APD/GBA (Belgium) - 170/2022
From GDPRhub
| APD/GBA - 170/2022 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 5(1)(b) GDPR Article 5(1)(c) GDPR Article 5(1)(a) GDPR Article 6(1) GDPR Article 12(1) GDPR Article 12(2) GDPR Article 13 GDPR Article 14 GDPR Article 21 GDPR Article 25 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 15.10.2018 |
| Decided: | |
| Published: | 22.11.2022 |
| Fine: | n/a |
| Parties: | Mister X (the data subject) La Radio Télévision Belge de la Communauté française (RTBF) (the controller) |
| National Case Number/Name: | 170/2022 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | French |
| Original Source: | Autorité de Protection des Données (ADP) (in FR) |
| Initial Contributor: | n/a |
The Belgian DPA closed the procedure because of a prior settlement decision between the DPA and a press organisation regarding the use of cookies
English Summary
Facts
The controller was a press organisation/public service broadcaster. The data subject filed a complaint with the Belgian DPA on 18 June 2018 because the controller’s live service for web streaming was only accessible on Belgian territory, and only for data subjects who would provide their personal data (such as email address, Facebook - or Google accounts). The data subject also complained that it was not possible to connect to the live service if he disabled cookies and trackers of third-party companies on the controller’s website.
The investigation service of the DPA (the investigation service) started an investigation into the controller. In its report, the investigation service reported the following findings:
Finding 1: The investigation service determined that the processing of registration data was based on legitimate interest, while the processing of data related to personalisation (profiling) was based on legitimate interest and/or consent. However, the investigation service considered that because the controller was likely an ‘autonomous public undertaking’ (Article 5 LTD (Data protection act)), legitimate interest could not be used as a legal basis. According to the investigation service, legitimate interest of the controller could not be used for processing carried out by public authorities in the performance of their tasks (Article 6(1) GDPR). Moreover, legitimate interest as a legal basis requires a balancing of the interests involved and the controller did not prove that such a balancing exercise was conducted. Finally, the DPA held that the controller could not switch from consent to legitimate interest as a legal basis for the processing of data for personalisation purposes.
Finding 2, 3 and 4: Regarding the processing for advertising profiling and the possibility of objecting, the controller's management contract allowed the controller to use 'content recommendation algorithms. However, the definition of ‘content recommendation algorithms' did not include advertising, according to the investigation service. Because of this lacking definition, the investigation service questioned compliance with Article 5(1)(b) GDPR). Additionally, the provisions of Articles 12(2), 21 and 25 GDPR did not appear to be satisfied because the data subject could not refuse advertising profiling at the time of registration. The controller also did not appear to allow easy opposition to this profiling after registration. Finally, the controller was supposed to update the purposes on the registration form to add the purpose of advertising profiling. However, the controller did not modify the registration form as of 9 January 2020, which resulted in a breach of Articles 12(1), 13 and 14 GDPR).
Finding 5 and 6: The investigation service also held that there was a difference between the mechanism of connection to the live service and registration to the platform of the controller using social networks (Facebook and Google). This difference lacked clarity and explanation, which was incompatible with Articles 12(1), 13 and 14 GDPR, according to the investigation service. Moreover, the mechanism used (under the guise of logging in using a Facebook account) was in fact the creation of a user account at the controller, using the data subject’s Facebook data. The data subject was not informed about the workings of this mechanism, which breached articles 5(1)(a), 5(1)(b) and 5(1)(c) GDPR as well as Articles 12(1), 13 and 14 GDPR.
However, in decision 168/2022, the Belgian DPA had agreed to a settlement with the same controller, regarding the use of cookies on it’s website, pursuant of Article 100(1)(4) WOG (Law establishing the DPA). This settlement extended to potential infringements of the law of 13 June 2005 (WEC – Wet Elektronische Communicatie) as well as potential infringements of the GDPR with regards to cookies, in the period from 25 May 2018 to 11 November 2020.
Holding
Despite the findings by the investigation service, the DPA closed the proceedings regarding some findings, while for other findings the DPA stated that it would continue to investigate.
For findings 1 (concerning advertising profiling only) and findings 2, 3 and 4, the DPA closed the proceedings because it had reached a settlement with the same controller regarding the use of cookies. According to the DPA, the subject matter of the current complaint with regard to cookies was also covered by the settlement. Because of this settlement, the DPA stated that it would not take action regarding findings 1 (concerning advertising profiling only) and findings 2, 3 and 4. The DPA closed the proceedings with regard to these findings pursuant of Article 100(1)(1) WOG. For findings 1 (with regards to the processing of registration data), 5 and 6, the DPA stated that it would continue to examine the substance of the complaint.
