APD/GBA (Belgium) - 157/2023

APD/GBA - DOS-2023-04144
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 21(2) GDPR
Type:	Complaint
Outcome:	Upheld
Started:	20.10.2023
Decided:	27.11.2023
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	DOS-2023-04144
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Dutch
Original Source:	APD (in NL)
Initial Contributor:	n/a

Belgian Data Protection Authority issued a preliminary decision in which, on the basis of Article 21 of GDPR it orders the controller to comply with a request of data subject to delete data used for direct marketing communication.

English Summary

Facts

The plaintiff received marketing information from the defendant on 21 June 2023. The next day, on 22 June 2023 they requested that the marketing information is no longer being send and unsubscribed from the newsletter. Despite that request, the plaintiff continued to receive marketing e-mails from the defendant. Plaintiff notified the defendant of this fact on September 6. After receiving again marketing e-mail communication, the plaintiff lodged a complaint with the ADP on October 6.

Holding

ADP noted that the Belgian law does not contain any specific definition of direct marketing. Similarly, such legal, official or generally accepted definition does not exist at European level. With that in mind, the ADP decided to build on the definition provided in CBPL Recommendation No. 02/2013 of 30 January 2013 on direct marketing and protection of personal data on the one hand and the proposal of Regulation of the European Parliament and of the Council of 18 September 2019 on respect for privacy and the protection of personal data in electronic communications and repealing Directive 2002/58/EC123.

With this in in mind, the ADP notes that on the basis of Article 21 GDPR, each person has a right to object to having their data processed for direct marketing. Under the definition of direct marketing used by the authority, communication to the plaintiff could have been considered to be direct marketing, and as such the defendant should have answered in accordance with requirements of art 12 of GDPR. As the plaintiff continued to receive marketing information, clearly the data was not deleted pursuant to the plaintiff exercising their right to objection, and thus the authority could require them to reject such information. Decision issued in the case was a preliminary one on the basis of art 100 para 6 Loi portant création de l'Autorité de protection des données, which allows the Authority to issue a preliminary decision in which it orders that the requests of the person concerned to exercise his rights be complied with.

Decision is not final and the controller may present its own claims.

Comment

CBPL Recommendation defines direct marketing as follows:

(32) In this Regulation, direct marketing refers to any form of advertising by which a natural or legal person sends direct marketing communications directly to one or more identified or identifiable end-users using electronic communications services. In addition to the offering of products and services for commercial purposes, this should also include messages sent by political parties that contact natural persons via electronic communications services in order to promote their parties. The same should apply to messages sent by other non-profit organisations to support the purposes of the organisation.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

