APD/GBA (Belgium) - 161/2023: Difference between revisions
From GDPRhub
mNo edit summary |
m (→Facts) |
||
| Line 70: | Line 70: | ||
=== Facts === | === Facts === | ||
On 19 July 2023, a data subject lodged a complaint through her representative, noyb, to the Belgian DPA (“APD”) against Les Editions de l’Avenir Presse (“controller”). More specifically, the complaint denounced 4 alleged practices on the controller’s website. Firstly, the fact that there was | On 19 July 2023, a data subject lodged a complaint through her representative, ''noyb'', to the Belgian DPA (“APD”) against Les Editions de l’Avenir Presse (“controller”). More specifically, the complaint denounced 4 alleged practices on the controller’s website. Firstly, the fact that there was no 'refuse' option on the first layer of the cookie banner. Secondly, that the "cookie banner" used "misleading button colours". Thirdly, the complaint stated that it is not as easy to withdraw consent as it is to give it. Finally, the data subject called into question the legality of the reference to legitimate interest on the website. | ||
On 21 September 2023, the APD sent a letter to both parties informing them of its intention to propose a settlement in accordance with Belgian law. | On 21 September 2023, the APD sent a letter to both parties informing them of its intention to propose a settlement in accordance with Belgian law. | ||
The data subject asked for clarifications and/or adjustments on several points. The APD indicated that the proposed settlement would not be modified in accordance with the data subject’s requests. | |||
=== Holding === | === Holding === | ||
Firstly, the APD noted that there was no “refuse” option at the first layer of information in the cookie banner. The first condition of the settlement was that the controller provided a “decline all” button within one month from the date of the settlement decision. The representative of the data subject had asked that the APD explicitly added that this condition meant that the “decline all” option must be provided on the first layer of the cookie banner. The APD rejected this request considering that it was not clear how this request would lead to a different concrete result. | |||
Firstly, the APD noted that there was no “refuse” option at the first layer of information in the cookie banner. The first condition of the settlement was that the controller provided a “decline all” button | |||
Secondly, the APD indicated that the controller used misleading button colours, and therefore the second condition of the settlement was that the controller would ensure that the “decline all” button would be no less visually appealing than the partial or total acceptance of the installation of cookies that are not strictly necessary. The representative of the data subject asked that they explicitly | Secondly, the APD indicated that the controller used misleading button colours, and therefore the second condition of the settlement was that the controller would ensure that the “decline all” button would be no less visually appealing than the partial or total acceptance of the installation of cookies that are not strictly necessary. The representative of the data subject had asked that they explicitly added that a no less visually appealing display includes, but is not limited to, that the option “decline all” and “accept and close” must be of the same size, colour, shape, contrast and location. The APD rejected this request because neither the DPA, nor the data subject may determine if the buttons must have the exact same characteristics. It is up to the controller to decide, and the APD argued that the controller may decide to make the “decline all” option more attractive, or to innovate in the use of colours. | ||
Thirdly, the APD considered that it was not as easy to withdraw consent as it was to give it under [[Article 7 GDPR#3|Article 7(3) GDPR]]. The third condition of the settlement was that the controller guarantee a procedure for withdrawal of consent that would not require more steps (in terms of ‘clicks’) than those required to give consent. | Thirdly, the APD considered that it was not as easy to withdraw consent as it was to give it under [[Article 7 GDPR#3|Article 7(3) GDPR]]. The third condition of the settlement was that the controller guarantee a procedure for withdrawal of consent that would not require more steps (in terms of ‘clicks’) than those required to give consent. | ||
Fourthly, the APD noted that the controller | Fourthly, the APD noted that the controller referred to legitimate interest. The fourth condition of the settlement was that the controller use legitimate interest as a legal basis only in the case of the placement of technical or functional cookies that are strictly necessary. | ||
Finally, the representative of the data subject requested that an administrative fine be imposed as part of the settlement with regard to [[Article 83 GDPR#1|Article 83(1) GDPR]]. The APD considered that the settlement was intended to achieve a general resolution without sanctions and highlighted the effectiveness of this process. | Finally, the representative of the data subject had requested that an administrative fine be imposed as part of the settlement with regard to [[Article 83 GDPR#1|Article 83(1) GDPR]]. The APD considered that the settlement was intended to achieve a general resolution without sanctions and highlighted the effectiveness of this process. | ||
The APD indicated that the controller has 30 days from receipt of the transaction proposal to indicate whether or not it accepts it, and the representative of the data subject may comment on the proposal and terms and conditions within 14 days of receipt of the letter. | The APD indicated that the controller has 30 days from receipt of the transaction proposal to indicate whether or not it accepts it, and the representative of the data subject may comment on the proposal and terms and conditions within 14 days of receipt of the letter. | ||
Revision as of 14:15, 6 February 2024
| APD/GBA - 161/2023 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 4(11) GDPR Article 6(1)(a) GDPR Article 7 GDPR |
| Type: | Complaint |
| Outcome: | Other Outcome |
| Started: | 19.07.2023 |
| Decided: | 01.12.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | Les Editions de l'Avenir Presse |
| National Case Number/Name: | 161/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | French |
| Original Source: | Autorité de protection des données (in FR) |
| Initial Contributor: | nzm |
The Belgian DPA proposed a settlement to a controller asking them to modify their cookie banner in order to comply with Article 4(11), 6(1)(a) and 7 GDPR.
English Summary
Facts
On 19 July 2023, a data subject lodged a complaint through her representative, noyb, to the Belgian DPA (“APD”) against Les Editions de l’Avenir Presse (“controller”). More specifically, the complaint denounced 4 alleged practices on the controller’s website. Firstly, the fact that there was no 'refuse' option on the first layer of the cookie banner. Secondly, that the "cookie banner" used "misleading button colours". Thirdly, the complaint stated that it is not as easy to withdraw consent as it is to give it. Finally, the data subject called into question the legality of the reference to legitimate interest on the website.
On 21 September 2023, the APD sent a letter to both parties informing them of its intention to propose a settlement in accordance with Belgian law.
