APD/GBA (Belgium) - 146/24
From GDPRhub
| APD/GBA - 146/24 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 5(1)(e) GDPR Article 5(1)(c) GDPR Article 5(2) GDPR Article 7 GDPR Article 7(3) GDPR Article 24 GDPR Article 25 GDPR Article 25(1) GDPR Article 26 GDPR Article 100 of the Belgian LCA |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 28.11.2024 |
| Published: | |
| Fine: | n/a |
| Parties: | Freedelity |
| National Case Number/Name: | 146/24 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | French |
| Original Source: | Autorité de protection des données (in FR) |
| Initial Contributor: | elu |
The DPA reprimanded a tech company for the centralised storage and disclosure of end-customers’ data to different retail companies. This practice violated the principles of data minimization, storage limitation, accountability, as well as data protection by default and by design.
English Summary
Facts
After a Belgian journal published an article on the data sharing from Freedelity to other brands, the Belgian DPA started an investigation.
Freedelity, the controller, is a company offering technological means to simplify the shopping experience of consumers, by collecting and storing the personal data present in Belgian electronic ID cards. This allows to centralise the commercial information and offers from different brands to consumers, such as loyalty cards and background log information of previous purchases. The data processed is stored in a central filing system, accessible to other brands other than only the controller.
Three main points were raised in the investigation. First, the collection of personal data, more specifically identification data and contact data. Second, the sharing of such personal data. Third, the transfer of personal data stored in the central filing system to third parties.
Holding
The DPA started its decision by explaining which type of data processing happened. First, there was a collection of personal data, not only directly from the clients through the scanning of their electronic ID, but also by the controller, both through its application and website, including its cookies, and by subscriptions to the central filing system. Second, there has been sharing of personal data between the controller and other companies, where the controller shared and updated all personal data of customers subscribed to the controller´s service, in exchange for advertisement of the controller´s website.
The court found that the data collection and sharing are two inextricably linked practices as the purpose of data collection from electronic IDs is to allow the constant growth of the central filing system.
Therefore, the DPA considered it appropriate to examine whether or not the controller and the companies providing the other brands acted as joint controllers in the context of this decision. The DPA considered the determination of, first, the purposes of processing; and, second, of the means of processing. The purpose was found to be the data collection and processing, which is shared between the controller and the other brands. Similarly, the means are shared, with the controller collecting personal data from their website and app, and the other brands advertising this service. In light of this, the controller and the other brands were considered joint controllers as per Article 26 GDPR.
Violation of Articles 5(2) and 7 GDPR
With regards to the lawfulness of the legal basis, the DPA found that a violation of Article 5(2) and 7 GDPR existed as the consent collected by the joint controllers was not “collected for specified, explicit and legitimate purposes”.
Violation of Articles 5(2), 7(3), 24 and 25 GDPR
Additionally, the DPA considers that the joint controllers did not respect the documentation requirements and liability arising from Articles 24 and 5(2) GDPR in matter of withdrawal of consent, as current mechanisms do not allow for a withdrawal of consent that is both simple and direct as required by Article 7(3) GDPR, in accordance with the principle of data protection by design under Article 25 GDPR.
Violation of Articles 5(1)(c) and 25(1) GDPR
A violation of the principle of data minimization under Article 5(1)(c) GDPR and of data protection by default under Article 25(1) GDPR was found as data concerning the municipality of issue of the identity card, the date of validity of the identity card and the history of this data has been collected, even if the DPA finds that it has no relevance in the framework of the processing carried out by the joint controllers.
Violation of Articles 5(1)(e), 5(2), 24 and 25(1) GDPR
Finally, the DPA found that a violation of Article 5(1)(e) GDPR, namely the storage limitation principle, as it established a data storage period of 8 years, which is too long, and also does not have in place a good storage system to keep the data subject´s data safe from third party interventions.
Reprimand
In the case at hand, as per Article 100 of the Belgian LCA, the DPA considered it sufficient to reprimand the controller, but also imposed a deadline of 4 months to correct these GDPR violations. After those 4 months, a €5,000 daily fine will be imposed.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/67
Contentious Chamber
Decision on the merits 146/2024 of 28 November 2024
Case number: DOS-2019-04308
Subject: Investigation concerning two processing operations implemented by Freedelity
The Contentious Chamber of the Data Protection Authority, consisting of Mr. Hielke
Hijmans, President, and Messrs. Yves Poullet and Romain Robert, members;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and on the
free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter "GDPR";
1
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter the "LCA");
Having regard to the internal regulations as approved by the Chamber of Representatives on 20
December 2
2018 and published in the Belgian Official Gazette on 15 January 2019;
Having regard to the documents in the file;
Has taken the following decision concerning:
The defendant: Freedelity, whose registered office is established at Rue Altiero Spinelli7, 1401 Nivelles,
registered under company number 0818.399.886, represented by Maîtres
Christian Defauw, Alexandre Cassart, Etienne Wéry, Victoria Ruelle and Fanny
Cotton, hereinafter: "the defendant"
1The DPA recalls that the revised organic law entered into force on 01/06/2024. It only applies to complaints, mediation files, requests, inspections and proceedings before the Litigation Chamber initiated from that date. Cases initiated before 01/06/2024, such as this case, are subject to the provisions of the old version of the LCA accessible here: https://www.autoriteprotectiondonnees.be/publications/loi-organique-de-l-apd.pdf
2
The new internal regulations of the APD, following the amendments made by the Law of 25 December 2023 amending the Law of 3 December 2017 establishing the Data Protection Authority (LCA), came into force on
01/06/2024. It only applies to complaints, mediation files, requests, inspections and proceedings before the Litigation Chamber initiated from that date. Cases initiated before 01/06/2024 are subject to the
provisions of the internal regulations as they existed before that date. Decision on the merits 146/2024 – 2/67
I. Facts and procedure
1. On 8 July 2019, the newspaper l’Echo published an article entitled “Freedelity proposes to
pool customer data management”. On 2 August 2019, a member of the
Management Committee proposed to the Chairman of the Management Committee to examine this service.
2. This discussion was put on the agenda of the Management Committee meeting of 20
August 2019. At this meeting, the Management Committee decided to send a letter to the
defendant to inquire about the operation of the service described in the article in l’Echo.
3. On 30 August 2019, the Director of the General Secretariat sent a letter containing a
series of approximately 10 questions to the defendant. On 9 October 2019, the defendant
forwarded its answers to the General Secretariat.
4. On the basis of these answers, the General Secretariat drafted a letter to the
Management Committee entitled “DIRCO Report – Preliminary Information Letter –
Freedelity”. On 6 December 2019, on the basis of the latter, the Management Committee of
the Data Protection Authority (hereinafter “DPA”) decided to request an investigation
from the Inspection Service, pursuant to Article 63.1° of the LCA.
5. On 20 April 2022, the Inspection Service's investigation was closed, the report was attached to the
file and the latter was forwarded by the Inspector General to the President of the
Litigation Chamber (Art. 91, § 1 and § 2 of the LCA).
The Inspection Service notes, broadly, that:
- Finding 1: Freedelity was unable to demonstrate the collection of
valid consent (in accordance with Article 4.11 of the GDPR) in violation of Articles
5.1.a., 6.1.a., 7 and 5.2. of the GDPR.
- Finding 2: Freedelity was unable to demonstrate that appropriate measures
had been put in place to facilitate the withdrawal of consent
in violation of Article 7.3. of the GDPR, read in light of the principle of
accountability (Articles 5.2., 24 and 25 of the GDPR).
- Finding 3: Freedelity was unable to demonstrate that it has implemented
appropriate measures to ensure the validity and collection of consent
(within the meaning of Article 4.11. of the GDPR) for the processing operations for which Freedelity
acts as data controller, in violation of Articles 5.2., 24 and 25 of the GDPR.
- Finding 4: Freedelity has violated the principle of data minimization set out in
Article 5.1.c. of the GDPR and Article 25.1 of the GDPR.
3 This article is available at the following link: https://www.lecho.be/entreprises/technologie/freedelity-propose-de-
mutualiser-la-gestion-des-donnees-clients/10143718.html Decision on the merits 146/2024 – 3/67
- Finding 5: Freedelity failed to justify the data retention periods
determined in violation of Articles 5.1.e., 5.2., 24 and 25.1. of the GDPR.
6. On 6 July 2022, the Litigation Chamber decided, pursuant to Article 95, § 1, 1° and
Article 98 of the LCA, that the case could be dealt with on the merits.
7. On the same day, the defendant is informed by registered mail of the provisions as
set out in Articles 95§2 and 98 of the LCA. It is also informed, pursuant to
Article 99 of the LCA, of the deadlines for submitting its submissions.
8. The deadline for receipt of the submissions in response from the defendant
was set at 31 August 2022
9. On 7 July 2022, the defendant requests a copy of the file (Art. 95, §2, 3° LCA),
which is sent to it on 12 July 2022.
10. On 18 July 2022, the defendant agrees to receive all communications relating
to the case by electronic means and expresses its intention to use the possibility of being
heard, in accordance with Article 98 of the LCA. She also requests an extension of the
deadline for submitting submissions to 30 October 2022.
11. On 2 August 2022, the Litigation Chamber accepts an extension of the deadline to 21
September 2022.
12. On 15 September 2022, the defendant requests to be able to consult the paper version of the
administrative file. She also requests an extension of the deadline for submitting
submissions to 21 October 2022.
13. On 21 September 2022, the Litigation Chamber agrees to extend the deadline for
filing submissions by two weeks, until 5 October 2022. It reminds the
defendant that, at her request, she had already obtained a complete digital copy of the
administrative file on 12 July 2022. However, she adds that she can consult the file by
contacting the registry.
14. On 28 September 2022, the consultation of the paper administrative file took place in the premises
of the APD.
15. On 5 October 2022, the Litigation Chamber received the submissions from the
defendant. When sending its submissions, the defendant also requested,
before ruling on the matter, documents that it considered necessary for the exercise of the
rights of the defence. It also requested to be granted a new deadline for submissions
after receipt of these documents.
16. On 2 May 2023, the Litigation Chamber sent the defendant numerous
documents and also authorised the defendant to conclude on these elements until 17
May 2023. Decision on the merits 146/2024 – 4/67
17. On 3 May 2023, the defendant requested that the deadline for submission of
conclusions be extended to 15 June.
18. On 8 May 2023, the Litigation Chamber agreed to extend the deadline by one week,
until 24 May 2023.
19. On 9 May 2023, the parties were informed that the hearing would take place on 14 June 2023.
20. On 23 May 2023, the defendant informed the Litigation Chamber that it wished
to receive a full copy of the minutes of the Management Committee meeting of 6
December 2019. It requested a copy of the decision to lift the mandate of the President of
the APD in 2022 and, in the event that the APD did not have it, it demanded that the
latter take steps to obtain it. It considers that the deadlines for submitting the
submissions granted to it are unreasonable, that the hearing is premature and that
the file is not ready.
21. On 24 May 2023, the Litigation Chamber receives the additional submissions from
the defendant.
22. On 2 June 2023, the Litigation Chamber responds to the defendant, stating that the
extracts from the minutes of the Management Committee meeting contain all the
information relating to this file. It adds that it has provided all the documents
at its disposal and that it is up to the defendant to present in support of its
submissions all the documents it considers useful. The Litigation Chamber concludes
that the file is ready and that the hearing can take place.
23. On 12 June 2023, the defendant informed the Litigation Chamber that it had filed
a request with the Commission for Access to Administrative Documents (hereinafter, “CADA”)
against the Litigation Chamber. It requested a further postponement of the hearing.
24. On 12 June 2023, the Litigation Chamber reiterated the position expressed on 2 June 2023. It
added that the APD did not currently consider itself subject to the law of 11 April 1994 on
the publicity of the administration.
25. On 12 June 2023, the defendant informed the Litigation Chamber that one of its
counsel was unavailable due to illness and that it was therefore unable
to argue the case on the scheduled hearing date.
26. On 13 June 2023, the Litigation Chamber informed the defendant that
the hearing had been postponed to 29 June 2023.
27. On 15 June 2023, the defendant sent the Litigation Chamber a request for
4
disqualification of its president on the basis of Article 828, 1° of the Judicial Code.
4 Art. 828 of the Judicial Code: "Any judge may be challenged for the following reasons: 1° if there is legitimate suspicion (…)" Decision on the merits 146/2024 – 5/67
28. On June 19, 2023, the President of the Litigation Chamber dismissed the challenge request
recalling in particular that the Judicial Code is not applicable to him, and that the
defendant's arguments concerning the lack of impartiality of the President of the
Litigation Chamber are unfounded.
29. On 20 June 2023, the defendant filed a challenge application with the Market Court, which informed the Litigation Division on 22 June 2023.
30. On 26 June 2023, the registry of the Litigation Division informed the defendant that
the hearing scheduled for 29 June 2023 was postponed to a date to be determined.
31. On 27 June 2023, the defendant sent an email to the President of the Data Protection Authority. In this email, the defendant recalled its various requests
concerning the documents and indicated that it considered that this issue should be
dealt with by the President of the DPA or the DPA Management Committee and not by the President
of the Litigation Division.
32. On 4 July 2023, the APD received Opinion No. 2023-95 from the CADA. The latter considered itself
competent to give an opinion on a request for access to a document made to
the APD. It also considered that the defendant's request was admissible.
33. In its opinion, the CADA indicated that the APD was not required to guarantee access to a
document that it did not possess, but that it must designate, if it was aware of it, the
authority that held the requested document. Following this opinion, the defendant again requested
access to documents that it considered necessary for the exercise of the rights of the defense.
34. On 11 July 2023, the Litigation Division responded to the defendant, informing it
that it was forwarding its request to the APD's Management Committee.
35. On 18 July 2023, the Management Committee, through the Chair of the APD, responded to the
defendant. She first stated that the CADA’s position constituted a reversal
of its previous position. She added that she was not taking a position at this stage
on the applicability of the law of 11 April 1994 to the APD, but she saw no objection to the
fact that, in this case, the agenda and minutes of the Management Committee meeting of 6
December 2019 were provided to the defendant, with the removal of information
concerning other data controllers.
36. On 31 October 2023, the Market Court issued a judgment 2023/7566 concerning the application for
disqualification filed by the defendant against the President of the Contentious
Chamber. In this judgment, the Market Court declared itself without jurisdiction and without
competence to hear the application for disqualification filed by the defendant against
the President of the Contentious Chamber.
5Judgment of the Market Court of 31 October 2023, No. 2023/AR/821 (judgment not registrable) Decision on the merits 146/2024 – 6/67
37. On 28 November 2023, the defendant was informed that the hearing would take place on 15
January 2024.
38. On 22 December 2023, the defendant filed a summons for interim relief with the
Interim Relief Chamber of the Brussels Court of First Instance requesting the production
of all documents relating to Freedelity under penalty of a penalty payment.
39. The Chamber of Interim Relief issued a first order on 12 February 2024 in which it
declared Freedelity’s application unfounded with regard to the production of the
decision to lift the mandate of the former president of the APD and the
documents that are not linked to the decision of the Management Committee of 6
December 2019. It ordered the APD to produce several of the
documents requested by the defendant.
40. On 20 March 2024, the Chamber of Interim Relief issued an order in which it
found Freedelity’s application to be partially founded and ordered the APD to produce
several additional documents, including internal emails between APD
employees that were included in the inventory of exhibits.
41. On 22 March 2024, the APD provided the additional exhibits to Freedelity. In accordance with the
second order of the Chamber of Interim Relief, it grants a period of 15 days to
Freedelity to conclude on all the documents provided by the APD and invites it to the hearing which
will take place on April 11.
42. On April 9, Freedelity files its additional submissions.
43. On April 11, 2024, the defendant is heard by the Litigation Chamber.
44. On April 29, 2024, the minutes of the hearing are submitted to the defendant.
45. On May 3, 2024, the defendant informs the Litigation Chamber that it does not
wish to comment on the minutes of the hearing and that it sticks to its procedural
writings and pleadings.
II. Reasons
II.1. Background
46. Since its creation in 2010, Freedelity has offered technology aimed at simplifying the
collection and updating of personal data, in particular by using data
contained in the chip of the Belgian electronic identity card (hereinafter, "eID").
47. Freedelity's services make it possible to centralise commercial advantages offered
by different brands to consumers, as well as the latter's loyalty cards or proofs of
purchase. These services are offered both (i) by Freedelity to its customers of the
"brand" type (according to a B2B model, as part of the CustoCentrix service), and (ii) by
Freedelity to consumers (according to a B2C model). Decision on the merits 146/2024 – 7/67
48. While the article in the aforementioned Echo focused on the presentation of CustoCentrix, from
the inspection phase, the investigation focused on the “Freedelity file”, maintained
by Freedelity as data controller, this file remaining largely
supplied by data collected by the brands.
49. As Freedelity explains in its responses to the inspection service (Exhibit 5 of the file),
“the Freedelity file allows the personal identification of each consumer,
access to the Myfreedelity portal as well as the management of the process of pooling the
maintenance of consumer data between Freedelity customers”.
50. The Inspection Service has only analysed the conformity of the processing operations relating to the
Freedelity file, and consequently (1) the collection of personal
identification and contact data, (2) the pooling of these personal
data, and (3) the transfer of identity data contained in the Freedelity
file to third parties such as Z1 and Z2.
51. The Litigation Chamber will successively analyse the legality of the processing operations (1) and (2)
referred to above in section II.5. However, it notes that the
Inspection Service’s investigation report does not contain sufficient elements to allow
an in-depth examination of the processing operation (3), in particular
concerning the possible legal bases and the roles of the actors involved. Consequently, this
decision will not concern this processing operation (3).