1/7
Dispute Chamber
Decision 157/2023 of November 27, 2023
File number: DOS-2023-04144
Subject: Removal of email address from a mailing list for marketing purposes
The Disputes Chamber of the Data Protection Authority, composed of Mr
Hielke HIJMANS, sole chairman;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of
personal data and regarding the free movement of such data and to the revocation of
Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”;
Having regard to the law of 3 December 2017 establishing the Data Protection Authority,
hereinafter “WOG”;
In view of the internal rules of order, as approved by the House of Representatives
Representatives on December 20, 2018 and published in the Belgian Official Gazette on
January 15, 2019;
Considering the documents in the file;
Made the following decision regarding:
The complainant: Mr.
The defendant: Mrs. Y, hereinafter “the defendant”.
Decision 157/2023 — 2/7
I. Facts and procedure
1. The complaint relates to the insufficient compliance with the complainant's right to
to object to the receipt of unwanted direct marketing emails.
The complainant will receive direct marketing from the defendant on June 21, 2023. On June 22, 2023
requests the complainant to be unsubscribed from the mailing list. Confirmed the same day
the defendant that the complainant was unsubscribed from the newsletters. On September 6
2023, the complainant informs the defendant that he is still receiving direct marketing.
After the complainant receives direct marketing again on October 6, 2023, the complainant brings
informs the defendant that he will file a complaint with the GBA.
2. On October 7, 2023, the complainant will submit a complaint to the Data Protection Authority
against the defendant.
3. On October 20, 2023, the complaint will be declared admissible by the First Line Service on
under Articles 58 and 60 of the WOG1 and the complaint is filed under Article 62,
§ 1 of the WOG transferred to the Disputes Chamber2
.
II. Justification
4. The complainant wishes to unsubscribe from the defendant's newsletters. The GDPR
does not define what is meant by “direct marketing”. To date, none exists
legal, official or generally accepted definition of this concept at European level.
Building on Recommendation No. 02/2013 of the CBPL of January 30, 2013 regarding
direct marketing and protection of personal data on the one hand and the proposal of
regulation of the European Parliament and of the Council of 18 September 2019 on
respect for privacy and the protection of personal data in electronic
communications and repealing Directive 2002/58/EC123
, the GBA proposes to
define the concept of direct marketing as follows:
“Any communication, in any form, solicited or unsolicited, originating from a
organization or person and aimed at the promotion or sale of services, products (al
without payment), as well as brands or ideas, addressed by an organization or
person acting in a commercial or non-commercial context, who directly
1 In accordance with Article 61 of the WOG, the Disputes Chamber hereby informs the parties that the complaint is admissible
declared.
2 In accordance with Article 95, § 2 of the WOG, the Disputes Chamber hereby informs the parties that the file will be sent to
has been transferred to her as a result of this complaint.
3 The text can be found via this link: https://eur-lex.europa.eu/legalcontent/EN/TXT/PDF/?uri=CONSIL:ST_12293_2019_INIT&from=EN
Decision 157/2023 — 3/7
is addressed to one or more natural persons in a private or professional context and
which involves the processing of personal data.”
4
5. The (unsolicited) communication is aimed at promoting the activities and the
promoting the defendant's image to the public, in this case cooperation
to the development of legislation. The message is addressed to identified persons
natural persons (cf. the address by name of the recipients) and becomes
sent via electronic communication, more specifically by e-mail. The Dispute Chamber
therefore concludes that the newsletters received by the complainant are direct marketing
to finish.
6. Article 21.2 GDPR stipulates that every data subject whose personal data is used
for direct marketing has the right to “object to the processing of him
concerning personal data for such marketing, including profiling
relates to direct marketing". The third paragraph of the same article stipulates that
"[w]hen the data subject objects to processing for direct
marketing, the personal data will no longer be processed for these purposes."
When a data subject objects to the processing of data for direct
marketing purposes, he does not have to justify his objection.
7. In accordance with Article 12.3 GDPR, the controller provides the
person concerned without delay and in any case within one month of receipt of the request
pursuant to Articles 15 to 22 GDPR information about the action taken on the request
is given. Depending on the complexity of the requests and the number of requests
that period may be extended by a further two months if necessary. The
the controller shall inform the data subject within one month of receipt of the
request of such extension.
8. The Disputes Chamber determines that the complainant's personal data, such as his email address, have indeed been used for direct marketing, since the complainant is a
direct marketing email on June 22, 2023. The Disputes Chamber also states
fixed the request dated. June 23, 2023 from the complainant to be removed from the mailing list
constitutes the exercise of his right to object within the meaning of Article 21.2 GDPR, because his
request that his data may no longer be used for a specific purpose,
namely direct marketing.
9. It is the responsibility of the defendant, in her capacity
controller, to respond to the exercise of the rights of the
data subjects in accordance with the conditions of Article 12.3 of the GDPR (see above,
marginal number 5). The Disputes Chamber notes that the answer dated June 23, 2023 of the
4 https://www.gegevensbeschermingsautoriteit.be/publications/aanadvies-nr.-01-2020.pdf
Decision 157/2023 — 4/7
defendant to the request for removal from the complainant's mailing list in a timely manner
answer constitutes a response in accordance with Article 12.3 GDPR. However, the complainant submits documents
