APD/GBA (Belgium) - 38/2024
From GDPRhub
| APD/GBA - 38/2024 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 7(3) GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | 09.08.2022 |
| Decided: | 21.02.2024 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 38/2024 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | French |
| Original Source: | APD (in FR) |
| Initial Contributor: | nzm |
The DPA dismissed a cookie complaint regarding the absence of a “withdraw consent” option as the controller set one up before the DPA’s investigation.
English Summary
Facts
A data subject represented by noyb (European Centre for Digital Rights) complained that a website did not provide a “withdraw consent” or similar options. Therefore, noyb considered that the cookie banner infringed both the GDPR as well as the ePrivacy directive as it was not as easy to give consent as it was to withdraw it.
On 9 August 2022, the data subject lodged a complaint with the Belgian DPA (“APD”).
Holding
On 24 August 2022, the APD visited the controller’s website and discovered that the cookie banner included an "Accept all" button, a “Reject all” button and a “Cookie settings” button. The APD therefore considered that the sole infringement invoked by the data subject was no longer founded. These findings were still applicable on 19 February 2024, thus, the APD decided to close the case.
Additionally, the APD also found that none of the categories of non-essential cookies were ticked by default.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/6
Litigation Chamber
Decision 38/2024 of February 21, 2024
File number: DOS-2022-03263
Subject: Complaint due to the processing of personal data through
of a website, without the valid consent of the person concerned
The Litigation Chamber of the Data Protection Authority, made up of Mr.
Hielke HIJMANS, president, sitting alone;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the
protection of natural persons with regard to the processing of personal data and
to the free movement of these data, and repealing Directive 95/46/EC (general regulation on the
data protection), hereinafter “GDPR”;
Having regard to the Law of December 3, 2017 establishing the Data Protection Authority, hereinafter
“ACL”;
Having regard to the Law of July 30, 2018 relating to the protection of individuals with regard to
processing of personal data, hereinafter “LTD”;
Having regard to the Internal Regulations as approved by the House of Representatives on
December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Has taken the following decision regarding:
The complainant: X, hereinafter “the complainant”, represented by NOYB - EUROPEAN CENTER FOR
DIGITALR IGHTS, Goldschlagstraße 172/4/3/2 – 1140 Vienna (Austria)
The defendant: Y, hereinafter “the defendant” Decision 38/2024 — 2/6
I. Facts and procedure
1. The complaint concerns processing of personal data through the page
internal […], without the valid consent of the person concerned.
The complainant states that she visited the website on 22-10-2021. This web page presented
a “banner” of a consent management platform (hereinafter, “Z1”) provided by
Z2. Ended on 10-06-2022, the complainant signs a mandate of representation, in accordance
in Article 80(1) GDPR, with NOYB.
The complaint mentions several personal data processing operations,
in the context of providing the web page, allegedly based on consent
of the person concerned. More precisely, the complaint alleges an infringement of the GDPR as well
than the ePrivacy Directive (ePD), namely that it would not be as easy to withdraw your
consent than giving it. According to the complaint, the option to accept the activities
of processing concerned appears prominently in the banner, but the complainant does not
was able to easily find the option allowing him to withdraw his consent. There was no
notably no clearly visible button entitled “withdraw consent” or options
similar. The complaint also specifies that despite the possibility that Z2 offers to display on
all pages have a floating and permanently visible icon, allowing people to
concerned to return to their cookie settings in order to withdraw their consent, the
defendant deliberately chose not to activate this option.
2. On August 9, 2022, the complainant filed a complaint with the Data Protection Authority.
3. On August 9, 2022, the First Line Service of the Data Protection Authority
declares the complaint admissible on the basis of articles 58 and 60 of the LCA, and transmits it
er
to the Litigation Chamber in accordance with article 62, § 1 of the LCA.
II. Motivation
4. Based on the facts described in the complaint file as summarized above, and on the
basis of the powers assigned to it by the legislator under article 95, § 1
of the LCA, the Litigation Chamber decides on the follow-up to be given to the file; as it happens,
the Litigation Chamber decides to proceed with the classification without further action of the complaint,
in accordance with article 95, § 1, 3° of the LCA, for the reasons set out below.
5. In matters of dismissal, the Litigation Chamber is required to provide reasons for its decision.
1
decision by step and to:
1Market Court (Brussels Court of Appeal), September 2, 2020, judgment 2020/AR/329, p. 18. Decision 38/2024 — 3/6
- pronounce a classification without technical follow-up if the file does not contain or not
sufficient evidence likely to lead to a sanction or if it includes a
technical obstacle preventing it from rendering a decision;
- or pronounce a classification without further opportunity, if despite the presence
of elements likely to lead to a sanction, the continuation of the examination of the
file does not seem appropriate given the priorities of the Authority of
data protection as specified and illustrated in the Privacy Policy
classification without further action by the Litigation Chamber. 2
6. In the event of dismissal based on several reasons for dismissal, these
last (respectively, classification without technical follow-up and classification without follow-up
opportunity) must be treated in order of importance.3
7. In this case, the Litigation Chamber decides to proceed with a classification without further action.
the complaint on grounds of expediency. The decision of the Litigation Chamber is based
more precisely on a reason for which it considers it inappropriate to pursue
the follow-up of the file, and therefore decides not to proceed, among other things, with an examination
of the case as to its merits.
