APD/GBA (Belgium) - 80/2021
From GDPRhub
| APD/GBA (Belgium) - 80/2021 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 17(1)(c) GDPR Article 19 GDPR Article 21(2) GDPR Article 24(3) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 19.07.2021 |
| Published: | 19.07.2021 |
| Fine: | None |
| Parties: | n/a |
| National Case Number/Name: | 80/2021 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | French French |
| Original Source: | BE DPA (in FR) BE DPA (in FR) |
| Initial Contributor: | n/a |
The Belgian DPA issued a new decision following a so-called 'light decision', whereby it had ordered a company to stop processing certain personal data used for direct marketing and to delete the data. Since the company neither complied with the order nor notified the DPA of any action taken, the DPA issued a new decision, with a reprimand and a new order to comply within one month.
English Summary
Facts
In a former decision adopted within the so-called 'light procedure', the Belgian DPA ordered a company to stop the processing of the personal data of a complainant who had objected to the sending of direct marketing emails several times.
The provider did not comply with the order and the litigation chamber decided to open the case to adopt a decision on the merits ("décision au fond").
None of the parties sent their submissions, despite the fact that they were invited to do so.
Holding
The DPA issued a reprimand against the company and ordered it to:
- comply with the right to object within a month after the notification of the decision;
- stop the processing of personal data for direct marketing purposes;
- erase all the data of the complainant (except if another legal basis could justify the processing for another purpose)
- notify all the recipients in accordance with Article 19 GDPR.
Comment
In a 'light procedure', the parties are not heard and the decision is made on the basis of the complaint. In a 'decision on the merits' ("décision au fond") the parties are heard.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/6
Contentious Room
Decision on the merits of July 19, 2021
File number: DOS-2020-00559
Subject: Direct Marketing - Substantive Decision Following Failure to Perform a
"light" decision on article 95.1.5 ° LCA - reprimand and personal orders
requests for the exercise of the complainant's rights (opposition, erasure and notification to third parties)
The Contentious Chamber of the Data Protection Authority, made up of Mr. HielkeHijmans,
chairman, and Messrs. Romain Robert and Dirk Van Der Kelen, members, taking up the matter in this
composition;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the protection
of natural persons with regard to the processing of personal data and on free movement
of this data, and repealing Directive 95/46 / EC (General Data Protection Regulation),
hereinafter "GDPR";
Considering the Law of December 3, 2017 establishing the Data Protection Authority (hereinafter the APD law);
Having regard to the internal regulations as approved by the Chamber of Representatives on December 20, 2018
and published in the Belgian Official Gazette on January 15, 2019;
Having regard to the documents in the file;
took the following decision regarding:
.
The complainant: X (hereinafter "the complainant"); .
.
The defendant: Y (hereinafter "the defendant") Decision on 80/2021 - 2/6
I. Facts and procedural history
1. Pursuant to his complaint of January 31, the complainant indicates that on several occasions he reported to the
defendant that he did not wish to receive emails from him, emails addressed to him
to his e-mail address […]. These emails relay promotions offered by the
defendant, active in the used vehicle market in particular.
2. It appears from the documents sent by the complainant that on December 11, 2019, a promotional email
unsolicited was sent to him at his address […].
3. On December 12, 2019, the next day, the complainant sent the STOP message to the email address
[…], Following in this the procedure mentioned by the defendant to unsubscribe from the
"Newsletter" received. This immediate reaction of the complainant had been preceded on July 4, 2019 and
November 5, 2019 of similar "STOP" messages.
4. It is also apparent from the documents filed by the complainant that on January 31, 2020, the latter was
again opposed to sending an unsolicited email from the defendant by sending the
STOP message by return email to the sender.
5. On February 28, 2020, the complainant filed a complaint with the APD.
6. On March 10, 2020, the complaint was declared admissible on the basis of Articles 58 and 60 LCA by the
APD's Front Line Service (SPL). The complainant was informed of this in accordance with article
61 LCA and the complaint was transmitted on the same date to the Litigation Chamber by virtue of
article 62.1 LCA.
7. On April 14, 2020, the Litigation Chamber has, in application of articles 58.2.c) of the RGPD and 95.1, 5 °
LCA, adopted decision 12/2020 against the Respondent (Annex 1) and decided to order
the defendant, prior to any decision on the merits, to comply, within one month
at the request of the complainant to exercise the rights of opposition and erasure (art. 21.2 and 17.1 c) of
GDPR) and therefore to cease all processing of the complainant's personal data for
prospecting purposes (article 21.3 of the GDPR) as well as to erase the data
personal data concerning him (article 17.1 c) of the GDPR). A compliance order has, by the same
decision, also sent to the defendant in application of Article 19 of the GDPR, either to
notify the erasure made to any recipient of the personal data of the
complainant. The follow-up given to this decision had to be notified, supporting documents
support to the Litigation Chamber within one month of notification of the decision.
