APD/GBA (Belgium) - 151/2022
From GDPRhub
| APD/GBA - 151/2022 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Artikel 100, §1, 4, van de WOG |
| Type: | Other |
| Outcome: | n/a |
| Started: | 14.09.2022 |
| Decided: | |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 151/2022 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Dutch |
| Original Source: | GBA (in NL) |
| Initial Contributor: | n/a |
In this decision and 7 other decisions, the Belgian DPA agreed a settlement of €10,000 with a news organisation. The DPA based it settlement on observations made by it's investigation service regarding the use of cookies on the controller's website. The DPA stopped the procedure and did not determine any violations.
English Summary
Facts
This decision consists of two parts. The actual decision (pg 1-3) and the proposed settlement agreement from the DPA (pg 4-8), which was later accpepted by the controller. This decision was not based on a complaint.
A news organisation (controller) used cookies on its website. The inspection service of the DPA reported the following observations regarding these cookies: There was 'placement of non-essential cookies before consent was given', a 'lack of choice', 'further browsing', a 'disclaimer for third party cookies', 'lacking information' and the 'impossibility to withdraw consent'. Further context regarding these observations was not provided in this decision.
Holding
The Belgian DPA came to a settlement agreement with the controller pursuant of Article 100, §1, 4, WOG (Law establishing the data protection authority). According to the DPA itself, it proposed a settlement because of the large amount of cases that still needed to be decided. This settlement entailed the facts, the period and technical context as described in the investigation report, which was not disclosed. The DPA specified that facts which do not relate to this period or context did not fall under this settlement.
Terms of the settlement
The controller agreed to pay €10,000 and agreed to comply with the terms of the settlement. The DPA would not determine a violation and would formally close the procedure. The DPA only considered observations which were mentioned in the investigation report, without assessing the correctness of these observations. It based the settlement on the basis of the facts presented by the investigation service.
The controller accepted the settlement with no admission of guilt. This acceptance of the settlement proposal could also not be used as an aggravating circumstance in determining sanctions in any future proceedings at the DPA. On the other hand, the controller was not allowed to pursue any further (legal (civil)) action with regard to this settlement. As an example, the DPA stated that any ‘negative communication’ from the controller with regard to this settlement was not allowed. It is not clear what the DPA meant with 'negative communication'.
Should the controller not meet the requirements of the settlement agreement, the DPA still had the possibility to revoke the settlement and handle the case in another way.
The final decision regarding the settlement could be appealed by the 'damaged party' (Article 108 paragraph 1 WOG). This final settlement did also not affect the right of any individuals who have suffered harm, to claim damages before a civil court, in particular pursuant of Article 82 GDPR. (in this case, the decision was not based on a complaint)
Comment
This decision is part of the "Cookie on press websites" file of the Belgian DPA, which contained 10 cases. Two of these cases were already decided on the merits. In both cases, this resulted in fines of €50,000 for the respective controllers (see decisions 85/2022 and 103/2022).
The other 7 cases in this file (different controllers) have all resulted in settlements of €10,000 for placing cookies on websites. These cases are quite similar and in most paragraphs almost identically written. A notable exception are the observations regarding the cookies for each controller. These 'supossed violations' seem to vary slightly from case to case.
The 8 settlement cases (including this decision) will be outlined below:
- 150/2022: Controller: IPM Group NV, for the use of cookies on the websites of La DH en La Libre (150/2022 is the only decision where the settlement agreement was not attached to the decision).
- 151/2022: Controller: IPM Group NV, for the use of cookies on the website of L'Avenir (This decision).
- 153/2022: Controller: DPG Media NV, for the use of cookies on the websites of HLN, De Morgen, VTM en 7 sur 7.
- 154/2022: Controller: Mediahuis NV, for the use of cookies on the websites of Het Nieuwsblad, De Standaard, Gazet van Antwerpen en Het Belang van Limburg.
- 155/2022: Controller: VRT: or the use of cookies on the websites of VRT.
- 156/2022: Controller: Mediafin NV, for the use of cookies on the website of De Tijd.
- 157/2022: Controller: RTL Belgium NV, for the use of coockies on the RTL website.
