APD/GBA (Belgium) - 32/2022
From GDPRhub
| APD/GBA (Belgium) - 32/2022 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 5(1)(c) GDPR Article 5(1)(e) GDPR Article 6(1)(f) GDPR Article 14 GDPR Article 15 GDPR Article 21 GDPR |
| Type: | Complaint |
| Outcome: | Partly Upheld |
| Started: | |
| Decided: | 10.03.2022 |
| Published: | 10.03.2022 |
| Fine: | None |
| Parties: | n/a |
| National Case Number/Name: | 32/2022 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | Belgian DPA (in NL) |
| Initial Contributor: | kc |
The Belgian DPA held that while direct marketing via email may not require the data subjects consent, it is still necessary to inform the data subject pursuant to Article 14 GDPR at the latest at the time of initial contact.
English Summary
Facts
In April 2020, the data subject requested not to receive any more direct marketing messages from the controller.
In May 2020, the data subject requested from the controller information on any processing of personal data concerning him pursuant to Article 15(1) GDPR after receiving further direct marketing messages via his email and on his mobile phone despite his previous request. Specifically, he asked about the origin of the acquisition of his personal data that allowed the controller to contact him and about the legal basis for the processing to which he claimed that he had not given consent.
The controller responded to the request by stating that it had obtained the data from a contact provider but limited itself to providing only the name of the company. Furthermore, it acknowledged that the data subject had received further messages due to human error.
In September 2020, the data subject filed a complaint with the Belgian DPA (APD/GBA). He complained both about the direct marketing messages which he claimed required consent (Article 6(1)(a) GDPR) and about the reaction to his access request which according to him had violated Articles 15(1), 5(1)(c) and (e) and 14(2)(e) GDPR.
Holding
The DPA partly upheld the complaint. It ordered the controller to comply with the data subject's right to access pursuant to Article 15(1)(g) GDPR. Furthermore, it formulated a warning with regard to the data controller's mentioning of the right to object to the processing in the message with which it first comes into contact with the data subject, so that the data processing in this respect will respect the transparency requirement set out in Articles 5(1)(a), 12, 14 and 21(4) GDPR in the future.
1. Direct marketing Regarding the direct marketing messages by the controller, the DPA dismissed the complaint. It held that the controller did not require the data subject's consent because it had sufficient legitimate interest in accordance with Article 6(1)(f) GDPR. According to the DPA, this was supported by Recital 47 GDPR which specifically states that direct marketing may be carried out with legitimate interest. Since the data subject's email address was publically available online, the DPA held that he had to have the reasonable expectation that that email address would be used to send him messages and that the controller had thus made use of publicly available information.
In addition, regarding his mobile phone number, the DPA obliged the controller to provide information on the source that formed the basis of the processing since it was unclear how the number was obtained by the controller and thus, it was not possible to assess whether that information had been obtained lawfully.
2. Information obligation Regarding the data subject's access request, the DPA held that the controller had not complied with its duty to provide access to the data subject because it had not given the data subject "all available information", Article 15(1)(g) GDPR.
Furthermore, the controller had violated Article 21(4) GDPR by not providing the information listed in Article 14 GDPR in its first communication with the data subject. According to the DPA, at the very least, the first message should have contained a link to the privacy policy in which this information is contained in an accessible, concise and clear manner. The fact that the first notice to the complainant did not contain the slightest reference to the information necessary to ensure transparent data processing constitutes an infringement of Articles 5(1)(a), 12(1) and 14 GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/10
Dispute room
Decision 32/2022 of 10 March 2022
File number : DOS-2020-04479
Subject : Exercising the right of objection and right of access pursuant to unsolicited
advertising messages
The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke Hijmans,
single chairperson;
Having regard to Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 on
the protection of natural persons with regard to the processing of personal data and
on the free movement of such data and repealing Directive 95/46/EC (General
Data Protection Regulation), hereinafter GDPR;
Having regard to the law of 3 December 2017 establishing the Data Protection Authority, hereinafter WOG;
Having regard to the internal rules of procedure, as approved by the Chamber of Representatives
on December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;
Having regard to the documents in the file;
has taken the following decision regarding:
†
The complainant: Mr X, hereinafter referred to as “the complainant”; †
†
The controller: Y, hereinafter referred to as “the controller”, Decision on the merits 32/2022 - 2/10
I. Facts procedure
1. On 8 September 2020, the complainant lodged a complaint with the Data Protection Authority against
the controller.
