APD/GBA (Belgium) - 157/2023
From GDPRhub
| APD/GBA - DOS-2023-04144 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 21(2) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 20.10.2023 |
| Decided: | 27.11.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | DOS-2023-04144 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | APD (in NL) |
| Initial Contributor: | n/a |
Belgian Data Protection Authority issued a preliminary decision in which, on the basis of Article 21 of GDPR it orders the controller to comply with a request of data subject to delete data used for direct marketing communication.
English Summary
Facts
The plaintiff received marketing information from the defendant on 21 June 2023. The next day, on 22 June 2023 they requested that the marketing information is no longer being send and unsubscribed from the newsletter. Despite that request, the plaintiff continued to receive marketing e-mails from the defendant. Plaintiff notified the defendant of this fact on September 6. After receiving again marketing e-mail communication, the plaintiff lodged a complaint with the ADP on October 6.
Holding
ADP noted that the Belgian law does not contain any specific definition of direct marketing. Similarly, such legal, official or generally accepted definition does not exist at European level. With that in mind, the ADP decided to build on the definition provided in CBPL Recommendation No. 02/2013 of 30 January 2013 on direct marketing and protection of personal data on the one hand and the proposal of Regulation of the European Parliament and of the Council of 18 September 2019 on respect for privacy and the protection of personal data in electronic communications and repealing Directive 2002/58/EC123.
With this in in mind, the ADP notes that on the basis of Article 21 GDPR, each person has a right to object to having their data processed for direct marketing. Under the definition of direct marketing used by the authority, communication to the plaintiff could have been considered to be direct marketing, and as such the defendant should have answered in accordance with requirements of art 12 of GDPR. As the plaintiff continued to receive marketing information, clearly the data was not deleted pursuant to the plaintiff exercising their right to objection, and thus the authority could require them to reject such information. Decision issued in the case was a preliminary one on the basis of art 100 para 6 Loi portant création de l'Autorité de protection des données, which allows the Authority to issue a preliminary decision in which it orders that the requests of the person concerned to exercise his rights be complied with.
Decision is not final and the controller may present its own claims.
Comment
CBPL Recommendation defines direct marketing as follows:
(32) In this Regulation, direct marketing refers to any form of advertising by which a natural or legal person sends direct marketing communications directly to one or more identified or identifiable end-users using electronic communications services. In addition to the offering of products and services for commercial purposes, this should also include messages sent by political parties that contact natural persons via electronic communications services in order to promote their parties. The same should apply to messages sent by other non-profit organisations to support the purposes of the organisation.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/7 Dispute Chamber Decision 157/2023 of November 27, 2023 File number: DOS-2023-04144 Subject: Removal of email address from a mailing list for marketing purposes The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke HIJMANS, sole chairman; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and regarding the free movement of such data and to the revocation of Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”; Having regard to the law of 3 December 2017 establishing the Data Protection Authority, hereinafter “WOG”; In view of the internal rules of order, as approved by the House of Representatives Representatives on December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019; Considering the documents in the file; Made the following decision regarding: The complainant: Mr. The defendant: Mrs. Y, hereinafter “the defendant”. Decision 157/2023 — 2/7 I. Facts and procedure 1. The complaint relates to the insufficient compliance with the complainant's right to to object to the receipt of unwanted direct marketing emails. The complainant will receive direct marketing from the defendant on June 21, 2023. On June 22, 2023 requests the complainant to be unsubscribed from the mailing list. Confirmed the same day the defendant that the complainant was unsubscribed from the newsletters. On September 6 2023, the complainant informs the defendant that he is still receiving direct marketing. After the complainant receives direct marketing again on October 6, 2023, the complainant brings informs the defendant that he will file a complaint with the GBA. 2. On October 7, 2023, the complainant will submit a complaint to the Data Protection Authority against the defendant. 