II.2. Preliminary question: Deportation of the President of the Litigation Division
52. As a preliminary point, the defendant requests the President of the Litigation Division to
withdraw due to the legitimate doubt that exists as to his impartiality. For the purposes of
readability and clarity of this decision, the response of the Litigation Division to this
argument will be examined later in the decision, in the section devoted to
respect for the rights of the defence, and more particularly to the impartiality of the members of
the Management Committee, including the President of the Litigation Division (section II.4.1.1).
II.3. Procedure: Stages of the procedure
53. The Litigation Division notes that the defendant has raised a significant
number of arguments relating to all stages of the procedure. However, without prejudging
its jurisdiction and the extent of its duty to provide reasons with regard to the arguments
raised - questions which have not been decided by the Markets Court -, the
Litigation Chamber wishes to respond to them below for the proper understanding of the decision.
6Freedelity’s role as the data controller of this file is not contested. Decision on the merits 146/2024 – 8/67
II.3.1. The questioning of the Director of the General Secretariat (at the time also
Chairman of the Management Committee) by the Director of the Knowledge Centre
54. The defendant considers that the Director of the Knowledge Centre at the time had
no authority to question the Director of the General Secretariat, either in her
capacity as a member of the Management Committee or as Director of the Knowledge Centre.
55. For all practical purposes, the Litigation Chamber recalls that the Management Committee is
composed of the five directors of the APD (Article 12 of the LCA). In this capacity, the Director of the
Knowledge Centre was, along with this function, a member of the
Steering Committee at the time of the questioning of the Director of the
General Secretariat. Furthermore, the Director of the
General Secretariat at the time was also the President of the
Data Protection Authority, and therefore, in this capacity, chaired the
Steering Committee in accordance with Article 13§1 of the
LCA.
56. Article 10§1 of the LCA provides that “The Steering Committee shall monitor
developments in the technological, commercial and other
fields that have an impact on the protection of personal data” (emphasis added).
57. It is clear from the documents in the case that the Director of the Knowledge Center (member of the
Management Committee) proposed to the Chairman of the Management Committee to examine a Freedelity
service whose operation was described as innovative in an article in
L’Echo published on 8 July 2019, entitled “Freedelity proposes to pool the management of
customer data”.
58. The APD, through its predecessor the Commission for the Protection of
Privacy (hereinafter “CPVP”), was aware of the existence of the service offered by Freedelity, consisting of
an innovative technology allowing access from one’s identity card to
economic advantages (e.g. points accumulated on a loyalty card). However,
the L’Echo article presented an evolution of the technological service in question:
“Today, the Nivelles company is going a step further. With Custocentrix, it is launching a
cloud platform enabling retailers to better organise and keep up to date
all of their customers' personal and behavioural data".
59. It should be noted that an evolution of a technological service offered by a private company
requiring the use of the Belgian identity card, which contains a unique identifier of
a highly sensitive and regulated nature (the national register number), has an
impact on the protection of personal data in Belgium. If the members of the
APD Management Committee were not able to understand the extent of
7As of 1 June 2024, this service is called the "Authorisation and Advice Service".
8The Echo article is available at the following link: https://www.lecho.be/entreprises/technologie/freedelity-propose-de-
mutualiser-la-gestion-des-donnees-clients/10143718.html
9Without however being considered as a special category of personal data within the meaning of Article 9 of the GDPR. Decision on the merits 146/2024 – 9/67
the impact of this development on the basis of a simple newspaper article, nor whether the processing of the
national register number was involved in this development, the latter have fully assumed
their responsibility by deciding to analyse said development on the basis of Article
10 of the LCA. Any contrary interpretation of this article would amount to limiting this monitoring power
conferred specifically on the members of the Management Committee 10 and to emptying it of its
meaning. The Director of the Knowledge Center was therefore entitled to formally request
the Chairman of the Management Committee that this discussion be placed on the agenda
of the Management Committee meeting of 20 August 2019.
60. Under the conditions mentioned in the two preceding paragraphs, any member of the
Management Committee is authorized to formally request the Chairman of the
Management Committee to place a discussion concerning such monitoring on the agenda of
Management Committee meetings. For the Litigation Chamber, this interpellation comes within the
framework of this obligation to monitor developments in technological fields,
falling to the APD and therefore, first and foremost, to the members of the Management
Committee. Such monitoring requires the possibility of an internal interpellation between members of the
Management Committee and is therefore perfectly justified.
61. A member of the Management Committee wished to put on the agenda a discussion
concerning the new service proposed by Freedelity, in order to allow the
Management Committee to monitor this development in the technological field. This
legitimate questioning occurs within the framework of Article 10§1 of the LCA and is
therefore in accordance with the law.
II.3.2. Sending of a letter requesting information to the defendant by the
Chairman of the General Secretariat (at the time, also Chairman of the Management
Committee)
62. First, the defendant considers that following the decision of the
Management Committee to monitor the Freedelity service, the General
Secretariat exceeded its powers by sending a letter requesting information to the
defendant (Exhibit 2 of the file). It relies in particular on a report from the Court of Auditors which, according to it,
criticises the fact that the General Secretariat grants itself a "role of filtering files".
Secondly, the defendant argues that sending this letter requesting
information in Dutch to the defendant is contrary to the law on the use of
languages in administrative matters and that by application of Article 58 of the
Law of 18 July 1966, the nullity of this act must be established and, by extension, that of the
entire procedure.
10It should be noted that the members of the Management Committee make particularly moderate use of this monitoring power conferred
by Article 10 of the LCA. This power is included in the new version of the LCA, as applicable to files initiated
after 01/06/2024. Decision on the merits 146/2024 – 10/67
63. First, the Litigation Chamber points out that during the meeting of the
Management Committee, its members decided that a letter could be sent on the basis of Article
20§1,1° of the LCA, after consulting the files that had previously been opened
concerning the defendant with the Front Line Service (“FLS”). The first
letter was drafted by the General Secretariat and sent to the defendant on 30 August 2019.
64. The President of the APD (and therefore of the Management Committee) was assisted in the
performance of his tasks by the General Secretariat (Article 13§3 of the LCA). In addition, the General
Secretariat has its own mission of “monitoring” technological developments, which
have an impact on the protection of personal data (Article 20§1,1° of the
LCA). This mission presents a certain redundancy with that of the Management Committee,
consisting of “monitoring” developments in the technological field having an impact
on the protection of personal data (Article 10 of the LCA). However, the
“monitoring” mission11 of the General Secretariat implies a priori an active control of a higher
degree than that implied by the notion of “monitoring” incumbent on the Management Committee. Furthermore,
the Management Committee does not have its own department and cannot ensure its
monitoring without going through another body of the APD to assist it, which was in this case the
General Secretariat, whose director chaired the Management Committee.
65. The Litigation Chamber does not share the defendant’s reading according to which the
General Secretariat arrogated to itself in this case “investigative” powers (a mission
incumbent solely on the Inspection Service) or “filtering of files”. In the
present case, the General Secretariat sent about ten neutral questions
concerning the operation of the new Freedelity service, in order to
understand how it works. The General Secretariat is in fact
authorized to exercise such surveillance
under Article 20§1,1° of the LCA), which is distinct in all respects
from the power of investigation reserved for the Inspection Service (Article 28 of the LCA).
66. Thus, the criticisms of the Court of Auditors concerning the fact that the General Secretariat
would play a role of filtering files are not relevant to the present case,
since in this case, the file was opened at the request of a member of the
Management Committee and the Management Committee decided to send a letter on 20 August 2019. The
General Secretariat merely assisted the Chairman of the Management Committee while
remaining within the limits of its legal powers, and, in this way, enabled the Management
Committee to monitor developments in the technological field in question.
1According to the Larousse dictionary, the primary meaning of the term "surveillance" is defined as: "Action of monitoring, of controlling
something, someone". See in this sense the online version available on the following link:
https://www.larousse.fr/dictionnaires/francais/surveillance/75897
12
According to the Larousse dictionary, the primary meaning of the term "monitoring" is defined as: "Set of operations consisting of
monitoring and controlling a process to achieve the desired result in the best conditions". See in this sense the
online version available at the following link: https://www.larousse.fr/dictionnaires/francais/suivi/75313 Decision on the merits 146/2024 – 11/67
67. Prohibiting the General Secretariat from contacting the stakeholders concerned regarding
technological developments in order to fully assume its “monitoring” mission,
would amount for the APD to requesting the intervention of another body (for example the
Inspection Service) to ensure this monitoring. This mode of operation would be completely
contrary to the spirit of the LCA, and to the logic of the distribution of internal powers between
the bodies of the APD, as explained above: it is not only provided in the text that
the General Secretariat follows technological developments, but it is also logical that
the General Secretariat assists the Management Committee in the performance of its tasks,
particularly when Article 13§3 of the LCA provides that the President of the APD – therefore the
President of the Management Committee – is assisted in the performance of his tasks by the
General Secretariat. Furthermore, the Inspection Service could not be contacted at this stage,
since its referral cannot come from a request from the General Secretariat (Article 63 of the
LCA) and no procedure justifies the sharing of an investigation by the Inspection Service
with the General Secretariat, which must remain secret as a matter of principle (Article 28 of the LCA).
68. For these reasons, the General Secretariat remained within the limits of its powers by
contacting Freedelity, as part of its monitoring mission, in order to measure
itself the impact of a technological development on data protection, as provided
for by Article 20§1,1° of the LCA, to inquire about the technological
development that constitutes the new service offered by Freedelity, a service whose
impact was certain due to the sensitive nature of the processing in question requiring the use of the
identity card.
Sending a letter requesting information concerning the processing of
personal data in the context of the new Freedelity service therefore constitutes a
proportionate measure in the context of the monitoring mission of the General
Secretary and of monitoring technological developments within the remit of the Management
Committee.
69. Secondly, regarding the use of language, as the Market Court has already decided, "Despite its public policy nature, an illegality relating to the language of a decision cannot give rise to annulment if it is not such as to affect the meaning of the decision, if it has not deprived the interested parties of any guarantee or if it has not had the effect of influencing the competence of the author of the decision" (free translation). In this case,
Exhibit 2 of the file was processed by the defendant without difficulty, and it was sent at a stage
prior to the investigation by the Inspection Service.
70. In this case, the Litigation Chamber recalls the chronology of the facts:
- Sending of a letter requesting information in Dutch (Exhibit 2) - 30.08.2019;
13Judgment of the Market Court, of September 4, 2019, 2018/AR/1446 and others, original version: “Ondanks zijn karakter van de
open order, kan een eventuale onwettigheid in verband met de taal van een beslissing, een aanleiding geven tot
vernietiging indian deze onwettigheid niet van aard is om, te dezen, een invloed hebben op de richting van de beslissing, zij
de belanghebbende partijen geen waarborg heeft ontzegd de zij niet het effect heeft gehad om van invloed te zijn op de
bevoegdheid van de auteur van het besluit”. Decision on the merits 146/2024 – 12/67
- Freedelity requests to be able to respond in French – 10.09.2019;
- APD agrees that the file be handled in French – 20.09.2019;
- Freedelity sends its responses in French – 09.10.2019
- The rest of the file is handled in its entirety in French.
71. The responses provided by the defendant to the letter requesting information in
Dutch were written in French by the defendant, who was therefore perfectly able
to understand the questions addressed to it.
72. In accordance with the defendant’s request, the rest of the procedure was conducted
in its entirety in French. The defendant was therefore in no way deprived of procedural
guarantees that could affect the present procedure.
73. Consequently, the Disputes Chamber considers that the sending of a letter requesting
information to the defendant by the President of the General Secretariat (at the
time, also President of the Management Committee) complies with Articles 10 and
20§1,1° of the LCA. The fact that this letter was written in Dutch is not such as
to taint the proceedings with nullity since the rights of the defence were not
affected.
II.3.3. Sending of a note to the Management Committee by the
General Secretariat (“DIRCO Report – Preliminary Information Letter –
Freedelity”)
74. First, the defendant criticises the fact that the General Secretariat drafted a
note (“Preliminary Information Letter”) for the Management Committee on the basis
of the responses provided by the defendant (document 6 of the file). It also criticises that
this note uses elements from the contacts between the CPVP and the
responses provided by Freedelity to the questions of the General Secretariat. Secondly, the
defendant claims that the document entitled “probe letter” which is attached to the
decision of the Management Committee of 6 December 2019 is not produced in the file. It adds that
the use of the terminology “probe” demonstrates the implementation of
exploratory, abusive, unfair and arbitrary procedures. It concludes that in this case, the APD
had no serious evidence at the time it contacted Freedelity.
75. Firstly, the Litigation Chamber notes that following the
defendant’s response to the letter requesting information, an opinion was drawn up by the
General Secretariat for the Management Committee on the basis of the
responses provided (document 6 of the file).
On this basis, the Management Committee decided on 6 December 2019 to ask the
Inspection Service to open an investigation.
76. As stated above, the Litigation Chamber recalls that the General
Secretariat has a monitoring mission (Article 20§1, 1° of the LCA). When this Decision on the merits 146/2024 – 13/67
monitoring mission follows a request for monitoring from the Management Committee (Article 10
of the LCA), it is logical that a document be drawn up on the basis of the answers provided to the
questions asked, to enable the Management Committee to ensure the continuity of its
monitoring (Article 10 of the LCA).
77. Indeed, in order to pursue “developments in the technological field” (emphasis added)
within the meaning of Article 10 of the LCA, it is necessary for the Management Committee to take into
account all information relevant to understanding such developments. The
Management Committee has therefore legitimately cross-checked and used the information made
available by Freedelity during its contacts with the CPVP, of which the APD is the
continuation.
78. The provision of information necessary for monitoring cannot be carried out by the
Management Committee itself since it does not have a department - as already
indicated previously - and must therefore necessarily be carried out by a body of the APD. In
this case, the General Secretariat was the natural APD department to do this: the
request for information already came from the General Secretariat, which logically
followed up on its letter, not to mention that this body is entrusted by
Article 10 of the LCA with a mission to monitor technological development.
79. The Litigation Chamber concludes that the General Secretariat was perfectly justified in
drafting an opinion for the Management Committee by gathering the information made available to
it so that the Management Committee could decide to open an investigation at a later
stage. Moreover, it was only on the basis of the information reported by the
General Secretariat that the Management Committee was able to assess the follow-up to be given to the procedure. No opinion or
recommendation is binding on the Management Committee, which is sovereign in its assessment.
In this case, the Management Committee decided that the next step in the procedure would be the implementation
of Article 63.1° of the LCA.
80. Secondly, the document entitled “probe letter” whose legality the defendant is contesting
is indeed document 6 of the inventory which has been part of the file since the beginning of the case and
which was provided to the defendant when it requested a copy of the file.
81. Furthermore, the term "probe" on which Freedelity's complaint is based is used only once by a legal adviser who wrote the opinion to the Management Committee on which the latter ruled on 6 December 2019. The term is never used again subsequently and the
letter is officially entitled ("DIRCO Report - Preliminary Information Letter -
Freedelity").
82. In its internal communications, the APD alternately uses the terms "monitoring" or
"system surveillance procedure" in relation to this letter. The unfair nature of the APD cannot be deduced from the
simple use of these terms. Indeed, these terms are taken from the very letter of the LCA, at most they are translated into English. The Litigation Chamber
recognises at most the use of different terms in the
internal communications to identify the procedure in question, which
has no legal consequences on the procedure.
83. The actions taken by the General Secretariat constitute a
necessary step in order to be able to provide a complete file to the
Management Committee so that it can make an informed decision. The
defendant wrongly confuses on the one hand (i) the preparatory
actions for the follow-up of a file as well as the decision of the
Management Committee, and on the other hand (ii) the investigation
itself.
84. The Litigation Chamber firmly reaffirms that an investigation can only be
carried out by the Inspection Service (Article 28 of the
LCA). Unlike the latter, neither the
General Secretariat nor the Management Committee have the power to note
infringements or violations of the GDPR before submitting their findings to the
Litigation Chamber.
85. The sending by the General Secretariat to the Management Committee of the contested note (the “DIRCO
Report – Preliminary Information Letter – Freedelity”) was done legally, on the basis
of Articles 10 and 20§1, 1° of the LCA.
II.3.4. Finding of serious evidence by the Management Committee
86. First, the defendant maintains that it was the General Secretariat that referred the
Management Committee, with reference to Article 63.1 of the LCA, when it did not have
serious evidence to do so and that it therefore illegally decided to ask
questions of the defendant. It considers that the article in L’Echo was not sufficient
in itself to trigger the opening of a file. Secondly, it adds that the
Management Committee did not find serious evidence in its decision of 6 December 2019 since
it merely repeated the report made by the General Secretariat. It refers in particular
14
to the judgment of the Court of Markets of 22 February 2023 to argue that the
Management Committee’s reasoning is deficient. Third, the defendant considers that the DPA has
undermined the defendant’s legitimate expectations by using information
present in files from 2014 to 2016, while the DPA’s predecessor, the CPVP
had closed these files.
87. First, with regard to the question of the General Secretariat’s jurisdiction, the
Litigation Chamber refers to section II.3.3 above, in which no illegality
is established. Furthermore, the Litigation Chamber notes a reading error on the part of the
defendant. The General Secretariat did not assist the Management Committee on the basis of
14 Judgment of the Court of Markets, dated 22 February 2023, No. 2022/AR/253, available at the following link:
https://www.autoriteprotectiondonnees.be/publications/arret-du-22-fevrier-2023-de-la-cour-des-marches-ar-953.pdf Decision on the merits 146/2024 – 15/67
Article 63.1° of the LCA, but rather on the basis of Article 20§1,1° of the LCA, as it clearly emerges
from the documents in the file.
88. The Litigation Chamber recalls that, by virtue of the powers conferred on the Management Committee, it is up to it to ask the Inspection Service to open an investigation if serious evidence reveals the existence of practices that could give rise to a violation of the fundamental principles of data protection (Article 63.1° of the LCA). As recalled by the Markets Court, this is a discretionary power of the APD.15
89. The elements covered by the report comply with the letter of the LCA, insofar as the object of the monitoring or surveillance is precisely the impact or incidence on the
protection of personal data as required by Articles 10 and 20§1, 1° of the LCA).
