APD/GBA (Belgium) - 32/2022
APD/GBA (Belgium) - 32/2022 | |
---|---|
Authority: | APD/GBA (Belgium) |
Jurisdiction: | Belgium |
Relevant Law: | Article 5(1)(c) GDPR Article 5(1)(e) GDPR Article 6(1)(f) GDPR Article 14 GDPR Article 15 GDPR Article 21 GDPR |
Type: | Complaint |
Outcome: | Partly Upheld |
Started: | |
Decided: | 10.03.2022 |
Published: | 10.03.2022 |
Fine: | None |
Parties: | n/a |
National Case Number/Name: | 32/2022 |
European Case Law Identifier: | n/a |
Appeal: | Unknown |
Original Language(s): | Dutch |
Original Source: | Belgian DPA (in NL) |
Initial Contributor: | kc |
The Belgian DPA held that while direct marketing via email may not require the data subjects consent, it is still necessary to inform the data subject pursuant to Article 14 GDPR at the latest at the time of initial contact.
English Summary
Facts
In April 2020, the data subject requested not to receive any more direct marketing messages from the controller.
In May 2020, the data subject requested from the controller information on any processing of personal data concerning him pursuant to Article 15(1) GDPR after receiving further direct marketing messages via his email and on his mobile phone despite his previous request. Specifically, he asked about the origin of the acquisition of his personal data that allowed the controller to contact him and about the legal basis for the processing to which he claimed that he had not given consent.
The controller responded to the request by stating that it had obtained the data from a contact provider but limited itself to providing only the name of the company. Furthermore, it acknowledged that the data subject had received further messages due to human error.
In September 2020, the data subject filed a complaint with the Belgian DPA (APD/GBA). He complained both about the direct marketing messages which he claimed required consent (Article 6(1)(a) GDPR) and about the reaction to his access request which according to him had violated Articles 15(1), 5(1)(c) and (e) and 14(2)(e) GDPR.
Holding
The DPA partly upheld the complaint. It ordered the controller to comply with the data subject's right to access pursuant to Article 15(1)(g) GDPR. Furthermore, it formulated a warning with regard to the data controller's mentioning of the right to object to the processing in the message with which it first comes into contact with the data subject, so that the data processing in this respect will respect the transparency requirement set out in Articles 5(1)(a), 12, 14 and 21(4) GDPR in the future.
1. Direct marketing Regarding the direct marketing messages by the controller, the DPA dismissed the complaint. It held that the controller did not require the data subject's consent because it had sufficient legitimate interest in accordance with Article 6(1)(f) GDPR. According to the DPA, this was supported by Recital 47 GDPR which specifically states that direct marketing may be carried out with legitimate interest. Since the data subject's email address was publically available online, the DPA held that he had to have the reasonable expectation that that email address would be used to send him messages and that the controller had thus made use of publicly available information.
In addition, regarding his mobile phone number, the DPA obliged the controller to provide information on the source that formed the basis of the processing since it was unclear how the number was obtained by the controller and thus, it was not possible to assess whether that information had been obtained lawfully.
2. Information obligation Regarding the data subject's access request, the DPA held that the controller had not complied with its duty to provide access to the data subject because it had not given the data subject "all available information", Article 15(1)(g) GDPR.