8. In view of the failure to implement this decision 12/2020 within the time limit of one month, the
Litigation Chamber, as announced under the terms of the operative part of the said decision, decided to
deal with the case on the merits on the basis of Article 98 LCA. Decision on 80/2021 - 3/6
9. On May 25, 2020, the Litigation Chamber informed the parties and invited them to argue
their arguments according to an exchange of conclusions schedule. The Litigation Chamber notes
neither party has concluded.
II. Place
II.1. From the "light" procedure (article 95.1. LCA) to the substantive procedure (article 98 et seq. LCA)
1
10. As it explained in its note on "Policy of discontinuing action", the Chamber
Litigation recalls that if the facts illustrated in the complaint are sufficiently clear to establish
an infringement of the GDPR, the Litigation Chamber can take a decision without requesting the
arguments of the defendant against whom the complaint is lodged, in the context of
of a so-called "light" decision as provided for in Article 95 LCA. In this case, the LCA does not have
there is an obligation to seek the point of view of the processing manager / subcontractor in view
allow ODA to offer a faster response to the needs of citizens at the end of a procedure
simplified.
11. The Contentious Chamber then takes a so-called “light” decision (for example a warning or
an order to respond to the complainant's request to exercise his rights) on the basis of the facts as they
are reported to him, without first obtaining the point of view of the party implicated.
12. Decision 12/2020 adopted on April 14, 2020 by the Litigation Chamber was a decision of this
type (see point 7 above).
13. Render a decision without having heard the arguments of the party complained of (the party
defendant) does, however, run the risk of disregarding factual circumstances or
important legal issues (e.g. force majeure, technical reality) that could have led to the
Litigation Chamber to qualify its decision. In accordance with the principle of good administration,
it is important to hear the arguments of all parties before making a decision on it
that affects it. The decisions of an administrative authority such as the Litigation Chamber are
must be founded both in law and in fact, as well as to be impartial, i.e. in particular without
prejudice and without either party being favored because one of them
would not have been heard. Consequently, the Litigation Chamber renders its decisions "light" "prima
facie "i.e. on the basis of an" appearance of right ", without prejudice to the substance (see in this regard the
operative terms of decision 12/2020).
1
https://autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-contentieuse.pdf Decision on 80/2021 - 4/6
14. If the defendant decides to comply with the decision rendered, the dispute is thus closed and a
acceptable solution for both parties was obtained simpler and faster on foot
of the procedure provided for in Article 95 LCA.
15. If the data controller / processor fails to comply with the said decision (or by
case of dispute), a substantive procedure is launched.
16. In the present case, as mentioned in points 8 and 9 above, the defendant has not given
following the light 12/2020 decision and neither party has concluded following the invitation given to it
made in this sense.
II.2 As to the substance
17. In view of the foregoing, the Contentious Chamber considers that in this case, on the basis of
the elements at its disposal, in particular the documents filed by the complainant, it is based
to issue a reprimand to the defendant on the basis of Article 100.1., 5 ° LCA, together with a
order to follow up on the complainant's request to exercise his rights (article 100.1. 6 ° LCA)
and this, for the reasons and according to the methods below.
18. The GDPR does not define what is meant by "processing for prospecting purposes" or for
purposes of "direct marketing" according to the English terminology. In its Recommendation 01/2020 of
January 17, 2020 relating to the processing of personal data for marketing purposes
direct, APD indicates that it is better to understand "direct marketing" as "any communication,
solicited or unsolicited, aimed at promoting an organization or a person, services,
of products, whether paid or free, as well as brands or ideas, addressed by
an organization or a person acting in a commercial or non-commercial context,
directly to one or more natural persons in a private or professional context, by
any means, involving the processing of personal data "(page 8 of the
Recommendation - definition).
19. The processing of such an e-mail address for the complainant (person concerned within the meaning of article
4.1. (Second part) of the GDPR) is, with regard to this definition, a personal data
(Article 4.1. of the GDPR) processed for prospecting purposes (direct marketing) within the meaning of Article 21. 2 of
GDPR. In this case, the data subject is entitled to exercise his right to object by
application of Article 21.2 of the GDPR.