Comment
This decision is a consequence of a settlement decided in decision 168/2022 by the Belgian DPA. Decision 168/2022 is one of the 10 cases opened by the Belgian DPA on "Cookie on press websites". For a summary of one of these settlement decisions and some context for all of these decisions, click this link.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/9
Litigation Chamber
Decision on the merits 170/2022 of 22 November 2022
File number: DOS-2018-04762
Subject: Complaint relating to the use of the "Auvio" service of RTBF
The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke
Hijmans, chairman, and Messrs. Dirk Van Der Kelen and Christophe Boeraeve, members;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and
to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the
data protection), hereinafter "GDPR";
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter
ACL);
Having regard to the Law of 30 July 2018 relating to the protection of natural persons with regard to
processing of personal data (hereinafter the LTD);
Having regard to the internal regulations as approved by the House of Representatives on 20
December 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Having regard to decision 168/2022 of November 22, 2022 of the Litigation Chamber;
Made the following decision regarding:
The plaintiff: Mr. X, hereinafter “the plaintiff”;
The defendant: The Belgian Radio Television of the French Community (RTBF), a company
autonomous public of a cultural nature,
Hereinafter “the RTBF” or “the defendant”;
Counsel for Maître Peter Craddock and Maître Eline Van Bogget, Decision on the merits 170/2022 - 2/9
I. Facts and procedure
1. On June 18, 2018, the complainant lodged a complaint with the Data Protection Authority
data (APD) against the defendant.
2. Under the terms of the complaint, the complainant denounces the fact that the RTBF live service (web
streaming – Auvio) is accessible on Belgian territory only if visitors
provide their personal data (e-mail address/login via their Facebook accounts
or Google). He also points out that the process of connecting to the live service does not
does not work if the user deactivates cookies and trackers from third-party companies
used by the RTBF website.
3. On October 15, 2018, the complaint was declared admissible on the basis of Articles 58 and 60 of the
LCA and the complaint is forwarded to the Litigation Chamber under Article 62, § 1 of the
ACL. The complainant is informed of this on the same date.
4. On October 23, 2018 the Litigation Chamber decides to request an investigation from the Service
d'Inspection (SI), pursuant to Articles 63, 2° and 94, 1° of the LCA.
5. On October 29, 2018, in accordance with Article 96, § 1 of the LCA, the Chamber's request
Litigation to proceed with an investigation is forwarded to the IS. The complainant is informed of this at
this same date.
6. On January 28, 2020, the IS investigation is closed, the report is attached to the file and the file is
transmitted by the Inspector General to the President of the Litigation Chamber (art. 91, § 1 and §
2 of the ACL). The investigation report is based on two technical analysis reports
July 1, 2019 and January 9, 2020 respectively.
7. According to its report, the IS makes the following observations:
- As to the legal basis underlying the processing of registration data of a
part and data related to personalization (profiling) on the other hand (finding 1):
The SI notes that the RTBF declares that it bases the lawfulness of the processing of registration data
on the legitimate interest on the one hand and the legality of the processing of data related to the
personalization on legitimate interest and/or consent on the other hand. The IS reminds
that according to Article 6.1. of the GDPR, the legitimate interest of the data controller cannot
constitute a basis for the lawfulness of the processing carried out by the public authorities in
the execution of their missions. The IS refers to article 5 of the LTD whose definition
"of public authority" is broad and seems to him to encompass the defendant as
as an autonomous public enterprise. The IS also adds that the use of interest
legitimate requires balancing the interests involved and underlines
that the defendant does not provide any element which tends to show that this balance Decision on the merits 170/2022 - 3/9
was realized. Finally, with regard to the consent invoked in addition with regard to the
lawfulness of personalization-related data processing, the IS recalls that the
data controller cannot switch from the basis of lawfulness of consent to that of
of legitimate interest.
