APD/GBA (Belgium) - 159/2023
From GDPRhub
| APD/GBA - 159/2023 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 4(11) GDPR Article 6(1)(a) GDPR Article 7(3) GDPR Article 5(3) ePrivacy Directive 2002/58/EC |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 19.07.2023 |
| Decided: | 24.11.2023 |
| Published: | 01.12.2023 |
| Fine: | n/a |
| Parties: | Mediafin noyb |
| National Case Number/Name: | 159/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | APD/GBA - Beslissing 159/2023 van 1 december 2023 (in NL) |
| Initial Contributor: | Stefan Ragossnig |
The Belgian DPA proposed a settlement between the data subject and Mediafin concerning the setting of cookies on www.tijd.be. Inter alia, Mediafin shall ensure that the withdrawal of consent doesn´t take more clicks than the granting of consent.
English Summary
Facts
On 19 July 2023, the data subject (through noyb) filed a complaint against Mediafin with the Belgian DPA . The complaint concerned the practices of the setting of cookies on the website https://www.tijd.be/.
The data subject first complained about a missing "decline" option at the first level of the consent banner. Second, it stated that the cookie banner used misleading button colours and third, that it is not as easy to withdraw consent as it is to give it.
On 20 October 2023, a settlement proposal was sent to the parties. The data subject responded on 30 October 2023 demanding some modifications to the proposed settlement which the DPA denied on 6 November 2023.
Mediafin accepted the proposal on 24 November 2023.
Holding
In its settlement decision the Belgian DPA held that Mediafin shall comply with three conditions:
(1) Mediafin shall provide the cookie-setting banner on https://www.tijd.be/ with a "refuse all" option at the same level as the "agree and close" option within one month of the decision. (2) The "refuse all" option shall be displayed no less (visually) attractive than the "agree and close" option. The data subjects demand to modify this condition - namely that both options should be identical in size, colour, shape, contrast and location - was rejected. The DPA stated that the controller is free to display the "refuse all" option even more appealing. (3) Mediafin shall within one month of the decision ensure that it does not take more clicks to withdraw than to give consent on the website https://www.tijd.be/. The clicks shall be counted from the moment the data subject reaches the cookie setting page. This cookie setting page shall be accesible on every page of the litigious website. This shall be done to meet the requirements of collecting valid consent under the GDPR and Article 5(3) ePrivacy Directive 2002/58/EC as well as these three addition cumulative requirements: (i) the ability to withdraw consent, (ii) the ability to withdraw consent at any time and (iii) withdrawal of consent must be as easy as giving consent (requirements stated by the "Cookie Banner Taskforce" of the EDPB).
The DPA did not impose a fine, because it did not feel the need for a sanction.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/23
Dispute Chamber
Decision 159/2023 of December 1, 2023
File number: DOS-2023-03281
Subject: settlement decision following a complaint regarding the use of cookies at
Mediafin (website “DeTijd”)
The Disputes Chamber of the Data Protection Authority, composed of Mr
Hielke HIJMANS, sole chairman;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of
personal data and regarding the free movement of such data and to the revocation of
Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”;
Having regard to the law of 3 December 2017 establishing the Data Protection Authority,
hereinafter “WOG”;
In view of the internal rules of order, as approved by the House of Representatives
Representatives on December 20, 2018 and published in the Belgian Official Gazette on
January 15, 2019;
Considering the documents in the file;
Has made the following decision regarding:
Complainant: Mr
Digital Rights, with registered office at [...], hereinafter “the complainant”, and
Settling party: Mediafin NV, with registered office in [...], hereinafter “the settling party”. Decision 159/2023 — 2/23
I. Pre-Settlement Procedure
I.1. The complaint
1. On July 19, 2023, the complainant, through his representative, submits a complaint to the
Data Protection Authority (“GBA”) against the settling party. 1
2. The subject of the complaint concerns various elements related to it
placing cookies on the website https://www.tijd.be/. The complaint refers to the following
the complainant relevant legislation regarding the granting of consent. The complaint makes
the link with “misleading cookie banners and 'dark patterns'”. The complaint also refers to
reports and communications from both the European Data Protection Committee and
the Belgian GBA relating to the obligations when placing cookies
where personal data are processed.
3. The complaint specifically states three alleged practices that are offensive to him
website exposed. First, the fact that there is “no 'decline' option at the first level
of the consent banner”. Secondly, that the 'cookie banner' would be used
creating “misleading button colors”. As the third complaint, the complaint states: “It is not so
easy to withdraw consent as it is to give consent.”
4. On August 3, 2023, the First Line Service of the GBA will contact the complainant with the question
for information “about the complainant's interest in filing the complaint”.
5. On August 24, 2023, the complaint will be declared admissible by the First Line Service on
on the basis of articles 58 and 60 of the WOG and the complaint is filed on the basis of article 62, § 1
of the WOG transferred to the Disputes Chamber. 4
6. On September 1, 2023, thereafter, the complainant's representative shall inform the
First-line service a document that further explains the interests of the complainant.