3. On October 20, 2023, the complaint will be declared admissible by the First Line Service on under Articles 58 and 60 of the WOG1 and the complaint is filed under Article 62, § 1 of the WOG transferred to the Disputes Chamber2 . II. Justification 4. The complainant wishes to unsubscribe from the defendant's newsletters. The GDPR does not define what is meant by “direct marketing”. To date, none exists legal, official or generally accepted definition of this concept at European level. Building on Recommendation No. 02/2013 of the CBPL of January 30, 2013 regarding direct marketing and protection of personal data on the one hand and the proposal of regulation of the European Parliament and of the Council of 18 September 2019 on respect for privacy and the protection of personal data in electronic communications and repealing Directive 2002/58/EC123 , the GBA proposes to define the concept of direct marketing as follows: “Any communication, in any form, solicited or unsolicited, originating from a organization or person and aimed at the promotion or sale of services, products (al without payment), as well as brands or ideas, addressed by an organization or person acting in a commercial or non-commercial context, who directly 1 In accordance with Article 61 of the WOG, the Disputes Chamber hereby informs the parties that the complaint is admissible declared. 2 In accordance with Article 95, § 2 of the WOG, the Disputes Chamber hereby informs the parties that the file will be sent to has been transferred to her as a result of this complaint. 3 The text can be found via this link: https://eur-lex.europa.eu/legalcontent/EN/TXT/PDF/?uri=CONSIL:ST_12293_2019_INIT&from=EN Decision 157/2023 — 3/7 is addressed to one or more natural persons in a private or professional context and which involves the processing of personal data.” 4 5. The (unsolicited) communication is aimed at promoting the activities and the promoting the defendant's image to the public, in this case cooperation to the development of legislation. The message is addressed to identified persons natural persons (cf. the address by name of the recipients) and becomes sent via electronic communication, more specifically by e-mail. The Dispute Chamber therefore concludes that the newsletters received by the complainant are direct marketing to finish. 6. Article 21.2 GDPR stipulates that every data subject whose personal data is used for direct marketing has the right to “object to the processing of him concerning personal data for such marketing, including profiling relates to direct marketing". The third paragraph of the same article stipulates that "[w]hen the data subject objects to processing for direct marketing, the personal data will no longer be processed for these purposes." When a data subject objects to the processing of data for direct marketing purposes, he does not have to justify his objection. 7. In accordance with Article 12.3 GDPR, the controller provides the person concerned without delay and in any case within one month of receipt of the request pursuant to Articles 15 to 22 GDPR information about the action taken on the request is given. Depending on the complexity of the requests and the number of requests that period may be extended by a further two months if necessary. The the controller shall inform the data subject within one month of receipt of the request of such extension. 8. The Disputes Chamber determines that the complainant's personal data, such as his email address, have indeed been used for direct marketing, since the complainant is a direct marketing email on June 22, 2023. The Disputes Chamber also states fixed the request dated. June 23, 2023 from the complainant to be removed from the mailing list constitutes the exercise of his right to object within the meaning of Article 21.2 GDPR, because his request that his data may no longer be used for a specific purpose, namely direct marketing. 9. It is the responsibility of the defendant, in her capacity controller, to respond to the exercise of the rights of the data subjects in accordance with the conditions of Article 12.3 of the GDPR (see above, marginal number 5). The Disputes Chamber notes that the answer dated June 23, 2023 of the 4 https://www.gegevensbeschermingsautoriteit.be/publications/aanadvies-nr.-01-2020.pdf Decision 157/2023 — 4/7 defendant to the request for removal from the complainant's mailing list in a timely manner answer constitutes a response in accordance with Article 12.3 GDPR. However, the complainant submits documents which shows that he received another direct marketing email on October 6, 2023. The The Disputes Chamber can deduce from this that appropriate action may not have been taken to the complainant's objection. 10. The Disputes Chamber is of the opinion that on the basis of the above analysis concluded that the defendant had violated the provisions of the GDPR committed, which justifies taking a decision in this case decision on the basis of Article 95, § 1, 5° of the WOG, more specifically the defendant order to comply with the claimant's request to object to the processing of his data for direct marketing purposes in accordance with Article 21.2 GDPR. 11. This decision is a prima facie decision taken by the Disputes Chamber in accordance with Article 95 of the WOG on the basis of the complaint submitted by the complainant, in the context of the “procedure prior to the decision on the merits” 5 and none decision on the merits of the Disputes Chamber within the meaning of Article 100 of the WOG. The Disputes Chamber has thus decided, on the basis of Article 58.2.c) GDPR and Article 95, § 1, 5° of the WOG, to order the defendant to comply with the request of the data subject to exercise his rights, in particular the right to object such as determined in article 21.2 GDPR. 12. The purpose of this decision is to inform the defendant of the fact that it has committed an infringement of the provisions of the GDPR and this is possible to still comply with the aforementioned provisions. 