The elements retained by the General Secretariat were indeed focused on such an object:
a) Article 10 of the LCA concerns technological areas that have
an “impact on the protection of personal data”
b) Article 20§1, 1° of the LCA requires the monitoring of technological
developments having an “impact on the protection of personal data”
90. A report on a technology having an impact or an impact on the protection of
personal data, may reveal serious indications of the existence of a practice
likely to give rise to an infringement of the fundamental principles of the protection of
personal data (Article 63.1 of the LCA).
91. Secondly, concerning the reference by reference, the Litigation Chamber recalls that
the Council of State accepts the motivation by reference, provided that the document to which reference is made is part of the
file. This is the case here since document number 6, which constitutes the opinion of the General Secretariat (“DIRCO Report – Preliminary
Information Letter – Freedelity”), is annexed to the decision of the Management Committee and has always been
part of the file. The decision of the Management Committee is formulated as follows:
“The conclusions of the attached annex contain indications of non-compliance with the
following principles: obtaining consent, profiling and sharing of data,
minimisation of data, retention period and recipients of data”
(free translation).
15
Judgment of the Market Court of 22 February 2023, No. 2023/1527, p. 40., available at the following link:
https://www.autoriteprotectiondonnees.be/publications/arret-du-22-fevrier-2023-de-la-cour-des-marches-ar-953.pdf.
16Decision of the Council of State of 7 May 2013, No. 223.440
17
Extract from the minutes of the Management Committee of 6 December 2019. Exhibit 7 of the file. Original version: "The extensive statements in
bijlage gevoegd bevatten aanwijzingen betreffende do not comply with the following principles: as per Décision sur le fond 146/2024 – 16/67
92. The decision of the Management Committee therefore justifies its decision by referring to the note
provided to it, and relies on it to identify serious indications of
breaches of the following principles:
- obtaining consent,
- profiling and sharing of data,
- minimisation of data,
- retention period,
- and recipients of the data.
93. Thirdly, with regard to the defendant’s argument that the consultation and
use of the information in the files opened within the CPVP, the predecessor of the
APD, violated the principle of legitimate expectations, the Litigation Chamber recalls that, like any public
authority, it is subject to the duty of thoroughness which requires it to “conduct a meticulous
research into the facts, to gather the information necessary for decision-making and to take into account
all the elements of the file in order to make its decision in full knowledge of the
facts and after having reasonably assessed all the elements useful for resolving the
specific case”. 18
94. This duty requires the APD, when it wishes to make a decision concerning
an individual, to check whether and to what extent files have already been opened
against that individual. This research is also essential in order to be able to
ensure compliance with the principle of non bis in idem. The Litigation Chamber
therefore considers that the General Secretariat was perfectly entitled to consult all
the files concerning the defendant, including the closed files, to enable
the Management Committee to make an informed decision.
95. The Litigation Chamber recalls that, according to the Council of State, the principle of
legitimate trust, "means that the person administered must be able to count on a clear and
well-defined line of conduct from the authority or, in principle, on promises made to him by
the authority in a specific case. The violation of the general principle of legitimate
trust requires three conditions, namely an error by the administration, a legitimate
expectation raised following this error and the absence of a reason to go back on this
recognition. This principle cannot be invoked on the basis of acts emanating from an
authority distinct from that which adopted the contested act. »
of toestemming, profiling in delen van gegevens, gegevensminimalisatie, bewaartermijn en ontvangers van de
gegevens. »
18Judgment of the Council of State, of December 6, 2021, No. 252.324, p. 13.
19Judgment of the Council of State of 8 May 2024, No. 259.704. Decision on the merits 146/2024 – 17/67
96. The Litigation Chamber notes that in its analysis, the General Secretariat
found five indications of non-compliance. Two of these indications (indications 3 and 5) are based
solely on the responses provided by the defendant in its letter of 9 October 2019.
These indicators are not based on elements of older files. The three other
indicators of non-compliance are based on a comparison between the elements contained
in a letter from the defendant to the CPVP dated 26 November 2015 and the
response of 9 October 2019. The General Secretariat noted in its three instances a
change in the defendant's practice which, according to it, could
constitute a breach of the principles of personal data protection. The General
Secretariat had to carry out this verification to allow the Management Committee to
"monitor developments", as explained previously, and decide to refer the
matter to the Inspection Service.
97. Thus, in its analysis, the General Secretariat claims that between 2015 and 2019, the duration of
data retention by the defendant increased from 5 to 8 years. It also writes
that the defendant would now carry out profiling based on the data collected,
which it had indicated that it did not do before.
98. For the Litigation Chamber, the General Secretariat's analysis does not reveal
any change in the position of the APD or an erroneous interpretation on its part. It therefore has
no impact on the procedure. Indeed, it emerges from the Chamber's analysis that
when the General Secretariat uses information from past cases, it is to compare
them with the current practices that the defendant has informed it of. This
comparison allowed the Management Committee to ensure its follow-up (Article 10 of the LCA).
99. For the Litigation Chamber, even if the CPVP had authorised the processing in question
by the defendant, quod non, the principle of legitimate expectation does not mean that in the face of
new facts and changes in practices, the public authority must maintain a
line of conduct that it would have expressed in the past on facts that were
significantly different. The defendant is therefore wrong to invoke a violation of the
principle of legitimate expectation.
100. In view of the foregoing, the Litigation Chamber concludes that the decision of the
Management Committee complies with the requirements of Article 63.1 of the LCA.
II.3.5. Referral to the Inspection Service by the Management Committee (validity of the minutes)
101. First, the defendant explains that the versions of the minutes sent to it
do not allow it to be established whether the President of the Litigation Division, who abstained
during the Management Committee’s vote on this point, participated in the discussion. In addition, it
considers that it has not been demonstrated that the majority of the members of the
Management Committee were present, nor that a majority of the members voted in favour under
Article 3 of the ROI. Finally, the defendant considers that there are doubts that a record of the
Management Committee’s decision was drawn up and signed by the President of the
Management Committee, which would constitute a violation of Article 16 of the LCA.
102. Secondly, the defendant also argues that since this decision was taken
in Dutch, it would be contrary to the law on the use of languages in administrative
matters, since the defendant is based in a French-speaking region.
103. Firstly, the Litigation Chamber recalls that the minutes of the
Management Committee cover many topics, including strategic decisions of the APD and
that they contain personal data. In accordance with the principle of data minimisation
(Article 5.1.c of the GDPR), and compliance with the principle of confidentiality
applying to the members of the Management Committee (Art. 48 LCA), the Litigation
Chamber does not transmit the minutes of the Management Committee in their entirety to the
parties concerned by a procedure, but only an extract of said minutes in order to
enable the parties to a procedure to assess their existence for the part that
concerns them.
104. The defendant had at the outset of the proceedings on the merits an extract from the minutes
of the Management Committee concerning the activation of Article 63.1° against it. At its
request, a broader extract was provided to it on 2 May 2023. A full version of the minutes
was provided to it on 18 July 2023 by the President of the APD.
105. The defendant was able to note from the minutes, firstly, that all the
members of the Management Committee were present at the meeting of the Management
Committee, but that the President of the Litigation Chamber recused himself for this item on the agenda,
secondly, that no objection from any of the members of the Management
Committee was noted, thirdly, that the minutes were indeed signed by the President of the
Management Committee, and fourthly, that the Management Committee decided to refer the
Inspection Service on the basis of Article 63.1° of the LCA. The conditions of Articles 15 and
16 of the LCA are therefore met. The defendant’s argument contesting
the existence of a report and compliance with its formalism is therefore unfounded.
106. With regard to the complaint concerning the bias of the members, the Disputes Chamber
refers to its examination in section II.4.1 below.
107. Therefore, neither the validity of the minutes of the Management Committee nor the participation of the
directors can be called into question. The procedure complied with the legal
requirements, and no evidence of bias has been provided. Decision on the merits 146/2024 – 19/67
21
108. Secondly, in a judgment of 7 July 2021, the Procurement Court recalled that the APD
must be considered a central service within the meaning of the Act on the use of languages in
administrative matters and that as such, it must comply with Articles 40 et seq. of that
Act.
109. However, the decision to refer the matter to the Inspection Service by the Management Committee does not constitute
communication with individuals, within the meaning of Article 41 of the Act on the Use of
Languages in Administrative Matters, but rather internal communication; the use of
French by the Management Committee was therefore not required.
110. The referral to the Inspection Service by the minutes of the Management
Committee is therefore valid and complies with the requirements of Articles 15 and 16 of the
LCA, as well as Article 3 of the ROI.
II.3.6. Procedure before the Inspection Service
111. The defendant argues that the file reference used by the APD has been the same
since the first letter sent by the General Secretariat, which tends to prove that there was a
well-established “pre-inspection” procedure within the APD. It adds that the Inspection Service
has taken up the exchanges between the General Secretariat and Freedelity
under the name “Surveillance of the General Secretariat”. The defendant also considers
that there is no evidence of the taking of an oath by an inspector who worked on the
case (“inspector concerned”), even though the latter contributed to the investigation.
112. The Litigation Chamber notes that the defendant draws no conclusions from the first two
arguments mentioned and linked to the reference and title of the case. Insofar as
necessary, it refers in this regard to the previous developments on this point (see
paragraph 8282).
113. With regard to the taking of an oath, at the defendant’s request, the Litigation
Chamber provided it with a document on 2 May 2023, the subject of which is “designation of
inspectors of the inspection service”. This document signed by the Inspector General and the
Director of the General Secretariat is dated June 25, 2019. It states that "Only the names
of the agents of the Data Protection Authority below who took the oath
on November 19, 2018 retain the status of inspector of the inspection service." This is followed
by a list of agents whose names have been redacted by the Litigation Chamber for
reasons of privacy, with the exception of the name of the inspector concerned which appears in the
list.
114. For the Litigation Chamber, this document demonstrates that the inspector concerned took the
oath on 19 November 2018 and that on 25 June 2019, the APD considered that he retained
21 Judgment of the Market Court of 7 July 2021, No. 2021/AR/320 available at the following link:
https://www.autoriteprotectiondonnees.be/publications/arret-du-7-juillet-2021-de-la-cour-des-marches-ar-320-
disponible-en-neerlandais.pdf Decision on the merits 146/2024 – 20/67
the quality of inspector of the inspection service. At the date of the referral to the Inspection Service
by the Management Committee on 6 December 2019, the inspector concerned had indeed taken the
oath and was still an inspector.
115. The Litigation Chamber also recalls that this type of request is not based on
any legal basis. Indeed, the law provides that inspectors take an oath (Article 30
§1 of the LCA), which must be considered as an established fact, except in cases of serious doubt
which must be proven by the defendant. The defendant cannot therefore rely on any legal basis to demand the transmission of these documents.
116. The Litigation Division concludes that the procedure before the Inspection Service
is not flawed.
II.3.7. Referral to the Litigation Division by the Inspection Service
117. The defendant argues that the Litigation Division could not have been validly referred to
given that the Inspection Service itself was not validly referred to.
118. The Litigation Division did not find any irregularity in the referral to the
Inspection Service. Consequently, it considers itself legally referred to on the basis of Article 92.3°
of the LCA.
119. The referral to the Litigation Division was made legally on the basis of Article
92.3° of the LCA.
II.4. Procedure: respect for the rights of the defence
II.4.1. Impartiality of the members of the Management Committee and of the Committee itself
120. The grievances raised by the defendant must be distinguished according to whether they concern the
members of the Management Committee or the Management Committee itself.
II.4.1.1. The President of the Litigation Chamber
Position of the defendant
121. As a preliminary matter, and as stated in Section II.2, the defendant requests the President
of the Litigation Chamber to withdraw on the grounds of the legitimate doubts that exist
regarding his impartiality. In the absence of a specific procedure established by the
LCA, the defendant argues that Article 828, 1° of the Judicial Code should apply by analogy.
122. According to the defendant, the possibility of requesting the recusal of a judge is an integral part
of Article 6 of the European Convention on Human Rights and Article 47 of the Charter of Fundamental Rights of the European Union. These same guarantees
of independence and impartiality are contained in Article 52 of the GDPR, which has been transposed
into Belgian law by Article 36 of the LCA. Decision on the merits 146/2024 – 21/67
123. In the event that the Contentious Chamber considers that the absence of an explicit
provision in the law would mean that recusal is not possible, the defendant
requests that a prejudicial question be submitted to the Constitutional Court. 124. It considers that this bias or appearance of bias arises from the following elements:
a) First, the President of the Litigation Chamber was aware of
several documents concerning Freedelity that led to the decision of the
Management Committee of 6 December 2019 and that despite his disqualification
during the examination of this point, it is impossible to know what his role was at this
meeting.
b) Second, the President of the General Secretariat was allegedly dismissed from his
mandate, in particular due to “pre-inspection” procedures such as those carried
out in this case. However, the President of the Litigation Chamber testified
before the Justice Commission on the occasion of the lifting of the mandate of the
President of the APD before the House of Representatives and also constituted himself
an intervener in the appeal for extremely urgent suspension brought by the
President of the APD before the Council of State against the decision to lift the
mandate.
He himself filed an appeal for suspension of the decision to lift the mandate
before the Council of State. For the defendant, the president of the Litigation
Chamber would defend the conduct of the president of the APD which was allegedly the
cause of his lifting of his mandate.
c) Thirdly, the president of the Litigation Chamber could not refuse access
to the request made by the defendant to access the decision to lift the
mandate of the president of the APD on the grounds that he did not have this document, since
he intervened in various proceedings before the Council of State on the subject
of this decision and therefore necessarily had access to it.
d) Fourthly, the fact that the president of the Litigation Chamber refused to
provide certain documents requested by the defendant and that he took a position
on the competence of the CADA with regard to requests for access
concerning documents held by the APD.
(e) Fifth, the defendant also considers that being a creditor is
a ground for challenge, which would be the case for the President of the Litigation Chamber
in this case since in the context of the challenge proceedings brought by
Freedelity before the Market Court, the President requested and obtained
a procedural indemnity, the payment of which he has not yet demanded.
Review by the Litigation Chamber Decision on the merits 146/2024 – 22/67
125. As a preliminary point, the Litigation Chamber does not dispute that the principle of impartiality
applies to administrative authorities. It should be stressed, however, that the principle
22
of impartiality “must be reconciled with the structure of the active administration”, as
described below, in paragraph 127.
126. The Litigation Chamber of the APD is chaired by Mr Hijmans. The proper functioning of
the Litigation Chamber and the APD requires that the president be available, and be able
to sit during decisions on the merits (Articles 33§1 and 92 to 107 of the LCA), as well as within the
Management Committee, as is apparent from the dual competence of the directors of the
organs of the APD established by Article 12 of the LCA.
127. According to consistent case law of the Council of State:
“the general principle of impartiality must be applied to all organs of the active administration.
It is sufficient that an appearance of bias could have raised legitimate doubts in the applicant
as to the ability to approach his case with complete impartiality. However, this principle
only applies to the extent that it is compatible with the specific nature, and in particular
with the structure of the active administration. Furthermore, the impartiality of a collegiate body
can only be called into question if, on the one hand, specific facts which raise suspicions of bias
on one or more members of that college can be legally established and
on the other hand, it is clear from the circumstances that the bias of that
member or members could have influenced the entire college. It is up to the person alleging that the authority did not act
with independence, impartiality and thoroughness to provide proof of this. 23
128. It is therefore up to the party invoking the breach of the principle of impartiality to
demonstrate the existence of specific facts from which it should be concluded that the
principle of impartiality has been breached. If the facts concern a member of a collegiate body, it
is appropriate for the party invoking the breach of the principle of impartiality to demonstrate
that the facts it identifies are likely to have affected the impartiality not only
of their author, but also of at least a majority of the members of the collegiate body
in question.24
- The bias of the president of the Litigation Division as a member either of the
management committee or of the Litigation Division sitting with three members.
129. First, the criticism concerns the fact that the President of the Litigation Chamber had received
documents concerning the defendant prior to the meeting of the Management Committee
of 6 December 2019. The defendant has not demonstrated why the fact of receiving
22
C.E., 25 April 2023, 256.341, Di Livio.
23 C.E., 30 November 2022, 255.145, Lemaire and Loslever; see also C.E., 19 January 2022, 252.684, XXX.
24 See in particular Cour des marchés, 7 December 2022, 2022/AR/556, available from the following link:
https://www.autoriteprotectiondonnees.be/publications/arret-du-7-decembre-2022-de-la-cour-des-marches-.r-556.pdf Decision on the merits 146/2024 – 23/67
these documents would demonstrate indications of bias on the part of the President of the Chamber
Contentious, especially since the latter did not, at any time, react to these documents and
that he recused himself during the discussion on this point as proven by the minutes of the meeting. It
is also not demonstrated how this bias, if it were demonstrated, could have
influenced the other members of the Management Committee.
130. Secondly, the Disputes Chamber considers that the impartiality of the President of the
Disputes Chamber cannot be called into question by the fact that he
filed in his own name an appeal to suspend the decision to lift the request of the
President of the APD, since this appeal was filed because he considered that this
decision posed a risk to his personal independence as President of the
25
Disputes Chamber. Furthermore, the President of the APD did not conduct
any “pre-inspections” in the present case (see section II.3.2 of the
decision) and the defendant presents evidence without proof of what it claims, nor
an explanation allowing the Disputes Chamber to follow its reasoning.
- The bias of the President of the Litigation Chamber sitting alone
131. Third, the fact that the President of the Litigation Chamber responded to the
defendant that the APD does not have the decision to lift the mandate of the President of
the APD is a factual observation that does not reveal any bias. This assertion was
further corroborated by the President of the APD in her letter dated 18 July 2023.