Furthermore, the controller had violated Article 21(4) GDPR by not providing the information listed in Article 14 GDPR in its first communication with the data subject. According to the DPA, at the very least, the first message should have contained a link to the privacy policy in which this information is contained in an accessible, concise and clear manner. The fact that the first notice to the complainant did not contain the slightest reference to the information necessary to ensure transparent data processing constitutes an infringement of Articles 5(1)(a), 12(1) and 14 GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/10 Dispute room Decision 32/2022 of 10 March 2022 File number : DOS-2020-04479 Subject : Exercising the right of objection and right of access pursuant to unsolicited advertising messages The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke Hijmans, single chairperson; Having regard to Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter GDPR; Having regard to the law of 3 December 2017 establishing the Data Protection Authority, hereinafter WOG; Having regard to the internal rules of procedure, as approved by the Chamber of Representatives on December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019; Having regard to the documents in the file; has taken the following decision regarding: † The complainant: Mr X, hereinafter referred to as “the complainant”; † † The controller: Y, hereinafter referred to as “the controller”, Decision on the merits 32/2022 - 2/10 I. Facts procedure 1. On 8 September 2020, the complainant lodged a complaint with the Data Protection Authority against the controller. 2. The subject of the complaint concerns the exercise by the complainant of his right to object to following the receipt of unwanted advertising sent to him by the controller at the complainant's e-mail address, as well as by contacting his cell phone. The complainant also invokes his right of access, in particular he asks about the origin of the acquisition of his personal data, which means that the controller in was able to contact him by e-mail and by mobile phone, as well as to the legal basis for the processing of are personal data for which the complainant states that he has not given his consent. When the complainant requests more complete information on 4 May 2020 to which he is entitled to pursuant to Article 15.1 of the GDPR – so not only limited to his initial request to provide him with the source and the legal basis for its data processing – this will be accepted by the controller who will provide him with all the information requested on May 28, 2020. from this does the complainant infer that the principle of transparency (Article 5.1 of the GDPR), the principle of minimum data processing (Article 5.1 c) GDPR) and the storage limitation (Article 5.1 e) GDPR) respected. Also, the controller's reply would not have referred to under the competence of the Belgian Data Protection Authority (Article 14.2 e) GDPR) and the complainant has not received the information to which he is entitled under Article 14 GDPR. 3. On March 23, 2021, the complaint will be declared admissible by the Frontline Service on the basis of the Articles 58 and 60 WOG and the complaint on the basis of art. 62, §1 WOG transferred to the Dispute room. II. Justification Legal basis for sending advertising messages – Exercise of the right to object 4. As to the complainant's allegation that the use of personal identification data, in this case his name, e-mail address and mobile phone number, for direct marketing purposes the consent would be required, the Disputes Chamber points out that the consent, but the legitimate interest of the controller as 1 legal basis to process the complainant's identification data for direct marketing 1 1. Processing is only lawful if and insofar as at least one of the following conditions is met: a) the data subject has consented to the processing of his/her personal data for one or more specific purposes; […], Decision on the substance 32/2022 - 3/10 purposes. Recital 47 GDPR expressly states that the processing of personal data for the purpose of direct marketing can be considered as performed with with a view to a legitimate interest (Article 6.1 f) GDPR). So this means that the controller not prior to processing for direct marketing consent from the data subject (Article 6.1 a) GDPR). The controller rightly invokes the legal basis set out in Article 6.1 f) GDPR to process information that is accessible to the public for direct marketing purposes. 5. The factual elements present in the file show that the unwanted message to which the complaint relates was sent by the controller to the 2 e-mail address (…), which was made available online and is therefore accessible to everyone. It making your own contact details available online, such as the e-mail address in this case of the complainant, necessarily implies that it is for the purpose of the person providing the contact details online, to be able to get in touch with the person to whom the contact details relate. Because the complainant makes his contact details publicly available through the publishing it online, it is within his reasonable expectations that his e-mail address may be used to send him messages. The controller has thus of this publicly available data. 6. The complainant does not deny that the email address used by the controller, and thus ipso facto also his name, is accessible to the public. The complainant, on the other hand, believes that specific to his cell phone number, to state that it is not publicly available data, but a private data that cannot be disclosed on the basis of the legitimate interest are processed. The Disputes Chamber notes that the complainant cannot