APD/GBA (Belgium) - 11/2023
From GDPRhub
| APD/GBA - 11/2023 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 12(3) GDPR Article 17(1)(c) GDPR Article 19 GDPR Article 21(2) GDPR Article 21(3) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 09.08.2022 |
| Decided: | 13.02.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 11/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | French |
| Original Source: | Gegevensbeschermingsautoriteit (in FR) |
| Initial Contributor: | Enzo Marquet |
The Belgian DPA ordered a controller to comply with an objection and erasure request pursuant to Article 58(2)(c) GDPR. The DPA determined that the controller should also order recipients to erase the data.
English Summary
Facts
The data subject was a client of the controller until December 2021. Afterwards, the controller kept calling him, from numerous phone numbers, to sell its services. The data subject requested, orally, to delete his personal data. The controller never followed-up on this request.
In April 2022, the data subject contacted the DPO with a request of erasure. The DPO confirmed that his personal data would only be processed for legal obligations (e.g. tax purposes) and that his phone number and mail address had been deleted from the customer database. Despite this, the data subject would still receive calls from the controller through different phone numbers. He therefore filed a complaint at the Belgian DPA.
Holding
The DPA determined that using the phone number (or mail address) of a data subject to send him promotional materials constitutes direct marketing in the sense of Article 21(2) GDPR. The same article grants the right to object to direct marketing, meaning that the personal data can no longer be processed for direct marketing purposes pursuant Article 21(3) GDPR.
As such, in line with Article 17(1)(c) GDPR, the controller was obliged to delete, as soon as possible and within one month, the phone number of the data subject unless the controller had another legal basis to process it. On top of that, the controller is obliged to inform all recipients of the phone number to delete it according to Article 19 GDPR.
The DPA held that the controllers could have breached Article 21(2) GDPR, Article 21(3) GDPR and Article 17(1)(c) GDPR in combination with Article 12(3) GDPR by still processing the personal data for direct marketing purposes and by not erasing it. The controllers could as well be breaching Article 19 GDPR by not ordering to recipients of the personal data to erase it.
The DPA ordered the controller to comply with the objection and erasure request pursuant Article 58(2)(c) GDPR and Article 95(1)(5) LCA (Law establishing the data protection authority).
Comment
This was a preliminary (Prima Facie) decision according to Article 95 WOG, prior to a decision on the merits.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/8
Litigation Chamber
Decision 11/2023 of February 13, 2023
File number: DOS-2022-03252
Subject: Complaint relating to the exercise of marketing opposition rights
directly and the erasure of data
The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke
Hijmans, chairman;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and
to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the
data protection), hereinafter “GDPR”;
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, hereinafter
“ACL”;
Having regard to the internal regulations as approved by the House of Representatives on 20
December 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Made the following decision regarding:
The plaintiff: Mr. X, hereinafter “the plaintiff”; .
.
.
The defendant: Y, hereinafter: “the defendant”. Decision 11/2023 - 2/8
I. Facts and procedure
1. According to his complaint, the plaintiff states that he was a client of the defendant
until December 2021.
2. He indicates that despite the fact that he was no longer a client of the defendant, he continued to
receive after this date telephone calls from various telephone numbers (… and
… for example) offering him services from the defendant. He adds that, in response to these
calls, requested the deletion of his personal data without his oral requests
are not followed up.
3. The complainant reports that he then contacted the Data Protection Officer in April 2022.
data (DPO) of the defendant. However, he did not produce his request. Asked about this
point in the context of the preparation of the file, the complainant indicated that he seemed to have
sent his request via an online form of which he has no record.
4. The complainant, on the other hand, produces the response received from the DPO of the defendant on April 22, 2022.
Under it, the DPO indicates that further to the complainant's request, "we can
confirm that in the meantime your email address and mobile phone number have been
erased from the CRM system of [read the defendant] and that your account (…) has also been
removed”. The defendant adds that in accordance with Article 17.3. of the GDPR and its
privacy policy, this deletion is not absolute. She adds that since the
complainant is a former customer, it is authorized to retain data relating to the services
provided (e.g. invoices) for accounting and tax purposes in a timely manner
prescription provided. The DPO concludes by indicating that it is self-evident that these data
will not be used to contact the complainant for solicitation purposes.
