Court of Appeal of Brussels - 2022/AR/723

Hof van Beroep - 2022/AR/723
Court:	Hof van Beroep Brussel (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 5(1)(c) GDPR Article 5(1)(a) GDPR Article 5(2) GDPR Article 6(1) GDPR Article 12(2) GDPR Article 21(2) GDPR Article 21(4) GDPR XV.2, Paragraph 1 WER
Decided:	14.06.2023
Published:
Parties:	Nationale Maatschappij der Belgische Sporen (NMBS)
National Case Number/Name:	2022/AR/723
European Case Law Identifier:
Appeal from:	GBA 71/2022
Appeal to:
Original Language(s):	Dutch
Original Source:	GBA (in Dutch)
Initial Contributor:	Kv33

The Belgian Marktenhof ruled in an appeal of the Belgian Railway Company NMBS against a prior decision of the Belgian DPA. In the prior decision, the company was fined €10,000 for sending an e-mail with promotional material to owners of a travel pass. All the grounds of appeal were dismissed by the court, but the fine was reduced to a symbolic €1 due to lacking motivation.

English Summary

Facts

This ruling of the Belgian Marktenhof concerns the Belgian Railway company NMBS (controller), a company with the Belgian state as its only shareholder. During the COVID 19 Pandemic, the controller started an initiative to promote train travel. By royal decree on 28 July 2020, the controller was ordered to issue a travel pass for Belgian citizens with 12 free train tickets to domestic destinations in order to promote traveling by train. (3).

On 13 October 2020, the controller sent an email to railway pass holders to inform them about the usecases of this travel pass and also provided COVID 19 related information, such as sanitary requirements (…) This e-mail also contained a hyperlink linking to travel blogs on the website of the controller. (page 19) This email also mentioned the fact that the recipients could receive promotional e-mails, with no visible option to opt out. (...)

This e-mail resulted in GDPR related discussions on Twitter, specifically regarding the lack of the possibility to exercise the right to objection. (Recitals 5-6-7) On 19 October 2020, the investigation service of the Belgian DPA informed the controller that it would start an investigation because of these Twitter discussions. (7)

On 9 November 2020, the investigation service found several GDPR violations. Among the other violations, the DPA determined that the controller had no legal basis for sending the e-mail. It also held that the e-mail in question qualified as direct marketing ((Article 21(2) GDPR). (8) On 4 May 2022, the violations were confirmed by the DPA. By not providing the possibility to opt-out of receiving similar emails, the controller violated Articles 12(2), 21(2) and 21(4) GDPR. Consequently, the DPA held that the controller violated Article 5(1)(a), 5(1)(c), 5(2), 6(1), 12(2) and 21(2) and 21(4) GDPR. The controller was fined €10,000.

On 2 June 2022, the controller appealed the decision of the DPA, resulting in this ruling of the Marktenhof. (Click here for the full text of the decision of the DPA. Click here for the GDPRHub summary of this decision). (11-12)

The controller presented several grounds of appeal before the Marktenhof.

First, the controller stated that the GDPR was not applicable in this case. Not the GPDR, but the e-privacy directive was applicable here as a Lex Specialis of the GDPR. Because of the fact that the DPA did not acknowledge this in the disputed decision, the violations were not properly motivated. Also, pursuant to Belgian Law (XV.2, Paragraph 1 WER), the DPA was not authorized to impose a fine on the controller, since competence regarding e-privacy related issues was reserved for the ‘FOD Economie’ another public institution. (page 14).

Second, the controller stated Article 6 ECFR had been breached. The controller claimed that screenshots of the e-mail were used as evidence in the decision. However, this screenshot of the e-mail was not included in the investigation file. Therefore, the controller had not been able to comment of this piece of evidence, resulting in a breach of Article 6 ECFR. (page 18)

Third, the controller stated that the decision of the DPA was based on an inaccurate an incomplete representation of the facts. Among the others, the controller disputed the DPA’s definition of ‘direct Marketing’ (20). The controller also stated that it had sent the e-mail in the first place because it was obligated to do so pursuant to the royal decree (25) It had to provide information to travelers regarding recommendations and obligations concerning the COVID 19 pandemic because this was part of its public service obligation. It stated that it had to promote its full service as part of its public service obligation (page 25-26).

Fourth, the controller stated that the DPA violated several principles of good governance, namely the principles of justification, reasonableness, due diligence, equality, impartiality and confidence. Among other arguments, the controller argued that the DPA did not properly motivate the GDPR violations in the original decision. (pagina 31).