simply claim that his cell phone number is private due to lack of knowledge in his mind about the source that was at the base of the processing of this data and through which the company to which the has appealed to the controller, has come into possession of the mobile phone number of the complainant and subsequently provided it to the controller. On the basis of the factual elements of the file, the Disputes Chamber must determine that it is unclear is how the complainant's mobile number was obtained, which means that it is therefore not it is possible to assess whether this information was obtained lawfully. To that end should provide the controller with information on the source that caused it of the processing of the GSM number (see below, edge nos. 13 et seq.) 7. Against the right of the controller to process personal data pursuant to has a legitimate interest to process for direct marketing purposes, it does state that the f) the processing is necessary for the purposes of pursuing the legitimate interests of the controller or of a third party, except where the interests or fundamental rights and freedoms of the data subject are necessary for the protection of personal data override those interests, in particular where the data subject is a child. 2 See eg (…); (…), Decision on the merits 32/2022 - 4/10 controller must comply with the objection raised by the data subject can be made against the processing of personal data concerning him at any time, without the data subject being required to provide any justification (Article 21.2 GDPR and Article 21.3 GDPR) . The controller has within one month (Article 12.3 GDPR) after receipt of the complainant's request on April 17, 2020 not to send direct marketing messages more, followed by confirmation of the removal of the personal data of the complainant from his file on April 21, 2020. It is true that in the response of April 21, 2020 incorrectly stated that the complainant was registered to be re-registered contacted by the controller. This shortcoming was rectified by the controller on May 28, 2020 in which it admitted that this was based on a human error and the correct representation had to be that the complainant was registered for not to be contacted again by the controller. 8. On the basis of the elements in the file known to the Disputes Chamber, and on the basis of the powers assigned to it by the legislator on the basis of Article 95, §1 WOG, decides the Disputes Chamber about the further follow-up of the file; in this case, the Disputes Chamber to dismiss the complaint as to the legal basis, in accordance with Article 95, §1, 3° WOG, based on the motivation below. 9. In the event of a dismissal, the Disputes Chamber must gradually investigate and motivate: - whether there is insufficient prospect of a conviction, after which a technical dismissal follows; - whether a successful conviction would be technically feasible but on grounds, in general 4 interest, a (further) prosecution is undesirable, followed by a policy dismissal. 10. In the event that more than one ground is being discarded, the discarded grounds (or technically dismissal and policy dismissal) should be treated in order of importance. 11. In the present case, the Disputes Chamber will proceed to a technical dismissal on a single ground, namely because the Disputes Chamber decides that the controller does not has committed an infringement of Article 6.1 of the GDPR. In addition, the controller within the legal period of one month has appropriately followed the request of the complainant causing his e-mail address, including his name, as well as his mobile phone number to no longer be used for direct marketing purposes, so that no infringement of article 12.3 . was also committed GDPR and Articles 21.2 and 21.3 GDPR. 3See in that regard also recital 70 of the GDPR: When personal data is processed for the purpose of direct marketing, the data subject, whether it concerns initial or further processing, have the right at any time and free of charge object to this processing, including in the case of profiling insofar as it relates to direct marketing. Which right must be brought to the attention of the data subject expressly, in a clear manner and separately from other information. 4 Cfr. Judgment Court of Appeal Brussels (Marktenhof), 2 September 2020, no. 2020/5460, 18., Judgment on the merits 32/2022 - 5/10 Exercise of the right of access 12. The Disputes Chamber determines on the basis of the documents that substantiate the complaint that the complainant is entitled to exercised the right of inspection, which was initially aimed at becoming acquainted with this information was obtained. Later, the complainant's request was extended to the full information. 13. The controller has complied with the complainant's first request by to state that he obtained it from a contact provider, but has limited himself to it only provide the name of the company. Article 15.1 g) GDPR nevertheless prescribes that the controller to the data subject “all available information” about the source of must provide the data, if the personal data have not been obtained from the data subject collected. 14. The accountability obligation (Article 5.2 GDPR) of the controller entails note that basic information is provided to the person concerned, ie the complainant, showing that the controller himself processes the data in accordance with the GDPR and prior to the purchase of an address file checks whether that data is lawfully processed by the company that trades in personal data. Thus, the complainant can expect that the data controller provides information about how the company is held obtained from the complainant's contact details, as well as the legal basis on which that personal data is processed by that company in order to demonstrate that the contact details from the complainant were lawfully purchased and processed by the controller. In order to guarantee the rights of the complainant, the controller should also provide the company's contact details. This enables the complainant to to exercise its right of inspection with regard to that company. 