- As to the legitimacy of the processing of personal data for the purposes of
advertising profiling and the possibility of opposition (findings 2, 3 and 4): the IS falls
that if the RTBF management contract allows it to use algorithms for
content recommendation, the definition of this term does not include advertising. His
concludes that the legitimacy of the advertising profiling purpose of the processing in the
of the RTBF (and therefore compliance with Article 5.1.b) of the GDPR) can therefore be implemented.
doubt. Since at the time of registration, the user cannot refuse profiling
advertising and that the platform does not seem to allow easy opposition to this
below, the IS concludes that the stipulations of articles 12.2., 21 and 25 of the GDPR
do not seem to be encountered. Finally, the IS observes that updating the purposes
in the registration form by including the purpose of advertising profiling has, at the
dated January 9, 2020, not carried out even though the defendant was there
engaged. the IS concludes that this appears to be inconsistent with the provisions of Articles 12.1.
13 and 14 GDPR.
- Regarding the use of social network data for login/registration purposes
(findings 5 and 6): the IS concludes that the difference between the connection mechanism
to Auvio on the one hand and registration to the platform via social networks (Facebook,
Google) on the other hand lacks clarity and explanations in contravention with the articles
12.1, 13 and 14 GDPR. The IS adds that the mechanism used (under cover of the connection
via a Facebook account) is in fact the creation of an RTBF account with the provision of
Facebook data of the user, without the latter being informed. The IS concludes
that this process is in contradiction with articles 5.1.a), 5.1.b) and 5.1.c) of the GDPR as well as
as Articles 12.1, 13 and 14 of the GDPR.
er
8. On March 17, 2020, the Litigation Division decides, pursuant to Article 95, § 1, 1° and
article 98 of the LCA, that the case can be dealt with on the merits.
9. On the same date, the parties concerned are informed by registered letter of the
provisions as set out in article 95, § 2 as well as in article 98 of the LCA. They are
also informed, pursuant to Article 99 of the LCA, of the deadlines for transmitting their
submissions, i.e. April 14 and May 14, 2020 for the defendant and April 29 for the
complainant.
10. On March 19, 2020, the defendant requested a copy of the file (art. 95, §2, 3° LCA),
which is transmitted to it on March 25, 2020. It also expresses the wish to be Decision on the merits 170/2022 - 4/9
heard by the Litigation Chamber in accordance with Article 51 of the Rules of Procedure
domestic ODA.
11. On April 14, 2020, the Litigation Chamber receives the submissions in response from the
defendant. On May 14, 2020, she received the conclusions of the summary of this last.
argument can be summarized as follows.
The first part of the defendant's conclusions tends to show that the
findings of the IS investigation must be discarded as soon as the establishment of the said
report and technical analysis reports has not been made in accordance with the principles
of good administration.
As to the merits, the defendant denies that there was any breach in its
chief.
12. On April 28, 2020, the Litigation Chamber received the complainant's submissions in response.
In general, the complainant denounces the attitude of the defendant and insists
in particular on the practice of cookies, the lack of transparency and the question of the
relevance of the collection of personal data as a mandatory step to access
online news content.
II. Motivation
13. Under Article 100 LCA, the Litigation Chamber has the power to:
1° dismiss the complaint without follow-up;
2° order the dismissal;
3° order a suspension of the pronouncement;
4° propose a transaction;
(5) issue warnings or reprimands;
6° order to comply with requests from the data subject to exercise these rights;
(7) order that the person concerned be informed of the security problem;
8° order the freezing, limitation or temporary or permanent prohibition of processing;
9° order the processing to be brought into conformity;
10° order the rectification, restriction or erasure of the data and the notification of
these to the recipients of the data;
11° order the withdrawal of accreditation from certification bodies;
12° to issue periodic penalty payments;
13° to impose administrative fines;
14° order the suspension of cross-border data flows to another State or a
international body; Decision on the merits 170/2022 - 5/9
15° forward the file to the public prosecutor's office of the Brussels Court, who informs it of the follow-up
data on file;
16° decide on a case-by-case basis to publish its decisions on the website of the Protection Authority
Datas
14. When a complaint is forwarded to it by the First Line Service (SPL) which declared it
admissible, or by the IS after an investigation report as in the present case, the Chamber
Litigation will first examine whether it is technically possible to render a decision
with regard to said complaint. Otherwise, this complaint will necessarily be closed.
not followed up for technical reasons.
15. In support of the arguments which follow and on the basis of the powers conferred on him
granted by the legislator under section 100.1. of the LCA, the Litigation Chamber
decides to proceed with the dismissal of the complaint in accordance with article 100.1., 1° of
the ACL.
