata, order the dismissal, in that Google Be / gium SA is not responsible fortreatment involved.Order the Data Protection Authority to pay the registration fee and to payGoogle Belgium SA all costs and expenses of the proceedings, including compensation forprocedure of 1,440 EUR (basic amount). "On March 31, 2021, X filed additional and summary conclusions in which,she asks :" Declare Ja present voluntary intervention in the instance existing between Google BelgiumSA and the admissible and founded Data Protection Authority, andDeclare I am appealing by Google Belgium SA against the Oécision regarding thebackground 37/2020 of the Litigation Chamber of / 'APO of July 14, 2020 having for object "XC /Google (de-listing) » admissible but unfounded, and declare the request for/ 'APO of which Ja brought in voluntary intervention appropriates the means as the device andin whose support it intervenes. "1 PAGE□ 1- □□ 002220406-0004-0041-09-01-4THE__J
Page 5
Page 6
Page 7
Page 8
Court of Appeal Brussels-2020 / AR / 1111 p. 8users who use its internet search engine services from the territorybeige, for dereferencing purposes, by clearly and precisely identifying whichlegal entity (ies) is (are) responsible for the processing and for what processing, atlater two but after notification of this decision and inform by e-mailthe Data Protection Authority (Litigation Chamber) that the aforementioned order has beenexecuted, in the same dé / ai (via the e-mail address litigationchamber@apd-gba.be).Pursuant to Article 108, § 1 of Ja LCA, this decision may be appealed against in athirty days, from the notification, to the Market Court, with the Authority ofdata protection as a defendant. "4.The factual context.In his conclusions, X gives the following account of the facts:1.The conclusive one, well known to the Brussels public:resides in Brussels;is the current director of Sf BELGA, a company, managing the gas distribution networkand electricity for the 19 Brussels municipalities, which has around 1,000 employees and isresponsible for 1.2 mil / ion of energy meters and 83,000 street lights;- has recognized skills.2.She has a professional background of very high quality, mainly occupyingsenior civil servant and manager functions in the energy sector.Holder of a master's degree in actuarial science, but also in applied economics and managementenvironment, she held the post of deputy chief of staff of a vice-premierMinister, Strategy Advisor to the CEO of the ELIA Manager, Chief Executive OfficerGeneral of the Energy of the FPS Economy, President of the Board of Directors of theBeige Federal Commission for Electricity and Gas Regulation {CREG}, Vice-Presidentof the Council of European Energy Regulators (CEER) and President of theinternational coordination {! CG} within the CEER. As President of CREG, she hasrepresented Belgium at the Agency for the Cooperation of Energy Regulators (ACER).3.The conclusive one was the subject of a referencing, by Google, of contents (richsnippets, keywords, titles, hypertext links) which undermine his honor and hisreputation, elements of his private life, as well as his personal datastaff.These contain inaccurate, not updated information as well as accusationsserious.4.While his skills are obvious and it is thanks to such skillsthat she was able to occupy different positions, certain publications referenced by Google beingreferred:r PAGE01-00002220406-0008-0041-09-01-THE..J
Page 9
Page 10
Court of Appeal Brussels -2020 / AR / 1111 p. 10- / 'URL 7 linked to the PS tagging on the grounds that this result no longer existed, which turned outcorrect in the end;- / 'URL 2 linked to the PS labeling on the grounds that the content of the article was locked (part 8.01filed by Google Belgium)- By a second email of 18 June 2019 at 18:53:49 Central European Summer Timesent from I address removals@qooqle.com and signed by "I team Google":- Jes URL 9 to 12, linked to the existence of complaints which have turned out to be unfounded, on the groundsnotably, but without great details, that the public role of X would oppose it.Then, in contradiction with the question of the faci / itation of the rights of the peopleconcerned required by the GDPR and the case law of the CJEU, Google invited Ja conclusiveto contact each publisher's website individually, thus relieving himself of anyliability (part 8.02 filed by Google Belgium).7.Faced with the impossibility of identifying with certainty the controller, Jaconclusively instituted a procedure against Google Belgium before the DPA, in Irespect for the spirit and the principles, in particular of transparency, efficiency