8. In this case, the Litigation Chamber was able to note, on August 24, 2022, that the
site concerned by the complaint presented a cookie banner including not only a
button allowing you to reject all (non-essential) cookies, but also included
a functional URL address at the bottom of the page, entitled “Cookie Settings”:
2
In this regard, the Litigation Chamber refers to its policy of classification without further action as developed and published on the
website of the Data Protection Authority: https://www.autoriteprotectiondonnees.be/publications/politique-de-
classification-without-suite-of-the-contentious-chamber.pdf.
3Cf. Title 3 – In what cases is my complaint likely to be dismissed by the Litigation Chamber? of the
policy of dismissal without further action by the Litigation Chamber. Decision 38/2024 — 4/6
It therefore appears that the only violation invoked by the complaint is no longer founded from the
datementioned.TheContentiousChamberconsequentlydecidestoclassifywithoutfurther
the complainant's grievance, taking into account the fact that the subject of the complaint has disappeared due to the
measures taken by the controller before transferring the complaint to the Chamber
4
Litigation by the APD Front Line Service. The Litigation Chamber
further emphasizes that the above findings still apply as of 19
February 2024:
9. In the alternative, the Litigation Chamber was also able to observe, on the occasion of this
visit to the site concerned, that none of the categories of non-essential cookies were checked
by default. The Litigation Chamber recalls in this regard that the European Committee of
Data Protection (EDPB) adopted, on January 17, 2023, the report established by the group
5
work on cookie banners (“Cookie Banner Taskforce”), in which the
European supervisory authorities have notably adopted a common position on
the prohibition of using pre-selected preferences authorizing the placement and
reading of non-essential cookies, as well as the obligation to provide the possibility for
users to easily withdraw their consent at any time. Bedroom
litigation notes that the data controller has, in the present case, configured
the cookies banner in accordance with the requirements listed in the report
aforementioned.
10. Finally, the Litigation Chamber specifies that it is not necessary to rule on
the complainant's interest in taking action in the specific case, given the reasons for dismissal
stated above.
4Cf. criterion B.6 in the Dispute Chamber's policy of dismissal.
5EDPB – Report on the work undertaken by the Cookie Banner Taskforce (adopted on 17 January 2023), available at the link
following: https://edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf. Decision 38/2024 — 5/6
III. Publication and communication of the decision
11. Considering the importance of transparency regarding the process
decision-making and the decisions of the Litigation Chamber, this decision will be published on the
website of the Data Protection Authority. However, it is not necessary for this
so that the identification data of the parties are directly communicated.
12. In accordance with its policy of dismissal, the Litigation Chamber
6
will communicate the decision to the defendant. Indeed, the Litigation Chamber decided to
communicate the decisions of dismissal to the defendants by default. There
Chambre Litigation, however, refrains from such communication when the complainant
requested anonymity vis-à-vis the defendant and when the communication of the decision to the
defendant, even pseudonymized, nevertheless risks allowing his reidentification. This 7
is not the case in the present case.
FOR THESE REASONS ,
the Litigation Chamber of the Data Protection Authority decides, after
deliberation, to classify this complaint without further action in application of article 95,§ 1, 3° er
of the LCA.
In accordance with article 108, § 1 of the LCA, an appeal against this decision may be lodged,
within thirty days from its notification, to the Court of Markets (court
of Appeal of Brussels), with the Data Protection Authority as defendant.
Such an appeal may be introduced by means of an interlocutory request which must contain the
information listed in article 1034ter of the Judicial Code. The interlocutory request must be
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 9
via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. judic.).
6
Cf.Title 5–Will the classification without further action be published? Will the opposing party be informed? of the classification policy
without further action by the Contentious Chamber.
7Ibidem.
8The request contains barely any nullity:
1° indication of the day, month and year;
2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualifications and his national register number or
Business Number;
3° the surname, first name, address and, where applicable, the status of the person to be summoned;
4° the object and summary of the grounds of the request;
5° indication of the judge who is seized of the request;
6° the signature of the applicant or his lawyer.
9 The request, accompanied by its annex, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court registry. Decision 38/2024 — 6/6
To enable it to consider any other possible course of action, the Litigation Chamber refers
the complainant to the explanations provided in its policy of dismissal. 10
(sé). Hielke HIJMANS
President of the Litigation Chamber
10Cf. Title 4 – What can I do if my complaint is closed? of the Chamber's policy of dismissal
Contentious.