20. Accordingly, the controller is obligated to provide the complainant with information on
the measures taken at the end of the exercise of the right of opposition within the period of one month to count
of the receipt of the request as provided for in Article 12.3. of the GDPR. Pursuant to Article 21.3.
2 See. in this regard, Decision 64/2020 of the Contentious Chamber (point 23): https://autoriteprotectiondonnees.be/publications/decision-
as to the merits-n-64-2020.pdf Decision as to the 80/2021 - 5/6
of the GDPR, when the data subject objects to processing for prospecting purposes, the
personal data is no longer processed for these purposes.
21. As a result of the exercise of the right of opposition based on Article 21.2 of the GDPR by the person
concerned, the controller is also under the obligation, in application
of Article 17.1 c) of the GDPR, to erase the personal data of the data subject
as soon as possible, ideally within a month. Only if he treats these same
data for another purpose and in support of an own legal basis that the person responsible for
processing is authorized to keep this data.
22. Pursuant to Article 19 of the GDPR, the controller is also required to notify
any erasure of personal data carried out (in accordance with Article 17.1 c) of
RGPD - see. above) to each recipient to whom the personal data would have
been communicated.
23. In the present case, the complaint and the documents communicated in support thereof reveal that the Respondent
sends promotional emails to the complainant's email address and that processing
this address continued for the same prospecting purposes despite the latter's opposition. In
Indeed, the complainant exercised his right to object on several occasions, from July 2019, following the
procedure put in place by the defendant. The complainant indicates that he continues to receive
emails of the same type to which, following a new mailing of December 11, 2019, to
new opposite on December 12, 2019 and once again on January 31, 2020 as evidenced by
documents which he communicated to the Litigation Chamber.
24. Accordingly, the Litigation Chamber concludes that there have been breaches of Article 21.2 of the GDPR as well
than in Article 17.1 c) of the GDPR - provided that the complainant has not asserted any other basis of lawfulness to
the support for which the processing of the complainant's data could have continued for a purpose
separate from that of direct marketing - combined with Article 12.3. of the GDPR. In support of these
breaches, it sends the defendant, as already mentioned in point 17 above, a
reprimand accompanied by a compliance order as described in the device below.
III. Publication of the decision
25. In view of the importance of transparency with regard to the decision-making process and
decisions of the Litigation Chamber, this decision will be published on the Authority's website
data protection by deleting the direct identification data of
parties and named persons, whether natural or legal.
3
See. in this regard, Decision 62/2021 of the Contentious Chamber (points 14 et seq.):
https://autoriteprotectiondonnees.be/publications/avaution-62-2021.pdf Decision on 80/2021 - 6/6
FOR THESE REASONS,
the Contentious Chamber of the Data Protection Authority decides, after deliberation:
- To reprimand the defendant on the basis of Article 100.1., 5 ° LCA, in
application of articles 58.2.c) of the RGPD and 100.1 6 ° LCA, of the compliance orders below
after ;
- Orders the defendant to comply, within one month of the notification of the
this decision, at the request of the complainant to exercise the right of opposition (art. 21.2
of the GDPR) and therefore to cease any processing of the personal data of the
complainant for prospecting purposes (article 21.3 of the GDPR);
- Orders the defendant to proceed within one month of the notification of this
decision, to the erasure of the complainant's personal data (Article 17.1 c) of
GDPR), except to be able to rely on a separate basis of lawfulness authorizing the processing
data of the complainant for another purpose;
- Orders the defendant to comply, within one month from the date of
notification of this decision, its notification obligation as provided for in
Article 19 of the GDPR, or to notify the erasure made to any possible recipient
personal data of the complainant;
- To order the defendant to inform, with supporting evidence, the Authority
data protection (Litigation Chamber) of the continuation of this decision
and this at the latest in the month of its notification. This communication can be done by e-mail
addressed to the following address (contact address of the Litigation Chamber):
litigationchamber@apd-gba.be.
Under Article 108, § 1 of the LCA, this decision may be appealed against to the
Market Court within thirty days of its notification, with the Authority
data protection as a respondent.