132. The fact that the President of the Litigation Chamber could have had knowledge of this
document is irrelevant since this took place in the context of his
private activities, since he was appearing before the Council of State
"on his own initiative, without being
authorised to do so by the data protection authority" (free
translation). It cannot be reasonably argued that the request for access to
documents that the defendant made to the APD would also extend to
documents that could be held by the directors outside their function within the
APD.
133. The Litigation Chamber also emphasises that access to this document was
also refused by the Chamber of Representatives when the defendant requested
access.
In its order of 12 February 2024, the Interim Relief Chamber of the Court of First Instance
also dismissed the defendant’s request for production of this
document.
134. Fourthly, the fact that the President of the Litigation Chamber granted access to
certain documents and not to others requested by the applicant does not mean
25
C.E. No. 256,827 of 19 June 2023, § 8.
26 C.E. of 17 August 2022, No. 254,326. Original version: “on its own title, without prejudice to the
Gegevensbeschesmingsauthority”. Decision on the merits 146/2024 – 24/67
that he thereby lacked impartiality. The President of the Litigation Chamber
is required to take a number of actions in the context of the organisation of the
procedure, actions that he considers legitimate and these do not prejudge his personal assessment
of the merits of the case.
135. Moreover, the bias of the President of the Litigation Chamber is not
demonstrated by the response to the request for production of documents made by the
defendant on the basis of the law of 11 April 1994 relating to the publicity of the
administration. Indeed, in its response, the Litigation Chamber states that the APD does not consider
itself currently subject to the law of 11 April 1994 relating to the publicity of the
administration.
This position does not demonstrate the bias of the President of the Contentious Division since
it concerns the position of the Management Committee as a whole and that the CADA itself
shared this position in the past.
136. In this regard, the case-law of the European Court of Human Rights teaches that
a problem linked to a lack of judicial impartiality does not arise when the judge has
already rendered formal and procedural decisions at other stages of the proceedings. On the other hand,
this problem may arise if, at other stages of the proceedings, the judge has already ruled
on the guilt of the accused.
137. However, in the present case, what is being criticised against the President of the Contentious Division does not imply
any position whatsoever on the part of the latter as to the merits of the case and, in
particular, as to the conduct or responsibility of the applicant.
138. This teaching of the European Court of Human Rights concerns judges; it applies
even more so with regard to members of an administrative college.
139. Fifth, the President of the Litigation Chamber is not acting in his
personal capacity in this case. The procedural compensation in question was requested in the
context of the exercise of his functions within the APD, that is to say, as President of
the Litigation Chamber; he has no personal or financial interest in this claim.
140. The lack of impartiality of the President of the Litigation Chamber has therefore not
been demonstrated. No valid reason can justify his removal from the present case.
II.4.1.2. The Director of the Knowledge Centre
27
See in particular CADA, opinion 2018-14, available at:
https://www.ibz.rrn.fgov.be/fileadmin/user upload/fr/com/publicite/avis/2018/ADVIES-2018-14.pdf
28European Court of Human Rights (ECHR), George-Laviniu Ghiurău v. Romania, 16/06/2020, Application no.
15549/16, § 67
29Gómez de Liaño y Botella v. Spain, 22/07/2008, Application no. 21369/04, § 67-72. See also ECHR, Guide on
Article 6 of the European Convention on Human Rights, Right to a fair trial – criminal aspect,
https://www.echr.coe.int/documents/guide art 6 criminal eng.pdf. Decision on the merits 146/2024 – 25/67
141. The defendant claims that the then Director of the Knowledge Centre, in the context of her previous employment, had worked with Freedelity and validated their legal model. The defendant considers that these agreements were covered by professional secrecy, business secrecy and confidentiality agreements and that this information was shared with the DPA, which allegedly was complicit in the violation of this confidentiality.
142. The Disputes Chamber recalls that the members of the Management Committee are bound by the
principle of impartiality (Article 43 of the LCA), which prohibits them from being present during
a deliberation or decision on cases in which they have a personal and
direct interest. According to the doctrine, "The personal and direct interest may be of a moral
nature, in particular when one or more members of the decision-making authority have
already expressed a clear point of view or have formed a personal opinion and could not
go back on it without losing face." (free translation).
143. This principle means that no member of the Management Committee may have a personal
interest in the decision taking a certain direction (nemo iudex in causa
sua). In particular, being morally unable to revise a previous point of view
carries the risk that members of the administration, having already expressed
(publicly) their opinion, can no longer assess the case objectively. Furthermore, the
Litigation Chamber notes that the defendant does not justify how the
situation meets the definition of a conflict of interest provided for in Article 58 of the ROI.
144. In this case, the Director of the Knowledge Center has never worked
within Freedelity, and therefore was not in a situation where the demonstration of a personal and direct
interest in Freedelity, or a conflict of interest, could be inferred from her previous
position. The fact that the Director of the Knowledge Center was aware of the Freedelity
legal model and had “validated” it in the past does not demonstrate that she had a
personal and direct interest in the decisions of the Management Committee based on
Articles 10 and 63.1° of the LCA. The Director of the Knowledge Center has never expressed
any public negative opinion regarding Freedelity. At most, the Director of the
Knowledge Center has expressed a positive opinion in the context of her former
functions on Freedelity in the past. If the director of the Knowledge Center had
actually used information collected in the course of their duties
30Wolters Kluwer – Tijdschrift voor Bestuurswetenschappen en Publiekrecht, “Partijdigheid en belangenconflicten bij het
actief bestuur: de sluipweg van het gelijkheidsbeginsel”, Lise Van den Eynde, 2024, paragraph 4. Original version: “De
This class in the well-known category is the person of subject matter. Het komt erop neer dat
Iemand met een personlijk en rechtstreeks belang zich moet onthouden van deelname aan het besluitvormingsproces » and
“Het personlijk en rechtstreeks belang kan van morele aard zijn, onder andere wanneer een de meer leden van de
be overheid eerder al een duidelijk standpunt hebben ingenomen de een eigen mening hebben gevormd en niet
zonder gezichtsverlies daarop zouden kunnen terugkomen”.
31See above Decision on the merits 146/2024 – 26/67
previous, this should have led to the only conclusion that the Freedelity service
was valid.
145. Furthermore, contrary to what Freedelity claims, there is no evidence in the case file
that the Knowledge Centre Director used confidential information or shared it with the
APD. The only statement on which Freedelity relies is the following:
“When I analysed the Freedelity offer a year ago, it constituted a clear violation of
the Privacy Regulation in several respects.” 32
146. No other sentence or information from the Knowledge Centre Director
can be found in the subsequent exchanges, opinions and documents in the case file. The
Litigation Chamber cannot therefore conclude that this was confidential information cited
by the defendant and the entire procedure is based only on information
legitimately collected by the APD.
147. The Litigation Chamber concludes that the Director of the Knowledge Centre did not
breach the principle of impartiality applicable to members of the Management Committee
(Article 43 of the LCA).
II.4.1.3. The Director of the General Secretariat (Chairman of the Management Committee)
148. First, the defendant also criticises the APD for not having forwarded to it the
decision relating to the lifting of the mandate of the President of the APD. Second, the
defendant maintains that the Director of the General Secretariat was biased because he was
the initiator of the request for information to the defendant. Third, the
defendant claims that the type of procedure followed by the Management Committee
in this case was the cause of the lifting of his mandate. It justifies itself by
supporting press articles and judgments handed down by the Council of State in cases
concerning the decision to lift the mandate.
149. First, the Litigation Chamber maintains that the APD does not have the
decision to lift the mandate of its former president.
150. Second, the Litigation Chamber recalls that situations of bias cannot arise
33
from the normal application of the law. However, the law provides that the director of the
General Secretariat may be in a position to chair the Management Committee (Article 13§2
of the LCA), and that the Chairman of the Management Committee is assisted in the performance of his
32
Email from the President of the Knowledge Center of August 2, 2019
33See the decision of the Council of State of May 11, 2021, No. 250.571 Decision on the merits 146/2024 – 27/67
tasks by the General Secretariat (Article 13§3 of the LCA). For the remainder, the Litigation Chamber refers to the previous developments on this point (see section II.3.2).
151. Third, of the nine press articles provided by the defendant, only one (exhibit 28 of the defendant’s file) makes a brief reference (one sentence in a four-page article) to a possible excess of authority by the president of the APD.
The file in question concerned questions put to a school in Ghent on a possible use of biometric data. No other file is mentioned.
152. The defendant does not provide evidence that this element was actually, alone
or among others, the reason for the lifting of the mandate of the president of the APD. It also does not explain
how the finding of an excess of competence that was allegedly noted by
the House of Representatives in the case identified by the press could be transposed to
the present case or even relevant for its processing.
153. Nor does it appear from the extracts of the decisions of the Council of State that the president of the APD
had his mandate lifted for facts related to the present case, or to the procedures put
in place for the activation of Article 63.1 of the LCA. The elements emerging from the extracts
cited are in fact very general and report serious failings and incapacities that
are not specified. Furthermore, as demonstrated above, this case was
proposed to the Management Committee by a director other than the President of the APD. The sending
of the first letter to the defendant, as well as the request to open an investigation, were
decided by the Management Committee. These elements seem difficult to reconcile
with allegations of exceeding the powers of the President of the APD.
154. The Litigation Chamber concludes that none of the elements put forward by the
defendant allows it to conclude that the General Secretariat or its director
was in a situation of bias or exceeding the powers of the defendant.
II.4.1.4. The Director of the Inspection Service (the Inspector General)
155. First, the defendant claims that the Inspector General (also a member of the
Steering Committee) had met with Freedelity in the past when he was working
for the CPVP and, secondly, had participated in the preparation of the file and decided on his
own referral. It maintains that the involvement of the Inspector General at the stage of
preparing the file for examination by the Steering Committee impacts his own
referral and the admissibility of his work.
156. Second, it also maintains that the Inspector General cannot take a position
on the activation of Article 63.1 of the LCA by the Steering Committee without affecting his
impartiality. Decision on the merits 146/2024 – 28/67
157. First, regarding the arguments on the partiality of the Inspector General, the
Litigation Chamber refers to its previous developments regarding the analysis
of situations of partiality (see paragraphs 142-143) and recalls that a situation of
partiality cannot arise from the normal application of the law. The fact that the Inspector
General sits on the Management Committee during the decision-making phase of monitoring developments in
the technological field (Article 10 of the LCA) or the phase of establishing serious indications
(Article 63.1° of the LCA), is legally provided to be compatible with his function
as Inspector General (Article 12 of the LCA).
158. Furthermore, the activation of Article 63.1 of the LCA (or Article 63.6) cannot in any case be
equated with an indictment or investigation procedure as the defendant
maintains. This is a preliminary step to the opening of an investigation, which does not
entail any definitive finding and which in no way prevents the Inspection Service from
conducting its investigation impartially thereafter. As it has proven in the past, the
Inspection Service is perfectly capable of conducting an investigation concluding that there
were no violations despite the findings of serious indications by the
Management Committee.
159. The fact that a member of the Management Committee has
“met” one or more members of a company’s staff does not
put him in a position of bias towards that company on that sole basis. Bias must be concretely demonstrated, which requires highlighting
specific facts or behaviors. 35 This obviously does not depend on the fact
that he has worked on a case in the past or met a person on this occasion.
160. For the Litigation Chamber, the exchange of information within the APD is
a sine qua non condition for the proper execution of its mission to ensure compliance with data
protection. A partitioning of information between services only takes place when
it is provided for by law. This is the case of Article 64.3 of the LCA, which provides that the investigation is secret.
161. The LCA does not provide for any other restriction on the exchange of information within the APD
when this exchange is necessary for its operation. Informal exchanges between
directors when carrying out preparatory acts for the adoption of a decision are
normal and essential steps in the decision-making process. The files opened with
the SPL concerning the defendant and the information available to the Inspector
General who was involved in these files as a lawyer at the time are entirely relevant
to assess whether an investigation should be requested against the defendant. The APD
34See in particular the decision of the Litigation Chamber 77/2020, in which the Management Committee had requested
the opening of an investigation by the Inspection Service. The latter found that the incriminated activity did not
involve the processing of personal data. The case was therefore closed by a filing without further action.
35See in this sense the judgment of the Court of Markets, 7 December 2022, 2022/AR/556, available from the following link:
https://www.autoriteprotectiondonnees.be/publications/arret-du-7-decembre-2022-de-la-cour-des-marches-ar-556.pdf,
p.21. What applies to collegiate bodies also applies to a member of an administrative body. Decision on the merits 146/2024 – 29/67
allegedly acted negligently by not using the information it had on
the defendant to inform its decision.
162. Indeed, if the latter could not handle cases in which he had been involved as a
lawyer before his appointment as Inspector General, this would de facto prevent the
Inspection Service from exercising its powers with regard to a large number of
data controllers. This is certainly not the intention of the House of
Representatives, which appointed the Inspector General while being fully
informed of the fact that he had been a lawyer within the CPVP. According to the
Litigation Chamber, this situation does not allow his impartiality to be called into
question.
163. Secondly, the argument that the Inspector General cannot take a position
on the activation of Article 63.1 of the LCA by the Management Committee without
affecting his impartiality is no more convincing to the Litigation Chamber. Indeed, the Management Committee
is not the only one that can request an investigation on the basis of serious evidence, since
Article 63.6° of the LCA provides that the Inspection Service may, on its own initiative,
open an investigation if there are serious indications of an offence. If the law provides that the
Inspection Service, and therefore the Inspector General, can decide alone that there are
serious indications of an offence, it can logically decide this collegially within the framework of the
Management Committee, without this affecting its impartiality in conducting the investigation.
164. The LCA also provides for a clear distinction between the investigative power, which is
devoted to the Inspection Service, and the sanctioning power, which is the prerogative of the
Litigation Chamber.
165. In this case, the Litigation Chamber concludes that no evidence of bias has been
demonstrated on the part of the Inspector General, who merely carried out
the tasks assigned to him under the LCA.
II.4.1.5. The Management Committee
166. The defendant argues that since the majority of the members of the
Management Committee were in a position of bias, the Management Committee was itself biased.
167. As already recalled by the Litigation Chamber on numerous occasions in this
decision, in accordance with the consistent case law of the Council of State, criticism of
36
bias cannot be based on a situation arising from the normal application of the law.
168. Furthermore, "the impartiality of a collegiate body can only be called into question if, on the one hand,
specific facts which raise suspicions of bias on the part of one or more members of
that college can be legally established and, on the other hand, it is clear from the
circumstances that the bias of that or those members could have influenced the entire
36 Decision of the Council of State of 11 May 2021, No. 250.571 Decision on the merits 146/2024 – 30/67
college. It is up to the person alleging that the authority did not act with independence, impartiality and thoroughness to provide proof of this."
169. The Markets Court specifies that the alleged bias of a collegiate body must be
concretely demonstrated, which requires highlighting specific facts or
38
behaviors that concern this body, therefore committed by its members.
170. The Management Committee is composed of the directors of the APD (Article 12 LCA). Each
director ensures the management of a body, as is apparent from the powers established by the
LCA. The Management Committee is competent to refer the matter to the Inspection Service in the event
of finding serious evidence of the existence of a practice likely to violate the
fundamental principles of the protection of personal data (Article 63.1° of the
LCA).
171. For the Litigation Chamber, the defendant must therefore demonstrate for each of the
members of the Management Committee against whom it makes this reproach, that on the one hand, he
showed bias, and that on the other hand, he was able to influence the other members of the college. The
Litigation Chamber adds, moreover, that the fact that a member of the
Management Committee allegedly showed a lack of bias – quod non in the present case – is not sufficient in
itself to invalidate a decision of the Management Committee. 39
172. However, as explained in sections II.4.1.1, II.4.1.2, II.4.1.3 and II.4.1.4, the bias of the
members has not been demonstrated. Furthermore, even if the bias of a member of the
Management Committee were demonstrated, this is not such as to taint the decisions
taken by the Management Committee, which are valid on condition that the “majority”
of the members were present (Article 15 of the LCA).
173. Therefore, neither the bias of the members of the Management
Committee nor that of the Management Committee itself has been demonstrated. The Litigation
Chamber concludes that the arguments of the defence on the issue of bias are not valid.
II.4.2. Processing within a reasonable time and adequate time to prepare its defence
174. The defendant argues that the proceedings lasted almost five years after the first
disputed letter, which exceeds the reasonable time and that it did not have the opportunity to
properly defend itself. She accuses the APD of deliberately soliciting
written contributions from the defendant during periods of leave. She cites
37
C.E., 30 November 2022, 255.145, Lemaire and Loslever; see also C.E., 19 January 2022, 252.684.
38 Judgment of the Market Court of 7 December 2022, 2022/AR/556, available from the following link:
https://www.autoriteprotectiondonnees.be/publications/arret-du-7-decembre-2022-de-la-cour-des-marches-ar-556.pdf .
39 Judgment of the Market Court of 7 December 2022, 2022/AR/556, , available from the following link:
https://www.autoriteprotectiondonnees.be/publications/arret-du-7-decembre-2022-de-la-cour-des-marches-ar-556.pdf. Decision on the merits 146/2024 – 31/67
including a judgment of the Brussels Court of Appeal which provides that a file which had
experienced a period of inertia of two years exceeded the reasonable time limit.
175. The defendant invokes unreferenced case law to argue that the rights of
the defence from the perspective of the useful time limit and the right to a reasonable time limit apply to the APD.
176. The Litigation Chamber confirms that it is indeed subject to respect for the rights of
the defence, including the right to a reasonable time, protected by Article 48 of the
Charter of Fundamental Rights of the European Union and
Article 6 of the European Convention on Human Rights.