and ease ofGDPR which will be developed below.Let us note, in fact, at this stage thatThe form did not contain any precise mention as to the person responsible for the processing;the addressshippingwaswebornmaymoreopaque“ Jegalremovals@system/gserviceaccount.com ”;the response to / 'submission to the form was signed by J'équipe Google;the response address was removals@qooqle.com;the confidentiality conditions specified, in 2019, that Google / re / and limited wascontroller, unless otherwise specified, but the name of Google LLC wasmentioned in the form as an interface, without further clarification (part n ° 9};I Team Google's responses encouraged " to submit your removal requestdirectly to the webmaster who controls the site in question. This person is able todelete I affected content on I Web or / 'prevent it from appearing in the search enginesresearch ”, in contradiction with the jurisprudence of Ja Court Google Spain, C-131/12, and" Guidelines " of November 26, 2014.the data concerned as sensitive data relating to a procedure and aalleged political connivance.8.By a decision on the merits 37/2020 of July 14, 2020 (ei hereafter " Ja Decisionattacked ”), the Litigation Chamber of J'APD ordered Google Be / gium SA to- dereference Jes URls 9 to 12 referring to web pages mentioning a complaint forharassment at work against the conclusive;- adapt the electronic forms and communicate " ... to users who useits internet search engine services from beige territory, for the purposes ofIPAGE 01-00002220406-0010-0041-09-01-
Page 11
Brussels Court of Appeal - 2020 / AR / 1111 p. 11delisting, by clearly and precisely identifying which legal entity (ies)is (are) responsible for the processing and for that / s processing ... ";-pay a fine of EUR 500,000 for breach of Articles 17.1 a) and 6.1 f) GDPR and100,000 EUR for breach of Articles 12.1 and 12.4 GDPR.It closed the complaint with regard to the de-listing of URls 1 to 8.referring to web pages mentioning the political labeling of Ja conclusive.Google Belgium SA claimed to have complied with the appropriate measures.The contentious content is however still referenced by Google, for Jes Jiens 9, 10, 11 and12, as shown by the screenshots taken on December 20, 2020 (exhibits n ° 7 and8}, and generally by referencing the pages identified in Ja request from Jaconclusive, see in particular[...][...][...][...]9.Google Belgium SA as well as the conclusive one received the decision of the APO, Th 14 July / andby email as well as by registered mail on July 16, 2020.On August 17, 2020 and although I have / have expired, Google Belgium SA introduced its requestcall. "5.The referral to the Litigation Chamber of the APD.The Contested Decision is not limited to ruling on a specific complaint.In the Contested Decision, the Contentious Chamber argues:“12. By this decision, the Litigation Chamber examines the question ofdelisting by an Internet search engine, of content followingre / ative research to a natural person. This question is the subject of case lawof the well-known Court of Justice of the European Union (ei-after CJEU), in particular in JesGoogle Spain stops.the beige Court of Cassation also ruled on de-listing and the right toforgetting.13. For the Contentious Chamber, this is the opportunity to adopt a decision of principle anddecide on some fundamental aspects related to dereferencing, on the basis of the1 PAGE□ 1- □□□□ 2220406- □ 011- □ 041- □ 9- □ 1-; i
Page 12
Page 13
Page 14
Page 15
Page 16
Page 17
Page 18
Page 19
Page 20
Page 21
Brussels Court of Appeal - 2020 / AR / 1111 p. 21means of such processing determined by Union law or the law of a Statemember, the controller may be appointed or the specific criteriaapplicable to its designation may be provided for by Union law or by the law of aMember state ".The power to impose measures and / or to take sanctions under Article58.2.d) and i) of the GDPR is limited ratione personae. A supervisory authority cannot exerciseits power only vis-à-vis the controller or processor.The parties agree that the notion of " controller " is akey concept under the GDPR.Article 17. 