The data subject asked for clarifications and/or adjustments on several points. The APD indicated that the proposed settlement would not be modified in accordance with the data subject’s requests.
Holding
Firstly, the APD noted that there was no “refuse” option at the first layer of information in the cookie banner. The first condition of the settlement was that the controller provided a “decline all” button within one month from the date of the settlement decision. The representative of the data subject had asked that the APD explicitly added that this condition meant that the “decline all” option must be provided on the first layer of the cookie banner. The APD rejected this request considering that it was not clear how this request would lead to a different concrete result.
Secondly, the APD indicated that the controller used misleading button colours, and therefore the second condition of the settlement was that the controller would ensure that the “decline all” button would be no less visually appealing than the partial or total acceptance of the installation of cookies that are not strictly necessary. The representative of the data subject had asked that they explicitly added that a no less visually appealing display includes, but is not limited to, that the option “decline all” and “accept and close” must be of the same size, colour, shape, contrast and location. The APD rejected this request because neither the DPA, nor the data subject may determine if the buttons must have the exact same characteristics. It is up to the controller to decide, and the APD argued that the controller may decide to make the “decline all” option more attractive, or to innovate in the use of colours.
Thirdly, the APD considered that it was not as easy to withdraw consent as it was to give it under Article 7(3) GDPR. The third condition of the settlement was that the controller guarantee a procedure for withdrawal of consent that would not require more steps (in terms of ‘clicks’) than those required to give consent.
Fourthly, the APD noted that the controller referred to legitimate interest. The fourth condition of the settlement was that the controller use legitimate interest as a legal basis only in the case of the placement of technical or functional cookies that are strictly necessary.
Finally, the representative of the data subject had requested that an administrative fine be imposed as part of the settlement with regard to Article 83(1) GDPR. The APD considered that the settlement was intended to achieve a general resolution without sanctions and highlighted the effectiveness of this process.
The APD indicated that the controller has 30 days from receipt of the transaction proposal to indicate whether or not it accepts it, and the representative of the data subject may comment on the proposal and terms and conditions within 14 days of receipt of the letter.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/24
Litigation Chamber
Decision 161/2023 of December 1, 2023
File number: DOS-2023-03284
Subject: settlement decision following a complaint regarding cookies on a site
web of “Les Editions de l’Avenir Presse SRL” (“L’Avenir” website)
The Litigation Chamber of the Data Protection Authority, made up of Mr.
Hielke HIJMANS, president, sitting alone;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the
protection of natural persons with regard to the processing of personal data and
to the free movement of these data, and repealing Directive 95/46/EC (General Regulation on the
data protection), (hereinafter “GDPR”);
Having regard to the Law of December 3, 2017 establishing the Data Protection Authority (hereinafter
“LCA”);
Having regard to the Law of July 30, 2018 relating to the protection of individuals with regard to
processing of personal data (hereinafter “LTD”);
Considering the Internal Regulations as approved by the House of Representatives on 20
December 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Has taken the following decision regarding:
The complainant: Ms. X, […], represented by noyb – European Center for Digital Rights, […], herein
after “the complainant”;
The party in transaction: L ESE DITIONSDE L’AVENIR PRESSE SRL, whose head office is established in
[…] represented by Me Frédéric DECHAMPS and Me Maxime ADAM, whose
firm is located […], hereinafter: “the party in transaction”. Decision 161/2023 — 2/24
I. Procedure prior to the transaction
I.1. The complaints
1. On July 19, 2023, the complainant, through her representative, filed a complaint
with the Data Protection Authority (hereinafter “DPA”) against the party in
transaction. 1
2. The subject of the complaint concerns several elements linked to the installation of cookies on the site
web “https://www.lavenir.net/”delapartientransaction (hereinafter “thewebsite” or “thesite
litigious "). The complainant refers to the legislation which she considers relevant in matters
2
of consent. The complaint refers to “misleading cookie banners” and
“obscure patterns”. The complaint also mentions reports and communications
both the European Data Protection Board (hereinafter “EDPB”) and the DPA
Belgian concerning the obligations relating to the installation of cookies involving the
processing of personal data.
3. More specifically, the complainant denounces four alleged practices on the websites
mentioned above which adversely affect him. First, the fact that there is “no option
“refuse” at the first level of information in the cookie banner. Secondly, that
the “cookie banner” would use “misleading button colors”. Third,
Laplainte indicates that “it is not as easy to withdraw consent as to give it.”
Finally, the complainant's fourth complaint calls into question the legality of the "reference to
legitimate interest” on the website.
4. On August 4, 2023, the APD Front Line Service (hereinafter “SPL”) contacted the
complainant to request information “as to the interest of the complainant in the introduction
of the complaint”. Subsequently, exchanges took place between the representative of the complainant and the
SPL regarding this issue.
5. On August 25, 2023, the complaint was declared admissible by the SPL under articles 58 and 60
of the LCA and is transferred to a file in the Litigation Chamber under article
62(1) of the ACA .4
6. On September 1, 2023, the representative of the complainant sends the SPL a document
explaining in more detail the complainant's interest.
1During the proceedings it was mentioned that the complaint was initially filed on July 18, as indicated in the
complaint filed by the complainant herself. However, it should be clarified that the complaint is not officially
2Arrival at the APD until the following day.
In particular, article 10/2 of the law of July 30, 2018 relating to the protection of individuals with regard to
processing of personal data, M.B. 05/09/2018 (implementing provisions of the “e-Privacy Directive”) and
3 Article 6.1.a. of the GDPR.
In accordance with article 61 of the LCA, the Litigation Chamber informs the parties that the complaint has been declared admissible.
4In accordance with article 95 §2 of the LCA, the Litigation Chamber informs the parties that the file has been transmitted to it
following this complaint. Decision 161/2023 — 3/24
7. In the document dated September 1, 2023, the representative of the complainant makes
reference to the conditions of admissibility set out in the LCA - to which the complaint
satisfied - and declares that "the reason why the front line service of your
authority requests additional justification of the complainant's interest in filing
complaints is not clear to [the representative].” The representative emphasizes that the
data of the complainant have actually been processed and that the complainant is a
data subject within the meaning of the GDPR.