7. In the document dated September 1, 2023, the complainant's representative refers to
the admissibility conditions in the WOG - which the complaint complies with - and states that it
“It is therefore not clear to [the representative] why your First Line Service
authority requests further substantiation of the complainant's interest in the
filing the complaint.” The representative points out that the complainant's details
1 During the procedure it was sometimes the case that the complaint was submitted on July 18, 2023, as stated on the complaint itself by
the complainant, but formally speaking the complaint only reached the GBA the following day.
2
In particular Article 10/2 of the Act of 30 July 2018 on the protection of natural persons with regard to
the processing of personal data, B.S. 05/09/2018 (in implementation of provisions of the “e-Privacy Directive”) and article
6.1.a. GDPR.
3In accordance with Article 61 of the WOG, the Disputes Chamber hereby informs the parties that the complaint is admissible
declared.
4In accordance with Article 95, § 2 of the WOG, the Disputes Chamber hereby informs the parties that the file will be sent to
has been transferred to her as a result of this complaint. Decision 159/2023 — 3/23
have been effectively processed, and that the complainant is a data subject within the meaning of the GDPR,
and further states: “The complaint therefore does not merely pursue a public interest in surviving relatives
protection of every data subject who visits the website.”
8. In order to ensure an efficient process, the Disputes Chamber will not investigate further
aspects relating to the interests of the complainant, which have already been discussed in
the communications between the complainant's representative and the First Line Service.
I.2. The settlement offer
9. On September 21, 2023, the Disputes Chamber will send a letter to both the
representative of the complainant and the settling party, whereby the Disputes Chamber
communicates to the parties involved that it intends to proceed
settlement proposal in the file, pursuant to Article 95, § 1, 2° WOG. Creates the notification
also mentioning the fact that the Disputes Chamber - through communication - has extended the term
for arresting the Inspection Service on the basis of Article 96, § 1 WOG, eight. The
Parties can also view the administrative file from this moment onwards if they wish
to inspect it, which they both subsequently request.
10. The settlement proposal will be transferred to the settling parties on 20 October 2023
to the complainant. The content of this settlement proposal is included unchanged in the
appendix to this settlement decision, and forms an integral part of it. 5 In this
settlement offer, in particular, all procedural and substantive conditions
included, as well as the periods within which the parties must respectively respond.
I.3. Thecomplainant's response
11. On October 30, 2023, the complainant's representative will send a letter to the
Dispute Chamber. The complainant's representative will send the letter on November 3, 2023
also to the settling party, now that it was unclear to the representative that they
also had to deliver the document to the settling party.
12. In her response to the settlement proposal, the complainant requests the proposal on several grounds
“to clarify or adjust points”. The complainant concludes with the following paragraph:
“The complainant points out that if the content of the settlement proposal is changed to...
in favor of the defendant [settling party] and/or not (fully) to the above
requests will be met, the complainant is forced to appeal
the final settlement decision.”
5It should be noted, however, that an “erratum” was inserted under section f) as the initial text incorrectly stated “(in
In this case, this does not concern a complaint file). Decision 159/2023 — 4/23
13. The Disputes Chamber will reconsider the requests in the light of a clear decision
of the complainant under section II of this decision, after which the Disputes Chamber in concrete terms
responds to requests.
14. The Disputes Chamber responded on November 6, 2023 that the settlement proposal was
the complainant's requests are not changed. The Disputes Chamber does indicate that
intends to make the decision without omitting the identification data of the
settling party in accordance with art. 95, §1, 8° WOG.
I.4. The requests of the settling party and the realization of the settlement
15. On November 16, 2023, the settling party will submit a response regarding the
settlement offer. She states that she “agrees in principle” to the terms of the agreement
settlement proposal, but requests clarification on some points. The settling party
requests, among other things, clarification regarding the format and essential elements of the
“clear document” referred to in the first and second conditions in the
settlement offer. For clarification, the settling party attaches appendices to its letter that:
according to her, could produce such a clear document based on the
adjustments that it had already made to the contested website at that time.
16. In view of the requests for clarification from the settling party, the
Dispute Chamber postponed for seven days on November 17, 2023, in extension of the term
determined under section d) of the settlement proposal.
17. On November 23, 2023, the Disputes Chamber replied that the clear document that
was transferred in the message of 16 November 2023, which is sufficient for the first one
two conditions. The Disputes Chamber confirms that it is no longer necessary
is to transfer the relevant document (or documents) after the present one
settlement decision is made. The Disputes Chamber also handles a number of other matters
clarifications and then states that the settling party until 28 November 2023
has to decide whether or not to accept the settlement proposal.