1 GDPR stipulates that " the data subject has the right to obtain from the responsibleprocessing the erasure, as soon as possible, of personal dataconcerning and the controller has the obligation to erase such datapromptly, where one of the following grounds applies: ... "(the Courthighlighted).It is this entity that bears the responsibility for complying with the obligations of the GDPR.6.6.2.Exhibit 71 of administrative file " 71 - 07/20/2020 - Google LLC - Mail: Google givesits agreement to dereference ” comes from GOOGLE LLC, and not from GOOGLE BELGIUM. Inthe case, following X's request for delisting, the Litigation Chamberon the one hand expressly identifies GOOGLE LLC as responsible forprocessing that would have violated GDPR 8, but on the other hand it orders the settingcompliance of the processing and imposes fines on GOOGLE BELGIUM (and not on GOOGLELLC).Insofar as the Litigation Chamber has established that in this case GOOGLE BELGIUM is notnot the controller but that GOOGLE LLC, is the controller andis solely responsible for the alleged violation of the GDPR (with regard to the complaint ofX), the APD cannot impose on GOOGLE BELGIUM a compliance order ora sanction for breaches related to this processing without violating the definition ofcontroller (article 4.7 of the GDPR), the scope of the GDPR (article3.1 of the GDPR), the right to erasure (article 17 of the GDPR) and its powers (article 58.2of the GDPR juncto article 100 §1, 8 ° , 13 of the LCA Law).The person in charge of the disputed treatment, GOOGLE LLC, is in contact with the APD and has already madesubject to decisions by other national authorities.By arguing that ODA has the power to take action with respect to an entity " whosehealth activities inseparably linked with those of the controller ” 9 and that8 Contested Decision, §161 ("Google LLC failed to comply with the obligations enshrined in ..."), §178 ("Google LLC sefinds indeed failing to identify c / airement ... 'l9 Ibid., §32.rPAGE01-00 □□ 2220406-0021-0041- □ 9- □ 1 -; - iTHE... J
Page 22
Page 23
Page 24
Page 25
Brussels Court of Appeal - 2020 / AR / 1111 p. 25part of the Google establishment located on French territory. It appears as well as athis situation falls within the territorial scope of application of Directive 95/46 and Regulation2016/679. "In the present case, the Contested Decision does not demonstrate that “it emerges from the information provided bythe referral decision, on the one hand, that the establishment available to Google in the territory[beige] carries out activities, in particular commercial and advertising activities, which areinseparably linked to the processing of personal data carried out forneeds of the operation of the search engine concerned and, on the other hand, that this engineresearch must, taking into account, in particular, the existence of gateways between itsdifferent national versions, be regarded as carrying out data processing atunique personal character ”.The APD argues:“42. The Litigation Chamber underlines that this position implies that Google Belgium SAseems to admit that the processing is carried out within the framework of the activities of an establishmentof the data controller in the European Union, i.e. Google Belgium SA. Aanother reading of this position would have - as ruled in / 'Google judgment / CN / L - "forconsequence that the processing of personal data [. ..] either subtracted fromobligations and guarantees provided [by directive 95/46 and] by RGPD ”. In othersterms, reading it would jeopardize the usefulness of the application of the GDPR. "This argument does not demonstrate the inseparable link between GOOGLE LLC and GOOGLEBELGIUM regarding the processing of X.The APD gives the following arguments:'44. In its conclusions in response, the complainant maintains in particular that Google BelgiumSA is a subsidiary of Google LLC. mainly active in digital marketing, includinghead office is located in Brussels and its activity targets the inhabitants of Belgium, and thatGoogle Belgium SA and Google LLC activities are inseparable within the meaning of the Google judgmentSpain mentioned above.45. Google Belgium SA does not dispute this. It is also not disputed that Google BelgiumSA actually and effectively carries out activities in Belgium.46. ​​During the hearing, Google Belgium SA was questioned about the various ro / es ofGoogle establishments. It has confirmed that it does not play any role with regard to the data processedwithin the framework of the three phases of the functioning of the Google search engine, namelyits exploration phase, its indexing phase and its selection phase of the resultsdepending on the request introduced by the user. Google LLC would be solely responsible fortreatment in this context. In essence for the hearing, Google Be / gium SA explainedthat it was a Google subsidiary established in Belgium likely to lead to the application ofIPAGE01-00002220406-0025-0041- □ 9-01-; iTHE_J
Page 26
Page 27