8. As part of an efficient procedure, the Litigation Chamber does not pursue
further examination of the aspects linked to the interests of the complainant which have already been addressed in
communications between the complainant's representative and the SPL.
I.2.The transaction proposal
9. On September 21, 2023, the Litigation Chamber sends a letter to the representative of the
complaining party and the transacting party, informing them of its intention to offer a
transaction, in accordance with article 95, § 1, 2° of the LCA. The notification mentions
also that the Litigation Chamber - through this communication - considers
that the deadline for contacting the Inspection Service under article 96, § 1 of the LCA is
interrupted. From this moment, the parties also have the possibility of consulting the
administrative file, a request that they both subsequently make.
10. On October 20, 2023, the transaction proposal is sent to the transacting party and
to the complainant. The content of this transaction proposal is fully reproduced
in the annex to this settlement decision and forms an integral part thereof. In 5
particular, this transaction proposal includes all the conditions - of procedure and
merits - as well as the deadlines to which the parties must respectively respond.
I.3.The complainant's response
11. On October 30, 2023, the representative of the complainant sent a letter to the Chamber
Contentious. On November 3, 2023, the representative of the complainant also transmitted the
letter to the party in transaction, because it was not clear to him that he also had to provide it
to the transacting party.
12. In her response to the proposed settlement, the complainant requests
clarifications and/or adjustments on several “points”. The complainant concludes
by the following paragraph: “The complainant emphasizes that if the content of the proposal for
5
However, it should be noted that an “erratum” was inserted at point f), the initial text wrongly indicating “(in the present case,
there is no complaint underlying the file). Decision 161/2023 — 4/24
transaction is modified in favor of the defendant party [transacting party] or if the
above-mentioned requests of the complainant are not satisfied (in their entirety), the
plaintiff will be forced to appeal the formal settlement decision.”
13. The Litigation Chamber reiterates - for the sake of decisional clarity - the requests for
the complainant set out in section II of this decision, then the Litigation Chamber
responds concretely to requests.
14. On November 6, 2023, the Litigation Chamber responded by confirming that the proposal for
transaction will not be modified in accordance with the requests of the complainant. However,
the Litigation Chamber specifies that it intends to publish the decision without omitting the
identification data of the party in transaction, in accordance with article 95, §1, 8° of the
LCA.
I.4. Requests of the transacting party and conclusion of the transaction
15. On November 17, 2023, the transacting party confirms that it fully accepts
all the conditions of the transaction proposal. On November 20, 2023, the Chamber
Litigation confirms that the notification of the party in transaction formalizes the conclusion
of a transaction, thus resulting in this transaction decision.
II. Conditions of the transaction and grounds for rejecting the plaintiff's requests
II.1General considerations
16. During the transaction process, no changes were made to the terms of the transaction.
transaction as set out in the transaction proposal. These terms
remain fully valid under the transaction. Although they are not repeated
in this section, they are annexed to this decision.
17. The Litigation Chamber further specifies that the acceptance of a proposal for
transaction will in no case be interpreted as an admission of guilt, and
cannot therefore be used as an aggravating circumstance to determine the
sanctions in future proceedings before the Litigation Chamber.
18. The Litigation Chamber specifies that, in the interest of adequate procedure, the procedure
transaction is divided into two distinct stages, namely the transaction proposal
on the one hand, and the transaction decision on the other hand. This clear division allows all
parties concerned to understand precisely the starting and stopping points of the
procedure, while retaining the possibility of appealing at each stage thanks to the inclusion Decision 161/2023 — 5/24
appeal clauses. This approach also aims to promote transparency in the
transaction process, a principle to which the Litigation Chamber fully adheres.
19. Finally, this decision is a prima facie decision taken by the Litigation Chamber
in accordance with article 95 of the LCA on the basis of the complaint filed by the complainant,
within the framework of the “procedure prior to the decision on the merits” and not a decision on
the merits of the Litigation Chamber within the meaning of article 100 of the LCA.
II.2 Complainant's requests rejected
20. The complainant made several requests to the Litigation Chamber, which were not
resulted in a modification of the transaction proposal. However, the Chamber
Contentious will proceed to the publication of this transaction decision on the website of
the Data Protection Authority (see section III of this decision), in accordance
at the request of the complainant, which constitutes a decision distinct from the transaction under
of article 95, §1, 8° of the LCA.
21. The Litigation Chamber sets out below the reasons why the others
requests are not accepted. It should be noted that these patterns are integrated into the
this decision, so that they fall clearly within the framework of the economy
generally established procedural procedure.
22. Firstly, with regard to the first condition of the proposed transaction, the
complainant requests “[to] explicitly add to the first condition of the proposal
transaction that this condition means that the option ‘refuse all’ must be provided on the
same, first ‘layer’ as the ‘accept and close’ option. ".
• The Litigation Chamber rejects this request for the following reason. He is not
clear how this request would lead to a different concrete result on the sites
contentious in relation to the current wording of the first and fifth conditions.
The Litigation Chamber considers that the proposed modification would not improve the
stipulated condition (see section c.1. of the transaction proposal).
23. Secondly, with regard to the second condition, the complainant requests “[to]
explicitly add to the second condition of the transaction proposal that
‘no less (visually) attractive’ display includes, but is not limited to, that the option
‘refuse all’ and the ‘accept and close’ option must have the same size, color,
same shape, same contrast and same location of the button/option. »
• The Litigation Chamber rejects this request for the following reason.
neither the Litigation Chamber nor the plaintiff to determine that the buttons must
6
Section 3, subsection 2 of the LCA (articles 94 to 97). Decision 161/2023 — 6/24
have (exactly) the same characteristics. This choice is made by the person responsible for
treatment. It is true that buttons with exactly the same characteristics
are clearly identical for the purposes of consent. Conversely, it is not excluded
the data controller decides to make the “refuse all” option more attractive
or to innovate in the use of colors (which, for example, display options
essentially equivalent) in order to facilitate the choice of the person concerned. There
condition formulated more generally in the transaction proposal
regarding the display "no less (visually) attractive" is therefore sufficient to
the Litigation Chamber.