5. Notwithstanding the guarantees received from the DPO of the defendant, the plaintiff alleges
still receiving unsolicited calls from the defendant (in the month of
July for example) or offering him at the very least the services of the defendant, this point
not being entirely clear in his request.
6. On August 9, 2022, the complaint is declared admissible by the SPL of the DPA on the basis of articles 58
and 60 of the LCA and the complaint is transmitted to the Litigation Chamber under article 62,
§ 1 of the ACL .2
1
Pursuant to article 61 LCA, the Litigation Chamber informs the parties by this decision, of the fact that the complaint has
been declared admissible.
2 Pursuant to Article 95, § 2 LCA, by this decision, the Litigation Division informs the parties of the fact that following
of this complaint, the file was forwarded to him. Decision 11/2023 - 3/8
II. Motivation
7. It appears in this case that the defendant was processing personal data
relating to the complainant, his e-mail address and his mobile phone number to all
less, as indicated by the defendant in its email of April 22, 2022. These
information is personal data relating to the complainant within the meaning of
section 4.1. of the GDPR in that they allow it to be identified, here directly. The complainant
is therefore a "data subject" within the meaning of Article 4.1. (second part) of the GDPR.
8. These data were also subject to automated processing by the defendant at the
meaning of Article 4.2. of the GDPR.
9. The GDPR grants any data subject a number of rights (including the right to
of opposition and the right to erasure relevant in the case in point) the terms of which
of exercise and the correlative obligations for the data controller are detailed in
article 12 of the GDPR. The Litigation Chamber here refers to article 12.3. in execution of which
the data controller who receives a request to exercise the rights
(Articles 15 to 22) is, subject to exceptions, required to provide the data subject with
information on the measures taken following his request within one month.
When the request proves to be particularly complex, this period may be extended by two
months, but the author of the request to exercise the right must nevertheless be informed of this within the
1 month period.
As for the right of opposition in prospecting (“direct marketing”)
10. The GDPR does not define what is meant by “processing for marketing purposes” or
for the purposes of "direct marketing" according to the English terminology. In its Recommendation
01/2020 of 17 January 2020 relating to the processing of personal data at
direct marketing purposes, the APD indicates that it should be understood as “direct marketing”
as “any communication, whether solicited or unsolicited, aimed at promoting a
organization or a person, services, products, whether paid for or
free, as well as marks or ideas, sent by an organization or a person
acting in a commercial or non-commercial context, directly to one or more
natural persons in a private or professional context, by any means,
involving the processing of personal data” (page 8 of Recommendation
- definition).
11. The processing of a mobile phone number or an e-mail address such as that of the
plaintiff to send him promotional offers of certain products constitutes a
processing of personal data for prospecting purposes (direct marketing) within the meaning of
3 See. in this regard Decision 64/2020 of the Litigation Chamber (point 23):
https://autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-64-2020.pdf Decision 11/2023 - 4/8
section 21.2. of the GDPR. In this case, the data subject is entitled to exercise his right
objection pursuant to Article 21.2 of the GDPR. The complainant indicates in the terms of his
complaint that he no longer wished to be contacted by the defendant and has, on several occasions,
tried unsuccessfully to object to said processing (points 1-3) both orally and via, affirms
he, an online form.
12. Accordingly, the Respondent was, prima facie, required to provide the Complainant with
information on the measures taken following the exercise of his right of opposition in the
period of one month from receipt of his request as provided for in Article 12.3. of
GDPR. The defendant's DPO thus confirmed to the plaintiff on April 22, 2022 that his
telephone number and e-mail would no longer be processed for canvassing purposes
6
(commercial prospecting / direct marketing). Pursuant to Article 21.3 of the GDPR,
when the data subject opposes the processing for prospecting purposes, the
personal data can no longer be processed for these purposes.
13. Notwithstanding this undertaking, the Complainant complains that he continues to receive calls
promotional material from the defendant.
As for the consequences of the right of opposition in terms of erasure
14. As a result of the exercise of the right to object based on Article 21.2 of the GDPR by the
plaintiff, the defendant was not only required to stop processing the data
of the complainant for marketing purposes but also under the obligation, pursuant to
7
Article 17.1 c) of the GDPR, to delete the complainant's telephone number as soon as possible
deadlines, ideally within a month. Only if it processes this same data for
another purpose and in support of a basis of lawfulness specific to the data controller,
here presumably the defendant, is authorized to keep it.