2. The subject of the complaint concerns the exercise by the complainant of his right to object to
following the receipt of unwanted advertising sent to him by the
controller at the complainant's e-mail address, as well as by contacting his
cell phone. The complainant also invokes his right of access, in particular he asks about the
origin of the acquisition of his personal data, which means that the controller in
was able to contact him by e-mail and by mobile phone, as well as to the legal basis for the processing of
are personal data for which the complainant states that he has not given his consent.
When the complainant requests more complete information on 4 May 2020 to which he is entitled to
pursuant to Article 15.1 of the GDPR – so not only limited to his initial request to provide him with the source and the
legal basis for its data processing – this will be accepted by the
controller who will provide him with all the information requested on May 28, 2020. from this
does the complainant infer that the principle of transparency (Article 5.1 of the GDPR), the principle of minimum
data processing (Article 5.1 c) GDPR) and the storage limitation (Article 5.1 e) GDPR)
respected. Also, the controller's reply would not have referred to
under the competence of the Belgian Data Protection Authority (Article 14.2 e) GDPR) and
the complainant has not received the information to which he is entitled under Article 14 GDPR.
3. On March 23, 2021, the complaint will be declared admissible by the Frontline Service on the basis of the
Articles 58 and 60 WOG and the complaint on the basis of art. 62, §1 WOG transferred to the
Dispute room.
II. Justification
Legal basis for sending advertising messages – Exercise of the right to object
4. As to the complainant's allegation that the use of personal
identification data, in this case his name, e-mail address and mobile phone number, for direct marketing
purposes the consent would be required, the Disputes Chamber points out that the
consent, but the legitimate interest of the controller as
1
legal basis to process the complainant's identification data for direct marketing
1
1. Processing is only lawful if and insofar as at least one of the following conditions is met:
a) the data subject has consented to the processing of his/her personal data for one or more specific purposes;
[…], Decision on the substance 32/2022 - 3/10
purposes. Recital 47 GDPR expressly states that the processing of
personal data for the purpose of direct marketing can be considered as performed with
with a view to a legitimate interest (Article 6.1 f) GDPR). So this means that the
controller not prior to processing for direct marketing
consent from the data subject (Article 6.1 a) GDPR). The
controller rightly invokes the legal basis set out in Article 6.1 f) GDPR
to process information that is accessible to the public for direct marketing purposes.
5. The factual elements present in the file show that the unwanted message
to which the complaint relates was sent by the controller to the
2
e-mail address (…), which was made available online and is therefore accessible to everyone. It
making your own contact details available online, such as the e-mail address in this case
of the complainant, necessarily implies that it is for the purpose of the person providing the contact details
online, to be able to get in touch with the person to whom the contact details
relate. Because the complainant makes his contact details publicly available through the
publishing it online, it is within his reasonable expectations that his e-mail address may be
used to send him messages. The controller has thus of this
publicly available data.
6. The complainant does not deny that the email address used by the controller, and thus
ipso facto also his name, is accessible to the public. The complainant, on the other hand, believes that
specific to his cell phone number, to state that it is not publicly available
data, but a private data that cannot be disclosed on the basis of the legitimate interest
are processed. The Disputes Chamber notes that the complainant cannot simply claim that
his cell phone number is private due to lack of knowledge in his mind about the source that was at the base
of the processing of this data and through which the company to which the
has appealed to the controller, has come into possession of the mobile phone number
of the complainant and subsequently provided it to the controller. On the basis of
the factual elements of the file, the Disputes Chamber must determine that it is unclear
is how the complainant's mobile number was obtained, which means that it is therefore not
it is possible to assess whether this information was obtained lawfully. To that end
should provide the controller with information on the source that caused it
of the processing of the GSM number (see below, edge nos. 13 et seq.)
7. Against the right of the controller to process personal data pursuant to
has a legitimate interest to process for direct marketing purposes, it does state that the
f) the processing is necessary for the purposes of pursuing the legitimate interests of the controller or of a
third party, except where the interests or fundamental rights and freedoms of the data subject are necessary for the protection of
personal data override those interests, in particular where the data subject is a child.