24. Thirdly, with regard to the third condition, the complainant proposes the
following text modification:
“The defendant undertakes to develop and implement, within a period of one
month, a mechanism on the website of “https://www.lavenir.net/” in accordance with the
requirements
defined in the above-mentioned policy documents, aimed at achieving an outcome
equivalent. The data controller also guarantees that the processing procedure
revocation of consent (withdrawal of consent) will not require further
steps (in terms of 'clicks') than those required to give consent.
permanently visible and visually identifiable option must be available on
all pages of the website to reopen cookie settings with a single click.
The same number of steps for withdrawal of consent will be counted from
from the moment the end user reopens the cookie settings. This will be done in
following an equivalent number of steps from the moment the end user
reaches the cookie settings page, which should be clearly accessible from
all pages of the website in question. All technical changes
made by the defendant for this purpose must be recorded in a
summary document, which will be developed during implementation and transmitted to the
Litigation Chamber and the complainant. Implementation of these changes
techniques, as well as the preparation and transmission of the summary document,
must be carried out within a period [sic] of one month from the decision of
transaction. » (The underlined part does not appear in the current proposals)
• The Litigation Chamber completely rejects this request for modification of the
condition for the following reason. The Contentious Chamber takes note of the point of view
of the complainant according to which she wants an “option permanently visible and
visually identifiable” on all web pages of the disputed site. Bedroom
Contentious, seeking to reach a reasonable and technically sound transaction Decision 161/2023 — 7/24
achievable with the transaction, considers that it is not appropriate to require such
changes as part of a transaction.
25. Fourth, the plaintiff requests that “an injunction of
cease unlawful processing”, which should read as follows:
“The controller undertakes to erase all personal data processed
due to cookies that have not been placed in accordance with the content herein
formal decision of transaction on the website of “https://www.lavenir.net” and at
communicate this erasure obligation
to all recipients to whom the personal data has been provided
in this context. Proof of erasure of personal data and
the communication of this obligation to erase personal data to
all recipients will be recorded in a summary document at the time of
implementation and transmitted to the Litigation Chamber and to the complainant.
The erasure of personal data and the communication of this
obligation to erase personal data to all recipients, including
including the preparation and transmission of the document, must take place within a time limit
one month after the formal transaction decision has been taken. »
• The Litigation Chamber rejects this request for the following reason. On the base
of the elements available in the administrative file, the complainant did not
addressed to the controller due to the alleged violation of their rights.
The Litigation Chamber therefore considers that it is not appropriate, in this case, to
propose such a condition, much less address an order on this subject to the
party in transaction. The complainant is of course free to contact anyone
controller with respect to which it can exercise its rights within the framework of
the legislation in force.
26. Fifth, the complainant requests the imposition of an administrative fine in the context of
of the transaction “having regard to article 83, paragraph 1, of the GDPR law”.
• The Litigation Chamber rejects this request for the following reason. Taxation
of an administrative fine is a competence which can be exercised by the
Litigation Chamber under article 100, §1, 13° of the LCA. In this sense, no
administrative fine as requested by the complainant cannot be imposed on this
stage before substantive processing under Article 95 of the ACL. It is true that
Article 107 of the LCA indicates that the legislator intended that transactions - without
clarify whether this can also be done under section 95 of the ACL - allow
also to receive sums of money, but this is not a condition of
the instrument of the transaction, as already indicated by the Litigation Chamber in the
transaction proposal. The transaction aims to achieve a general resolution of Decision 161/2023 — 8/24
grievances of the complainant, without it being necessary to sanction him. Bedroom
Litigation highlights the effectiveness of the process in this regard.
27. Sixth, the plaintiff requests that the settlement decision “include
also the fact that the responsible party [transacting party] waives any claim
civil or other related to the formal transaction decision, for example, but not limited to,
the possibility of negative publicity regarding this formal transaction decision."
• The Litigation Chamber rejects this request for the following reason.
of an essential request with regard to the grievances formulated by the complainant in her
complaint.
28. Seventh, the complainant requests that the settlement decision be published on the website
website of the Data Protection Authority.
• The Litigation Chamber can grant this request, through section III
of this decision.
III. Publication of the decision
29. Given the importance of transparency regarding the decision-making process of the Chamber
Contentious, this settlement decision is published on the Authority’s website
data protection. However, it is not necessary for this purpose that the data
identification of the complainant are directly communicated, since they are not
relevant.
30. However, the Litigation Chamber chooses to publish the names of the representative of the
complainant and the transacting party. Indeed, it is in the public interest that the citizen
can become aware, in the most transparent manner possible, of the procedures
transactions that lead to (visual) changes on websites frequently
visited, such as the disputed sites. Indeed, the journalistic publications on these websites
are by nature aimed at a wide audience, and visitors to these sites have an interest in being informed of
aspects related to data protection. For the sake of completeness, the Litigation Chamber
underlines that the representative of the complainant himself gave publicity to the complaints.
FOR THESE REASONS ,
The Litigation Chamber of the Data Protection Authority decides:
- under article 95, §1,2° of the LCA, validate the transaction as accepted
by the transacting party on November 17, 2023, subject to the conditions
fixed and specified in this decision and its annex. Decision 161/2023 — 9/24
In accordance with article 108, § 1 of the LCA, an appeal against this decision may be lodged,
within thirty days from its notification, to the Court of Markets (court
of Appeal of Brussels), with the Data Protection Authority as defendant.
Such an appeal may be introduced by means of an interlocutory request which must contain the
information listed in article 1034ter of the Judicial Code. The interlocutory request must be
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 8
via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. judic.).
(s.) Hielke H IJMANS
President of the Litigation Chamber
7
The request contains barely any nullity:
1° the indication of the day, month and year;
2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualifications and his national register number or
Business Number ;
3° the surname, first name, address and, where applicable, the status of the person to be summoned;
4° the object and summary of the means of the request;
5° indication of the judge who is seized of the request;
6° the signature of the applicant or his lawyer.