(se.) Hielke Hijmans
President of the Litigation Chamber
Annex: Decision 12/2020 of the Contentious Chamber 1/6
Litigation Chamber
Decision 12/2020 of April 14, 2020
File No .: DOS-2020-00559
Subject: Complaint against a company for unsolicited and unsolicited promotional emails
respect for the right to object
The Contentious Chamber of the Data Protection Authority, made up of Mr. Hielke
Hijmans, chairman, serving as sole member;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the
protection of individuals with regard to the processing of personal data and the
free movement of such data, and repealing Directive 95/46 / EC (general regulation on the
data protection), hereinafter GDPR;
Having regard to the law of 3 December 2017 establishing the Data Protection Authority (hereinafter the law
LCA);
Having regard to the Rules of Procedure as approved by the Chamber of Representatives on
December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;
Having regard to the documents in the file;
Took the following decision regarding:
- the complainant: X (hereinafter the complainant)
- the data controller: Y (hereinafter the defendant) Decision 12/2020 - 2/6
1. Facts and procedural history
Under the terms of his complaint, the complainant indicates that on several occasions he reported to the respondent
that he did not wish to receive emails from him, emails addressed to him at his address
electronic […]. These emails relay promotions offered by the defendant in the context of
of its business activities.
It appears from the documents in the file that on December 11, 2019, an unsolicited promotional email was
sent to the complainant at his address […].
On December 12, 2019, the complainant sent the STOP message to the email address [...], following in this
the procedure mentioned by the defendant to unsubscribe from the "newsletter" received. This
the complainant's immediate reaction had been preceded on July 4, 2019 and November 5, 2019 by messages
Similar "STOP".
It also emerges from the documents in the file that on January 31, 2020, the complainant again objected
sending an unsolicited email from the defendant by sending the STOP message by
return mail to sender.
On February 28, 2020, the complainant filed a complaint with the Data Protection Authority (DPA).
On March 10, 2020, the complaint is declared admissible on the basis of articles 58 and 60 of the LCA law by
APD's Front Line Service (SPL). The complainant was informed of this in accordance with article
61 of the LCA law and the complaint was transmitted on the same date to the Litigation Chamber by virtue of
of article 62.1 LCA.
Pursuant to article 95.2 LCA, the Litigation Chamber hereby informs the parties
that following this complaint, a case is pending.
Pursuant to article 95.2, 3 ° LCA, a copy of the file may be requested by the parties. In
response, the documents in the file will be sent to them electronically via the address
1
litigationchamber@apd-gba.be.
1 In view of the current exceptional circumstances and the organizational measures taken to combat the
spread of the COVID-19 virus, the file cannot be removed on site. For the same reasons, a consultation of the file
and a copy of it on site is also not possible (article 95. 2, 3 ° LCA). All communications in
this file will also be done electronically for the same reasons. Decision 12/2020 - 3/6
2. Legal basis
✓ Articles 21.2 and 21.3 of the General Data Protection Regulation (GDPR) - Right
opposition
2. When personal data is processed for prospecting purposes, the person
concerned has the right to object at any time to the processing of personal data
concerning for such prospecting purposes, including profiling insofar as it is linked to a
such prospecting.
3. When the person objects to processing for prospecting purposes, the personal data
staff are no longer processed for these purposes.
✓ Article 17 of the General Data Protection Regulation (GDPR) - Right to
erasure ("right to be forgotten")
The data subject has the right to obtain from the controller the erasure, within
as soon as possible, of personal data concerning him and the controller has
the obligation to erase this personal data as soon as possible, when one of the reasons
the following applies:
(…)
c) the person objects to the processing pursuant to Article 21 (1) and there are no grounds
compelling legitimate grounds for the processing, or the data subject objects to the processing by virtue of
Article 21, paragraph 2.
✓ Article 19 of the General Data Protection Regulation (GDPR) - Obligation to
notification regarding the rectification or erasure of personal data
personal or restriction of processing
The controller notifies each recipient to whom the personal data
have been communicated any rectification or erasure of personal data or
any limitation of the processing carried out in accordance with Article 16, Article 17, paragraph 1, and
section 18, unless such communication proves impossible or requires effort
disproportionate. The controller provides the data subject with information about
these recipients if the latter so requests.
✓ Article 12.3 of the General Data Protection Regulation (GDPR) - Transparency
information and communications and modalities for the exercise of the rights of the
concerned person
The controller provides the data subject with information on the measures taken
following a request made in accordance with Articles 15 to 22, as soon as possible and in
any event within one month of receipt of the request. If necessary this Decision 12/2020 - 4/6
deadline may be extended by two months, taking into account the complexity and number of requests. the
controller informs the data subject of this extension and the reasons for
postponement within one month of receipt of the request. When the person
concerned submits their request in electronic form, the information is provided by
electronic where possible, unless the data subject so requests
other.