177. Concerning the reasonable time, the defendant mentions a judgment of the
Brussels Court of Appeal in which it allegedly found that the reasonable time had been exceeded in
a case that had experienced a period of inertia of two years. This judgment is not provided to the
Litigation Chamber. It cannot therefore take it into account.
178. The Litigation Chamber recalls that, according to the case law of the Council of
State, "the principle of a reasonable time, which is derived from the general
principles of good administration and legal certainty, is capable of being applied to all
administrative decisions. The reasonable period within which any administrative authority
must ensure that it takes a decision only begins to run from the moment it is
able to do so. The assessment of whether or not the duration of a procedure is
reasonable is a question of the individual case which depends, in particular, on the
circumstances of the case, and more particularly on the respective
conduct of the authority and the person concerned. » 40
179. The Inspection Service sent letters containing questions to the
defendant in June and October 2020. It subsequently carried out technical
findings and asked Freedelity new questions in October 2021. It carried out new
technical findings between December 2021 and February 2022. In April 2022, it sent its report to the
Litigation Chamber.
180. The Litigation Chamber considers that an investigation that lasted approximately two years does not exceed
the reasonable period since numerous investigative acts were carried out during
these two years, which is the case here. Furthermore, in the present case, the
Litigation Chamber does not note any period of inertia that would be close to two years.
181. For its part, the Litigation Chamber notified the defendant of its intention to deal
with the case on the merits in July 2022, three months after it was referred to it. The period between
this decision to deal with the case on the merits and the adoption of the present decision was
marked successively by requests for the production of documents, by a 41
40Judgment of the Council of State, 13 September 2022, no. 254.469, p. 16.
41See exhibit 94 of the file Decision on the merits 146/2024 – 32/67
request to the CADA, by an application for recusal followed by proceedings before the
Court of Procurement and a summons for interim relief, by requests for postponement of the hearing, and by
multiple requests for a stay of proceedings, in particular pending the publication of a
judgment of the Court of Justice of the European Union, requests which were all made by the
defendant. In view of these very numerous procedures which led to several
postponements of the hearing, it cannot be reasonably argued that the case was the subject
of an abnormally long period of inertia or that the Litigation Division was
able to adopt a decision more quickly.
182. As regards the right to a time limit for the defence, the Market Court ruled in a
judgment of 12 June 2019 that "The establishment of a timetable for submissions where each
party has approximately one month and where the defendant is granted the final deadline is
consistent with the rules on the rights of the defence." (free translation) 44
183. The Litigation Chamber notes that during the investigation by the Inspection Service, the
defendant always had a response period of at least 30 calendar days and
a maximum of 45 days, which is consistent with the case law of the Market Court. The
Litigation Chamber cannot therefore conclude that there was a violation of the right to a time limit for the
defence at the investigation stage.
184. As regards the time limits granted to the defendant during the proceedings on the merits, the
Litigation Chamber recalls that these are identical in all the cases it
deals with on the merits and that they are extended by two weeks during the
months of July and August. The defendant therefore had a period of 8 weeks, which is
identical to that which would have been granted to any other defendant in
proceedings based on an investigation report. This period was subsequently
extended by three weeks at the request of the defendant. It was again
extended by two weeks at its request, bringing the total to 13 weeks.
185. When additional documents were provided to the defendant following its
requests, it was given a period of two weeks 45 to adapt its conclusions (period
extended by one week at its request). The defendant cannot therefore reasonably
maintain that the time limits granted to it by the Litigation Chamber, and which were
42
See Exhibit 94 of the case file
43 See in particular Exhibits 87 and 136 of the case file, and the following pages of the defendant's additional submissions:
(i) page 163, "The Litigation Chamber must stay its decision on this point pending the outcome of case C154/21
pending before the Court of Justice",.
44 Judgment of the Market Court, of June 12, 2019, No. 2019/AR/741, available at the following link:
https://www.autoriteprotectiondonnees.be/publications/arret-du-12-juin-2019-de-la-cour-des-marches-available-en-
Dutch.pdfP.11.Original version:“Hetopstellenvaneenconclusiekalenderwaarbijelkepartijoverongeveeréénmaand
beschiktenwaarbijdeverwerendepartijdelaatstetermijnverkrijgtisconformaanderegelsvanderechtenvanverdediging”.
45The Litigation Chamber notes in this regard that when the Interim Relief Chamber of the Court of First Instance of Brussels ordered the APD to provide additional documents to the defendant, it also considered that a period of 15 days was sufficient for the defendant to be able to conclude on the documents (a period which was granted to the
defendant by the APD). Decision on the merits 146/2024 – 33/67
extended by his act on multiple occasions, did not allow him to have a useful period
to prepare his defense.
186. The Contentious Chamber in concludes that there has been no exceeding of the reasonable time limit
in this case, nor any failure concerning the right to a useful time limit.
II.4.3. The principle of adversarial proceedings
187. The defendant considers that by repeatedly and constantly refusing to provide
certain documents that it requested, the APD has violated the principle of adversarial proceedings and the
rights of the defence. The defendant considers that the APD has repeatedly refused to provide
decisive elements in the file and in its defence.
188. The The Contentious Chamber reminds that the LCA does not define the composition of the administrative
file. This is composed of all the official decisions and documents related to a
case (decisions of the SPL, investigation report of the SI, decisions of the CC, etc.). The Litigation Chamber
forwarded the entire administrative file to Freedelity when the
latter requested it to do so.
189. The defendant subsequently demanded the production of internal documents from the APD that are
not traditionally present in an administrative file.The defendant's requests have varied on numerous occasions and have been made on
varying grounds.
190. On 2 May 2023, the Litigation Chamber transmitted to Freedelity all the
additional documents that it requested, to the extent that the APD had these.
191. On 18 July 2023, APD again sent Freedelity certain documents following
the CADA's opinion, namely the agenda of the meeting of the Management Committee of the APD of 6
December 2019 as well as a more complete version of the minutes of the same
meeting.
192. It was only on 22 December 2023, by a first summary summons, that Freedelity
requested (from the Court) access wider than that previously requested and obtained.
193. The APD responded to this new request by sending Freedelity the most recent documents in the administrative file – these documents were all already known to Freedelity – since they were correspondence between Freedelity and the APD. 194. The APD again sent additional documents to Freedelity on its own initiative
dated 12 January 2024, which it considered could be relevant in the
46The Litigation Chamber recalls in this regard that the opinions of the CADA are not not binding at all. See C.E., 15
November 2002, 111.522, Poncin. Decision on the merits 146/2024 – 34/67
framework of the criticism that Freedelity intended to formulate concerning the way in which the APD was seized of the case concerning it .
195. Then, in the context of the interim relief proceedings, Freedelity and the APD agreed that
the APD would provide certain additional documents.
196. Finally, following the order of the Interim Relief Chamber, the APD provided additional
documents, including preparatory documents, such as internal
communications between APD employees.
197. It is clear from the chronological description above that the APD has, on several
occasions and voluntarily, provided additional documents to the defendant. It also
complied with the order of the Chamber of Interim Relief when it required it to
provide certain additional documents.
198. The fact that a party to a case requests the production of additional documents
to the case file administrative does not mean that the Litigation Chamber is obliged to follow it up without being able to contest the need for such production.
199. The fact that the APD contested, for certain documents, the need to produce them cannot
result in a violation of the principle of adversarial proceedings and the right of defence. It is
moreover right that the APD opposed the production of certain documents and
since both the CADA and the Chamber of Interim Relief refused Freedelity access to certain
documents .In addition, all the exhibits could have been the subject of an adversarial debate, in particular
during the hearing.
200. As regards more specifically the decision to lift the request of the former president
of the APD, the Litigation Chamber refers to the developments above (see
paragraphs 130-133 and section II.4.1.3).201. Furthermore, the Litigation Chamber notes that the defendant was ultimately able to obtain
all the documents necessary for its defence, since it was able to exhaustively
formulate the grievances it wished to make concerning the legality of the procedure.
202 . The Litigation Chamber cannot find a violation of the principles of
adversarial proceedings and the right of defense in this case.
II.4.4. Violations of the principles of good administration
203. The defendant considers that the duty of "fair play", the duty of " solicitude" and the duty
of motivation were not respected by the APD, without further details concerning
these complaints.
204. The Litigation Chamber notes that the defendant does not explain what it means
by "duty to do- play" and "solicitude", does not cite its sources, and does not justify in
why the duty of motivation was not respected by the APD. Decision on the merits 146/2024 – 35/67
205. With regard to the duties of “fair play” and “care”, the defendant’s complaints are
formulated as follows: “The Authority is seriously failing in its duty of fair play and
care, which constitute principles of good administration in their own right." The
Litigation Chamber can only note the absence of factual arguments which
should corroborate the lack of respect for such duties.
206. The Litigation Chamber cannot therefore respond to these arguments, and refers, as far as necessary, to its considerations concerning the principle of adversarial proceedings and
access to files above (see section II.4.3).
207. The Litigation Chamber considers that the principles of good administration have been
respected.
II. 5. On the merits
II.5.1. On the processing operations in question, the responsibility for the processing operations and the legal bases
1. On the processing operations in question
208. Article 4, 2) of the GDPR defines processing as “any operation or set of operations
whether or not performed using automated processes and applied to
personal data or sets of data, such as the collection,
recording, organization, structuring, storage, adaptation or
modification, extraction, consultation, 'use, communication by transmission,
diffusion or any other form of making available, the approximation or interconnection,
limitation, erasure or destruction'.
209. In this case, the Litigation Chamber notes, on the basis of the information provided by
Freedelity to the Inspection Service, that the following data processing operations are
implemented:
47
210. Firstly, the collection of personal data:
a) directly provided by customers through the reading of the eID card. The reading of
the eID card can be carried out, in particular via eID readers, via a terminal
installed at Freedelity customers' premises, or via any other type of terminal. For
people who do not have a Belgian eID card or who do not want to make use of, the
same data may be entered manually into the screen of a terminal
or via the partner's website by the person concerned or the staff of
Freedelity's customers, based on the information provided by the person
concerned.
47See page 24 of the additional submissions Decision on the merits 146/2024 – 36/67
b) by Freedelity:
- via its MyFreedelity platform or application, including cookies embedded in
emails and other digital interfaces, or
- by recording the data communicated by the person concerned as part of
their voluntary registration in the Freedelity file.
48
211. In its responses to the questions from the Inspection Service, Freedelity indicates that the
49
data collected is largely collected through Freedelity terminals , in
a less significant portion, the data is collected through a seller
authorized by the Freedelity customer, and very rarely, the data is collected through
the filling of an online form.
50
212. Secondly, the pooling of personal data consists of sharing and
automatically updating the information of a common consumer between
several brands that have subscribed to the Custocentrix service, with which
he has a relationship, while guaranteeing that those who already have his data
can access these updates if the consumer's personal data has changed. To understand
this processing, it is essential to remember that most of the electronic data
contained in the identity card are updated in the event of a change. Thus, as the defendant recalls in its submissions, if a brand A has more recent information on a consumer
in common with a brand B, then pooling allows for the transfer of this up-to-date data to brand B. Only companies that already have
a commercial relationship with the consumer (i.e. they have, prior to granting the card, this consumer in their database) can access the
updated data via this pooling.
213. The Litigation Chamber considers that the collection and pooling processes are
inextricably linked, insofar as the purpose of collecting data from the
electronic identity card is to allow the Freedelity file to be populated, which
is presented as a precise and constantly updated database. Indeed,
52
as Freedelity points out, "Saving in the Freedelity file does not entail
any particular purposes other than those related to the management of the Freedelity file. It is
one and the same processing. These data flows reach us through
48See page 11 of the responses provided by Freedelity to the Inspection Service on 29 October 2020.
49
Freedelity only collects information contained in the eID card through the terminals and readers
distributed through it (see page 14 of the responses provided by Freedelity to the Inspection Service on 29 October
2020)
50See page 14 of the defendant’s additional submissions
51For example, Belgian citizens have eight days to declare their new address to the population service of the municipality
into which they are moving. This new address is recorded by the municipality in their electronic identity card,
even if this data does not appear on the official (physical) document.
52
See page 3 of the responses provided by Freedelity to the Inspection Service on 29 October 2020. Decision on the merits 146/2024 – 37/67
different methods of data collection and consents as described
above”. These will be examined jointly in the following sections.
214. The Litigation Chamber notes that the defendant does not contest implementing
the processing described in the preceding paragraphs.
2. On the responsibility for processing
215. A controller is defined as "the natural or legal person, public
authority, agency or other body which, alone or jointly with
others, determines the purposes and means of processing" (Article 4.7 of the
GDPR) (emphasis added). This is an autonomous concept specific to
data protection regulation, which must be assessed according to the criteria it
establishes: determining the "purposes" and "means" of processing involves
deciding the "why" (the reason or objective of the
processing) and the "how" (the way in which this objective will be
achieved).
216. In some cases, responsibility is considered joint. For there to be
joint responsibility for data processing, it is necessary that two or more
entities participate together in determining the purposes and means of
processing. This participation may be manifested by a joint decision or by convergent
decisions that complement each other and are essential to the performance of the
processing. A key criterion is that the processing could not be carried out without the
contribution of each party, which means that the processing operations are inseparable and
inextricably linked.
217. The Litigation Chamber recalls that in the event of joint responsibility, Article 26 of the
GDPR requires joint controllers to ensure, by means of a contract,
that they mutually comply with the GDPR.
218. According to the EDPB Guidelines on the concepts of controller and processor, “Joint participation may take the form of a joint decision
taken by two or more entities or result from converging decisions adopted by two or more entities, where the decisions complement each other and are necessary for
the processing to be carried out in such a way that they have a concrete effect on determining the purposes
and means of the processing. An important criterion is that the processing would not be possible without the participation of both parties in the sense that the processing by
each party is inseparable from that of the other, i.e. inextricably linked.
53EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR (v. 2), adopted on 7 July 2021, (hereinafter “Guidelines 07/2020”), section 35.
54
EDPB, Guidelines 07/2020, page 3.
55EDPB, Guidelines 07/2020, page 3. Decision on the merits 146/2024 – 38/67
Joint participation must encompass, on the one hand, the determination of the purposes and, on the other, the determination of the means” (emphasis added).
219. The Litigation Chamber will successively analyse situations of joint participation
in the context of the determination of the purposes (a) and the determination of the means
(b).
a) Determination of the purposes
220. First, the Litigation Chamber notes that the purpose of the collection and
pooling of personal data is to feed the pooled Freedelity file
to enable unique and up-to-date identification of consumers.
221. Freedelity considers that it exclusively controls this purpose, with the
brands only intervening in the collection methods and without making a decision
regarding the final objectives of the processing. In this sense, Freedelity considers that joint
liability does not apply.
222. Contrary to what the defendant maintains, the Litigation Chamber considers that
this purpose is common to Freedelity and the brands. Indeed, this purpose is
necessary to enable Freedelity to enrich its database to attract
brands interested in reliable and up-to-date identification of their consumers. It
is also essential for brands wishing to avoid any confusion between their
consumers and thus prevent the accumulation of obsolete data.
223. The fact that these treatments occur one after the other has no impact on the
qualification of joint controller. According to the CJEU, "the existence of
joint responsibility does not necessarily translate into equivalent
responsibility of the different operators concerned by the processing of personal
data. On the contrary, these operators may be involved at different stages of this
processing and to different degrees, such that the level of responsibility of
each of them must be assessed taking into account all the relevant
circumstances of the individual case." 6
224. In order to remove any ambiguity, the Litigation Chamber specifies that this
decision does not concern the processing purposes specific to the brands (such as
registration for consumer loyalty programs, sending digital invoices, etc.), for
which Freedelity does not have joint responsibility. It is
important not to confuse these purposes specific to the brands with the common
purpose in question, which is the collection and pooling of data to
update the Freedelity file. Confusing these different purposes, as the defendant does,
56Judgment of the CJEU of 5 June 2018, Wirtschaftsakademie Schleswig-Holstein, C 210/16, EU:C:2018:388, paragraph 43. Decision on the merits 146/2024 – 39/67
leads to an incorrect characterisation of the roles of the parties. Furthermore, the
Contentious Chamber also does not dispute that when a brand ceases its collaboration
with Freedelity, Freedelity remains the sole data controller for future
processing, even if the data was initially collected by the brand that
terminated its contract with Freedelity.
(b) Determination of the means
225. Secondly, as regards the means, the Litigation Chamber recalls that according
to the EDPB guidelines, “It may also be the case that one of the entities concerned
provides the means of processing and makes them available for the personal data
processing activities carried out by other entities. The entity that
decides to use these means so that personal data can be processed for a
particular purpose also participates in determining the means of processing. This
scenario may occur in particular in the case of platforms, standardised
tools or other infrastructures that allow the parties to process the same personal
data and that have been created in a certain way by one of the
parties for use by other parties, who may also decide how to create them”.
226. In this case, the means of processing are also defined jointly: the collection is
carried out mainly by customers via devices provided by Freedelity and offered
by the brands (particularly via the terminals). In terms of means, Freedelity
centralises the data in a technical infrastructure that it has developed, but the
pooling is itself made possible by the continuous contributions of customers,
who regularly transfer identity data to make it possible
to update the information.
227. In addition, Freedelity explains that the content of the terminal varies between the
brands in order to take into account the multiple customer journeys and actions related to the
collection of personal data as well as the expectations of its customers regarding the
consideration of elements specific to them, in particular their identity and their graphic charters. Regarding
manual forms, Freedelity explains that forms can vary from one client
to another (i.e. the visual and text content). For some, it is even Freedelity
that does the formatting work on behalf of the client.
228. Regarding this last point, the Inspection Service requested further
clarification. Freedelity responded that: “The process is similar to that of the
57EDPB, Guidelines 07/2020, sections 64 and 65.
58
See page 8 of Freedelity’s responses to the questions posed by the Inspection Service on 29 October 2020.