8 The request, accompanied by its annex, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court registry. Decision 161/2023 — 10/24
Annex – transaction proposal Decision 161/2023 — 11/24
Litigation Chamber BY EMAIL
To the attention of Les Editions de l’Avenir Presse srl,
[…]
Secretariat
Represented by Me Frédéric DECHAMPS, whose firm
T: +32 (0)2 274 48 56 is located […]
Email: litigationchamber@apd-gba.be
Via the email address: […]
Respondent
BY EMAIL
To the attention of NOYB – European Center for Digital Rights,
representative of Mrs.
Via the email address […]
Complainant
Your references Our references Annex(es) Date
NOYB: C-062-12 DOS-2023-03284 1 10/20/2023
Subject: Application of article 95, § 1, 2° of the LCA - Transaction proposal in the file
complaint from Mrs.
on its website “https://www.lavenir.net/”
Dear,
9
The Litigation Chamber first refers to the letter it previously sent to the
defendant and the plaintiff, informing them of his intention to send a settlement proposal
in the current case. This document contains said transaction proposal. Being
given the large volume of files awaiting examination by the Litigation Chamber, which
causes considerable delays in the processing of all files, the Chamber
Litigation decided, under article 95, §1, 2° of the law creating the Authority of
10
data protection (hereinafter “LCA”), to explore the possibility of a proposal for
transaction in the file referred to under heading (“transaction proposal”) through the
9
10registered letter dated September 21, 2023.
M.B., January 10, 2018. Decision 161/2023 — 12/24
this letter. In addition, the Litigation Chamber takes into account the fact that it deals with –
currently – a large number of complaints about cookies. Although the question of
“cookies” is a priority of the Data Protection Authority, the Litigation Chamber must
exercise careful selection of the files to be processed in order to guarantee that it can address
various matters relevant to the company with due diligence. In this regard, the legislator
Belgian underlined the need for the Litigation Chamber to be able to act selectively
12
with a view to ensuring effective implementation of their skills.
This proposed transaction is formulated without any prejudicial acknowledgment and
does not commit the Litigation Chamber as to a position that it could adopt in the event of
refusal of the said proposal. If the receiving party of this transaction proposal refuses it
expressly, the Litigation Chamber will continue the procedure. In the event of findings of
violations, the Litigation Chamber will be able to exercise the sanctioning powers provided for by
European and Belgian law. 14
In casu, the Litigation Chamber retains the possibility of pursuing the case otherwise in the event
refusal of the proposal or if it is withdrawn by the Litigation Chamber itself.
If the party to whom the transaction proposal is addressed expressly refuses this
proposal, the Litigation Chamber will continue the procedure on the merits and will deal with the case
other than by a transaction.
a) Procedural situation of the transaction proposal
The proposed transaction presented here is part of the “procedure prior to the
15
substantive decision” before the Litigation Chamber, considered by the legislator. Therefore,
the Litigation Chamber does not take here and now a position as to the need for measures
investigations 16 carried out by the APD Inspection Service nor to the question of the need to
(subsequently) pursue the case in accordance with the provisions of Article 95 of the LCA.
11 See the press release from the Data Protection Authority on this subject, accessible via:
https://www.autoriteprotectiondonnees.be/lapd-definit-ses-priorites-pour-lannee-2023.
12The House of Representatives, Explanatory memorandum in the bill establishing the Human Rights Protection Authority
data, Doc. 2648/001 (54th Legislature Session), available via:
https://www.dekamer.be/kvvcr/showpage.cfm?section=/flwb&language=fr&cfm=/site/wwwcfm/flwb/flwbn.cfm?lang=N&legislat=54&doss
ierID=2648, 51; see also: E. Degraeve, “Title 11. Control authority” in C. DE TERWANGNE in K. ROSIER, The Protection Regulation
data (RGPD/GDPR) – 1st edition, Larcier, 2018, (593)607: “[The supervisory authority] can thus exercise its control and
13prescribe the follow-up to be given to any complaints that are addressed. »
See article 58 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals
with regard to the processing of personal data and the free movement of such data, and repealing Directive
95/46/EC (General Data Protection Regulation), hereinafter “GDPR”;
14See also article 100 of the LCA.
15See section 6.3.2. and sections 94-97 of the LCA.
16 Cfr. Article 94, 1° and 2° of LCA; also compare the following paragraph in the notification letter dated. 09/21/2023 to the parties: “This
notification interrupts the 30-day period as referred to in article 96, § 1 of the LCA to refer the matter to the Inspection Service until the moment when the
Litigation Chamber notes that the proposed transaction does not or cannot lead to a real transaction. » Decision 161/2023 — 13/24
Given the nature of the procedure before the Litigation Chamber of the Authority of
data protection, it should be emphasized that the "transaction" provided for under article 95,
§1, 2° of the LCA cannot be assimilated to a “transaction” within the meaning of criminal law..7 Indeed, the
transaction within the meaning of the ACL has a sui generis character.
In addition, the Litigation Chamber mentions the precise facts, situating them in time and in
space, on the basis of which the transaction proposal occurs (infra). Although, like
specified above, the Litigation Chamber does not rule hic et nunc on the existence of
violations, it must however formulate the proposal for transactions on elements exposed in
the folder. These are elements perceived as offensive by the complainant. The proposal of
transaction therefore concerns the facts, the period and the (technical) context, the facts which are not
18
covered by this period and this context not being included by the transaction. The disputed deadline
concerns only the period between the date of filing of the complaint and the date of the
formal transaction decision following this transaction proposal.
Generally speaking, the Litigation Chamber supervises the transaction on the procedural level of the
following way:
1. The transaction provided for by the LCA is a transaction between:
- on the one hand, the Litigation Chamber which undertakes to put an end to the procedure, in
waiving, among other things, the potential imposition of corrective measures,
- and, on the other hand, the defendant who undertakes to pay a sum and/or to respect
certain conditions.
2. A transaction in principle implies an acknowledgment of the facts on the part of the party
which compromises, but is not an acknowledgment of a violation of the law in force.
3. The scope of the transaction is in all cases limited to the facts and deadlines
expressly mentioned in the transaction proposal or the (decision of)
transaction itself.