Brussels Court of Appeal - 2020 / AR / 1111 p. 27in the territory of a Member State, within the meaning of that provision, when the operator of asearch engine creates in a Member State a branch or a subsidiary intended toensure the promotion and sale of the advertising spaces offered by this engine and of whichthe activity targets the inhabitants of this Member State. "51. In addition, since its activities are inextricably linked to those of Google LLC., This subsidiary inBelgium, having regard to the role it plays and describes, can be treated in the same way as aresponsible for the data processing carried out within the framework of the operation of the engineof Google searches and management of requests for de-listing in Belgium.52. In short, the Contentious Chamber considers that Google Belgium SA should be treated asthe same way as a controller on the basis of the elements of the file andthe Google Spain case law of the Court of Justice of the European Union.53. In any event, even though Google Belgium SA could not be consideredas data controller, the Litigation Chamber would remain competent toI have regard to Google Be / gium SA because of the presence of this entity in the beige territory,as the following elements demonstrate. "In other words, the Litigation Chamber claims, but does not demonstrate that there isthe species an inseparable link between GOOGLE LLC and GOOGLE BELGIUM regarding the processingdata from X to lead to dereferencing.References to case-law decisions of the Court of Justice (which the Court ofmarkets does not question), justify the theory, but do not justify its application inthe species.6.6.4.Insofar as the Litigation Chamber of the APO has the power - by virtue of Article58.2.i of the GDPR “to adopt all corrective measures, in particular to impose aadministrative fine in application of article 83, in addition to or in place ofmeasures referred to in this paragraph, depending on the specific characteristics of eachcase ”, this does not imply that it has the power to impose an administrative fine on aentity other than the controller or processor 12- without examination andmotivation of the factual circumstances which demonstrate, on a case-by-case basis, activitiesinextricably linked to the processing of data in personal made for- needs of the operation of the search engine concerned. In the absence of suchmotivation, the Attacked Decision lacks the principles of adequate motivation such asthat governed by the beige law (law July 29, 1991).6.7.6.7.1.12 APD summary conclusions of December 18, 2020, §261.1 PAGE01-00002220406-0027-0041-09-01-_J
Page 28
Page 29
Page 30
Page 31
Court of Appeal Brussels-2020 / AR / 1111 p. 31controller or a processor who is not established in the Union, when thehealth treatment activities related to:a) the offer of goods or services to such data subjects in the Union, that a paymenteither required or not of said persons; Whereb) monitoring the behavior of these people, insofar as it is abehavior that takes place within the Union.3. This Regulation applies to the processing of personal data by acontroller who is not established in the Union but in a place or the law of aMember State applies under public international law. "The GDPR does not allow the APD to impose corrective measures, advertising orfine to GOOGLE BELGIUM, which is - in this case - no more than a simple subsidiaryor an establishment of GOOGLE LLC.An administrative fine, an injunction and publicity are coercive measures whichcould, if applicable, be imposed on GOOGLE LLC in its capacity asprocessing and pursuant to Article 58 of the GDPR.It is the (procedural) choice of the complainant and the Litigation Chamber of the APD not tonot involve GOOGLE LLC and not require that the APD Inspection Servicecarries out investigations.The data subject (in this case X) has the right to obtain from the data controllerprocessing the erasure, as soon as possible, of personal dataconcerning and the controller has the obligation to erase such datastaff as soon as possible (article 17.1 GDPR).This article does not state that national DPAs can act - without other conditions (seeei-avant) - against other parties - i.e. other legal persons in accordance withto the principles of national law which determines the formal and substantive conditions forbecome a party to an administrative procedure - that the person responsible for the processing.GOOGLE LLC being in this case the controller, GOOGLE IRELAND Ltd beingthe main establishment in the European Union.6.9.2.Insofar as the Litigation Chamber of the APD determines that the person responsible fordisputed treatment is GOOGLE LLC but it pursues and nevertheless sanctions(only and to the exclusion of this controller