2
See eg (…); (…), Decision on the merits 32/2022 - 4/10
controller must comply with the objection raised by the data subject
can be made against the processing of personal data concerning him at any time,
without the data subject being required to provide any justification (Article 21.2 GDPR and Article 21.3
GDPR) . The controller has within one month (Article 12.3 GDPR)
after receipt of the complainant's request on April 17, 2020 not to send direct marketing messages
more, followed by confirmation of the removal of the
personal data of the complainant from his file on April 21, 2020. It is true that in the response
of April 21, 2020 incorrectly stated that the complainant was registered to be re-registered
contacted by the controller. This shortcoming was rectified by the
controller on May 28, 2020 in which it admitted that this was based on a
human error and the correct representation had to be that the complainant was registered for not
to be contacted again by the controller.
8. On the basis of the elements in the file known to the Disputes Chamber, and on the basis of the
powers assigned to it by the legislator on the basis of Article 95, §1 WOG, decides
the Disputes Chamber about the further follow-up of the file; in this case, the Disputes Chamber
to dismiss the complaint as to the legal basis, in accordance with Article 95,
§1, 3° WOG, based on the motivation below.
9. In the event of a dismissal, the Disputes Chamber must gradually investigate and motivate:
- whether there is insufficient prospect of a conviction, after which a technical dismissal follows;
- whether a successful conviction would be technically feasible but on grounds, in general
4
interest, a (further) prosecution is undesirable, followed by a policy dismissal.
10. In the event that more than one ground is being discarded, the discarded grounds (or technically
dismissal and policy dismissal) should be treated in order of importance.
11. In the present case, the Disputes Chamber will proceed to a technical dismissal on a single
ground, namely because the Disputes Chamber decides that the controller does not
has committed an infringement of Article 6.1 of the GDPR. In addition, the controller within
the legal period of one month has appropriately followed the request of the complainant
causing his e-mail address, including his name, as well as his mobile phone number to no longer be
used for direct marketing purposes, so that no infringement of article 12.3 . was also committed
GDPR and Articles 21.2 and 21.3 GDPR.
3See in that regard also recital 70 of the GDPR: When personal data is processed for the purpose of direct marketing, the
data subject, whether it concerns initial or further processing, have the right at any time and free of charge
object to this processing, including in the case of profiling insofar as it relates to direct marketing. Which
right must be brought to the attention of the data subject expressly, in a clear manner and separately from other information.
4 Cfr. Judgment Court of Appeal Brussels (Marktenhof), 2 September 2020, no. 2020/5460, 18., Judgment on the merits 32/2022 - 5/10
Exercise of the right of access
12. The Disputes Chamber determines on the basis of the documents that substantiate the complaint that the complainant is entitled to
exercised the right of inspection, which was initially aimed at becoming acquainted with
this information was obtained. Later, the complainant's request was extended to the full
information.
13. The controller has complied with the complainant's first request by
to state that he obtained it from a contact provider, but has limited himself to it
only provide the name of the company. Article 15.1 g) GDPR nevertheless prescribes that the
controller to the data subject “all available information” about the source of
must provide the data, if the personal data have not been obtained from the data subject
collected.
14. The accountability obligation (Article 5.2 GDPR) of the controller entails
note that basic information is provided to the person concerned, ie the complainant, showing that the
controller himself processes the data in accordance with the GDPR and prior to the
purchase of an address file checks whether that data is lawfully processed by the
company that trades in personal data. Thus, the complainant can expect that the
data controller provides information about how the company is held
obtained from the complainant's contact details, as well as the legal basis on which that
personal data is processed by that company in order to demonstrate that the contact details
from the complainant were lawfully purchased and processed by the controller.
In order to guarantee the rights of the complainant, the controller should also
provide the company's contact details. This enables the complainant to
to exercise its right of inspection with regard to that company.
15. It is therefore not sufficient for the controller to provide only the name of the company
to the complainant without any further specification. As a result, the
controller acted in violation of Article 15.1 g) GDPR.
16. The Disputes Chamber is of the opinion that on the basis of the above analysis,
concluded that a breach of the provisions of the
GDPR was committed, which justifies the taking of a
decision on the basis of Article 95, §1, 5° WOG, more specifically to inform the controller
Orders to comply with the complainant's exercise of his right of access (Article
5
See the answer provided by the controller on April 21, 2020, to the question d.d. 17 by the complainant.