18. On November 24, 2023, the settling party confirms that it fully agrees to all
conditions in the settlement proposal. The Disputes Chamber confirms this on the same day
a settlement has been formally concluded by the notice of the settling party, which
will lead to the present settlement decision. Decision 159/2023 — 5/23
II. Terms of the settlement and reasons for rejected requests
II.1. General considerations
19. During the settlement procedure no changes were made to the
settlement proposal formulated conditions for the settlement; the conditions stated in
were included in the settlement proposal, apply pursuant to the settlement. They become in
this section is not included and are shown in the appendix to this decision.
20. The Disputes Chamber also clarifies that they agree with a
does not regard the settlement offer as a confession, which could be used in particular
be considered as an aggravating circumstance in determining the sanction for future cases
procedures at the Disputes Chamber.
21. The Disputes Chamber then confirms once again that the documents that have been submitted
by the settling party, are sufficient for what was requested under the first and
second condition, regarding the provision of a “clear document” that
shows the technical adjustments.
22. The Disputes Chamber clarifies that, in the light of adequate procedural progress, the
settlement procedure is divided into a settlement proposal on the one hand, and a
settlement decision on the other. This method ensures that the procedural start and end
endpoint is clear to all parties involved, including the options for
appeal in these phases through the addition of the appeal clauses. Taking one
settlement decision also facilitates the transparency of the settlement procedure, now that the
Disputes Chamber fully opts for such transparency.
23. In conclusion, the present decision is a prima facie decision taken by the
Disputes Chamber in accordance with Article 95 of the WOG on the basis of the complaints submitted by the complainant
complaint submitted, in the context of the “procedure prior to the decision at
merits” and not a decision on the merits of the Disputes Chamber within the meaning of Article 100 of
the WOG.
II.2. The denied requests of the complainant
24. The complainant submitted several requests to the Disputes Chamber, which the
did not persuade the Disputes Chamber to adjust the settlement proposal. The
The Disputes Chamber will publish this settlement decision on the
website of the Data Protection Authority (see section III of this decision), such as
6Section 3, Subsection 2 of the WOG (Articles 94 to 97). Decision 159/2023 — 6/23
also requested by the complainant, which constitutes a separate decision separate from
the settlement on the basis of Article 95, §1, 8° WOG.
25. The Disputes Chamber explains below why it will not discuss the others
requests. It should be noted that the motivation is included in this
decision, so that the motives follow clearly within the general structure
process economics.
26. Firstly, with regard to the first condition in the settlement proposal, the
complainant “explicitly add that this condition means that the 'refuse all' option is
the same, first 'layer' should be provided as the 'agree and close' option”.
• The Disputes Chamber rejects this request for the following reason. It's not clear
which sense this request would produce a different concrete result on the disputed
website than the current wording in the first condition. The Dispute Chamber
considers that the proposed change is not an improvement (cf. section c.1. of the
settlement proposal) would bring about the stipulated condition.
27. Secondly, in relation to the second condition, the complainant requests “to add
that displaying 'no less (visually) attractive' means, among other things, but not
is limited to the fact that both the 'reject all' option and the 'agree and close' option are the same
size, color, shape, contrast and location of the button/option.”
• The Disputes Chamber rejects this request for the following reason. It's not on the
Dispute Chamber, nor to the complainant, to determine that buttons are (exactly) the same
properties should have. This choice belongs to the
controller. It's true that buttons are exactly the same
properties, are clearly equivalent to granting permission. a
contrario, it cannot be ruled out that the controller will opt for this
to display the “refuse all” option more attractively, or to innovate
use of colors (which, for example, represent business and equivalent options) that
facilitate the person concerned in making his or her choice. The more general
condition formulated in the settlement proposal regarding “no less (visual)
attractive” presentation of the choices is therefore sufficient for the Disputes Chamber.
28. Thirdly, in relation to the third condition, the complainant states as follows
text change for:
“The defendant undertakes to, within a period of one month,
to develop and implement a mechanism on the website of [...] that
meets the requirements stated in the aforementioned
policy documents and an equivalent effect; it also connects Decision 159/2023 - 7/23
defendant undertakes that withdrawal of consent will not require any more steps (in
matter “clicks”) than is necessary for giving consent. On all
pages of the website must be permanently visible and visually distinguishable
option is available to reopen the cookie settings with one click. Same
number of steps for withdrawing consent is counted from the moment
that the end user reopens the cookie settings. This is done via a
equivalent number of steps once the end user leaves the page
has reached cookie settings; this page must be clearly accessible at any
page of the contested website. The technical adjustments made by the defendant
does this, will be recorded in a clear document at the time of
the implementation, and forwarded to the Disputes Chamber and the complainant. Both it
carrying out the technical implementation, such as drawing up and forwarding
the document reflecting the implementation will be published within one month of the
settlement decision made.” (the underlined parts are missing in the current one
condition three of the settlement proposal)
• The Disputes Chamber rejects this request to change the condition in its entirety
the next reason. The Disputes Chamber takes note of the complainant's view that
a “permanently visible and visually distinguishable option” on all web pages
of the contested website. The Disputes Chamber, which reaches a reasonable and reasonable settlement with the settlement
wishes to reach a technically feasible comparison, considers that it is not an option
to require such adjustments through a settlement.