- 168/2022: Controller: RTBF, for the use of cookies on the RTBF website.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/8
Litigation room
Decision on the substance 151/2022
of October 21, 2022
File number : DOS-2020-03297
Subject: use of cookies on the L'Avenir website
The Disputes Chamber of the Data Protection Authority, consisting of Mr. Hielke
Hijmans, chairman;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of
personal data and on the free movement of such data and revocation of
Directive 95/46/EC (General Data Protection Regulation), - hereinafter GDPR;
Having regard to the law of 3 December 2017 establishing the Data Protection Authority,
hereafter WOG;
Having regard to the rules of internal order, as approved by the Chamber of
Representatives on 20 December 2018 and published in the Belgian Official Gazette on 15
January 2019;
Having regard to the documents in the file;
In view of the settlement proposal submitted to the party on September 14, 2022, which if
appendix is attached to this decision and forms an integral part thereof;
Made the following decision regarding:
The party: IPM Group NV, [...], represented by master Frédéric DECHAMPS. Decision on the merits 1512022 - 2/8
I. Procedure prior to the basis of decision:
1. In the present case concerning IPM Group NV, on September 14, 2022 a
settlement proposal to this party. The full contents of the letter with this
settlement proposal is attached to this decision.
2. On September 26, 2022, the party submits a letter to the registry of the Disputes Chamber with
it contains a request for amendment of the proposed conditions in the settlement proposal.
3. On 5 October 2022, an answer will be given to this request to amend the
requirements. The request is rejected.
4. On October 10, 2022, the party will deliver a letter to the registry of the Disputes Chamber in which
it declares that it formally and expressly accepts the settlement proposal.
5. Given the express acceptance of the party, then on October 10, 2022, a
settlement reached. The present decision formalizes this settlement.
II. Terms of settlement
6. The terms of the settlement are identical to those in the letter containing the settlement proposal
of 14 September 2022. Therefore, the Annex forms an integral part of that proposal
from the present decision. The terms of this proposal are set out below in it
in brief.
7. The findings made by the Inspection Service of the Data Protection Authority
in the context of this case, and the possible infringements that may be related thereto
will no longer be dealt with by the Disputes Chamber. The
scope of this settlement is thus intrinsically limited to the elements of the case, such as
indicated in the settlement proposal, which contains the following sentence: "The settlement proposal
therefore concerns the facts, the period and the (technical) context, as described in the
inspection report; the facts that do not relate to this period and this context
are therefore not covered by this settlement. .." The party pays an amount of
10,000 euros to the Belgian treasury and meets the terms of the settlement.
III. Publication of the decision
8. Given the importance of transparency with regard to decision-making by the
Litigation Chamber, this decision will be published on the website of the
Data Protection Authority. Decision on the merits 1512022 - 3/8
FOR THESE REASONS,
the Disputes Chamber of the Data Protection Authority decides, after deliberation:
- Pursuant to Article 100, §1, 4, of the WOG, to declare the settlement valid as it is
accepted by the party on October 10, 2022, subject to the provisions of this decision and her
conditions included in the appendix.
An appeal can be lodged against this decision on the basis of Article 108, §1, of the WOG
at the Marktenhof (Brussels Court of Appeal), within a period of thirty days from the
notification thereof, with the Data Protection Authority as the defendant.
Such an appeal can be lodged by means of an interlocutory application dated
must contain the information referred to in Article 1034 ter of the Judicial Code . It 1
interlocutory petition must be submitted to the Registry of the Market Court
in accordance with article 1034 quinquies of the Ger.W. , or via the e-Deposit information system
of the Ministry of Justice (Article 32 ter of the Ger.W.).
(get.) Hielke H IJMANS
Chairman of the Litigation Chamber
1
The petition states, under penalty of nullity:
1° the day, month and year;
2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his
national register or company number;
3° the surname, first name, place of residence and, where appropriate, the capacity of the person to be
summoned;
4° the object and brief summary of the means of the claim;
5° the court before which the action is brought;
6° the signature of the applicant or his lawyer.
2
The application, with the attachment, will be sent in as many copies as there are parties, by registered letter to the Registrar
sent by the court or deposited with the clerk's office. Decision on the merits 1512022 - 4/8
Litigation Chamber REGISTERED
For the attention of IPM Group NV, [...]
With Mr. Frédéric DECHAMPS and Mr. Nathan as counselors
VANHELLEPUTTE, whose office is located in [...]