GOOGLE LLC) a completely differentlegal person (namely GOOGLE BELGIUM), the Contested Decision is notproperly motivated since it does not provide adequate motivation (orsatisfactory) - within the meaning of the law of July 29, 1991 - able to justify to the ChamberLitigation the appropriate jurisdiction, based on the interpretation of the judgments of the Court ofJustice, to conduct prosecutions and impose sanctions (points 2 to 5 of the DecisionAttacked) only to GOOGLE BELGIUM SA which is not the controllerwhich is the subject of the complaint and of which it is not established without ambiguity and without contradictionof the reasons (see ei-before) that it would - in this case - be inextricably linked with thecontroller (GOOGLE LLC).Insofar as the complaint must be directed against the controller andit is only with proof that the local establishment is inextricably linked to this1 PAGE□ 1-00002220406-0031-0041-09-01-_J
Page 32
Court of Appeal Brussels-2020 / AR / 1111 p. 32controller, that the national DPA can sue the local establishment, theproof of this alleged link cannot be presumed, nor demonstrated by reference todecisions - were final judicial decisions - other jurisdictionsnational or jurisdictions of other Member States or of the Union.The Contested Decision must be annulled for lack of motivation.7. The other means of GOOGLE BELGIUM.Insofar as the Contested Decision is annulled for lack of motivation, there is noplace to examine the other pleas and other complaints, which cannot give rise tomore extensive cancellation.8. The voluntary intervention of X.8.1.X was not appearing at the hearing on June 16, 2021 and is not represented there.Her counsel, who informed the Court that she was without instructions, nevertheless said that she referred tojustice and written procedure. There is no need for a written procedure, article 755 of the Codejudicial process requires a joint application by all parties to the case. In this case there isdisagreement of all parties involved.At the hearing of June 16, 2021, the other parties to the case indeed oppose the procedurewritten. The Court will take into account the legal claims filed in accordance withArticle 744, paragraph l st of the Judicial Code (Art. 780 Judicial Code).8.2.In these conclusions X puts forward the following pleasMeans 3 (mainly): The application of the mutual assistance mechanism is compliantas prescribed in article 61.3 of the GDPR as well as the principles of good administration andthe obligation to state reasons;Means 4 (primarily): Compliance with the obligation to state reasons and procedural rightsof Google Belgium as regards the finding of infringements of articles 6, 12.1 and 12.4 of the GDPRMeans 5 (mainly): The contested Decision complies with Articles 4.16 and 56.1 ofGDPRrPAGE□ 1- □□□□ 2220406-0032- □□ 41- □ 9- □ 1-THE[!]_J
Page 33
Court of Appeal Brussels - 2020 / AR / 1111 p. 33Means 6 (mainly): The contested Decision complies with Articles 3.1, 4. 7 juncto17.1 and 58.2 of the GDPR and in article 100, §ler, 9 ° of the APO LawMeans 7 (mainly): The ODA respected its obligation to provide reasons and its duty tothoroughness (compliant application of articles 6.1.f and 17 of the GDPR)Means 8 (mainly): Article 12 of the GDPR has been correctly interpreted by the DPAin the context of the contested DecisionMeans 9 (mainly): The APD respected the principle of legality of incriminations andpenaltiesMeans 10 (mainly): The contested Decision complies with Article 83.1 of the GDPR and Ieprinciple of proportionalityPlea 11 (mainly): The contested Decision complies with Articles 83.2 and 58.2.i} ofGDPR and respects the principle of motivationMeans 12 (mainly): The ODA complied with the requirements of article 83.2 of the GDPR and tookaccount for all relevant elements of the speciesPlea 13 (mainly): The contested Decision complies with the rule of cumulative finesprovided for in articles 83.3 of the GDPR and 103 of the APO lawPlea 14 (mainly): The reasoning of the contested Decision concerning the applicationof the territorial scope complies with the GDPRMedium 15 (infinitely subsidiary): Ancillary measuresMeans 16 (infinitely in the alternative): In the event of annulment of the contested Decision, there isplace to refer / 'case before /' APO.In means 1 and 2 X invokes:Medium 1 (on a preliminary basis): The demands set out by the conclusive and / 'APO santadmissibleMeans 2 (as a preliminary): The arguments developed by the DPA and the intervenerare not intended to supplement or correct the contested Decision.In the interlocutory judgment of February 17, 2021, the Court