29. Fourthly, the complainant requests “an order to cease unlawful processing
added with regard to the website”, which should read as follows:
“The defendant undertakes that data that are processed because of
to delete cookies that have not been placed in accordance with the content of this settlement decision
and that the defendant communicates this obligation to erase to all recipients to whom the
personal data has been provided in this context. Evidence of this erasure of
personal data and the communication of this obligation to erase
personal data to all recipients is recorded in a clear document
at the time of implementation, and forwarded to the Disputes Chamber and the
complainant. Both this erasure of personal data and the communication of this
obligation to erase personal data from all recipients and forward it
the document reflecting the implementation will be published within one month of the
settlement decision made.” Decision 159/2023 — 8/23
• The Disputes Chamber rejects this request for the following reason. The complainant has opted out
based on the elements available in the administrative file, not addressed to the
controller following the alleged violation of his rights.
The Disputes Chamber therefore does not consider it appropriate here and now to do such a thing
to propose a condition, let alone address an “order” to the settling party.
The complainant is of course free to address any data controller
with regard to which the complainant can exercise his rights within the conditions
of the legislation.
30. Fifth, the complainant requests that an administrative fine be imposed via
the settlement “in view of Article 83(1) GDPR”.
• The Disputes Chamber rejects this request for the following reason. Imposing one
administrative fine is a power that can be exercised by the
Dispute Chamber pursuant to Article 100, §1, 13° WOG. In that sense, nothing can be done by the
the complainant intended the administrative fine to be imposed at this stage beforehand
to the substantive treatment under Article 95 WOG. It is correct that Article 107 WOG
points out that the legislature wished that with settlements – without clarifying whether
This could indeed also amount to sums of money under Article 95WOG
collected, but this is not a requirement for the settlement instrument, as is already the case
stated by the Disputes Chamber in the settlement proposal. The settlement aims to
to arrive at a general solution to the complainant's grievances, without
sanctions should be taken. The Disputes Chamber points out in this regard
efficient process flow.
31. Sixth, the complainant requests that the settlement decision “shall include that
defendant [settling party] waives any civil and other rights
claims related to the settlement, for example but not limited to the
case of negative reporting regarding the settlement.”
• The Disputes Chamber rejects this request for the following reason. This does not concern any
essential request in light of the complainant's grievances expressed in his
complaint.
32. Seventh, the complainant requests that the settlement decision be published on the
website of the Data Protection Authority.
• The Disputes Chamber can grant this request, through section III of this decision. Decision 159/2023 — 9/23
III. Publication of the decision
33. Considering the importance of transparency with regard to decision-making
Dispute Chamber, this decision will be published on the website of the
Data Protection Authority. The name and personal data of the
complainant, as these are not relevant for transparency regarding the
settlement procedure.
34. However, the Disputes Chamber does choose the names of the representative of the
complaining to the settling party. After all, it is in the social interest that
the citizen can become aware, in the most transparent manner, of settlement procedures
lead to (visual) interventions on frequently visited websites such as the website at issue. Per
definition, after all, the journalistic publications on this contested website are aimed at one
wide audience, and the visitor to such a website has an interest in taking note of it
the data protection related aspects. The Disputes Chamber points out for the sake of completeness
points out that the complainant's representative himself publicized the complaint.
FOR THESE REASONS ,
the Disputes Chamber of the Data Protection Authority will decide
- on the basis of Article 95, § 1, 2° of the WOG, the settlement as accepted by the
settling party on November 24, 2023, subject to the terms and conditions
laid down and clarified in the present decision and its appendix.
Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the
notice, an appeal against this decision will be filed with the Market Court (court of
appeal Brussels), with the Data Protection Authority as defendant.
Such an appeal can be lodged by means of an inter partes petition
must contain statements listed in Article 1034ter of the Judicial Code. It
an objection petition must be submitted to the registry of the Market Court
7The petition states, under penalty of nullity:
1° the day, month and year;
2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
company number;
3° the surname, first name, place of residence and, where applicable, the capacity of the person to be
summoned;
4° the subject matter and brief summary of the grounds of the claim;
5° the judge before whom the claim is brought;
6° the signature of the applicant or his lawyer. Decision 159/2023 — 10/23
in accordance with Article 1034quinquies of the Dutch Civil Code. , 8 or via the e-Deposit
IT system of Justice (Article 32ter of the Judicial Code).