59 See page 9 of Freedelity’s responses to the questions posed by the Inspection Service on 29 October 2020. Decision on the merits 146/2024 – 40/67
design of the forms used in the Kiosks when the implementation of the form is entrusted to us. We do not reinvent the wheel for each customer, which explains why the underlying logic remains similar.”60
229. In a document intended for retailers, although after excluding joint liability, Freedelity reveals a non-exhaustive list of cases where collaboration is evident
must take place between Freedelity and the brands, which reinforces the analysis of the
61
Litigation Chamber that this is a case of joint liability. This non-exhaustive list refers, among other things, to:
- the validation of forms and processes for collecting personal data via
terminals, cash register systems or other digital interfaces,
- the production and delivery of leaflets intended to inform consumers,
- informing consumers when collecting their consent to the
processing of their data by providing oral explanations supported by the
delivery of the explanatory information leaflet,
- the provision of alternative solutions to reading the identity card in order
to benefit from the advantages or the loyalty program.
- explicit mention of the use of Freedelity's services in the terms and privacy policy,
- validation of the robustness of the processing of data flows between customers'
applications and CustoCentrix,
- mandatory and immediate coordination in the event of a personal data
leak,
- coordination in response to requests for deletion of their data by
certain consumers,
- the implementation of IT systems ensuring the required IT security.
230. In conclusion, if the collection is mainly the responsibility of the brands, while the
pooling is carried out by Freedelity, these operations are inseparable and
inextricably linked, since the second could not happen without the first. In other
words, pooling by Freedelity is only possible through the collaboration of the
brands in the process of collecting identity data.
60See page 15 of the responses provided by Freedelity to the additional questions posed by the Inspection Service on
29 October 2021
61“White Paper” by Freedelity, 2020 edition. Decision on the merits 146/2024 – 41/67
231. This technical infrastructure, configured by Freedelity but integrated mainly
in the customers’ environment, shows a convergence of the means of processing and
the purposes implemented to carry it out. The Litigation Chamber considers, like
the Inspection Service, that this is a case of joint liability.
232. Freedelity is joint data controller with its customers for the collection and
pooling of identity data.
3. On the legal bases of processing
233. Article 5.1.a of the GDPR requires that data be processed lawfully, fairly and
transparently, which requires in particular securing a legal basis to implement
the data processing.
234. Under Article 6.1 of the GDPR, several legal bases may be invoked by
the data controller, including consent: "processing is lawful only if, and
to the extent that, at least one of the following conditions is met:
235. a) the data subject has consented to the processing of his or her personal data
for one or more specific purposes;
236. […]".
237. The collection and sharing of personal data must take place in accordance
with applicable law, in particular Article 6, §4 of the 1991 law 62 and the GDPR. This article
of the 1991 law requires the prior obtaining of "free, specific and informed" consent
for the electronic reading of data appearing on the identity card. The CPVP
(predecessor of the APD) issued a recommendation on 25 May 2011 63 in which
it recommended: "The prior obtaining of the free, specific and informed consent
of the customer to proceed with the electronic reading of his identity card as part of a
loyalty system. An alternative to the use of his identity card must also be offered to him" (emphasis added).
238. These criteria directly echo the criteria for valid consent within the meaning of the GDPR 64
and must meet the conditions for consent of Article 6.1.a) of the GDPR, provided for in
Article 4.11) of the GDPR, and explained in the EDPB Guidelines 5/2020 on
consent within the meaning of Regulation (EU) 2016/679.
62 Law of 19 July 1991 on population registers, identity cards, foreigners' cards and residence documents, available at the following link:
https://www.ejustice.just.fgov.be/img l/pdf/1991/07/19/1991000380 F.pdf
63
CPVP, recommendation No. 03/2011 of 25 May 2011, on taking copies of identity cards, as well as their use and electronic reading, the link to which is available opposite:
https://www.dataprotectionauthority.be/publications/recommandation-n-03-2011.pdf (page 7)
64
Under Article 4.11) of the GDPR, consent is defined as "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she accepts, by a declaration or by a clear affirmative act, that
personal data concerning him/her are processed" (emphasis added). Decision on the merits 146/2024 – 42/67
239. These criteria ensure that each individual retains full control over the use of
his/her personal data, particularly when it comes to reading his/her electronic
identity card, for which the Belgian legislator has provided a specific regime. In France, the
National Commission for Information Technology and Civil Liberties has even considered that
an electronic identity card contains information that can be considered as "highly personal
data". 65
240. Consent ensures that this control is exercised with full knowledge of the facts,
thus allowing the person concerned to decide freely whether or not
he/she accepts that his/her data is used in this specific context. This choice must be made freely and
specifically, i.e. relate to a clearly defined purpose. In addition,
the obligation to offer an alternative to the use of the eID card is essential to ensure
that the use of this card remains an option, and not an obligation.
241. In this sense, Article 6§4 of the 1991 law protects citizens by ensuring that the processing
of their identity data takes place in a transparent framework, respectful of their
privacy, and in accordance with the fundamental principles set out by the GDPR. The use
of consent, as provided for in Article 6.1.a of the GDPR, is therefore the appropriate legal
basis for the processing of personal data collection and pooling.
242. In conclusion, the collection and sharing of personal data must be based
on the consent of the persons concerned, namely the consumers of the
brands, in accordance with Article 6.1.a of the GDPR.
II.5.2. Finding 1: On the validity of consent (5.1.a., 6.1.a, 7 and 5.2. of the GDPR):
243. As a preliminary, some consent mechanisms implemented by
Freedelity and certain brands will be recalled. The brands whose processing has been examined
offer an alternative to data collection by identity card, i.e. by
66
filling out a manual form. This obligation is provided for by the 1991 law and is
applied – for example – as follows:
a) On the Freedelity website, to create a profile, the person concerned must
enter their identity card number and activate the toggle “I consent to
registering with Freedelity and agree to its privacy policy” (associated with a link).
b) At Enseigne A, a terminal associated with a home screen offers the
consumer to enter their identity card to give their consent,
65See the doctrine of the French data protection authority (the Commission Nationale de l’Informatique et
des Libertés), which considers that the NIR [personal registration number] is “highly personal data”: https://www.cnil.fr/fr/tout-savoir-sur-le-decret-cadre-nir-dans-le-champ-de-la-sante
66Article 6§4 of the Law of 19 July 1991 relating to population registers, identity cards, foreigners’ cards
and residence documents, available at the following link:
https://www.ejustice.just.fgov.be/img l/pdf/1991/07/19/1991000380 F.pdf Decision on the merits 146/2024 – 43/67
which must be deemed to have been obtained, according to the defendant, when the person inserts
his card into the card reader and continues to browse the pages of the
terminal:
“By using your identity card, you agree that Enseigne A and Freedelity
use the identity data to inform you of actions that correspond to your
profile and interests and to update the databases of Freedelity’s commercial
partners. Find out more”.
By clicking on "Learn more", a page opens on which EnseigneA presents
three distinct purposes for which this consent is obtained:
(i) To update the information of the persons concerned in the
databases of Enseigne A and other Freedelity partners,
(ii) To allow Enseigne A to carry out its marketing actions based on
the registration of the telephone number and email address,
(iii) To allow Enseigne A to send a digital proof of guarantee
(proof of purchase) in replacement of the receipt.
c) At Enseigne B, two consent mechanisms are offered through the
terminals: 1) “I agree that Enseigne B uses my data to inform me
of future actions based on my interests”, and 2) “I agree that Freedelity,
Enseigne B’s partner designated to manage my loyalty card, manages my data
in this context, informs me of actions based on my interests and updates the
databases of Freedelity’s partners”. However, on the
Enseigne B website, three consent mechanisms are present: 1) “I consent
to registering with Enseigne B and agreeing to its privacy policy [link]”, 2) “I consent
to registering with Freedelity and agreeing to its privacy policy [link]”, 3) “I consent
to receiving offers by SMS and email from Enseigne B”.
d) On the Enseigne C website, three consent mechanisms are offered during manual
registration: 1) “I accept the registration, the general terms and conditions [link]
and privacy policy [link] of Freedelity”, 2) “I accept the registration and the
general terms and conditions of Enseigne C [link]”, 3) “I agree to receive offers by
SMS and email from Enseigne C”.
244. The defendant maintains that the various consent-obtaining
mechanisms set up by the brands for the collection and sharing of personal
data are all compliant with the GDPR. With regard to its three aforementioned partners, it
successively analyses the characteristics of consent in an attempt to demonstrate
that they meet the requirements of Article 4.11 of the GDPR. While it is not possible to
present the defendant’s arguments in detail in this section, which extends over Decision on the merits 146/2024 – 44/67
50 pages of conclusions, the Litigation Chamber will respond to the defendant’s
arguments in its analysis below.
245. The Litigation Chamber refers to its previous paragraphs concerning the
need to obtain a legal basis for processing within the meaning of Article 5.1.a of the GDPR (see
paragraph 233), and consent as a possible legal basis within the meaning of
Article 6.1.a of the GDPR (see paragraph 234234).
246. It recalls that under Article 4.11) of the GDPR, consent is defined as
"any freely given, specific, informed and unambiguous indication of the data subject's wishes by which
the data subject signifies agreement, by a statement or by a clear affirmative action, to the processing of
personal data relating to him or her".
247. Article 7.1 of the GDPR relating to the conditions applicable to consent provides that:
"where processing is based on consent, the controller
shall be able to demonstrate that the data subject has given his or her consent to the
processing of personal data relating to him or her". In addition, the controller
shall be able to demonstrate that valid consent has been given
(Article 5.2 of the GDPR).
248. It emerges from the Inspection Service's investigation and the observations
sent by Freedelity that the brands are contractually designated as separate
data controllers. The clauses of the contract subject them to general obligations of
cooperation with Freedelity, to collect valid consent and provide
information to the persons concerned. The Litigation Chamber recalls that it is
not bound by a qualification of the role of the parties as it results from the agreements concluded
between them.
249. The Litigation Chamber notes that the different mechanisms presented in
paragraph 243243 are significantly different, and each fails in its own way,
to meet the essential criteria of consent. The defendant uses as a general argument
that the EDPB guidelines on consent, used to support the analysis made
by the Inspection Service, are not enforceable against Freedelity because they were
adopted after the investigation. This argument is irrelevant, since these guidelines
essentially take up the achievements of the guidelines on consent
adopted in 2017 by the Article 29 Working Party ("WP29") 68:
A) Free nature of consent: For consent to be considered
free within the meaning of Article 4.11 of the GDPR, the data subject must be able to consent
67
EDPB, Guidelines 07/2020, section 191
68G29, Guidelines on Consent under Regulation 2016/679, adopted on 28 November 2017, and available on the following link:
https://ec.europa.eu/newsroom/article29/items/623051/en. Decision on the merits 146/2024 – 45/67
freely, i.e. without being subject to pressure or negative consequences if
they refuse the processing of their personal data. Consent must be given
without the obligation to adhere to other conditions, and the data subject must be able
to withdraw their consent without suffering any harm. In addition, the eID cardholder
may refuse to have their data read and/or recorded in the context of
loyalty, which means that they must be able to benefit from the possibility of subscribing to
a loyalty program outside of any eID card reading. In the
situations presented, several elements show that consent is not
free:
- At Enseigne C, the services offered require acceptance of the
Freedelity general conditions as consent within the meaning of Article 6.1.a of the GDPR.
The fact that the data subject must accept the general terms and conditions of
Freedelity in order to benefit from the commercial advantages offered by Enseigne C
demonstrates a lack of freedom offered to the data subjects. Such
consent, which combines both (i) the acceptance of the general terms and
conditions of Freedelity and (ii) the obtaining of consent (Article 6.1.a of the GDPR)
necessary for the processing of the collection and sharing of personal data, is to
the detriment of the data subject and is not free by nature. 71
- It is incorrect for the defendant to assert that when consent is
requested separately for the processing of data by (i) a brand and
(ii) by Freedelity, this circumstance makes the consent free. Indeed, assuming
that all the other conditions of consent are met, it is up to the
defendant to demonstrate that consent to processing operations by
Freedelity is completely optional, such that, by setting up
separate consent mechanisms, the data subject does not need to
consent to the pooling service offered by Freedelity and its partners in
order to benefit from the commercial advantages offered by the brand.
- Thus, in all cases where the persons concerned are forced to consent to the
processing of their personal data by Freedelity (in particular the
pooling), in order to obtain the desired commercial advantages, this consent is
vitiated because it is not free (see in particular the example of Enseigne A). Indeed,
consent can only be free if the person has the choice to accept or refuse
69EDPB, Guidelines 5/2020 on consent within the meaning of Regulation (EU) 2016/679 (v1.1), adopted on 4 May 2020,
(hereinafter, "Guidelines 5/2020"), section 13 et seq., and available at the following link:
https://www.edpb.europa.eu/sites/default/files/files/file1/edpb guidelines 202005 consent fr.pdf
70Article 6§4 of the Law of 19 July 1991 on population registers, identity cards, foreigners' cards
and residence documents, available at the following link :
https://www.ejustice.just.fgov.be/img_l/pdf/1991/07/19/1991000380_F.pdf
71EDPB, Guidelines 5/2020, section 13 et seq. Decision on the merits 146/2024 – 46/67
the pooling of his personal data, envisaged as a service that would benefit him
distinctly from the commercial advantages offered by the brand in question.
B) Specific nature of consent: To be considered specific within the meaning
of Article 4.11 of the GDPR, consent must relate to precise and
distinct purposes. Each purpose must be clearly separated from the others in order to avoid any use
of the data collected that has not been previously and clearly announced to the person
concerned. In all the cases presented, the consent is not specific:
- On the Freedelity website, the request for consent related to the creation of a
profile includes the obligation to provide one's identity card number and to accept the
privacy charter. Contrary to the defendant's allegations, the presence
of a link to the privacy charter containing more information on the
processing does not make the consent specific. Indeed, the
Litigation Chamber notes that the request is global, not distinguishing
between consents (i) to the creation of an account, and (ii) to the subsequent use of the
data in order to feed the shared Freedelity file using data collected by
other partners. The absence of specification of each purpose prevents the
data subject from understanding and consenting separately to the
different uses of their personal data.
- At Enseigne A, the terminal does not allow specific consent: by inserting
their identity card, the person concerned generally accepts the use of their
data for three separate purposes (updating Freedelity’s databases,
marketing actions, and sending proof of digital guarantee). However, each
purpose should be presented as requiring a separate request for consent to
ensure control of the user’s data, which is not the case in this instance. The
Litigation Chamber disputes the defendant’s claims that the
EDPB’s guidelines on consent do not prohibit several
purposes from being linked. The Litigation Chamber refers to the version of these guidelines
adopted in 2017 by the G29.73
- Retailer B and Retailer C offer different consent mechanisms
through a system of terminals (Retailer B only) and their websites, but the
structure of these options creates confusion. In Retailer B, consent
to Freedelity's processing operations groups together several distinct purposes. On
72
EDPB, Guidelines 5/2020, section 55 et seq.
73 See Guidelines 5/2020, section 58: "Without prejudice to the provisions relating to the compatibility of purposes,
consent must be specific to the purpose". "If a data controller processes data based on consent and wishes to process the data for another purpose, it must seek additional consent for that other purpose unless another legal basis better reflects the situation", which on this point echoes a well-established position since the publication of the 2017 G29 guidelines on consent also cited above (see page 12). Decision on the merits 146/2024 – 47/67
the websites of these brands, the consents are not specifically
linked to clear and distinct purposes. For example, it is not specified whether the data
collected are used only by Brand B or whether they will be shared in the
Freedelity file, accessible by other partners. Specific consent
would have required separating the purposes related to Enseigne B and those common to Enseigne
B and Freedelity, to obtain the explicit consent of the data subject for their
personal data to be shared and updated in the Freedelity file, using
the contributions of Freedelity’s partners.
250. C) Informed nature of consent: The GDPR requires that consent be informed,
i.e. allowing data subjects to understand precisely what
74
they are consenting to. In addition, the minimum requirements for informed consent are
75
included in the guidelines on consent and include in particular (i)
the identity of the data controller, (ii) the purpose of each of the
processing operations for which consent is requested, (iii) the (types of) data
collected and used, (iv) the existence of the right to withdraw consent (etc.).
Regarding points (i) and (iii), the EDPB points out that if the consent requested must serve as a basis
for several (joint) controllers or if the data must be transferred to, or processed by, other controllers who wish to rely on the
original consent, these organisations should all be named.
251. The 1991 law also requires that “informed” consent be provided in the event
of electronic reading of the information on the identity card. In the situations described,
the consent cannot be described as informed:
- On the websites of Freedelity, Enseigne B, and Enseigne C, the concept of
mutualisation, requiring the sharing of data with Freedelity’s partners, is not
explained at all to the data subject when obtaining their consent.
This information is nevertheless essential for the persons concerned
to understand the processing that will be done of their personal data, making the
consent uninformed. The fact that the categories of recipients are
included in Freedelity's privacy policy is not sufficient to make the consent
informed, as the defendant maintains, since this separate obligation is governed by the
transparency obligations of Articles 13 and 14 of the GDPR.
- On the terminals of Enseigne A and Enseigne B, if the concept of mutualisation is referred to in a more or less direct manner, the recipients of the personal data are not mentioned.
74
EDPB, Guidelines 5/2020, section 62 et seq.
75 EDPB, Guidelines 5/2020 , sections 64 and 65
76 Article 6§4 of the Law of 19 July 1991 on population registers, identity cards, foreigners' cards and residence documents, available at the following link:
https://www.ejustice.just.fgov.be/img l/pdf/1991/07/19/1991000380 F.pdf Decision on the merits 146/2024 – 48/67
However, since each recipient of the data acts as a (joint) data controller with Freedelity, and therefore as a potential recipient of the data collected by the other joint controllers of
Freedelity, it is essential to inform the person by announcing the identity of the
recipients of this data. It was therefore appropriate to name them individually, without
which the consent could not be considered informed, and therefore valid. The
Guidelines on consent, both in their previous version 77 and in their
current version, specifically mention this point. This omission, in violation of the
GDPR, is aggravated by the circumstances of the processing, which require the
electronic collection of particularly sensitive identity data, and their subsequent
automated exchange between data controllers in the event of an update of the latter.