Fifth, the controller stated that the DPA did not properly motivate its reasoning in the original decision why it he controller provided commercial services, and was therefore not able to rely on Article 221, paragraph 2 GBW, which is transposing article 83(7) GDPR. The controller stated that supplying the railway pass was part of its public service obligation as an autonomous publicly owned company. (page 32). The controller also stated that the DPA was not even allowed to fine the controller because of Article 221, paragraph 2 GBW, since the controller stated that it did not offer commercial services. Providing public transport should not count as be considered as providing these services on the open market. The controller repeated that it had sent the e-mail because it was obligated to do so by royal decree of 28 July 2020. (pagina 32 -33)

Sixth, the controller stated that the DPA did not properly motivate its fine of €10,000 and violated the principle of proportionality. The controller outlined several circumstances that shoulld have been considered by the DPA. (page 36)

Holding

First, the court determined that the Belgian DPA was authorized to impose the fine. It held that both the GDPR and the e-privacy directive were applicable in this case. The court stated that Article 13(2) of the e-privacy directive, which covers the conditions for direct marketing, explicitly mentions that the GDPR should also be respected. (Page 15 – 16). The court also assessed the authority of the Belgian DPA described in national law. Pursuant to Article 4 WOG, the court concluded that the DPA was not only authorized to assess the controller’s compliance with the GDPR, but also with more specific regulations, such as the e-privacy directive. (Page 17)

Second, the court determined that the controller did not violate Article 6 ECFR by not including a screenshot of the e-mail in the investigation file. The court stated that the screenshot had not been the main piece of evidence on which the DPA’s decision was based. The main evidence was the wording of the controller itself in the e-mail, including the hyperlink in this e-mail which linked to travel blogs on the controllers website. The controller had been the author of both the email and these travel blogs. The court held that the controller had been provided with ample opportunity to defend itself since the e-mail and hyperlink had been part of the investigation file. (17 – 18 - 19)

Third, the court assessed several claims of the controller regarding inaccurate and incomplete facts in the DPA’s decision. The court began with reiterating the definition of direct marketing and its cumulative elements. First, there needs to be a form of communication, which is information shared between a limited amount of parties using a publicly accessible communication-service. Secondly, the communication needs to serve a commercial purpose and needs to be directed individually to a consumer. The controller and the DPA disagreed about this second point. The controller was of the opinion that it had provided information to travelers regarding the COVID 19 pandemic. However, the court agreed with the DPA that not all the information in the e-mail was related to sanitary information related to the pandemic, since the e-mail included a hyperlink linking to promotional content. Therefore, the court rejected this argument of the controller and held that the e-mail was a form of ‘direct marketing’. (page 22 – 23 – 24 – 25).

The court also agreed with the DPA that promotional material for a government service can constitute ‘direct marketing’. The controller also did not provide any arguments that were sufficient to convince the court that the e-mail was not ‘direct marketing’. (Page 25)

Fourth, the court held that the DPA did not violate any principles of good governance. Among other arguments, the court held that the DPA properly motivated the violations in the original decision. (page 30 - 32)

Fifth, the court rejected the controller’s argument that Article 83(7) GDPR was not applicable in this case. The court held that the controller did not limit itself to its legal obligation by only providing the railway pass and sanitary information regarding COVID 19. Therefore, article 83(7) was not applicable. (page 35)

Sixth, the court remarked that the DPA did not adequatly consider the circumstances brought forward by the controller that could impact the amount of the fine. The court also considered several circumstances on its own initiative, namely that the communication had the main goal of providing safety from COVID 19 infections and the fact that the controller had been obligated by law to issue the travel pass.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

Brussels Court of Appeal - 2022/AR/723 - p. 2




The SA under public law NATIONALE MAATSCHAPPIJ DERBELGISCHE RAILWAYS ("NMBS"), with

company number 0203.430.576, with registered office at 1060 Brussels, Rue de France
56,


applicant,


represented by mr. WAEM Heidi and mr VERSCHAEVE Simon, lawyers with office in [...]






in return for

DATA PROTECTION AUTHORITY ("GBA"), with company number 0694.679.950, with

registered office at Drukpersstraat 35, 1000 BRUSSELS,


defendant,


represented by mr. ROETS Joos, mr. CLOOTS Elke and mr. ROES Timothy, lawyers with
office in [...]




                                               ***





Considering the procedural documents




        the decision no. 71/2022 of the Disputes Chamber of the Data Protection Authority
        from May 4, 2022;
        the petition for appeal as filed with the clerk of the Brussels Court of Appeal by

        NMBS on June 2, 2022;
        the introductory session of 15 June 2022 of the Marktenhof;

        the request of NMBS pursuant to Article 748 GerW filed on November 28, 2022;
        the decision of the Market Court of 5 December 2022;
        the (synthesis) conclusions of both parties;

        the bundles of documents filed by both parties;