16. In matters of dismissal, the Litigation Chamber must justify its decision by
step and:
- to pronounce a classification without technical continuation if the file does not contain or not
sufficient elements likely to lead to a sanction or if it includes a
technical obstacle preventing him from rendering a decision;
- or pronounce a classification without continuation of opportunity, if in spite of the presence of elements
likely to lead to a sanction, the continuation of the examination of the file does not seem to him
timely given its priorities.
17. If the dismissal takes place on the basis of more than one reason (respectively technical or
opportunity), the reasons for dismissal must be dealt with in order
important.
18. In the present case, the Litigation Chamber issues a decision without any technical follow-up
application of article 100.1., 1° of the LCA on the basis of the reasoning which follows (points 19 to 27) and
within the limits of the grievances concerned.
19. On November 22, 2022, the Litigation Chamber took decision 168/2022 with regard to the
defendant. Pursuant to this decision, the Litigation Chamber adopted, with regard to
facts identical to those reported in the second part of the complaint by the complainant
of the findings 1 (with regard to advertising profiling only) 2, 3 and 4 of the report
1
See. the dismissal policy note from the Litigation Chamber, point 3.1.
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
litigation.pdf Decision on the merits 170/2022 - 6/9
investigation of the IS – point 7), one of the measures listed in article 100.1 of the LCA recalled below
above, or a transaction (article 100.1.4° LCA).
20. Said settlement decision 168/2022 extends “to potential infringements under the law of 13
June 2005 (in force at the time of the findings of the APD Inspection Service in the
2
file), as well as potential violations of the General Data Protection Regulation.
data (GDPR), with regard to cookies and, more generally, the storage and
consent to the placement and further processing of information on the device of
the user as a data subject. The transaction decision relates to the websites
involved and mentioned in the file and concerns the party to which the proposal of
3
transaction is addressed”.
21. This settlement decision 168/2022 is addressed to the same party as the defendant of the
this decision, or to RTBF.
22. The object of the transaction also relates, as has just been mentioned, to “the offenses
potential GDPR, with regard to cookies and, more generally, the storage and
consent to the placement and further processing of information on the device of
the user as a data subject”. The settlement thus covers the “cookies” grievance
as a whole raised by the complainant under the terms of his complaint (second part) as well as
findings 1 (only for advertising profiling), 2, 3 and 4 of the IS investigation report
as recalled in point 7 above.
23. Finally, Decision 168/2022 specifies that “the transaction relates only to a specific period:
4
the period from May 25, 2018 to November 11, 2020”, i.e. the date of submission of the last
IS report in said file.
24. Within the limits of this decision 168/2022, the Litigation Chamber has thus exhausted its referral
as to the facts denounced by the complainant and as to the corresponding "cookie" grievances. The
Dispute Chamber therefore dismisses the plaintiff's complaint with regard to these grievances.
for technical reasons and this, within the same material and temporal limits.
25. Decision 168/2022 specifies in the same way that “the transaction exhausts the powers of the
Litigation Chamber to take corrective measures in respect of infractions
within the limits of the legal elements and provisions described above and in the
transaction proposal, as well as within the period [read the period] referred to above. The
Chambre Litieuse stresses that the transaction does not affect the powers of the courts and
2The settlement decision comes in the context of an own initiative investigation carried out by the Inspection Service on the
problem of data processing via cookies in the Belgian media sector, including those operated by the
defendant.
3Point 19 of decision 168/2022 of the Litigation Chamber.
4Point 20 of decision 168/2022 of the Litigation Chamber. Decision on the merits 170/2022 - 7/9
courts nor those of other authorities to examine infringements where appropriate. The
transaction in this case binds only the Litigation Chamber of the Authority of
5
Belgian data protection”.
26. As mentioned above, the object of the transaction formalized in the decision
168/2022 is limited to the period from May 25, 2018 to November 20, 2020, the date on which the SI has
closed its findings in the said file, which exceed the date of January 28, 2020 on which
the IS closed its investigation initiated following the complainant's complaint (point 7).
27. For the period from November 20, 2020 to date, the Litigation Chamber does not have
findings that support the grievances invoked by the complainant. For this reason, the Chamber
Litigation is therefore not in a position to find any breach in the head
of the defendant and classifies the complaint without follow-up as regards this technical reason also to
support of criterion A.1. of its classification policy note without follow-up.