13. However, if the defendant does not agree with the contents of this fine facie decision and is of the opinion that it may allow factual and/or legal arguments funds that could lead to a different decision can be made via the e-mail address litigationchamber@apd-gba.be send a request to hear the merits of the case to the Disputes Chamber within 30 days of notification decision. The implementation of this decision will be carried out if necessary suspended for the aforementioned period. 14. In the event of a continuation of the merits of the case, the Dispute Chamber the parties on the basis of Articles 98, 2° and 3° in conjunction with Article 99 WOG invite them to submit their defenses as well as any documents they consider useful in the case file to add. If necessary, the present decision will be permanently suspended. 5 Section 3, Subsection 2 of the WOG (Articles 94 to 97). Decision 157/2023 — 5/7 15. Finally, for the sake of completeness, the Disputes Chamber points out that a hearing on the merits of the case may lead to the imposition of the measures stated in Article 100 WOG6 . III. Publication of the decision 16. Considering the importance of transparency with regard to decision-making Dispute Chamber, this decision will be published on the website of the Data Protection Authority. However, it is not necessary that the identification details of the parties are disclosed directly. 6 Article 100. § 1. The Disputes Chamber has the authority to: 1° to dismiss a complaint; 2° to order the dismissal of prosecution; 3° order the suspension of the ruling; 4° to propose a settlement; 5° formulate warnings and reprimands; 6° order that the data subject's requests to exercise his rights be complied with; 7° to order that the person concerned is informed of the security problem; 8° order that processing be temporarily or permanently frozen, restricted or prohibited; 9° to order that the processing be brought into compliance; 10° the rectification, restriction or deletion of data and its notification to the recipients of the data recommend data; 11° order the withdrawal of the recognition of certification bodies; 12° to impose penalty payments; 13° to impose administrative fines; 14° the suspension of cross-border data flows to another State or an international institution command; 15° to transfer the file to the public prosecutor's office in Brussels, who will inform it of the follow-up given to the file; 16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. Decision 157/2023 — 6/7 Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the notice, an appeal against this decision will be filed with the Market Court (court of appeal Brussels), with the Data Protection Authority as defendant. FOR THESE REASONS, the Disputes Chamber of the Data Protection Authority decides, with reservations from the submission of a request by the defendant for a hearing on the merits in accordance with Article 98 et seq. of the WOG, to: - on the basis of Article 58.2.c) of the GDPR and Article 95, § 1, 5° of the WOG the order the defendant to comply with the data subject's request to exercise its rights, in particular the right to object (Article 21.2 GDPR), and to delete the personal data from the mailing list immediately marketing purposes and this within 30 days from the notification of this decision; - order the defendant to contact the Data Protection Authority (Dispute Chamber) by e-mail within the same period of the consequences this decision will be given via the email address litigationchamber@apd-gba.be; and - in the absence of timely implementation of the above stated by the defendant, to consider the merits of the case ex officio in accordance with Articles 98 et seq. of the WOG. Decision 157/2023 — 7/7 Such an appeal can be lodged by means of an inter partes petition must contain information listed in Article 1034ter of the Judicial Code7 . It an objection petition must be submitted to the registry of the Market Court in accordance with article 1034quinquies of the Ger.W.8 , or via the e-Deposit IT system of Justice (Article 32ter of the Judicial Code). (get). Hielke HIJMANS Chairman of the Disputes Chamber 7 The petition states, under penalty of nullity: 1° the day, month and year; 2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or company number; 3° the surname, first name, place of residence and, where applicable, the capacity of the person to be summoned; 4° the subject matter and brief summary of the grounds of the claim; 5° the judge before whom the claim is brought; 6° the signature of the applicant or his lawyer. 8 The petition with its appendix will be sent by registered letter in as many copies as there are parties involved deposited with the clerk of the court or at the registry.