April 2020.
6See the answer provided by the controller on May 28, 2020, to the question asked by the complainant dated 4
May 2020, Decision on the merits 32/2022 - 6/10
15.1 g) GDPR) and this in particular in view of the documents submitted by the complainant showing
that the complainant has indeed exercised his right of access, but the
controller has not adequately followed this up.
17. When the complainant in a second application requests more complete information under Article
15.1 GDPR - so not only limited to the legal basis stated in point g) -, this is discussed
by the controller who provides him with the requested information. This brings the
then submit to the complainant that there would be no transparent data processing because
the response to the request for access is given in English, while the
marketing messages were drawn up in Dutch. The Disputes Chamber notes that
the principle of transparency does not contain a language requirement. Transparent information and communication is
necessary. Since the complainant was approached by the defendant from his position within his
business and English is a common language used in business,
are expected that the information given in English was completely transparent.
18. According to the complainant, the retention period was also not clearly defined and it would be
an infinite storage period. First of all, the Disputes Chamber notes that the
controller indicates to keep the personal data for as long as necessary to
to provide the services it provides. To the extent that the relevant personal data is
processed for direct marketing purposes, it is sufficient that the controller
offers the right of objection to the data subject, which immediately ends if it is exercised
applies to the processing of the personal data of the data subject. In that sense, the
data processing is not infinite. This is also apparent from the facts, i.e. as soon as the complainant has exercised his right to
objected, the processing of his personal data was terminated (Article 21.3 GDPR)
and no infringement of Article 5.1 e) GDPR can be established, provided that the
controller informs the data subject in a timely and adequate manner about his or her right to
objection (see margin no. 21 below).
19. The complainant also cites that the controller is not the competent
data protection authority and refers to the German
Data protection authority instead of the Belgian authority. The Disputes Chamber points
points out that the controller states that the complainant cannot only lodge a complaint with
the German Data Protection Authority, but also at the Data Protection Authority
7
where he resides. This is in accordance with Article 77.1 GDPR. Because the complainant in Belgium
resides, the controller has complied with the obligation to state that the
complainant has the right to lodge a complaint with a supervisory authority, in this case the
7Article 77.1. GDPR. Without prejudice to other possibilities of administrative appeal or a judicial remedy, every person concerned has
the right to lodge a complaint with a supervisory authority, in particular in the Member State where he usually resides, his place of work
has or where the alleged infringement was committed, if he believes that the processing of his personal data infringement
makes on this regulation., Decision on the substance 32/2022 - 7/10
Belgian Data Protection Authority (Article 15.1 f) GDPR). For the sake of completeness, the
The dispute chamber still allows the Belgian Data Protection Authority to
exercises jurisdiction under Article 55 of the GDPR because the defendant has
has its registered office in Belgium and there is no reason to assume that there is a cross-border
situation as referred to in Article 56 GDPR.
Information obligation
20. The complainant alleges that the obligation to provide information as set out in Article 14 GDPR was breached by
the controller.
21. With regard to information on the right to object (Article 14.2 b) GDPR) in particular
Article 21.4 of the AVG 8 expressly states that this option, separately from the other
information, already in the first message to the person concerned, being in this case the complainant, must be
included. However, the message that is the subject of the complaint does not in any way make it
the right of objection is clearly communicated to the complainant. What's more, it doesn't contain any reference to
this right of objection. Recital 70 GDPR provides, however, that this right expressly, on
clear manner and separate from other information, must be brought to the attention of the data subject
are being brought . In the absence of notification of this right of objection to the complainant on the
the moment he was first contacted, the controller has
acted in violation of Article 21.4 of the GDPR.
22. With regard to the other information (Article 14.1 and 14.2 GDPR) that the
controller, this provision (Article 14.3 GDPR) requires that this
this also takes place at the latest at the time of the first contact with the data subject. The first
Prosecutor's notice does not contain any information as such. At least had the first message
contain a link to the privacy policy in which, in an accessible manner and in a
concise and clear way this information is included. Because the first message to the
complainant does not contain the slightest reference to the necessary information to ensure a transparent
data processing, there is an infringement of Articles 5.1 a), 12.1 and 14
GDPR.