4 Section 21.2. of the GDPR: The controller notifies each recipient to whom the personal data
personal data have been communicated any rectification or erasure of personal data or any
restriction of processing carried out in accordance with Article 16, Article 17, paragraph 1, and Article 18, unless such
communication is impossible or requires disproportionate effort. The controller provides the
data subject information about these recipients if the data subject so requests.
5Section 12.3. of the GDPR: The controller provides the data subject with information on the measures
TAKEN FOLLOWING A REQUEST MADE IN APPLICATION OF ARTICLES 15 TO 22, AS SOON AS POSSIBLE, ATTEMPTING ANY STATE OF CASE
within one month of receipt of the request. If necessary, this period may be extended by two months,
given the complexity and number of requests.
this extension and the reasons for the postponement within one month of receipt of the request.
6Section 21.3. GDPR: . When the data subject objects to processing for prospecting purposes, the data to be
personal character are no longer processed for these purposes.
7Section 17.1. c) of the GDPR: The data subject has the right to obtain from the controller the erasure, within the
as soon as possible, of personal data concerning it and the data controller has the obligation to erase these
personal data as soon as possible, where one of the following grounds applies: (…) the person
concerned objects to the processing pursuant to Article 21, paragraph 1, and there are no overriding legitimate grounds for the
processing, or the data subject objects to the processing pursuant to Article 21(2);
8See. in this regard Decision 62/2021 of the Litigation Chamber (points 14 and s.):
https://autoriteprotectiondonnees.be/publications/advisory-62-2021.pdf Decision 11/2023 - 5/8
9
15. Pursuant to Article 19 of the GDPR, the controller is also required to
notify any deletion of personal data carried out (in accordance with
Article 17.1 c) of the GDPR – see. above) to each recipient to whom the data to be
personal character would have been communicated.
16. In the present case, the complaint and the documents in the file seem to reveal that the processing of the
complainant’s mobile phone business continued for prospecting purposes despite
the opposition of the latter and the assurances given by the DPO of the defendant.
As to the decision of the Litigation Chamber
17. The Litigation Chamber considers that on the basis of the aforementioned facts, there is reason to
conclude that the defendant may have breached the provisions of the GDPR, in
particular of Articles 21.2., 21.3. and 17.1.c) of the GDPR combined with Article 12.3. of the GDPR. This
finding justifies the adoption by the Litigation Chamber of a decision against it in
application of Article 95, § 1, 5° of the LCA, consisting more specifically in ordering him to
follow up on the complainant's request to exercise the right of opposition within one month
months from the notification of this decision and this, in support of the motivation which
precedes as well as to follow up on his right to erasure within the limits set by
the operative part of this decision.
18. This decision is a prima facie decision taken by the Litigation Chamber
in accordance with article 95 of the ACL on the basis of the complaint lodged by the complainant in
10
the framework of the “procedure prior to the substantive decision”. It is therefore not a
decision on the merits of the Litigation Chamber within the meaning of Article 100 of the LCA.
19. The purpose of this decision is to inform the defendant, allegedly responsible for the
processing, of the fact that it may have committed a breach of the provisions of the GDPR and of
to still comply with the aforementioned provisions.
20. Pursuant to article 95 § 2, 3° of the LCA as well as article 47 of the rules of order
inside the DPA, a copy of the file may be requested by the parties. If one of
parties wishes to make use of the possibility of consulting the file, the latter is required to
contact the secretariat of the Litigation Chamber, preferably via the address
litigationchamber@apd-gba.be.
21. If the Respondent does not agree with the content of this prima facie decision and
believes that it can make factual and/or legal arguments that could
9Article 19 of the GDPR: The controller notifies each recipient to whom the personal data
have been communicated any rectification or erasure of personal data or any limitation of the
processing carried out in accordance with Article 16, Article 17(1) and Article 18, unless such
communication is impossible or requires disproportionate effort. The controller provides the
data subject information about these recipients if the data subject so requests.
10Section 3, Subsection 2 of the ACL (sections 94 to 97 inclusive). Decision 11/2023 - 6/8
lead to another decision, it can address to the Litigation Chamber a request
processing on the merits of the case via the e-mail address litigationchamber@apd-gba.be, and
this within 30 days of notification of this decision. If applicable,
the execution of this decision will be suspended for the aforementioned period.