15. It is therefore not sufficient for the controller to provide only the name of the company to the complainant without any further specification. As a result, the controller acted in violation of Article 15.1 g) GDPR. 16. The Disputes Chamber is of the opinion that on the basis of the above analysis, concluded that a breach of the provisions of the GDPR was committed, which justifies the taking of a decision on the basis of Article 95, §1, 5° WOG, more specifically to inform the controller Orders to comply with the complainant's exercise of his right of access (Article 5 See the answer provided by the controller on April 21, 2020, to the question d.d. 17 by the complainant. April 2020. 6See the answer provided by the controller on May 28, 2020, to the question asked by the complainant dated 4 May 2020, Decision on the merits 32/2022 - 6/10 15.1 g) GDPR) and this in particular in view of the documents submitted by the complainant showing that the complainant has indeed exercised his right of access, but the controller has not adequately followed this up. 17. When the complainant in a second application requests more complete information under Article 15.1 GDPR - so not only limited to the legal basis stated in point g) -, this is discussed by the controller who provides him with the requested information. This brings the then submit to the complainant that there would be no transparent data processing because the response to the request for access is given in English, while the marketing messages were drawn up in Dutch. The Disputes Chamber notes that the principle of transparency does not contain a language requirement. Transparent information and communication is necessary. Since the complainant was approached by the defendant from his position within his business and English is a common language used in business, are expected that the information given in English was completely transparent. 18. According to the complainant, the retention period was also not clearly defined and it would be an infinite storage period. First of all, the Disputes Chamber notes that the controller indicates to keep the personal data for as long as necessary to to provide the services it provides. To the extent that the relevant personal data is processed for direct marketing purposes, it is sufficient that the controller offers the right of objection to the data subject, which immediately ends if it is exercised applies to the processing of the personal data of the data subject. In that sense, the data processing is not infinite. This is also apparent from the facts, i.e. as soon as the complainant has exercised his right to objected, the processing of his personal data was terminated (Article 21.3 GDPR) and no infringement of Article 5.1 e) GDPR can be established, provided that the controller informs the data subject in a timely and adequate manner about his or her right to objection (see margin no. 21 below). 19. The complainant also cites that the controller is not the competent data protection authority and refers to the German Data protection authority instead of the Belgian authority. The Disputes Chamber points points out that the controller states that the complainant cannot only lodge a complaint with the German Data Protection Authority, but also at the Data Protection Authority 7 where he resides. This is in accordance with Article 77.1 GDPR. Because the complainant in Belgium resides, the controller has complied with the obligation to state that the complainant has the right to lodge a complaint with a supervisory authority, in this case the 7Article 77.1. GDPR. Without prejudice to other possibilities of administrative appeal or a judicial remedy, every person concerned has the right to lodge a complaint with a supervisory authority, in particular in the Member State where he usually resides, his place of work has or where the alleged infringement was committed, if he believes that the processing of his personal data infringement makes on this regulation., Decision on the substance 32/2022 - 7/10 Belgian Data Protection Authority (Article 15.1 f) GDPR). For the sake of completeness, the The dispute chamber still allows the Belgian Data Protection Authority to exercises jurisdiction under Article 55 of the GDPR because the defendant has has its registered office in Belgium and there is no reason to assume that there is a cross-border situation as referred to in Article 56 GDPR. Information obligation 20. The complainant alleges that the obligation to provide information as set out in Article 14 GDPR was breached by the controller. 