19
4. The complainant is heard when concluding any transaction following a complaint. THE
complainant is heard regarding his point of view on the use of the instrument
of the transaction and on the content of the transaction proposal. The complainant has the
possibility of taking a position on the transaction proposal no later than 14 days after
17See in particular articles 216bis and 216ter of the Code of Criminal Procedure (“CIC”) concerning the termination of public action for
certain offenses upon the fulfillment of certain conditions (respectively the payment of a sum of money and the execution of
measures and compliance with conditions); A. RIGLOLET, Transaction contract, Larcier, Brussel, 2021; A. RAES, T. VAN WYNSBERGE, S. DE
KEULENAER, E. DEVEUX, K. DECRAMER, A. DELADRIERE, “De verruimde minnelijke schikking: een ‘meerwaarde’ of ‘win-win’ situation?
Evaluatievandepraktijk.”,Panopticon,nr.36(2),2015,(88);M.FERNANDEZ-BERTIERenN.VANDEREECKEN,“The expanded criminal transaction
declared unconstitutional: towards a motivation of the transaction and a sufficient and effective judicial control”, Criminal Law of
Company, 2016, nr. 3, (213)213.
18In this sense, the ne bis in idem principle does not apply to facts which do not fall within this scope.
19In the ratio legis of article 77 of the GDPR, the complainant has a more extensive role with respect to transaction procedures before others
regulators, see for example the simple communication to the complainant in the transaction procedure before the Belgian Authority of
Competition, cf. article IV.59 in fine of the Code of Economic Law of February 23, 2013 (M.B. 03/29/2013). Decision 161/2023 — 14/24
having received it. This deadline does not exclude the possibility for both parties to obtain
clarifications regarding the transaction proposal in writing or orally (infra).
5. The transaction is formalized by a transaction decision, which clearly sets out
transparently the progress of the procedure prior to the transaction, and resumes
explicitly the terms of the transaction proposal as well as the terms of the
transaction finally negotiated (in principle by referring to the transaction proposal
annexed to the final settlement decision).
6. All parties concerned retain the right to comment, in principle in writing, on the
transaction proposal and its content.
7. An unaccepted or otherwise unsuccessful transaction does not affect the continuation of
the case and has no impact on a possible alternative treatment of the case.
b) Substantive conditions of the transaction proposal.
b.1. Complaint against “Les Editions de l’Avenir Presse srl” of July 18, 2023
b.1.1. First grievance of the complainant in his complaint of July 18, 2023
The complainant's first grievance is described by the complainant as follows: “Violation
type 1: no “refuse” option at the first level of information in the banner
Cookies. »
In support of this complaint, the complainant attaches the following screenshot:
Complaint, Annex 2: Decision 161/2023 — 15/24
Prima facie relevant evidence from policy positions and regulatory documents
the Data Protection Authority.
1. The point of view of the working group of the European Health Protection Committee
data (“EDPB”) 20 and the APD press release on this subject. An extract
press release:
The absence of a “refuse all” type button at the same level as the button
“accept everything”. The majority of data protection authorities, in this
including the APD, considered that this was a breach and that the user
of a website should be able to access the option to agree or refuse the
deposit/read cookies on your device simultaneously.
22
2. The APD “cookie checklist”:
I don't foresee an "accept all cookies" button (or similar) without
provide at the same “level” a “refuse all non-essential cookies” button
(or similar)
First condition of the transaction proposal:
The defendant provides on the website of “https://www.lavenir.net/” an option
"reject all" where it currently says "accept and close", within a time limit
of one month from the date of the transaction decision, or implements a
practice with equivalent effect within the same period. Technical adjustments made
speaks to the defendant for this purpose will be recorded in a summary document at the time
of implementation and transmitted to the Litigation Chamber and to the complainant. Setting
implementation of the technical implementation, as well as the preparation and transmission of the
document reflecting the implementation, must be carried out within one month to
from the transaction decision.
b.1.2. Second grievance of the complainant in his complaint of July 18, 2023
Complainant's second complaint: “Type 2 violation: Misleading button colors”
20In English,ReportoftheworkundertakenbytheCookieBannerTaskforce, accessiblehere:https://edpb.europa.eu/our-work-
tools/our-documents/other/report-work-undertaken-cookie-banner-taskforce_en.
21 APD press release, February 10, 2023, accessible here:
https://www.autoriteprotectiondonnees.be/citoyen/actualites/2023/02/10/bannieres-cookies-ledpb-publie-des-entreprises-
non-compliant-practices.
22
You will find, attached to this transaction proposal, a copy of this “cookie checklist”; the document is
also accessible via the APD website: https://www.autoriteprotectiondonnees.be/publications/checklist-cookies.pdf Decision 161/2023 — 16/24
In support of this complaint, the complainant attaches the following two screenshots:
1. Complaint, annex 2:
2. Complaint, Annex 3:
Prima facie relevant evidence from policy positions and regulatory documents
the Data Protection Authority. Decision 161/2023 — 17/24
1. The point of view of the working group of the European Health Protection Committee
data (“EDPB”) 23 and APD press release 24 on this subject.
An extract from a press release:
Deceptive design. The taskforce drew attention to various types of practices
misleading in terms of banner layout.
An extract from the report of the EDPB working group:
To assess the conformity of a banner, a case-by-case verification must
be carried out to ensure that the contrast and colors used are not
not obviously misleading to users and do not result in
involuntary consent and, therefore, invalid on their part. Consequently,
it was also agreed that a case-by-case analysis would be necessary to
deal with specific cases, although some examples of characteristics
manifestly contrary to the provisions of the directive on privacy and
electronic communications have been identified.
2. The APD “cookie checklist”:
I do not use techniques that could be described as “deceptive design” 25
(e.g. incentive through the use of color).