(transl.) Hielke HIJMANS
Chairman of the Disputes Chamber
8
The petition with its attachment will be sent by registered letter, in as many copies as there are parties involved.
deposited with the clerk of the court or at the registry. Decision 159/2023 — 11/23
Annex - settlement proposal Decision 159/2023 - 12/23
Dispute Chamber Only by e-mail:
For the attention of Mediafin
Havenlaan 86c, bus 309, 1000 Brussels
Secretariat Contact person: Mr. Y
T: +32 (0)2 274 48 56
Email: litigationchamber@apd-gba.be
Via email address: […]
Defendant
By email:
For the attention of NOYB-European Center for Digital
Rights, representative of Mr. X
Via email address: […]
Complainant
Bi
Your reference Our reference Attachment(s) Date
NOYB: C-062-10 DOS-2020-03281 1 20/10/2023
Subject: application of art. 95, § 1, 2° WOG – settlement proposal in the complaint file
because of mr. X regarding cookies at Mediafin (de Tijd website)
Dear,
9
The Disputes Chamber first refers to the letter it previously sent to the defendant and complainant
with the notification that the Disputes Chamber intended to submit a settlement proposal
to the parties in the current file. The present document contains this
settlement offer.
In the context of a large number of files that are before the Disputes Chamber,
resulting in long processing times for all files, the Disputes Chamber pursuant to Article 95
§ 1, 2° of the Act Establishing the Data Protection Authority (“WOG”) 10 decided to
9Letter by registered mail dated September 21, 2023.
10
B.S. January 10, 2018. Decision 159/2023 — 13/23
to propose a settlement in the aforementioned file by means of this letter (
“settlement offer”). The Disputes Chamber also takes into account the fact that a large
number of complaints regarding cookies are currently being processed. Although the theme “cookies”
belongs to the priorities of the Data Protection Authority, serves the Disputes Chamber
to carefully choose the treatment of its files, so that it covers various socially relevant matters
can handle (complaint) files with the necessary speed. The Belgian legislator has to
underlines the need for the Disputes Chamber to be able to act selectively,
to ensure effective enforcement. 12
This settlement proposal is made without any adverse acknowledgment and binds the Disputes Chamber
in no way whatsoever with regard to any position taken in refusing it
settlement offer. The Disputes Chamber refers in particular to its powers to:
whether or not to determine infringements and, if necessary, to use the hair below
European and Belgian law granted sanctioning powers. In this case it belongs
to the possibilities of the Disputes Chamber to review the file - in the event of a refusal or
if the Disputes Chamber withdraws the settlement proposal - to continue in a different manner.
If the party to whom the settlement proposal is addressed expressly refuses the proposal,
the Disputes Chamber will continue the file.
a) Procedural positioning of the settlement proposal and the settlement
The settlement proposal in this case is within the scope provided for by the legislature
“procedure prior to the decision on the merits” at the Disputes Chamber. 15 The
The Dispute Chamber therefore does not take any position regarding the necessity of any
investigative measures 16 by the Inspection Service, or the need to open the file (subsequently)
otherwise continue in accordance with the provisions of Article 95 WOG.
11 See the press release from the Data Protection Authority in this regard, available at:
https://www.gegevensbeschermingsautoriteit.be/burger/de-gba-stelt-haar-priorheden-voor-het-jaar-2023-vast
12Belgian Chamber of Representatives, Explanatory Memorandum to the Bill establishing the
Data Protection Authority, Doc. 2648/001 (Parliamentary term 54), available via:
https://www.dekamer.be/kvvcr/showpage.cfm?section=/flwb&language=nl&cfm=/site/wwwcfm/flwb/flwbn.cfm?lang=N&leg
islat=54&fileID=2648, 51; see also: E. Degraeve, “Titre 11. Autorité de control” in C. DE TERWANGNE and K. ROSIER, Le
re
Règlement sur la protection des données (RGPD/GDPR) – 1 edition, Larcier, 2018, (593)607 : « [L'autorité de contrôle]peut
It is important to exercise the missions of control and appreciation of the suitability of the plain text that is addressed. »
13See Article 58 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and with regard to free movement
of that data and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”;
14See article 100 WOG.
15See section 6.3.2. and articles 94-97 of the WOG.
16 Cfr. Article 94, 1° and 2° WOG; also compare the notification in the notification dated. 21/09/2023 to parties: “This notification was encountered
period as referred to in Article 96, §1 WOG of 30 days to apprehend the Inspection Service until the moment that the
Disputes Chamber determines that the settlement proposal does not lead or cannot lead to an actual settlement.” Decision 159/2023 — 14/23
Now the procedure for the Disputes Chamber of the Data Protection Authority cannot be the same
with the criminal law procedure, “the settlement” as provided
are not equated with the Belgian legislator under Article 95 §1 2° WOG
“amicable settlement” from criminal law. After all, the settlement within the meaning of the WOG has a sui
generic character.