21. With regard to information on the right to object (Article 14.2 b) GDPR) in particular Article 21.4 of the AVG 8 expressly states that this option, separately from the other information, already in the first message to the person concerned, being in this case the complainant, must be included. However, the message that is the subject of the complaint does not in any way make it the right of objection is clearly communicated to the complainant. What's more, it doesn't contain any reference to this right of objection. Recital 70 GDPR provides, however, that this right expressly, on clear manner and separate from other information, must be brought to the attention of the data subject are being brought . In the absence of notification of this right of objection to the complainant on the the moment he was first contacted, the controller has acted in violation of Article 21.4 of the GDPR. 22. With regard to the other information (Article 14.1 and 14.2 GDPR) that the controller, this provision (Article 14.3 GDPR) requires that this this also takes place at the latest at the time of the first contact with the data subject. The first Prosecutor's notice does not contain any information as such. At least had the first message contain a link to the privacy policy in which, in an accessible manner and in a concise and clear way this information is included. Because the first message to the complainant does not contain the slightest reference to the necessary information to ensure a transparent data processing, there is an infringement of Articles 5.1 a), 12.1 and 14 GDPR. Decision 23. The present decision is with regard to the exercise of the right of access and information obligation a prima facie decision taken by the Disputes Chamber in accordance with Article 95 WOG on the basis of the complaint submitted by the complainant, in the context of the 'procedure' 8 Article 21.4 GDPR. The right referred to in paragraphs 1 and 2 shall be expressly granted at the latest at the time of the first contact with the data subject brought to the attention of the data subject and presented clearly and separately from any other information. 9See footnote 2., Decision on the substance 32/2022 - 8/10 prior to the decision on the merits' and no decision on the merits of the Disputes Chamber within the meaning of Article 100 WOG. 24. The purpose of this decision is to inform the controller of the fact that it may have infringed the provisions of the GDPR and that it is in the opportunity to still conform with the aforementioned provisions. 25. However, if the controller does not agree with the content of this prima facie decision and considers that it may allow factual and/or legal arguments money that could lead to a different decision, can be sent to the email address litigationchamber@apd-gba.be submit a request for treatment on the merits of the case to the Disputes Chamber and this within the period of 14 days after notification of this decision. The enforcement of this decision will, if necessary, be during the aforementioned period suspended. 26. In the event of a continuation of the handling of the case on the merits, the Disputes Chamber will the parties on the basis of Articles 98, 2° and 3° in conjunction with Article 99 WOG invite their to submit defenses and to attach to the file any documents they deem useful. The If necessary, this decision will be definitively suspended. 27. For the sake of completeness, the Disputes Chamber points out that a hearing on the merits of the case may lead to the imposition of the measures stated in Article 100 WOG. 28. Finally, the Disputes Chamber points out the following: 29. If one of the parties wishes to make use of the possibility to consult and copying the file (art. 95, §2, 3° WOG), this should contact the secretariat of the Disputes Chamber, preferably via litigationchamber@apd-gba.be, in order to make an appointment to capture. 30. If a copy of the file is requested, the documents will be sent electronically if possible or else delivered by regular mail. III. Publication of the decision 31. Given the importance of transparency in the decision-making of the Litigation Chamber, this decision will be published on the website of the Data Protection Authority. It is not necessary, however, that the identification data of the parties be published directly., Decision on the merits 32/2022 - 9/10 FOR THESE REASONS, the Disputes Chamber of the Data Protection Authority decides, after deliberation, to: - the complaint to the extent that it relates to the legal basis for the shipment of advertising messages, pursuant to Article 95, §1, 3° WOG, to be dismissed in view of the fact that no breach of the GDPR can be established in this regard. - the complaint to the extent to which it relates to the exercise of the right of inspection pursuant to Article 58.2. c) GDPR and Article 95, §1, 5° WOG de order the controller to comply with the complainant's request to exercise its rights, in particular the right of access under Article 15.1 g) GDPR); to order the controller to the Data Protection Authority (Dispute Chamber) by e-mail within the period of 14 days after the notification of this decision of the outcome of this decision via the email address litigationchamber@apd-gba.be; and in the absence of the timely implementation of the above by the controller, to handle the case on the merits ex officio in accordance with Articles 98 et seq. WOG. - to formulate a warning with regard to the controller for with regard to the mention of the right of objection in the message with which he first contacts the data subject, so that the data processing at this point in the future the transparency requirement as stated in Articles 5.1 a), 12, 14 and 21.4 GDPR respects; to request the controller from the Data Protection Authority (Dispute Chamber) by e-mail within the period of 14 days after the notification of this decision of the outcome of this decision in order to To inform the dispute chamber about the adjustment of the procedure (see margin no. 21) via the e-mail email address litigationchamber@apd-gba.be; and In the absence of the timely implementation of the above by the controller, to handle the case on the merits ex officio in accordance with Articles 98 et seq. WOG. Against this decision, pursuant to art. 108, §1 WOG, appeals must be lodged within a period of thirty days, from the notification, to the Marktenhof, with the Data Protection Authority as Defendant., Decision on the merits 32/2022 - 10/10 (Get). Hielke Hijmans Chairman of the Disputes Chamber