By email : […]
Defendant
Secretariat
T: +32 (0)2 274 48 56
Email: litigationchamber@apd-gba.be
Your reference Our reference Attachment(s) Date
/ DOS-2020-03297 14/09/2022
0
Subject: settlement proposal in the case "Use of cookies on the website of L'Avenir"
Dear Sir / Madam,
Given the large number of files waiting to be dealt with by the Litigation Chamber, with
long processing times for all files, the Disputes Chamber has, pursuant to
article 100, §1, 4° of the Law establishing the Data Protection Authority (“WOG”), 3
decided to propose a settlement in the above-mentioned case by means of this letter (
“settlement proposal”).
The settlement proposal fits in a context in which two of the ten files are related
with the present dossier (the ten so-called “cookies on press sites” dossiers).
led to a decision on the merits, in which the Disputes Chamber found infringements that
twice led to the imposition of an administrative fine of EUR 50,000. 4
3
BS, January 10, 2018.
4 See decision 85/2022 of 25 May 2022 of the Litigation Chamber, available at
https://www.dataprotectionauthority.be/publications/besluit-ten-gronde-nr.-85-202ziedf; Decision Substantive decision 1512022 - 5/8
This settlement proposal is made without any prejudicial recognition and binds the Litigation Chamber
not as to any position it might take if this proposal were to be made
turned down.
If the party to whom the settlement proposal is made expressly rejects this proposal,
the Disputes Chamber will continue the proceedings on the merits and will deal with the case in a different manner
deal with it through a settlement. If it determines that infringements have been committed, it will use
to make use of the sanctioning powers it has under European law and the 5
Belgian law have been granted .6
a) L'Avenir under the responsibility of Nethys, and then IPM Group
On December 21, 2020, the Disputes Chamber has an invitation to close in this case
sent to Nethys NV, of which Les Editions Vers l'Avenir Presse BV a
subsidiary when the inspection report was added to the administrative one
file of the Litigation Chamber (attached for information).
In response to this letter, IPM NV informed us of the
fact that Les Editions Vers l'Avenir BV had been taken over by IPM Group since October 14, 2020.
IPM NV has conclusions for its subsidiary Les Editions de l'Avenir presse BV
submitted. For that reason, the Disputes Chamber addresses this proposal directly to IPM NV.
b) Procedural status of the settlement proposal
The settlement proposal submitted here precedes the deliberation phase on the
infringements that may have been committed in this case. In that sense, the Dispute Chamber holds in her
settlement proposal only takes into account the findings stated in the
Inspection report from the Data Protection Authority, without the accuracy of this one
findings yet to be investigated.
Since the procedure before the Disputes Chamber of the Data Protection Authority is not
can be equated with the procedure of criminal law, "the settlement" in which is
provided for by the Belgian legislator under Article 100, §1, 4°, of the WOG
103/2022 of June 16, 2022, only available in French at:
https://www.dataprotectionauthority.be/publications/besluit-ten-gronde-nr.-103-2022.pdf.
5See Article 58 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and freedom
movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
6See also article 100 of the WOG. Decision on the merits 1512022 - 6/8
7
equated with the “amicable settlement” of criminal law. The settlement within the meaning of the WOG
has a sui generis character.
In the first place, the Litigation Chamber hic et nunc does not rule on the existence of
possible infringements, even if the procedure is in the “substance” phase of the treatment
in accordance with articles 98 and 99 of the WOG. The Litigation Chamber uses the hair
expressly granted authority to formulate a settlement proposal, as well
is possible in a case of a "settlement" in criminal matters.