In addition, the Disputes Chamber states the precise facts framed in time and space
the reason for the settlement proposal (infra). Although the Litigation Chamber, such as
mentioned earlier, hic et nunc does not make a statement about the existence of infringements, it must
on the elements present in the file in order to proceed with the settlement proposal
to go. This concerns the elements that the complainant experienced as offensive. The settlement offer
thus relates to certain facts within a certain time frame and within a certain
(technical) context, where facts that go beyond this time frame and context are not included
scope of the settlement. If a settlement is entered into, this will apply
have on the elements as reflected in the complaints of the complaining party, in this case between the
time of filing the complaint and the date of the formal settlement decision. The
The disputed period only concerns the period between the date of filing the complaint and the date
of the formal settlement decision following this settlement proposal.
In general, the Disputes Chamber frames the settlement procedurally as follows:
1. The settlement under the WOG is a settlement between:
- On the one hand, the Disputes Chamber, which undertakes to terminate the procedure, whereby it:
among other things, refrains from potentially imposing corrective measures,
- and on the other hand, the defendant who undertakes to pay a sum of money and/or
to comply with certain conditions.
2. The settlement in principle entails an acknowledgment of the facts on the part of the settling party,
but is not an admission of a violation of current legislation.
3. The scope of the settlement is in all cases limited to the facts and the time frame
that are expressly stated in the settlement proposal, respectively. the settlement are stated.
17See in particular Articles 216bis and 216ter of the Code of Criminal Procedure regarding the extinguishing of public
criminal proceedings relating to certain infringements by fulfilling certain conditions such as paying a
sum of money, as well as agreeing to implement certain measures; A.RIGLOLET, Contratdetransaction,
Larcier, Brussels, 2021 ; A. RAES, T. VAN WYNSBERGE, S. DE KEULENAER, E. DEVEUX, K. DECRAMER, A. DELADRIERE, “The
extended amicable settlement: an 'added value' or 'win-win' situation? practice.”, Panopticon, no. 36(2), 2015,
(88) M. FERNANDEZ-BERTIER and N. VAN DER EECKEN, “La transaction penale élargie déclarée inconstitutionnelle : vers une
motivation de la transaction et un contrôle jurisdictionnel suffisant et effectiveif », Droit Pénal de l'Entreprise, 2016, no. 3, (213)213. Decision 159/2023 — 15/23
4. The complainant will be heard in the realization of a possible settlement
following a complaint. The complainant is being heard about his views on both
use of the settlement instrument in this case, if the contents of the
settlement proposal on the other.
The complainant has the opportunity to take a position with regard to the proposed
settlement, at the latest within 14 days of receiving the settlement proposal.
This period does not prevent either party from providing an explanation
regarding the settlement proposal in writing or verbally (infra).
5. A settlement is formalized by means of a settlement decision, with the procedure
the procedure prior to the settlement is outlined in a transparent manner, and
whereby the conditions in the settlement proposal and those ultimately stipulated
settlement terms are expressly included (in principle by reference
to the settlement proposal, attached to the settlement decision).
6. All parties involved retain the right to make comments, in principle in writing
about the settlement proposal and its contents.
7. An unaccepted or otherwise unsuccessful settlement does not allow the continuation of the matter
file is unaffected and has no impact on any alternative handling of the file
file.
b) Substantive conditions of settlement proposal
b.1.) De Tijd (www.tijd.be)
b.1.1) first complaint of the complainant in his complaint dated. July 18, 2023
First complaint of the complainant in his complaint dated. July 18, 2023:
“Violation type 1: No 'decline' option on the first information level of the
consent banner”. In support of this complaint, the complainant adds the following two:
screenshots in the attachment:
1. Complaint, appendix 2
18In light of Article 77 of the General Data Protection Regulation, the complainant has a more extensive role than in
settlement procedures at other regulators, see e.g. the mere notification to the complaining party in the settlement procedure
at the Belgian Competition Authority, cf. article IV.59 in fine of the Code of Economic Law of 28/02/2013 (B.S.
29/03/2013). Decision 159/2023 — 16/23
2. Complaint, appendix 3
Prima facie relevant elements from policy positions and documents of the
Data Protection Authority.
1. The positions of the “Cookie Banner Taskforce” of the European Committee for
Data protection 19 and the press release of the
20
Data Protection Authority. An excerpt from that press release:
19European Data Protection Board, January 18, 2023, Report of the Work undertaken by the Cookie Banner
Taskforce, available in English at: https://edpb.europa.eu/our-work-tools/our-documents/other/report-work-
undertaken-cookie-banner-taskforce_en
20Data Protection Authority press release, February 10, 2023, Cookie banners: the EDPB publishes examples of non-
compliant practices” available at
https://www.dataprotectionauthority.be/burger/nieuws/2023/02/10/cookiebanners-de-edpb-published-
examples-of-non-compliant-practices. Decision 159/2023 — 17/23
“Missing a “deny all” button at the same level as the button
“accept everything”. Most data protection authorities, including the DPA,
believed that this was an infringement and that the user of a website
at the same time must have the option to accept or refuse the
placing/reading cookies on his device.”