D) Unambiguous nature of consent: For consent to be considered
unambiguous, it must result from a clear positive act by the data subject. This requirement
excludes any ambiguity: the action by which the person concerned consents must be
clearly distinguished from other possible actions, in particular the simple continuation of
navigation.The Litigation Chamber notes that the consent cannot be described as
unambiguous for the following reasons:
- In the case of Enseigne A, the defendant considers that the person who inserts his
identity card into a reader and clicks on a green button to continue
browsing, gives unambiguous consent. Contrary to what the
defendant maintains, the simple fact of navigating from page to page on a terminal by
pressing a green button to continue does not amount to a clear expression of
consent. For the Litigation Chamber, the simple click on the green button to
navigate from page to page does not meet the requirements of valid consent,
in accordance with Article 4.11) of the GDPR. 80
- Indeed, successive navigation from one page to another can just as well indicate
an exploration of options or an acknowledgement of information, rather than
an approval of a specific data processing. The fact of moving from page to page,
even with a return option (via a red button), remains ambiguous and can mean
several things: exploration, search for more information, or simple navigation,
without it being possible to unequivocally deduce the intention to consent. Thus,
for consent to be unequivocal, the terminal should include a mechanism
77G29, Guidelines on Consent under Regulation 2016/679, adopted on 28 November 2017: “With regard to item (i) and (iii),
WP29 notes that in a case where the consent sought is to be relied upon by multiple (joint) controllers or if the data is to be
transferred to or processed by other controllers who wish to rely on the original consent, these organisations should all be
named” (page 13).
78
EDPB, Guidelines 5/2020, section 65
79EDPB, Guidelines 5/2020, section 75 et seq.
80See also, EDPB, Guidelines 5/2020. Decision on the merits 146/2024 – 49/67
explicit request for consent, such as a specific and dedicated button,
formulated in such a way that the data subject understands unequivocally that by
clicking, he or she is giving his or her consent to the processing of his or her personal data.
252. The Litigation Chamber wishes to clarify that the examples mentioned above are
limited to three specific cases detailed by Freedelity, in which consent,
although not valid, was actually obtained. It notes, however, that Freedelity does not
provide proof of the very existence of any collection of consent
by Freedelity's other partner brands.
253. In conclusion, the Litigation Chamber argues that the mechanisms put in place by
the brands to ensure compliance with Articles 5.1.a and 6.1.a of the GDPR do not
allow valid consent to be considered to have been obtained, in violation
of Articles 5.2 and 7 of the GDPR.
II.5.3. Finding 2: Measures put in place to facilitate the right to withdraw
consent at any time (Arts. 7.3, 5.2, 24 and 25 of the GDPR)
254. According to the defendant, data subjects who wish to withdraw their
consent to the processing of their data by Freedelity can do so by going to the
“My profile” tab of the MyFreedelity portal and disabling the “Validation and updating
of my data with Freedelity customers” toggle. Concerning Brand A, Freedelity
indicates that the possibility for the person concerned to return to the previous page by
clicking on a red button associated with a cross constitutes a right to withdraw consent. It
considers that for certain brands: "The fact that the person concerned has the
possibility of simply not confirming their account is an additional way
made available to them by Freedelity to withdraw their consent to the
processing of their data".
255. It also explains that the person concerned can always send their
withdrawal request by email or by post, or make their request to the
seller of the brand. In this sense, Freedelity considers that it allows the persons
concerned to withdraw their consent at any time. Furthermore, and notwithstanding
these measures which it considers satisfactory, Freedelity admits that it is in the process of changing the
terminal screens in order to provide the possibility for the person concerned to delete their
accounts directly via the terminal.
256. The Litigation Chamber recalls that Article 7.3 of the GDPR provides that: "The data subject
has the right to withdraw his or her consent at any time. The withdrawal of
consent does not compromise the lawfulness of processing based on consent
81As of 12 November 2020, there were 5 customers who used terminals (page 8 of the responses provided by the
defendant to the questions from the inspection service asked on 29 October 2020). Decision on the merits 146/2024 – 50/67
made before this withdrawal. The data subject is informed of this before giving his/her
consent. It is as easy to withdraw as it is to give your
consent. Articles 24.1 and 5.2 of the GDPR impose
accountability obligations on the data controller, requiring it to be able to
demonstrate that the processing is carried out in accordance with the
GDPR.
257. Article 25.1 of the GDPR requires the data controller to
apply data protection measures by design and by default, depending in particular
on the nature, scope and risks of the processing for the rights and freedoms of
the data subjects. It requires the implementation of technical and
organisational measures to ensure compliance with the GDPR.
258. In this case, Freedelity is criticised for not having
implemented sufficiently simple and direct means to allow the withdrawal of
consent. Although
options exist via the MyFreedelity portal and in-store terminals, these methods do not
meet the simplicity requirement of Article 7.3 of the GDPR, according to which
withdrawing consent must be as simple as giving it. Indeed, the need for
data subjects to navigate through various tabs or interfaces, as well as
the absence of an explicit and immediate withdrawal option, may discourage
consumers from withdrawing their consent.
259. The principle of data protection by design and by default, as set out in
Article 25 of the GDPR, requires the data controller to implement adequate
technical and organizational measures to ensure the protection of personal
data, in particular with regard to the rights of data subjects. This
principle of protection by default should have led Freedelity to provide
withdrawal mechanisms directly at the terminals themselves, even before the
processing is set up. Having to revise the interfaces of the terminals to facilitate the withdrawal of
consent demonstrates a lack of anticipation regarding the requirements of data protection by
default, which should have guided the initial design of the device.
260. Freedelity has implemented a system where the right of
withdrawal, as currently proposed, does not fully meet the requirements of simplicity and
accessibility established by the GDPR. In accordance with the Guidelines on Consent, a
consent mechanism cannot be considered compliant with the GDPR if the conditions of the right of
withdrawal are not effectively respected. The fact that data subjects must go through
separate steps or interfaces to withdraw their consent, instead of a
withdrawal functionality directly integrated into the terminals, does not meet the conditions for
withdrawal of consent provided for in Article 7.3 of the GDPR.
82EDPB, Guidelines 5/2020, section 116 Decision on the merits 146/2024 – 51/67
261. In conclusion, the Litigation Chamber considers that Freedelity has not complied with the
documentation and accountability requirements arising from Articles 24 and 5.2 of the GDPR
regarding withdrawal of consent, as the current mechanisms do not allow for a
simple and direct withdrawal of consent (Art. 7.3 of the GDPR), in accordance with the
principle of data protection by design (Art. 25 of the GDPR).
II.5.4. Finding 3: Measures put in place to demonstrate that the consent
collected complies with the GDPR (Arts. 5.2, 24 and 25 of the GDPR)
262. The defendant maintains that its standard contract requires brands to collect
quality consent, combined with a clause providing that the brand will indemnify
Freedelity in the event of a failure to obtain consent or the quality of the
consent. It also states that its consent register includes important
information, such as the date of consent or the consent log and
the source of the consent.
263. The Litigation Chamber recalls that Article 5.2 enshrines the principle of
accountability and requires that the data controller be able to demonstrate
compliance with the principles of the GDPR in its data processing. Article 24 supplements
this obligation by requiring data controllers to implement
technical and organizational measures adapted to the nature, scope, context,
purposes of the processing as well as the risks to the rights of the data subjects, with
an obligation of continuous review to ensure compliance. Article 25.1, finally,
enshrines the obligation of data protection by design and by default, implying
the implementation of concrete measures that must be applied from the definition of the
processing means. This finding is limited to examining the measures put in
place to ensure the validity of the consent collected.
264. In this case, Freedelity, whose role as data controller is not
contested, must respect these principles of accountability, by demonstrating that the
consents collected comply with the requirements of the GDPR. Indeed, when
processing is based on consent, the data controller must be able to
demonstrate that the data subject has given consent to the processing of
personal data concerning him or her (Article 7.1 of the GDPR). Recital 42
provides that: “Where processing is based on the data subject’s consent, the
controller should be able to prove that the data subject has consented to the
processing operation.”
265. Freedelity explains in its answers to the questions of the Inspection Service 83 that “The
management of consent and its collection is tailored to each client. The IT aspect
83See page 12 of the responses provided by Freedelity to the questions asked by the inspection service on 29 October 2020. Decision on the merits 146/2024 – 52/67
of the management of this consent within the software is complex and is not
documented in itself”. To the extent that this consent can be adapted to each customer,
at least at the level of the Freedelity terminals, the Litigation Chamber questions
the reasons why Freedelity has not secured quality consent for the
collection and sharing of data at the terminals themselves.
266. In addition, the Litigation Chamber notes that the agreements concluded by Freedelity with the
brands do not allow Freedelity to demonstrate the collection of valid and systematically GDPR-compliant consent
for each person concerned. By limiting itself to requiring the implementation of "quality consent" on a case-by-case basis,
Freedelity takes the risk that certain consent forms are non-
compliant.
267. Without prejudging the compliance procedures that could have been
considered to enable compliance, the Litigation Chamber notes that the
following procedures seemed entirely feasible in this case to guarantee Freedelity's
compliance with the requirements of the GDPR in view of the risks presented by the processing in
question:
- Freedelity could have established a precise model for collecting valid consent,
relating to the collection and pooling of identification and contact data,
integrated directly into the Freedelity terminals.
- For brands wishing to implement the consent
mechanisms themselves (for example via their websites), Freedelity could have
established a precise model for collecting consent, described in its contracts with the
brands.
- As far as necessary, ask brands to provide proof that they
have put in place valid consent once the implementation is complete and
add to this obligation an audit clause allowing Freedelity to verify the
compliance of the consent mechanism in a timely manner.
268. The Litigation Chamber insists on the fact that a data controller, even in
a context of joint responsibility, cannot be exempted from this obligation to
demonstrate the collection of valid consent.
269. The sole obligation to compensate Freedelity in the event of collection of invalid consent is not sufficient in itself to demonstrate the sufficiency of the measures implemented
84See in this sense the IAB decision of the Litigation Chamber of 2 February 2022, No. 21/2022, available from the following link:
https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-21-2022-en.pdf
And the deliberation of the restricted formation of the CNIL, the French data protection authority, No. SAN-2023-009 of
15 June 2023 concerning the company CRITEO, available from the following link:
https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000047707063. This decision is currently the subject of an appeal before
the French Council of State. Decision on the merits 146/2024 – 53/67
to ensure the collection of valid consent. Indeed, appropriate technical and
organizational measures should have supplemented such contractual measures. In
addition, the presence of a register that simply contains information on the
presence of a consent mechanism is also insufficient, as it only
allows one to note that consent has been obtained. Neither the quality of the
consent nor its specific nature to Freedelity can be deduced from such a
register.
270. In these circumstances, the Litigation Chamber considers that Freedelity has not
implemented the necessary measures to enable it to demonstrate that the consent
collected for the collection and pooling of data complies with the GDPR within the meaning
of Articles 5.2, 24 and 25 of the GDPR.
II.5.5. Finding 4: Principle of minimisation of personal data (Art. 5.1.c
of the GDPR), and principle of data protection by default (Art. 25.1 of the GDPR)
271. The defendant maintains that given the large amount of personal data processed
by Freedelity, a balance must be struck between the principle of minimisation (Art. 5.1.c of the GDPR) and
the principle of accuracy (Art. 5.1.d of the GDPR). It points out that in order
to carry out its missions, it must quickly limit the risk of confusion between
individuals, avoid duplication, and identify potential fraud, hence the large volume
of information collected. Finally, it maintains that the recording of changes
of postal or electronic address in order to allow consumers to receive
promotional offers, advertisements or any other
information and new tenants or purchasers not to receive
unwanted advertising.
272. The Litigation Chamber recalls that the principle of data minimisation, set
out in Article 5.1.c of the GDPR, requires that the personal data collected be adequate,
relevant and limited to what is strictly necessary in relation to the
purposes for which they are processed. In other words, only data that is
essential to achieve the objectives of the processing must be collected, thus
avoiding any excessive collection of information that would not be
directly useful or justified by the intended purposes. As stated above, Article 25.1 of the GDPR, enshrines the obligation of
data protection by design and by default, implying the implementation of
concrete measures that must be applied as soon as the processing means
are defined.
273. The Inspection Service indicated that with regard to the
processing carried out for the purposes of registration in the
"Freedelity file" as well as for the pooling of data
with Freedelity customers and partners, the following personal
data would be processed in particular: Decision on the merits 146/2024 - 54/67
- Identification data, namely: "surname, first name(s), gender, place and date of birth,
nationality, home address, identity card number, municipality of issue of the
identity card, validity date of the identity card and history of this data"; and
- Contact data: "your email address, telephone/mobile number and history of
this data".
274. In addition, the 2011 recommendation of the CPVP states: "Certain commercial
practices also lead the Commission to look into the use of the identity
card as a loyalty card. (…) This choice must be offered to customers in a
transparent and explicit manner as soon as a loyalty system is offered to them. In
addition, the principle of proportionality of the privacy law requires that only the
necessary data of the identity card can be read in this context. There can be no question
of processing and storing for this purpose either the photo of the cardholder,
nor the number of his identity card, his identification
number in the National Register, his nationality, his place of
birth" (emphasis added). The underlined data are nevertheless collected by
Freedelity. ". Therefore, contrary to what the defendant claims, the CPVP has not
only never approved this practice but has also limited in its opinion the
modalities of lawful processing of identity card data.
275. A fortiori, data such as the municipality where the identity card was issued, the
validity date of the identity card and the history of this data are of no relevance
in the context of the processing carried out by Freedelity and the brands. This data is
generally not included in the manual collection form set up by
certain brands, which shows that it is not useful, and therefore a fortiori not
necessary for the implementation of the processing.
276. As the Inspection Service rightly points out, only a few data items would have been
necessary for Freedelity to fully comply with the GDPR’s principles of minimisation and
accuracy when feeding the Freedelity file. The Litigation Chamber considers that the surname, first name and contact details (postal
address, email or telephone) are sufficient to provide a sufficiently precise indication of the
data subject in view of the purpose in question, which does not require irrefutable
identification of the data subject’s identity. These data items could have been the only
ones collected from the start of the processing, without the operation of the
Freedelity file being affected.
85The identity card number is an identifier distinct from the national register registration number (NIR), which Freedelity
assures that it does not collect.
86CPVP, recommendation No. 03/2011 of 25 May 2011, relating to the taking of copies of identity cards, as well as their
use and electronic reading, the link to which is available opposite:
https://www.dataprotectionauthority.be/publications/recommandation-n-03-2011.pdf. Decision on the merits 146/2024 – 55/67
277. The risk of having obsolete data in the Freedelity file does not justify the collection
of around ten additional and optional information. Furthermore, the greater the
number of personal data collected, the more difficult it is to comply with both the
principle of accuracy and the principle of minimisation. The defendant’s arguments on
this point cannot therefore convince. The Litigation Chamber is
particularly concerned about the impact on the persons concerned in the event of a data
breach, due to their quantity and precision. Indeed, the massive centralisation of data
of a large part of the population and their data collected directly on their
identity card poses a high risk to the privacy of millions of consumers.
278. For these reasons, the Litigation Chamber considers that Freedelity has failed to comply with the
principle of minimisation of personal data (art. 5.1.c of the GDPR), and with the principle of
data protection by default (art. 25.1 of the GDPR).
II.5.6. Finding 5: Principle of limitation of the retention of personal data (art. 5.1.e, 5.2, 24 and 25.1 of the GDPR)
279. The defendant claims that the retention of data for a period of 8 years in the
context of the management of the Freedelity file is appropriate. The starting point of this retention period is
calculated, according to the defendant, from the last "activity" of the person
concerned (e.g.: checkout).
280. It maintains that the data retention period of 8 years is justified first of all
by the specific purpose of the Freedelity file, which requires regular updating and immediate
accessibility of the data. Then, it underlines the legitimate economic interest
of retaining the data for a sufficient period to allow optimal operation
of its service. This retention period is also justified by
accounting and tax considerations, both for customers and for the company itself. It
highlights the fact that the legal guarantee of consumer goods of 2 years, 87
which can be extended by traders, requires a longer data retention period than the strict 2-year period proposed by the Inspection Service.
281. The Litigation Chamber recalls that within the meaning of Article 5.1.e of the GDPR, data
must be retained in a manner that guarantees that they are not kept in a form
that allows the identification of individuals for longer than is necessary for
the purposes for which they are processed. The data controller is
responsible for compliance with this principle and must be able to demonstrate that it is
87Article 1649quater of the Civil Code Decision on the merits 146/2024 – 56/67
complied with (Arts. 5.2 and 24 of the GDPR). The Litigation Chamber refers to its
previous findings concerning Art. 25 of the GDPR (see paragraph 263).
282. The Litigation Chamber notes that the defendant's arguments are
not sufficient to justify such a long retention period. Indeed, while regular updating of the
file and immediate accessibility of the data are necessary to ensure quality customer
service, it should be noted that these objectives can be achieved with a
retention period significantly shorter than 8 years.
283. Concerning the retention periods invoked by the defendant, the
Chamber notes that these apply mainly to purposes distinct from the management of the
Freedelity file, and for which Freedelity does not act as data controller. Indeed, the legal requirements relating to
guarantees essentially concern the relations between the consumer and the seller. Thus, the
legal obligations weighing on Freedelity in terms of data retention cannot be based
on these requirements alone.