42. In the event of further processing of the case on the merits, pursuant to Articles 98, 2° and 3°
juncto article 99 of the LCA, the Litigation Chamber will invite the parties to introduce their
conclusions and to attach to the file all the documents they deem useful. If applicable,
this decision will be permanently suspended.
43. With a view to transparency, the Litigation Division finally emphasizes that a
dealing with the case on the merits may lead to the imposition of the measures mentioned in
section 100 of the ACL. 11
44. Finally, without this constituting any corrective measure or sanction whatsoever for the
meaning of Article 95 of the LCA, the Litigation Chamber reminds the defendant that it
is obliged to put in place the technical and organizational measures necessary to
allow the exercise of the rights of the persons concerned, in particular the procedures for
monitoring of requests to exercise rights. These procedures are all the more important
that the defendant processes a considerable volume of data due to the nature of its
activities and the number of people affected by them.
11Art. 100. § 1. The litigation chamber has the power to
1° dismiss the complaint without follow-up;
2° order the dismissal;
3° pronouncing the suspension of the pronouncement;
4° to propose a transaction;
5° issue warnings and reprimands;
6° order to comply with requests from the data subject to exercise his or her rights;
7° order that the person concerned be informed of the security problem;
8° order the freezing, limitation or temporary or permanent prohibition of processing;
9° order compliance of the processing;
10° order the rectification, restriction or erasure of the data and the notification thereof to the recipients
Datas ;
11° order the withdrawal of the approval of the certification bodies;
12° to issue periodic penalty payments;
13° to issue administrative fines;
14° order the suspension of cross-border data flows to another State or an international body;
15° forward the file to the public prosecutor's office in Brussels, who informs it of the follow-up given to the file;
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. Decision 11/2023 - 7/8
III. Publication of the decision
44. Given the importance of transparency regarding the decision-making process of the Chamber
Litigation, this decision is published on the website of the Protection Authority
data (APD). However, it is not necessary for this purpose that the data
identification of the parties are directly mentioned.
FOR THESE REASONS,
the Litigation Chamber of the Data Protection Authority decides, subject to
the introduction of a request by the defendant for treatment on the merits in accordance with
to articles 98 e.s. of the ACL:
- pursuant to Article 58.2.c) of the GDPR and Article 95, §1, 5° of the LCA, to order
the defendant to comply with the plaintiff's request to exercise his rights,
as soon as possible and at the latest within 30 days of notification of the
this Decision, more specifically:
o his right to object (art. 21.2 of the GDPR) and consequently, (a) to cease all
processing of the personal data of the complainant for the purposes of
prospecting (article 21.3 of the GDPR) as well as (b) to proceed with the deletion of
personal data of the complainant (article 17.1 c) of the GDPR), except to be able to
rely on a distinct basis of lawfulness authorizing the processing of the data
of the complainant for another purpose and (c) to comply with its obligation to
notification as provided for in Article 19 of the GDPR, or to notify the deletion
made to any potential recipient of the personal data of the
complainant;
- to order the defendant to inform, by e-mail, the Data Protection Authority
data (Litigation Chamber) of the follow-up given to this decision, in the
same 30-day period, via the e-mail address litigationchamber@apd-gba.be; And
- if the defendant does not comply in good time with what is requested of it
above, to deal ex officio with the case on the merits, in accordance with articles 98 e.s. of
the ACL.
In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged,
within thirty days of its notification, to the Court of Markets (court
d'appel de Bruxelles), with the Data Protection Authority (DPA) as a party
defendant. Decision 11/2023 - 8/8
Such an appeal may be introduced by means of an interlocutory request which must contain the
information listed in article 1034ter of the Judicial Code (C. jud.) . 12
The interlocutory request must be filed with the registry of the Market Court in accordance with
article 1034quinquies of the C. jud. , or via the e-Deposit information system of the Ministry of
Justice (article 32ter of the C. jud.).
(Sr.) Hielke H IJMANS
President of the Litigation Chamber
12
The request contains on pain of nullity:
(1) indication of the day, month and year;
2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
Business Number;
3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
(4) the object and summary of the grounds of the application;
(5) the indication of the judge who is seized of the application;
6° the signature of the applicant or his lawyer.
13The request, accompanied by its annex, shall be sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.