2. The “cookie checklist” of the Belgian Data Protection Authority
“I do not provide an “accept all cookies” (or similar) button without the same
“low” a “refuse all not strictly necessary cookies” (or similar) button
provided"
Proposal condition one settlement proposal:
The defendant provides a similar “refuse all” option on the “De Tijd” website
place where “agreement and conclusion” is now indicated, within one month after the date of the
settlement decision, or implements a practice of equivalent effect within the same
period of time. The technical adjustments that the defendant makes for this purpose are recorded in a document
clear document at the time of implementation, and forwarded to the
Dispute Chamber and the complainant. Both the implementation of the technical implementation and the
preparation and forwarding of the document showing the implementation is done within the
month after the settlement decision.
b.1.2) second complaint of the complainant in his complaint dated. July 18, 2023
Second complaint of the complainant in his complaint dated. July 18, 2023:
“Violation type 2: Misleading button colors, more specifically, the complainant is advised to use
a different and more eye-catching color for accepting cookies a
would infringe the relevant legislation. In support of this complaint, the complainant adds:
following two screenshots in the attachment:
1. Complaint, appendix 2
21A copy of this “cookie checklist” is attached to this settlement proposal; This is until publication on the website
document confidential. Decision 159/2023 — 18/23
2. Complaint, appendix 3
Prima facie relevant elements from policy positions and documents of the
Data Protection Authority.
1. The “cookie checklist” of the Belgian Data Protection Authority
I do not use techniques that can be qualified as “deceptive design”.
(e.g. nudging through the use of color)
2. The positions of the “Cookie Banner Taskforce” of the European Committee for
Data protection and the press release from the Data Protection Authority.
An excerpt from that press release and from the January 17 Task Force report
2023 respectively:
22See also our earlier press release: https://www.gegevensbeschermingsautoriteit.be/burger/nieuws/2023/02/24/deceptive-
design-patterns-how-to-recognize-and-avoid-these-on-social-networks Decision 159/2023 — 19/23
Misleading design. The task force draws attention to several species
misleading practices regarding banner formatting.
To assess the conformity of a banner, it must be determined on a case-by-case basis
the contrast and colors used are not clearly misleading to the
users and do not lead to an unintended and therefore invalid consent from the
users. Consequently, it was also agreed that a case-by-case analysis is necessary to
specific cases, although some examples have been identified
23
features that clearly conflict with the provisions of the ePrivacy Directive.
Proposal condition two settlement proposal:
The defendant undertakes to follow the option where a “refuse all” option
of the possible acceptance of condition 1 of the present settlement proposal – behind
is not less (visually) attractive than the partially or
fully accept the placing of cookies that are not strictly necessary, and this within one
month after the settlement decision. The technical adjustments that the defendant makes for this purpose
are recorded in a clear document at the time of implementation, and
forwarded to the Disputes Chamber and the complainant. Both the implementation of the technical
implementation, as well as drafting and forwarding the document that implements it
will be made within one month of the settlement decision.
b.1.2) The complainant's third complaint in his complaint dated. July 18, 2023
The complainant's third complaint in his complaint dated. July 18, 2023:
“Violation type 3: it is not as easy to withdraw consent as it is to
to give permission”. In support of this complaint, the complainant adds the following two:
screenshots in the attachment:
1. Complaint, appendix 4
23Original text in English: In order to assess the conformity of a banner, a case-by-case verification must be carried out
in order to check that the contrast and colors used are not obviously misleading for the users and do not result in an
unintended and, as such, invalid consent from them. As a result, it was also agreed that a case-by-case analysis would be
necessary to address specific cases, although some examples of features manifestly contradictory to the e-privacy Directive
provisions have been identified. Decision 159/2023 — 20/23
Prima facie relevant elements from policy positions and documents of the
Data Protection Authority.
1. The “cookie checklist” of the Belgian Data Protection Authority:
I provide a mechanism to withdraw consent as easily as withdrawing it
such as by placing a clearly visible link or button where the cookie
settings can be managed and consent can be withdrawn with one click
become;
2. The positions of the “Cookie Banner Taskforce” of the European Committee for
Data protection and the press release of the Data Protection Authority.
An extract from the Taskforce report of 17 January 2023:
In addition to the consent collection requirements to be valid in
be in accordance with the GDPR and pursuant to Article 5(3) E-Privacy Directive
three additional cumulative conditions required: (i) the ability to
withdraw consent, (ii) the ability to withdraw consent at any time
withdraw, (iii) withdrawing consent should be as easy as giving it
of consent. 24
Proposalconditionthreesettlementproposal:ThedefendantcommitstoOoom,withinone
period of one month, to develop and implement a mechanism on the website of
“The Time” that meets the requirements stated in the aforementioned
policy documents; the Defendant also undertakes that the withdrawal of the
consent does not involve more steps (in this case “clicks”) than are necessary for giving the consent
permission. This is done via an equivalent number of steps as soon as the end user completes the
has reached the cookie settings page; this page must be clearly accessible from any user
page of the contested website.