284. Furthermore, the Freedelity file is not the appropriate medium for storing data based
on such requirements, specific to customers. Indeed, the CustoCentrix
database is the one that hosts, in the form of Silos, the data strictly
specific to each brand and the processing of which is subcontracted to Freedelity by
each of the brands. To this extent, and based on the responses provided by
89
Freedelity to the Inspection Service, the Silo specific to each customer could serve
90
as an intermediate archive of data whose retention in an active database, on the
Freedelity file, is no longer justified.
285. In this case, the Chamber considers that a retention period of maximum 3
years from the last activity would be sufficient to meet the needs of the defendant, while
respecting the rights of the persons concerned. This period is aligned with the
current practices recommended by the National Commission for Information Technology and
91
Liberties. The Chamber considers that a consumer who has not shown any
activity for a period of two to three years within the partner brands of
Freedelity can be presumed to no longer wish to benefit from the services associated with this file.
88As explained by Freedelity in its 2020 WhitePaper, (page 5): "the database specific to each client within
CustoCentrix containing consumer data that cannot be shared with other clients and
for which Freedelity acts as a subcontractor within the meaning of data protection regulations".
89See page 22 of the responses provided by Freedelity to the additional questions from the Inspection Service asked on 29 October 2021.
90
The concepts of “intermediate archiving” and “active base” are used by the CNIL in its reference documents on data retention. See for example this article from the CNIL on the determination of retention periods:
https://www.cnil.fr/fr/passer-laction/les-durees-de-conservation-des-donnees
91
CNIL reference document on the processing of personal data – management of commercial activities.
https://www.cnil.fr/sites/cnil/files/atoms/files/referentiel traitement-donnees-caractere-personnel gestion-activites-
commerciales.pdf (page 5) Decision on the merits 146/2024 – 57/67
It is indeed reasonable to consider that such a consumer has lost all interest in
this type of loyalty program.
286. In this perspective, the defendant is free to set up a mechanism
for regular verification of the activity of the persons concerned to ensure that their
data - and their account - should not be deleted. For example, an
email could be sent to consumers who have not shown any activity
for 3 years, in order to ask them to confirm their wish to maintain their registration
in the Freedelity file. In the absence of a response from them within a reasonable time, the
defendant could consider that these persons have waived the benefit of this
service and proceed to the deletion of their data or their archiving, if applicable.
287. In view of all these elements, the Chamber considers that the retention period
of 8 years set by the defendant is disproportionate to the purpose pursued.
The principle of data minimization, enshrined in Article 5.1.e of the GDPR, requires the
data controller to limit the retention of data to a strictly
necessary period.
288. In conclusion, the Litigation Chamber finds a violation of the principle of
limitation of the retention of personal data (Art. 5.1.e, 5.2, 24 and 25.1 of the
GDPR) due to the excessive retention period of 8 years for the management of the Freedelity file.
III. Corrective measures and sanctions
289. Under Article 100§1 of the LCA, the Litigation Chamber has the power to:
1° dismiss the complaint;
2° order that there be no further action;
3° order a suspension of the decision;
4° propose a transaction;
5° issue warnings or reprimands;
6° order compliance with the requests of the person concerned to exercise these rights;
7° order that the person concerned be informed of the security problem;
8° order the freezing, limitation or temporary or permanent prohibition of the processing;
9° order that the processing be brought into compliance;
10° order the rectification, restriction or erasure of the data and the notification of
these to the recipients of the data;
11° order the withdrawal of the accreditation of the certification bodies; Decision on the merits 146/2024 – 58/67
12° impose periodic penalty payments;
13° impose administrative fines;
14° order the suspension of cross-border data flows to another State or an
international body;
15° forward the file to the Public Prosecutor's Office of the Brussels
King's Prosecutor, who shall inform him of the follow-up given to the file;
16° decide on a case-by-case basis to publish its decisions on the website of the
Data Protection Authority.
III.1. Choice of the appropriate corrective measure or sanction
290. In light of the above and on the basis of the powers assigned to it by
the legislator, the Litigation Chamber decides to order measures to bring
processing into compliance, pursuant to Article 100, §1, 9° of the LCA, as
well as the deletion of certain data, in accordance with Article 100, §1, 10° of the LCA. In order
to guarantee the effective execution of these measures, the Litigation Chamber considers it
necessary to combine them with periodic penalty payments, considering that this approach
constitutes the most appropriate response to the circumstances of the case.
291. The Litigation Chamber considers that a combination of such measures is
appropriate to achieve the effective, proportionate and dissuasive nature of the sanction. Indeed, it is
imperative that Freedelity implements this decision by bringing its
processing into compliance and deleting certain data. In this case, the planned penalty payment is
able to put sufficient pressure on Freedelity to achieve this end.
292. The Litigation Chamber could decide to impose an administrative fine under
its powers on the basis of Article 83 of the GDPR and Article 100, § 1, 13° of the
LCA, with regard to the violations found of Articles 4, 5, 6, 7, 24 and 25 of the GDPR.
293. Nevertheless, the Litigation Chamber considers that compliance orders accompanied
by a penalty payment do not require the imposition of a fine since the injunctions issued
require the company to significantly transform its business model in order to
comply with the requirements of the GDPR. This complex and demanding process will require
significant financial resources from the defendant.
294. The penalty payment, through its incentive mechanism, guarantees that the corrective measures will
be effectively implemented without unduly weakening the financial stability of the company. This approach, combined with the other sanctions adopted, ensures a response
that respects the principles of effectiveness, proportionality and dissuasion of the GDPR.
295. Therefore, pursuant to Article 100§ 1 of the LCA, the Litigation Chamber decides to:
a) in accordance with Article 100§ 1, 9° of the LCA, order compliance
of the processing operations within a period of 4 months, in accordance with injunctions 1 to 5;
b) in accordance with Article 100§ 1, 10° of the LCA, order the erasure of the data
in accordance with injunctions 4 and 5 within a period of 4 months;
c) in accordance with Article 100§ 1, 12° of the LCA, impose periodic penalty payments of EUR 5,000
per day of delay from the day on which the Litigation Chamber notifies it that it
has partially or not at all complied with the injunctions issued in
this decision, on the basis of the responses provided by the defendant to the
Litigation Chamber, which must have been received by the end of the
period allowed for compliance;
d) in accordance with Article 100§ 1, 16° of the LCA decide to publish the decision on the
website of the Data Protection Authority, with direct identification of
the defendant.
III.2. Order for compliance and erasure of data
296. The Litigation Chamber considers that it is appropriate to impose several injunctions for
compliance and erasure of data on the defendant, by virtue of the
breaches noted.
297. Injunction 1: Pursuant to Article 100§ 1, 9° of the LCA, the Litigation Chamber orders
Freedelity to put in place consent collection mechanisms guaranteeing
that consent is free, specific, informed and unequivocal, in accordance with Article 4.11 of
the GDPR, and this for each processing of personal data that it carries out, including the
pooling of data with its commercial partners.
298. Freedelity must in particular:
- Ensure that access to the commercial advantages offered by a brand is not
conditioned on the acceptance of other non-essential processing or conditions, including the
pooling of data.
- Clearly and comprehensibly inform the persons concerned, at the time
of the collection of their data, on the specific purposes of each processing, the
categories of data concerned, and allow consumers to know the identity of the recipients with whom the data will be shared. Decision on the merits 146/2024 – 60/67
- Implement explicit mechanisms to obtain unambiguous consent, such as
a button that is not checked by default allowing data subjects to expressly confirm
their agreement for each processing purpose envisaged.
- Verify the existence of free, informed, unequivocal and specific consent for
all data subjects whose data is processed in the Freedelity file, in light of the above requirements and in the event of a negative finding, either
delete the data currently present in the Freedelity file without
valid consent, or renew the consent of the data subjects before the end of the period
allowed for compliance with this Injunction 1.
- Transmit to the Litigation Chamber evidence of compliance with this Injunction 1,
including a copy of the Freedelity-specific consent form template (or
consent forms) modified or implemented pursuant to Injunction 1 issued by the Litigation Chamber.
299. Injunction 2: Pursuant to Article 100§ 1, 9° of the LCA, the Litigation Chamber orders
Freedelity to put in place simple, accessible and direct mechanisms to
allow data subjects to withdraw their consent, in accordance
with Article 7.3 of the GDPR.
300. Freedelity must in particular:
- Integrate on all physical terminals used by its partners an explicit
and immediate option allowing the withdrawal of consent, without the need to navigate
through complex menus or interfaces.
- Update the MyFreedelity portal to include a clearly visible and
directly accessible feature allowing data subjects to withdraw their
consent in as many steps as it takes them to give their consent.
- Inform the persons concerned, at the time of collecting consent, of the
means available to withdraw this consent, ensuring that this information
is clear, understandable and easily accessible.
- Adopt and document technical and organizational measures in accordance with
the principle of data protection by design and by default (Article 25 of the GDPR),
ensuring that withdrawal mechanisms are integrated from the design of any
new interface or terminal.
- Transmit to the Litigation Chamber evidence of compliance with this Injunction 2,
including screenshots of the new consent withdrawal mechanisms as
implemented or modified by Freedelity and the brands. Decision on the merits 146/2024 – 61/67
301. Injunction 3: Pursuant to Article 100§ 1, 9° of the LCA, the Litigation Chamber orders
Freedelity to document precisely the consent collection process, in
such a way as to be able to demonstrate, at any time, that it was obtained in
accordance with the requirements of the GDPR, and this in order to ensure in particular
compliance with Articles 5.2, 24 and 25 of the GDPR. Freedelity shall provide the Litigation Chamber with evidence of
compliance with this Injunction 3.
302. Injunction 4: Pursuant to Article 100§ 1, 9° of the LCA, the Litigation Chamber orders
Freedelity to immediately cease the collection and processing of personal data
from consumers’ identity cards, with the exception of data
strictly necessary for the stated purpose, namely, to take the example of a
classic loyalty program: the surname, first name and contact details
(postal address, email or telephone). Pursuant to Article 100§ 1, 10° of the
LCA, the Litigation Chamber also requires the deletion of any data that has been
collected beyond this information within a period of four months.
303. Freedelity shall in particular:
- Update, or order the updating of all collection interfaces and tools
used by Freedelity and its partners (in-store terminals, digital portals,
manual forms, etc.) in order to guarantee that only authorized data is
collected.
- Prohibit, with respect to third parties, any resale or transfer of
unnecessary data collected before the definitive deletion of this data, unless
valid consent from the persons concerned is obtained. This prohibition includes
data previously collected that does not comply with the principle of minimization.
- Notify the persons concerned of the deletion of unnecessary data
already collected, reminding them of their rights regarding the data that continues to be
processed by Freedelity, in particular the right to access, rectify, delete their data, as
well as their right to withdraw their consent.
- Freedelity must provide the Litigation Chamber with evidence of compliance with this
Injunction 4, in particular a copy of the template for the notification to the persons
concerned and proof of the effective deletion of the unnecessary personal data
identified in Finding 4 of this decision.
304. Injunction 5: Pursuant to Article 100§ 1, 9° of the LCA, the Litigation Chamber orders
Freedelity to reduce the retention period of personal data processed in the
context of the Freedelity file to a maximum of three years from the last activity of the
persons concerned. Pursuant to Article 100§ 1, 10° of the LCA, the Litigation Chamber
requires Freedelity to erase data that has been retained for a period of more than three years, unless a separate legal basis justifies their retention in an
intermediate archive such as Customer Silos (for example, specific legal obligations for
brands).
305. Freedelity must in particular:
- Delete all personal data retained beyond this period of three
years for persons who have not demonstrated any activity, unless a separate legal basis
justifies their retention (for example, specific legal obligations or ongoing disputes).
Apply this erasure to all data currently contained in the
Freedelity file and purge the Freedelity file of obsolete data.
- Ensure that when a separate legal basis justifies the retention of data for
more than 3 years, the data is archived on a medium separate from the Freedelity file and
that it is processed for no purpose other than that of storage justified by the legal
basis in question.
- Send a reminder by email or any other appropriate means to
consumers who have not shown any activity for three years or more, in order to
ask them to confirm their wish to maintain their registration. In the absence of a
response within a reasonable period (for example, one month), archive the data under
the conditions listed above, or delete them if applicable.
- Freedelity must provide the Litigation Chamber with evidence of compliance with this
Injunction 5, in particular documents demonstrating the effective erasure of
personal data beyond the authorized periods, in accordance with Finding 5 of
this decision.
III.3. Conditional sanction: the penalty payment
III.3.1. Preliminary considerations
306. The penalty payment is unique in that it is fully conditional. The amount to be paid
is indeed uncertain. The defendant first has a period of time to comply or to appeal the
decision. It is only in the event of non-compliance on its part
after a period of 4 months from notification of this decision that the penalty
payment will be implemented. Therefore, the amount of the penalty payment is variable, and it may even be zero,
where applicable.
92See on this point the recommendations of the CNIL (French data protection authority) regarding intermediate data archiving: https://www.cnil.fr/fr/passer-laction/les-durees-de-conservation-des-donnees Decision on the merits 146/2024 – 63/67
307. The penalty payment is distinguished from the administrative fine in that it constitutes an indirect means of enforcement of the main penalty(s) in order to comply
with the law in force, whereas the administrative fine is punitive in nature.
308. The penalty payment therefore also has an ancillary nature. The penalty payment and the administrative fine are thus different both in nature and in the objectives they pursue.
309. In light of the reasons set out above, the Litigation Chamber decides to impose
periodic penalty payments on the defendant in this case, and does not consider that it must inform
the defendant in advance by means of a penalty form.
III.3.2. Practical arrangements for the periodic penalty payment
310. In order to give the defendant the time necessary to comply with the
injunctions issued in this decision, the periodic penalty payment will not be implemented
directly following the notification of this decision to the defendant. In this case, the
Litigation Chamber considers that a period of 4 months from the notification of this
decision is sufficient to allow the defendant to comply with the said
injunctions.
311. The time limit shall run from the day on which the defendant receives the registered letter notifying it
of this decision or from the day of expiry of the time limit during which the
defendant is, where applicable, required to collect said registered letter from
the post office.
312. From the expiry of the 4-month period from the notification of this
decision, and provided that it has received the evidence requested in the various
injunctions within the time limits, the Litigation Division shall notify the defendant, after
examining the documents:
1) That the latter has fully complied with the injunctions issued in
this decision; or
2) That the defendant has partially complied with the injunctions issued in
this decision; or
3) That the defendant has not complied with the injunctions issued in
this decision.
313. The Litigation Chamber shall initiate the enforcement of the penalty payment on the same day as the
notification in the second and third cases. In case of doubt, the APD may use
its powers derived from the LCA or the ROI in order to continue the procedure or open a
new file, if necessary.
93Decision on the merits of the Contentious Chamber, No. 131/2024 of 11 October 2024, paragraphs 113 to 116. Decision on the merits 146/2024 – 64/67
314. The amount of the periodic penalty payments is defined as follows:
a) Injunction 1: the defendant must pay EUR 1,000 per day of delay from the day on which
the Contentious Chamber notifies it that it has partially or not at all complied with
the injunctions issued in this decision;
b) Injunction 2: the defendant must pay EUR 1,000 per day of delay from the day on which
the Contentious Chamber notifies it that it has partially or not at all complied with
the injunctions issued in this decision.
(c) Injunction 3: The defendant shall pay EUR 1,000 for each day of delay from the day on which
the Litigation Chamber notifies it that it has complied partially or not at all with
the injunctions issued in this decision.
(d) Injunction 4: The defendant shall pay EUR 1,000 for each day of delay from the day on which
the Litigation Chamber notifies it that it has complied partially or not at all with
the injunctions issued in this decision.
(e) Injunction 5: The defendant shall pay EUR 1,000 for each day of delay from the day on which
the Litigation Chamber notifies it that it has complied partially or not at all with
the injunctions issued in this decision.
315. If the defendant fails to comply with the six injunctions, it must then pay EUR 5,000
for each day of delay from the day on which the Litigation Chamber notifies it that it has
partially or not at all complied with the injunctions issued in this
decision.
316. The Litigation Chamber recalls that the penalty payment is not punitive in nature. The
injunctions are each accompanied by a penalty payment to ensure their proper execution.
The amount of the penalty payments is reasonable in view of the infringement that the
defendant has caused to the rights of the plaintiff, and of users more generally, but also
in view of the financial capacity of the defendant, whose turnover is less
than [amount], and the profit that it can derive from the non-execution of the injunctions in question.
317. If the defendant considers that full execution of the injunctions is impossible
within the prescribed period despite all reasonable efforts, it may submit a
reasoned request for an extension of time to the Litigation Chamber within 45
days of notification of this decision to it.
318. The penalty payment is daily. The Litigation Chamber decides that the maximum
cumulative amount of the penalty payment may not exceed EUR 100,000. Decision on the merits 146/2024 – 67/67
In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged,
within thirty days of its notification, with the Market Court (Brussels Court of
Appeal), with the Data Protection Authority as the defendant.
Such an appeal may be filed by means of an interlocutory application which must contain the
information listed in Article 1034ter of the Judicial Code. The interlocutory application must be
filed with the registry of the Market Court in accordance with Article 1034quinquies of the Judicial Code, or 95
via the e-Deposit information system of the Ministry of Justice (Article 32ter of the Judicial Code)
(sé). Hielke H IJMANS
President of the Litigation Chamber
94
The application contains, under penalty of nullity:
1° the indication of the day, month and year;
2° the surname, first name, address of the applicant, as well as, where applicable, his/her qualities and his/her national register number or
company number;
3° the surname, first name, address and, where applicable, the quality of the person to be summoned;
4° the subject and summary statement of the grounds of the application;
5° the indication of the judge who is seized of the application;
the signature of the applicant or his lawyer.
95The application, accompanied by its annex, is sent, in as many copies as there are parties involved, by registered letter to the clerk of the court or filed with the registry.