28. With regard to grievances related to data processing in the context of connection and
registration on the Auvio platform (first part of the complainant's complaint and findings 1 (in
regarding registration)), 5 and 6 of the inspection report), the Litigation Chamber decides
to continue examining it, as these grievances are not covered by its settlement decision
168/2022. The defendant having requested to be heard in this case, the
Litigation Chamber will schedule a hearing in the presence of the parties in due course.
29. With regard to the settlement decision (168/2022) for which it opted as
decision to classify this complaint without action for part, the Litigation Chamber calls
that it is sovereignly incumbent upon it as an independent administrative authority - in the
compliance with the relevant articles of the GDPR and the LCA - to determine the measure(s)
corrector(s) and appropriate sanction(s).
30. Thus, it is not for the plaintiff to ask the Litigation Chamber to order
such or such corrective measure or sanction. If, notwithstanding the foregoing, the Complainant
nevertheless had to ask the Litigation Chamber to pronounce one or the other
measure and/or sanction, it is therefore not for the latter to justify why it does not
would not accept one or the other request made by the complainant. These considerations
leave intact the obligation for the Litigation Chamber to justify the choice of measures and
sanctions which it deems (among the list of measures and sanctions made available to it by
articles 58 of the GDPR and 95.1 and 100.1 of the ACL) appropriate to condemn the complaining party
55
Point 21 of decision 168/2022 of the Litigation Chamber.
6In this sense, Decision 168/2022, like this decision to close without further action, leaves the jurisdiction of the
the DPA to decide, for the period after November 20, 2020, if it were to be newly seized of it, on
any shortcomings that would persist to this day with regard to the facts denounced by the complaint Decision on the merits 170/2022 - 8/9
7
cause . In this case, the Litigation Chamber refers to points 19-27 above concerning
its decision to dismiss the complainant's complaint on a technical ground.
III. Publication of the decision
31. Given the importance of transparency with regard to the decision-making process
and the decisions of the Litigation Chamber, this decision will be published on the website of
the DPA by deleting the direct identification data of the complainant and the
named persons, whether natural or legal, excluding the defendant.
32. The Litigation Chamber judges that the identification of the defendant is necessary since
that this Decision refers to Decision 168/2022 adopted by the Chamber
Litigation against the defendant and whose operative part (transaction) is the basis of this
classification decision without technical follow-up. The identity of the defendant having been published
under this decision 168/2022, the omission of the identity of the same defendant in the
terms of this decision would make no sense. Its explicit mention allows
overwhelmingly the better understanding and coherence of these two decisions of the
Litigation Chamber.
FOR THESE REASONS,
the Litigation Chamber of the Data Protection Authority decides, after deliberation:
- to close the complaint without further action under article 100.1.1° of the LCA with regard to
concerns grievances covered by decision 168/2022 of the Litigation Chamber
- to continue the examination of the merits of the complaint for the remainder (point 28 above).
In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged,
within thirty days of its notification, to the Court of Markets (Court
d'appel de Bruxelles), with the Data Protection Authority (DPA) as a party
defendant.
7 Litigation Chamber, Decision on the merits 81/2020. See also the note from the Litigation Chamber relating to the
complainant's position (point D. page 4 in fine). https://www.autoriteprotectiondonnees.be/publications/note-relative-a-la-
position-of-the-complainant-in-the-procedure-within-the-litigation-chamber.pdf: “The conclusions of the complainant must
deal with the content of the complaint and not, for example, the nature of the sanction that the Litigation Chamber must impose
according to the complainant. The complainant is of course free to give an opinion on the sanction to be imposed, but the Chamber
Litigation is not obliged to adopt this opinion, nor to refute the arguments of the plaintiff concerning the imposition of the
sanction”. Decision on the merits 170/2022 - 9/9
Such an appeal may be introduced by means of an interlocutory request which must contain the
information listed in article 1034ter of the Judicial Code. 8
The interlocutory request must be filed with the registry of the Market Court in accordance with
article 1034quinquies of the C. jud. , or via the e-Deposit information system of the Ministry of
Justice (article 32ter of the C. jud.).
(Sr.) Hielke H IJMANS
President of the Litigation Chamber
8
The request contains on pain of nullity:
(1) indication of the day, month and year;
2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
Business Number;
3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
(4) the object and summary of the grounds of the application;
(5) the indication of the judge who is seized of the application;
6° the signature of the applicant or his lawyer.
9 The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.