24In addition to the requirements for the collection of consent to be valid in accordance with the GDPR and under Article 5(3)
ePrivacyDirective, three additional cumulative conditions aremandatory(i)thepossibilitytowithdraw consent, (ii)theabilityto
withdraw consent at any time, (iii)withdrawal of consent must be as easy as to give consent. Decision 159/2023 — 21/23
c) Written and oral exchanges with parties
c.1.: written exchanges
The settlement proposal is the starting point of the settlement procedure. The conditions
However, this proposal may be used during the further course of the settlement procedure
be clarified or otherwise adjusted, especially in the case of such adjustments
bring improvements in light of data protection legislation.
Such requests do not automatically extend the term.
In principle, the parties contact the Disputes Chamber in writing when they:
consider it useful to make certain adjustments to the terms of the settlement proposal
to do. It is up to the Disputes Chamber to decide on the basis of this communication
parties to make an adjustment to the settlement proposal.
In this sense, a constructive attitude on the part of the parties is encouraged. The
Disputes Chamber expects requests to be made in a reasonable and proportionate manner.
When, in the view of the Disputes Chamber, the requests demonstrate the fact that a
settlement is little or not likely, this may lead to the withdrawal of the agreement
settlement offer.
c.2. verbal exchanges
Both parties can request oral explanation of the settlement proposal or
direct subsequent communications to the Disputes Chamber, whereby it is up to the Disputes Chamber
25
able to assess the relevance of such verbal exchanges.
It goes without saying that this is a favor and that the Disputes Chamber will take this into account
purely in function of an efficient process flow.
An official report will be drawn up that, in principle, merely records the occurrence of the incident
determines the oral explanation moment.
Both parties are free to participate in the Disputes Chamber
organized oral explanation moments. The conversations are confidential.
No communication may be made to third parties about the content of what has been discussed.
25 “Settlement discussions” are a well-known legal practice within the regulatory landscape, compare in particular the
procedure before the Belgian Competition Authority in articles IV.55 et seq. (“Subsection 4 – Settlement procedure”)
of the Economic Law Code of 28/02/2013 (B.S. 29/03/2013) and the mention of such settlement discussions
there. Decision 159/2023 — 22/23
d) Term
Mediafin must respond within 30 days of receipt of this settlement proposal
comment. The (representative of the) complainant can do so within 14 days of receipt
in this letter take a position on the initial settlement proposal and the underlying one
conditions.
e) The existence of other controllers and/or processors
This settlement proposal is only addressed to Mediafin. It does not take a position on whether and to what extent
there are other actors responsible for the potential breaches that gave rise
to the present settlement proposal.
f) Validation of the settlement
When the settlement proposal becomes a formal settlement decision by express
acceptance by the party to whom the settlement proposal is addressed within the aforementioned
period, an appeal can be lodged against this by any “grievous party”. 26
The final settlement does not prejudice the rights of any individuals [ERRATUM]
who have suffered damage to claim compensation before a civil court
on the basis of, among other things, Article 82 GDPR.
g) Appeal against the settlement offer
Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the
notice to appeal against this decision to make a settlement offer
registered with the Market Court (Brussels Court of Appeal), with the
Data Protection Authority as defendant.
Such an appeal can be lodged by means of an inter partes petition
27
The entries listed in Article 1034ter of the Judicial Code must contain.
26
Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the notification, this
decision will be appealed to the Market Court (Brussels Court of Appeal), with the
Data Protection Authority as defendant.
Such an appeal may be lodged by means of a petition against the objection referred to in Article 1034ter of the
Judicial Code must contain listed entries. The petition must be contradicted
submitted to the registry of the Market Court in accordance with Article 1034quinquies of the Dutch Civil Code, or via the Deposit
IT system of Justice (Article 32ter of the Judicial Code).
27The petition states, under penalty of nullity:
7° the day, month and year;
8° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
company number; Decision 159/2023 — 23/23
an objection petition must be submitted to the registry of the Market Court
28
in accordance with Article 1034quinquies of the Dutch Civil Code. , or via the e-Deposit
IT system of Justice (Article 32ter of the Judicial Code).
Yours faithfully
Hielke Hijmans
Chairman of the Disputes Chamber
9° the surname, first name, place of residence and, where applicable, the capacity of the person to be
summoned;
10°the subject matter and brief summary of the grounds of the claim;
11° the judge before whom the claim is brought;
12° the signature of the applicant or his lawyer.
28The petition with its attachment will be sent by registered letter in as many copies as there are parties involved
deposited with the clerk of the court or at the registry.