Second condition of the transaction proposal:
The defendant undertakes to ensure that the option behind which lies an “all” option
refuse” – following the possible acceptance of condition 1 of this proposal
transaction – is no less (visually) attractive than partial acceptance or
total installation of cookies that are not strictly necessary, within the time limit
of one month from the transaction decision. The technical adjustments made
speaks to the defendant for this purpose will be recorded in a summary document at the time
of implementation and transmitted to the Litigation Chamber and to the complainant. Both the stake
technical implementation as the preparation and transmission of the document reflecting the implementation
23
In English, Reportoftheworkundertaken bytheCookieBannerTaskforce, accessiblehere:https://edpb.europa.eu/our-work-
tools/our-documents/other/report-work-undertaken-cookie-banner-taskforce_en.
24 APD press release, February 10, 2023, accessible here:
https://www.autoriteprotectiondonnees.be/citoyen/actualites/2023/02/10/bannieres-cookies-ledpb-publie-des-entreprises-
non-compliant-practices.
25
See also our press release, available via the following link:
https://www.autoriteprotectiondonnees.be/citoyen/actualites/2023/02/24/deceptive-design-patterns-comment-les-
recognize-and-avoid-them-on-social-media. Decision 161/2023 — 18/24
implemented will be carried out within one month from the decision of
transaction.
b.1.3. Third grievance of the complainant in his complaint of July 18, 2023
Complainant's third complaint: “Type 3 violation: It is not as easy to remove the
consent than to give it”
In support of this complaint, the complainant attaches the following screenshot:
Complaint, Annex 5:
Prima facie relevant evidence from policy positions and regulatory documents
the Data Protection Authority.
1. The point of view of the working group of the European Health Protection Committee
data (“EDPB”) 26 and APD press release 27 on this subject.
An extract from the report of the EDPB working group:
In addition to the conditions required for the collection of consent to be
valid in accordance with GDPR and Article 5(3) ePrivacy
Directive, three additional cumulative conditions are mandatory (i)
26In English, Reportoftheworkundertaken bytheCookieBannerTaskforce, accessiblehere:https://edpb.europa.eu/our-work-
tools/our-documents/other/report-work-undertaken-cookie-banner-taskforce_en.
27
APD press release, February 10, 2023, accessible here:
https://www.autoriteprotectiondonnees.be/citoyen/actualites/2023/02/10/bannieres-cookies-ledpb-publie-des-entreprises-
non-compliant-practices. Decision 161/2023 — 19/24
the possibility of withdrawing consent, (ii) the possibility of withdrawing the
consent at any time, (iii) withdrawal of consent must also be
easier than granting consent. 28
2. The APD “cookies checklist”:
I foresee a mechanism by which it is as simple to remove the
consent than giving it, such as placing a link or button
clearly visible allowing you to manage the settings of cookies and
withdraw consent with one click;
I ensure that this withdrawal of consent actually has the desired effect
and the cookies concerned are not simply no longer stored in the future.
I ensure that this withdrawal of consent actually has the effect
expected and that it does not have the sole consequence that this cookie will not be
more placed in the future;
Third condition of the transaction proposal:
The defendant undertakes to develop and implement, within one month, a
mechanism on the website “https://www.lavenir.net/” compliant with the defined requirements
in the above-mentioned policy documents, aimed at achieving an outcome
equivalent. The data controller also guarantees that the processing procedure
revocation of consent (withdrawal of consent) will not require further
steps (in terms of 'clicks') than those required to give consent.
will be done by following an equivalent number of steps from the moment the user
final reaches the coolie settings page, which must be clearly accessible
from all pages of the website in question. All technical changes
made by the defendant for this purpose must be recorded in a
summary document, which will be developed during implementation and transmitted to the
Litigation Chamber and the complainant. Implementation of these changes
techniques, as well as the preparation and transmission of the summary document,
must be carried out within one month of the transaction decision.
28Original English text: “In addition to the requirements for the collection of consent to be valid in accordance with the
GDPR and under Article 5(3) ePrivacy Directive, three additional cumulative conditions are mandatory (i) the possibility to
withdraw consent, (ii) the ability to withdraw consent at any time, (iii) withdrawal of consent must be as easy as to give
consent.” Decision 161/2023 — 20/24
b.1.4. Fourth grievance of the complainant in his complaint of July 18, 2023
Fourth grievance of the complainant: “Type 4 violation: Reference to legitimate interest”
In support of this complaint, the complainant attaches the following screenshot:
Complaint, Annex 4:
Prima facie relevant evidence from policy positions and regulatory documents
the Data Protection Authority.
1. The point of view of the working group of the European Health Protection Committee
data (“EDPB”) 29 and APD press release 30 on this subject.
An extract from the APD press release:
Legitimate interest. Some websites appeal to legitimate interest, and not to
consent, for data processing subsequent to filing or
reading cookies. The report recalls that legitimate interest cannot
constitute the legal basis for the deposit of cookies itself, and whether the deposit
or reading cookies do not comply with the ePrivacy directive, the
subsequent processing resulting therefrom may not comply with the
GDPR.
29In English, Reportoftheworkundertaken bytheCookieBannerTaskforce, accessiblehere:https://edpb.europa.eu/our-work-
tools/our-documents/other/report-work-undertaken-cookie-banner-taskforce_en.
30
APD press release, February 10, 2023, accessible here:
https://www.autoriteprotectiondonnees.be/citoyen/actualites/2023/02/10/bannieres-cookies-ledpb-publie-des-entreprises-
non-compliant-practices. Decision 161/2023 — 21/24
2. The APD “cookies checklist”:
has. I have checked the categorization of “essential technical cookies”31 (such
than those for load balancing);
b. I have controlled the categorization of "functional cookies strictly
necessary" (such as cookies for the temporary storage of
choice of language, cookie preferences or content
of the basket). This only includes cookies that are strictly
necessary to provide a service 32 explicitly requested by the
“visitor”;
vs. I have ensured that no other cookies than those above are placed
without first obtaining the valid consent of the “visitor”.