3. Motivation
The GDPR does not define what is meant by "processing for prospecting purposes" or for
purposes of "direct marketing" according to the English terminology. In its Recommendation 01/2020 of 17
January 2020 relating to the processing of personal data for direct marketing purposes,
PDA indicates that "direct marketing" should be understood as "any communication,
solicited or unsolicited, aimed at promoting an organization or a person, services,
products, whether paid or free, as well as brands or ideas, addressed by a
organization or person acting in a commercial or non-commercial context, directly to
one or more natural persons in a private or professional setting, by any means,
involving the processing of personal data ”(page 8 of the Recommendation -
definition).
The treatment of the complainant's e-mail address by the respondent is, with regard to this definition,
personal data (article 4.1. of the GDPR) processed for prospecting purposes (direct
marketing) within the meaning of Article 21.2 of the GDPR. The latter was therefore entitled to exercise his right
opposition pursuant to Article 21.2 of the GDPR.
It appears from the documents in the file that the defendant did not provide the complainant with information on
the measures taken following the exercise of his right of opposition within a period of one month from
of receipt of his request as provided for in Article 12.3. of the GDPR.
It also emerges from the documents in the file that the processing of the complainant's email address
continued beyond the expiration of this month, still for the same prospecting purposes. Indeed,
the complainant exercised his right on several occasions, from July 2019, following the procedure initiated
place by the defendant. He indicates that he continues to receive emails of the same type despite everything.
which he again opposed on December 12, 2019 and again on January 31, 2020 as
The documents in the file attest to this.
Therefore, the defendant did not comply with Article 21.3, taken in conjunction with Article 12.3. of the GDPR. Decision 12/2020 - 5/6
As a result of the exercise of its right of objection based on Article 21.2 of the GDPR, the defendant
was also under the obligation, pursuant to Article 17.1 c) of the GDPR, to erase the data to
personal character of the complainant as soon as possible and at the latest within the one month period referred to
in Article 12.3. of the GDPR. It appears from the documents in the file that this erasure did not take place.
Pursuant to Article 19 of the GDPR, the controller is also required to notify
each recipient to whom the personal data have been communicated any
erasure of personal data carried out in accordance with Article 17.1 c) of the GDPR.
Given the importance of transparency with regard to the decision-making process and
decisions of the Litigation Chamber, this decision will be published on the website of the APD
by deleting the direct identification data of the parties and persons mentioned,
whether they are physical or legal.
FOR THESE REASONS,
THE LITIGATION CHAMBER
Decide, after deliberation:
- Order the defendant, prior to any decision on the merits, to comply,
2 3
within one month of the notification of this decision, upon request
to exercise the rights of opposition and erasure of the complainant (art. 21.2 and 17.1 c) of
GDPR) and therefore to cease all processing of the complainant's personal data
for prospecting purposes (article 21.3 of the GDPR) as well as to erase
personal data concerning him (article 17.1 c) of the GDPR) and this, in application of article
58.2.c) of the GDPR and of article 95.1, 5 ° LCA;
- Order the defendant, prior to any decision on the merits, to comply,
within one month of the notification of this decision, at its 5th
notification obligation as provided for in Article 19 of the GDPR, or to notify
the erasure made to any recipient of the personal data of the
complainant;
2
This period of compliance is longer than that granted by the Litigation Chamber in the past in cases
comparable to take into account the current exceptional circumstances (Ministerial Decree of 23 March 2020 laying down
emergency measures to limit the spread of the COVID-19 coronavirus, M.B., March 23, 2020).
3
The sending of this decision by the registry of the Contentious Chamber constitutes notification.
4 Same as footnote 2.
5 Idem footnote 3. Decision 12/2020 - 6/6
- Order the defendant to inform the APD (Litigation Chamber) of the rest
6
reserved for this decision at the latest within one month of its notification. This
communication can be done by e-mail to the following address (contact address of the
Litigation Chamber): litigationchamber@apd-gba.be.
- To deal with the case on the merits in the event that the defendant abstains
to execute this decision within the time limit, in application of Articles 98 and
following of the LCA.
This decision can be appealed to the Markets Court within 30 days of
from its notification (article 108.11 of the law of 3 December 2017 establishing the Authority of
data protection) with the Data Protection Authority as the defendant.
(se.) Hielke Hijmans
President of the Litigation Chamber
6This period of notification to the Litigation Chamber of its compliance by the defendant is longer than that
the Litigation Chamber has granted in the past in comparable cases to take account of the circumstances
exceptional current events (Ministerial Decree of 23 March 2020 on emergency measures to limit the spread of
coronavirus COVID-19, M.B., March 23, 2020).
7
Pursuant to Article 100 of the LCA, the Litigation Chamber is notably authorized to impose a fine
administrative.