which shows that he received another direct marketing email on October 6, 2023. The
The Disputes Chamber can deduce from this that appropriate action may not have been taken
to the complainant's objection.
10. The Disputes Chamber is of the opinion that on the basis of the above analysis
concluded that the defendant had violated the provisions of the GDPR
committed, which justifies taking a decision in this case
decision on the basis of Article 95, § 1, 5° of the WOG, more specifically the defendant
order to comply with the claimant's request to object to the processing
of his data for direct marketing purposes in accordance with Article 21.2 GDPR.
11. This decision is a prima facie decision taken by the Disputes Chamber
in accordance with Article 95 of the WOG on the basis of the complaint submitted by the complainant,
in the context of the “procedure prior to the decision on the merits”
5 and none
decision on the merits of the Disputes Chamber within the meaning of Article 100 of the WOG.
The Disputes Chamber has thus decided, on the basis of Article 58.2.c) GDPR and
Article 95, § 1, 5° of the WOG, to order the defendant to comply with the request
of the data subject to exercise his rights, in particular the right to object such as
determined in article 21.2 GDPR.
12. The purpose of this decision is to inform the defendant of the fact that
it has committed an infringement of the provisions of the GDPR and this is possible
to still comply with the aforementioned provisions.
13. However, if the defendant does not agree with the contents of this fine
facie decision and is of the opinion that it may allow factual and/or legal arguments
funds that could lead to a different decision can be made via the e-mail address
litigationchamber@apd-gba.be send a request to hear the merits of the case
to the Disputes Chamber within 30 days of notification
decision. The implementation of this decision will be carried out if necessary
suspended for the aforementioned period.
14. In the event of a continuation of the merits of the case, the
Dispute Chamber the parties on the basis of Articles 98, 2° and 3° in conjunction with Article 99 WOG
invite them to submit their defenses as well as any documents they consider useful in the case
file to add. If necessary, the present decision will be permanently suspended.
5 Section 3, Subsection 2 of the WOG (Articles 94 to 97).
Decision 157/2023 — 5/7
15. Finally, for the sake of completeness, the Disputes Chamber points out that a hearing on the merits
of the case may lead to the imposition of the measures stated in Article 100 WOG6
.
III. Publication of the decision
16. Considering the importance of transparency with regard to decision-making
Dispute Chamber, this decision will be published on the website of the
Data Protection Authority. However, it is not necessary that the
identification details of the parties are disclosed directly.
6 Article 100. § 1. The Disputes Chamber has the authority to:
1° to dismiss a complaint;
2° to order the dismissal of prosecution;
3° order the suspension of the ruling;
4° to propose a settlement;
5° formulate warnings and reprimands;
6° order that the data subject's requests to exercise his rights be complied with;
7° to order that the person concerned is informed of the security problem;
8° order that processing be temporarily or permanently frozen, restricted or prohibited;
9° to order that the processing be brought into compliance;
10° the rectification, restriction or deletion of data and its notification to the recipients of the data
recommend data;
11° order the withdrawal of the recognition of certification bodies;
12° to impose penalty payments;
13° to impose administrative fines;
14° the suspension of cross-border data flows to another State or an international institution
command;
15° to transfer the file to the public prosecutor's office in Brussels, who will inform it of the
follow-up given to the file;
16° decide on a case-by-case basis to publish its decisions on the website of the
Data Protection Authority.
Decision 157/2023 — 6/7
Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the
notice, an appeal against this decision will be filed with the Market Court (court of
appeal Brussels), with the Data Protection Authority as defendant.
FOR THESE REASONS,
the Disputes Chamber of the Data Protection Authority decides, with reservations
from the submission of a request by the defendant for a hearing on the merits
in accordance with Article 98 et seq. of the WOG, to:
- on the basis of Article 58.2.c) of the GDPR and Article 95, § 1, 5° of the WOG the
order the defendant to comply with the data subject's request
to exercise its rights, in particular the right to object (Article 21.2 GDPR), and
to delete the personal data from the mailing list immediately
marketing purposes and this within 30 days from the
notification of this decision;
- order the defendant to contact the Data Protection Authority (Dispute Chamber)
by e-mail within the same period of the consequences
this decision will be given via the email address litigationchamber@apd-gba.be;
and
- in the absence of timely implementation of the above stated by the defendant,
to consider the merits of the case ex officio in accordance with Articles 98 et seq.
of the WOG.
Decision 157/2023 — 7/7
Such an appeal can be lodged by means of an inter partes petition
must contain information listed in Article 1034ter of the Judicial Code7
. It
an objection petition must be submitted to the registry of the Market Court
in accordance with article 1034quinquies of the Ger.W.8
, or via the e-Deposit
IT system of Justice (Article 32ter of the Judicial Code).
(get). Hielke HIJMANS
Chairman of the Disputes Chamber
7 The petition states, under penalty of nullity:
1° the day, month and year;
2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
company number;
3° the surname, first name, place of residence and, where applicable, the capacity of the person to be
summoned;
4° the subject matter and brief summary of the grounds of the claim;
5° the judge before whom the claim is brought;
6° the signature of the applicant or his lawyer.
8 The petition with its appendix will be sent by registered letter in as many copies as there are parties involved
deposited with the clerk of the court or at the registry.