Court of Appeal of Brussels - 2022/AR/723
| Hof van Beroep - 2022/AR/723 | |
|---|---|
 | |
| Court: | Hof van Beroep Brussel |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 5(1)(c) GDPR Article 5(1)(a) GDPR Article 5(2) GDPR Article 6(1) GDPR Article 12(2) GDPR Article 21(2) GDPR Article 21(4) GDPR XV.2, Paragraph 1 WER |
| Decided: | 14.06.2023 |
| Published: | |
| Parties: | Nationale Maatschappij der Belgische Sporen (NMBS) |
| National Case Number/Name: | 2022/AR/723 |
| European Case Law Identifier: | |
| Appeal from: | GBA 71/2022 |
| Appeal to: | |
| Original Language(s): | Dutch |
| Original Source: | GBA (in Dutch) |
| Initial Contributor: | Kv33 |
The Belgian Court of Appeal reduced a €10,000 fine imposed by the DPA to the national railway company to a symbolic €1 due to lacking motivation concerning the amount of the fine.
English Summary
Facts
This ruling of the Belgian court of appeal (Marktenhof) concerns the Belgian Railway company SNCB/NMBS (controller), a company with the Belgian state as its only shareholder. During the COVID-19 Pandemic, the controller was ordered by the Belgian government to start an initiative to promote train travel. On 13 October 2020, the controller emailed railway pass holders to inform them about the use cases of this travel pass and also provided COVID-19 related information. This e-mail resulted in GDPR related discussions on Twitter, specifically regarding the lack of the possibility to object. The Belgian DPA started an investigation on that matter and found that by not providing the possibility to opt-out of receiving similar emails, the controller violated Articles 12(2), 21(2) and 21(4) GDPR. Moreover, the DPA held that the controller violated Article 5(1)(a), 5(1)(c), 5(2), 6(1), 12(2), 21(2) and 21(4) GDPR.
The controller was fined €10,000 (a summary of this decision is available on the hub) and decided to appeal the decision with the Appeal Court on the following grounds: First, the controller contested the applicability of the GDPR, considering that the e-privacy directive was applicable as lex specialis. Second, the controller stated Article 6 ECFR had been breached because it had not been able to comment on a piece of evidence. Third, the controller stated that the decision of the DPA was based on an inaccurate and incomplete representation of the facts. Among the others, the controller disputed the DPA’s definition of ‘Direct marketing’. It added that it had sent the e-mail in the first place because it was obligated to do so pursuant to the government's instruction. It had to provide COVID-19 related information and promote its full service as part of its public service obligation. Fourth, the controller argued that the DPA did not properly motivate the GDPR violations in the disputed decision. Fifth, the controller disputed the DPA's application of the national implementation of article 83(7) GDPR which enables the DPA to fine a public entity controller under certain conditions. Sixth, the controller stated that the DPA did not properly motivate its fine.
Holding
First, the court held that both the GDPR and the e-privacy directive were applicable in this case. The court stated that Article 13(2) of the e-privacy directive, which covers the conditions for direct marketing, explicitly mentions that the GDPR should also be respected.
Second, the court determined that there was indeed a piece of evidence on which the controller was not able to comment but it was not the main piece of evidence on which the DPA’s decision was based.
Third, the court held that since the e-mail also included a hyperlink linking to promotional content, it was a form of direct marketing. The court also agreed with the DPA that promotional material for a government service can constitute direct marketing.
Fourth, the court held that the DPA properly motivated the violations in the original decision.
Fifth, the court rejected the controller’s argument regarding Article 83(7) GDPR, considering that the controller did not limit itself to its legal obligation by only providing the railway pass and sanitary information regarding COVID-19. Therefore, Article 83(7) GDPR was not applicable for the controller.
Sixth, the court held that the DPA did not adequately consider the circumstances brought forward by the controller that could impact the amount of the fine. The court also considered several circumstances on its own initiative, namely that the communication had the main goal of providing safety from COVID-19 infections and the fact that the controller had been obligated by law to issue the travel pass.
In conclusion, following point 6 of the appeal above, the court concluded that the fine was improperly motivated, not proportional and reduced it to a symbolic €1,00. It rejected all the other grounds for the appeal and therefore confirmed the original decision on the other grounds.
Comment
The court did not refer to the EDPB guidelines on the calculation of administrative fines.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
Brussels Court of Appeal - 2022/AR/723 - p. 2
The SA under public law NATIONALE MAATSCHAPPIJ DERBELGISCHE RAILWAYS ("NMBS"), with
company number 0203.430.576, with registered office at 1060 Brussels, Rue de France
56,
applicant,
represented by mr. WAEM Heidi and mr VERSCHAEVE Simon, lawyers with office in [...]
in return for
DATA PROTECTION AUTHORITY ("GBA"), with company number 0694.679.950, with
registered office at Drukpersstraat 35, 1000 BRUSSELS,
defendant,
represented by mr. ROETS Joos, mr. CLOOTS Elke and mr. ROES Timothy, lawyers with
office in [...]
***
Considering the procedural documents
the decision no. 71/2022 of the Disputes Chamber of the Data Protection Authority
from May 4, 2022;
the petition for appeal as filed with the clerk of the Brussels Court of Appeal by
NMBS on June 2, 2022;
the introductory session of 15 June 2022 of the Marktenhof;
the request of NMBS pursuant to Article 748 GerW filed on November 28, 2022;
the decision of the Market Court of 5 December 2022;
the (synthesis) conclusions of both parties;
the bundles of documents filed by both parties;