Fourth condition of the transaction proposal:
The defendants undertake to use legitimate interest as a legal basis only in the case
the placement of strictly necessary technical or functional cookies. THE
defendant also ensures that the associated visualization vis-à-vis the site visitor
web meets transparency requirements, and therefore does not engage in
practices involving the use of techniques that can be described as "deceptive
33
design" - see also on this point that the complaint in this file deals in general
misleading cookie banners and “dark templates”. 34 When the visitor
website does not give consent to the installation of a particular cookie - for
cookiesrequiringconsent-defendantsagreenottoinvokeinterest
legitimate to continue installing these cookies. For this purpose, the data controller
prepares a document, at the time of the technical implementation of this(these)
adaptation(s), showing the display of cookies that it still (potentially) places on
the website visitor's device at that time based on legitimate interest. This
The document is then sent to the Litigation Chamber and to the complainant. Setting
31Article 10/2, § 2 of the law of July 30, 2018 relating to the protection of individuals with regard to data processing
personal data ("framework law"): "the technical recording of information or access to information
stored in the terminal equipment of a subscriber or end user with the sole purpose of sending a
communication via an electronic communications network" (emphasis mine).
32In principle, this therefore does not include the counting of visitors, see also page 10 of opinion 04/2012 of
Article 29 Data Protection Working Group: https://ec.europa.eu/justice/article-29/documentation/opinion-
recommendation/files/2012/wp194_en.pdf ” While they are often considered as a “strictly necessary” tool for website
operators, they are not strictly necessary to provide a functionality explicitly requested by the user (or subscriber). In fact, the
user can access all the functionalities provided by the website when such cookies are disabled.”
Some supervisors (in other Member States) take the position that the placement or procurement
access to such cookies - under certain strict conditions - escapes the requirement of consent. Sometimes it is the
consequence of an adaptation of national legislation (this ground for exception was then explicitly added), sometimes of the
national jurisprudence.
33 See also our press release, available via the following link:
https://www.autoriteprotectiondonnees.be/citoyen/actualites/2023/02/24/deceptive-design-patterns-comment-les-
recognize-and-avoid-them-on-social-media.
34
Compare the ODA documents listed in section b.1.2. Decision 161/2023 — 22/24
work, including the preparation and transmission of the document, must take place in a
period of one month after the transaction decision has been taken.
c) Written and oral exchanges with the parties
c.1. written exchanges
The transaction proposal marks the starting point of the transaction procedure.
However, the terms of this proposal may be clarified or adjusted during the
transaction procedure, particularly if these adjustments result in improvements to the
with regard to data protection legislation. Such requests do not lead
not automatically to an extension of the deadline.
In principle, the parties send their requests in writing to the Litigation Chamber if
they consider it necessary to make adjustments to the terms of the proposed
transaction. It is up to the Litigation Chamber to make adjustments to the
proposed transaction based on communications from the parties.
In this sense, a constructive attitude on the part of the parties is encouraged. There
Litigation Chamber expects requests to be reasonable and proportionate.
When, according to the Litigation Chamber, the requests suggest that a transaction is
improbable or unlikely, this could result in the withdrawal of the proposal of
transaction.
c.2. oral exchanges
To facilitate the efficient conduct of the transaction procedure, the parties have the
possibility of requesting an oral discussion regarding the transaction proposal. He Decision 161/2023 — 23/24
is important to note that this option is offered as a favor and that the Chamber
Litigation offers it in order to ensure the effectiveness of the procedure. 35
A report will be drawn up at the end of the oral discussion, generally with the aim of
simply note that the oral explanation has taken place.
Both parties are free to participate in oral discussions organized by the
Litigation Chamber. It is essential to emphasize that these discussions are
confidential, and therefore, the content of the discussions cannot under any circumstances be
disclosed to third parties.
d) Deadline
Les Editions de l’Avenir Presse srl has 30 days from receipt of this
transaction proposal to indicate whether he accepts it or not. The (representative of the) complainant has the
possibility of commenting on the initial transaction proposal and the conditions attached to it
arise within 14 days of receipt of this letter.
e) Existence of other controllers and/or subcontractors
This transaction proposal is addressed solely to Les Editions de l’Avenir Presse srl.
She does not comment on the question of knowledge whether other actors can be responsible for
potential violations leading to this proposed transaction, nor to what extent.
f) Validation of the transaction
If the transaction proposal results in a formal transaction decision due to
the explicit acceptance or lack of response from the party to whom it is addressed within the time limit
mentioned above, an appeal may be lodged by the “injured party”. 36
It is important to note that the final transaction does not limit the rights of any individuals
affected [ERRATUM] to claim damages before a civil court on the basis
in particular article 82 of the GDPR.
35Conducting discussions with a view to reaching a transaction is a legal practice known in the landscape of regulators, compare
in particular the procedure before the Belgian Competition Authority in articles IV.55 et seq. ("Subsection 4 - Procedure in matters
transaction") of the Code of Economic Law of 02/28/2013 (B.S. 03/29/2013) and the mention of such discussions in this code.
3In accordance with article 108, § 1 of the LCA, an appeal against this decision may be lodged, within thirty days from
explicit acceptance or lack of response, within the aforementioned deadline, to the Cour des Marchés (Brussels court of appeal),
with the Data Protection Authority as the defendant.
Such an appeal may be introduced by means of an interlocutory request which must contain the information listed in article 1034ter of the
Judicial Code. The interlocutory request must be filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C.
judi., or via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.). Decision 161/2023 — 24/24
g) Appeal against the proposed transaction
In accordance with article 108, §1 of the LCA, an appeal against this decision which results in proposing
a transaction can be introduced, within thirty days from its notification,
with the Court of Markets (Brussels Court of Appeal), with the Protection Authority of
data as defendant.
Such an appeal may be introduced by means of an interlocutory request which must contain the
37
information listed in article 1034ter of the Judicial Code. The interlocutory request must be
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 38
via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. judic.).
Please accept, Madam, Sir, the assurance of my perfect consideration.
Hielke Hijmans
President of the Litigation Chamber
37
The request barely contains nullity:
7° indication of the day, month and year;
8° the surname, first name, domicile of the applicant, as well as, where applicable, his qualifications and his national register number or
Business Number;
9° the surname, first name, address and, where applicable, the status of the person to be summoned;
10° the object and summary of the means of the request;
11° the indication of the judge who is seized of the request;
12° the signature of the applicant or his lawyer.
38The request, accompanied by its annex, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court registry.