The Disputes Chamber also states the precise facts, in time and space, on the basis of which it
settlement proposal is made (infra). Although the Litigation Chamber is, as stated above,
does not pronounce hic et nunc on the existence of infringements, it must submit the settlement proposal
nevertheless formulate it on the basis of the facts stated in the file. The amount that the
After all, the Litigation Chamber proposes to pay the party must be in proportion to the nature of the dispute
the possible infringements. The settlement proposal therefore concerns the facts, the period and (technical)
context, as described in the inspection report; the facts that do not relate to this
period and this context are therefore not covered by this settlement. 8
c) Findings by the Inspectorate that relate to the settlement proposal
In this case, the inspections were carried out by the Inspection Service of the Data Protection Authority
findings that the Disputes Chamber takes into account - without, however, substantively
pronounce the case - the following: 9
- "Statement 1: installation of non-strictly necessary cookies before consent was given
obtained" 10
11
- "Finding 2: Lack of choice"
12
- "Assessment 3: use of further browsing"
13
- "Finding 4: disclaimer for third party cookies"
- "Finding 5: Inadequate information 14
7See in particular articles 216 bis and 216 ter of the Code of Criminal Procedure (“CPC”) regarding the expiry of the
criminal proceedings for some crimes under certain conditions (respectively the payment of a sum of money, and the
implementation of measures and compliance with conditions).
8In this sense, the ne bis in idem principle does not apply to facts falling outside its scope.
9 The Litigation Chamber takes full account of the additional investigation report of the Inspectorate of 30
November 2020 in DOS-2020-03297.
10
Report of the Inspectorate of the Data Protection Authority of 7 October 2020 in file DOS-2020-03297
(“Inspection Report”), pp. 13-4.
11Inspection Report, pp. 14-5.
12Inspection Report, pp. 15-6.
13
Inspection report, pp. 16-7.
14Inspection report, pp. 17-8. Decision on the merits 1512022 - 7/8
15
- « Finding 6: impossibility to withdraw consent"
d) Substantive conditions
In the context of the settlement proposal, the following terms and conditions are accepted by the party in the
procedure accepted:
- IPM Group undertakes to pay an amount of EUR 10,000 to the
Belgian treasury, in accordance with the terms determined by the Federal
16
Government Finance Department. IPM Group waives any civil or other action in connection therewith
related to the Settlement, such as, but not limited to, negative communications
with this settlement;
- The Litigation Chamber finds no infringement by IPM Group and formally closes the procedure
with its settlement decision, to the extent that IPM Group accepts the settlement and the
comply with its terms;
- For the Disputes Chamber, the fact that the settlement proposal is accepted does not matter
confession of the defendant. This acceptance of the settlement proposal can be done with
not be used as an aggravating circumstance when determining sanctions
17
in any future proceedings before the Dispute Chamber;
- In case of express acceptance or in the absence of a response from the party to whom
the settlement proposal is addressed within the period specified below, takes this
settlement proposal takes the form of a formal decision published on the website of the
Data Protection Authority is published, stating the name of
the party.
In the event of non-compliance with the terms of the accepted settlement, the
Litigation Chamber reserves the right to withdraw the settlement decision and this case on a
treat in another way.
e) Term
IPM Group must within 30 days of receipt of the present settlement proposal
indicate whether or not it will accept this proposal. In the absence of an answer it will
settlement proposal shall be deemed accepted subject to the above conditions.
f) The existence of other controllers and/or processors
15Inspection Report, page 18.
16Cfr. art. 107 WOG.
17See in particular Article 83(2)(e) of the GDPR in the context of imposing administrative fines when
identify breaches following “previous relevant breaches by the controller or the
processor”. Decision on the substance 1512022 - 8/8
This settlement proposal is only addressed to IPM Group. It takes no position on the question
whether and to what extent other actors are responsible for possible violations that give rise
have given to this settlement proposal.
g) Settlement Validation
In the event that the settlement proposal results in a formal settlement decision by the
express acceptance or the lack of response within the aforementioned period of the
party to whom the settlement proposal is addressed may be appealed by the "aggrieved party".
18
registered.
The final settlement does not affect the rights of any individuals (in this case, the
case not based on a complaint) who have suffered damage, to a civil court
claim damages, in particular pursuant to Article 82 of the GDPR.
Yours faithfully,
(get). Hilke Hijmans
Chairman of the Litigation Chamber
18An appeal against this decision can be lodged with the Marktenhof (Court of Appeal of
of appeal of Brussels), within a period of thirty days from the express acceptance or the lack of response
within the aforementioned period, with the Data Protection Authority as the defendant.
Such an appeal may be lodged by means of an interlocutory application that contains the
Judicial Code must contain said information. The interlocutory petition must be submitted to the Registry of the Market Court
be submitted in accordance with article 1034 quinquies of the Ger.W., or via the e-Deposit information system of the
Ministry of Justice (Article 32 ter of the Ger.W.).