decided:"Holds X's voluntary intervention inadmissible except in so far as it is limited to supporting thethesis of / 'APO and to defend the merits of the contested decision and to hear himdeclare joint / 'judgment which will be delivered by the Court of the markets; "The Court of Markets has already ruled on the first plea.The second plea does not require a response since it confirms an uncontested principle inknow that the Contested Decision cannot be "motivated" in the context of the appeal, butthat it is necessary to rule on the basis of the merits of the reasons for the decision itself andnot what the parties would add to this motivation during the proceedings before theMarket Court.IPAGE01-00002220406-0033-0041-09-01-_J
Page 34
Court of Appeal Brussels - 2020 / AR / 1111 p. 34Insofar as the Markets Court rules on the merits of theGOOGLE BELGIUM (see point 6 above), the means developed by X must notbe examined since these means are not likely to lead to another decisionof the Court.8.3.As regards (plea 6, first part: "The ODA could legally impose thecompliance of the processing with Google Be / gium ” and second branch: “ The APD coulddraw a parallel between the role of the institution and that of the representative whiledistinguishing the respective situations ”, the Court observes that if, in order to satisfy the criteriaArticle 3 1. the RGPD, must Ie data processing to achieved personalby the controller is carried out "within the framework of the activities of aestablishment ' of this official in the territory of the Union, it turns out that in this caseGOOGLE BELGIUM did not carry out the disputed data processing.Under the GDPR article 4, 7 ° : a "controller", [is] the natural personor legal entity, public authority, service or other body which, alone or jointlytogether with others, determine the purposes and means of processing; when the purposes andmeans of this processing are determined by Union law or the law of a Statemember, the controller may be appointed or the specific criteriaapplicable to its designation may be provided for by Union law or by the law of aMember state;A " subcontractor [is] the natural or legal person, the public authority, the service oranother body which processes personal data on behalf of thecontroller; (article 4, 8 ° ).As specified in point 6 above, in this case GOOGLE LLC is responsible forprocessing and GOOGLE IRELAND Ltd is the main establishment in the European Union.While it is not disputed that there is a connection between the activities of the operator of thesearches (in this case Google LLC) and those of its establishment located in the Member Stateconcerned (GOOGLE BELGIUM), there is still a main establishment in the EU.The pleas relied on by X are therefore unfounded.9. The publication.9.1.GOOGLE BELGIUM asserts:" 15 th means: accessories Measures cancellationThe DPA has given the Impugned Decision publicity that goes beyond the mere publication ofthe Contested Decision on its website:• the DPA posted a press release (Exhibit C.9 bis) to announce its decision;• the DPA has posted a translation into English of the Attacked Decision (Exhibit C.9 ter), and thiseven before providing a translation into the other national languages;IPAGE01- □ 0 □□ 2220406-0034- □□ 41- □ 9- □ 1- iTHE_J
Page 35
Page 36
Page 37
Page 38
Page 39
Page 40
Court of Appeal Brussels -2020 / AR / 1111 p. 4011. the costs.The APO is the unsuccessful part.The procedural compensation amounts to EUR 1,440.The costs incurred by the voluntary intervener remain at its charge; it cannotclaim to a procedural indemnity.********FOR THESE REASONSRuling contradictorilyHaving regard to articles 24 and 43 bis § 3 in fine of the law of June 15, 1935Holds the appeal of SA GOOGLE BELGIUM inadmissible in so far as it relates to point (1) of theContested Decision and for the surplus admissible and founded as followsCancels points (2) to (5) of Decision n ° 37/2020 pronounced by the Litigation Chamberof the Data Protection Authority July 14, 2020 (DOS-2019-03780);Orders the Data Protection Authority to pay the costs, procedural compensation forthe GOOGLE BELGIUM SA set at EUR 1,440.00;In application of article 2692 of the Code of registration, mortgage andregistry, condemns the Data Protection Authority to pay to the beige State, SPF Finances, Ieright of putting to the roll of appeal (400 €).Holds the grounds invoked by X unfounded, says that the costs and expenses of X remain at his charge.r PAGE01-00002220406-0040-0041-09-01-THE_J
Page 41
Google Translate
Original text
dorsan.iolly@altius.com) avocats à BRUXELLES,
Contribute a better translation