Decision
23. The present decision is with regard to the exercise of the right of access and
information obligation a prima facie decision taken by the Disputes Chamber in accordance with
Article 95 WOG on the basis of the complaint submitted by the complainant, in the context of the 'procedure'
8
Article 21.4 GDPR. The right referred to in paragraphs 1 and 2 shall be expressly granted at the latest at the time of the first contact with the data subject
brought to the attention of the data subject and presented clearly and separately from any other information.
9See footnote 2., Decision on the substance 32/2022 - 8/10
prior to the decision on the merits' and no decision on the merits of the Disputes Chamber
within the meaning of Article 100 WOG.
24. The purpose of this decision is to inform the controller of the
fact that it may have infringed the provisions of the GDPR and that it is in the
opportunity to still conform with the aforementioned provisions.
25. However, if the controller does not agree with the content of this
prima facie decision and considers that it may allow factual and/or legal arguments
money that could lead to a different decision, can be sent to the email address
litigationchamber@apd-gba.be submit a request for treatment on the merits of the case to the
Disputes Chamber and this within the period of 14 days after notification of this decision. The
enforcement of this decision will, if necessary, be during the aforementioned period
suspended.
26. In the event of a continuation of the handling of the case on the merits, the Disputes Chamber will
the parties on the basis of Articles 98, 2° and 3° in conjunction with Article 99 WOG invite their
to submit defenses and to attach to the file any documents they deem useful. The
If necessary, this decision will be definitively suspended.
27. For the sake of completeness, the Disputes Chamber points out that a hearing on the merits of the case may
lead to the imposition of the measures stated in Article 100 WOG.
28. Finally, the Disputes Chamber points out the following:
29. If one of the parties wishes to make use of the possibility to consult and
copying the file (art. 95, §2, 3° WOG), this should contact the secretariat
of the Disputes Chamber, preferably via litigationchamber@apd-gba.be, in order to make an appointment
to capture.
30. If a copy of the file is requested, the documents will be sent electronically if possible
or else delivered by regular mail.
III. Publication of the decision
31. Given the importance of transparency in the decision-making of the
Litigation Chamber, this decision will be published on the website of the
Data Protection Authority. It is not necessary, however, that the identification data
of the parties be published directly., Decision on the merits 32/2022 - 9/10
FOR THESE REASONS,
the Disputes Chamber of the Data Protection Authority decides, after deliberation, to:
- the complaint to the extent that it relates to the legal basis for the shipment
of advertising messages, pursuant to Article 95, §1, 3° WOG, to be dismissed in view of the fact
that no breach of the GDPR can be established in this regard.
- the complaint to the extent to which it relates to the exercise of the right of
inspection pursuant to Article 58.2. c) GDPR and Article 95, §1, 5° WOG de
order the controller to comply with the complainant's request
to exercise its rights, in particular the right of access under Article 15.1
g) GDPR);
to order the controller to the Data Protection Authority
(Dispute Chamber) by e-mail within the period of 14 days after the notification of this
decision of the outcome of this decision via the email address
litigationchamber@apd-gba.be; and
in the absence of the timely implementation of the above by the
controller, to handle the case on the merits ex officio
in accordance with Articles 98 et seq. WOG.
- to formulate a warning with regard to the controller for
with regard to the mention of the right of objection in the message with which he
first contacts the data subject, so that the data processing at this point in the
future the transparency requirement as stated in Articles 5.1 a), 12, 14 and 21.4 GDPR
respects;
to request the controller from the Data Protection Authority
(Dispute Chamber) by e-mail within the period of 14 days after the notification of this
decision of the outcome of this decision in order to
To inform the dispute chamber about the adjustment of the procedure (see margin no. 21) via the e-mail
email address litigationchamber@apd-gba.be; and
In the absence of the timely implementation of the above by the
controller, to handle the case on the merits ex officio
in accordance with Articles 98 et seq. WOG.
Against this decision, pursuant to art. 108, §1 WOG, appeals must be lodged within a
period of thirty days, from the notification, to the Marktenhof, with the
Data Protection Authority as Defendant., Decision on the merits 32/2022 - 10/10
(Get). Hielke Hijmans
Chairman of the Disputes Chamber
