| APD/GBA - DOS-2023-04144 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 21(2) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 20.10.2023 |
| Decided: | 27.11.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | DOS-2023-04144 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | APD (in NL) |
| Initial Contributor: | n/a |
The Belgian DPA issued a preliminary decision in which it ordered the controller to comply with a request of the complainant to delete data used for direct marketing communication, following the complainant's objection request pursuant to Article 21 GDPR.
English Summary
Facts
The complainant received direct marketing information from the controller on 21 June 2023.
The next day, on 22 June 2023, the complainant requested to be unsubscribed from the newsletter and the controller to stop sending them marketing information. Despite the request, the complainant continued to receive marketing e-mails from the controller.
Thus, on 6 September 2023, the complainant notified the controller of the direct marketing information. After receiving another marketing e-mail communication on 6 October, the complainant informed the controller it would file a complaint with the Belgian DPA, which it did on 7 October 2023.
Holding
The Belgian DPA noted that Belgian law does not contain any specific definition of "direct marketing". Similarly, a legal, official or generally accepted definition does not exist at the European level either. With that in mind, the DPA decided to build on the definition provided in Recommendation No. 02/2013 of 30 January 2013 of the Belgian Privacy Advisory Commission on direct marketing and protection of personal data and the proposal of Regulation of the European Parliament and of the Council of 18 September 2019 on respect for privacy and the protection of personal data in electronic communications and repealing Directive 2002/58/EC123.
With this in mind, the DPA noted that on the basis of Article 21(2) GDPR, each person has a right to object to having their data processed for direct marketing. Under the definition of direct marketing considered by the authority, the communication to the complainant could have been considered to be direct marketing, and as such, the controller should have answered in accordance with the requirements of Article 12 GDPR and within the time limit set in Article 12(3) GDPR. As the complainant continued to receive marketing information, even after the objection request made by the complainant, clearly the processing of data had not stopped.
It must be noted that the decision issued in this case is a preliminary one on the basis of Article 100 para 6 Loi portant création de l'Autorité de protection des données, which allows the DPA to issue a preliminary decision in which it orders that the requests of the person concerned to exercise his rights be complied with.
Comment
It must be noted that the decision is not final and the controller may still present its own claims.
CBPL Recommendation defines direct marketing as follows:
(32) In this Regulation, direct marketing refers to any form of advertising by which a natural or legal person sends direct marketing communications directly to one or more identified or identifiable end-users using electronic communications services. In addition to the offering of products and services for commercial purposes, this should also include messages sent by political parties that contact natural persons via electronic communications services in order to promote their parties. The same should apply to messages sent by other non-profit organisations to support the purposes of the organisation.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/7 Dispute Chamber Decision 157/2023 of November 27, 2023 File number: DOS-2023-04144 Subject: Removal of email address from a mailing list for marketing purposes The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke HIJMANS, sole chairman; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and regarding the free movement of such data and to the revocation of Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”; Having regard to the law of 3 December 2017 establishing the Data Protection Authority, hereinafter “WOG”; In view of the internal rules of order, as approved by the House of Representatives Representatives on December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019; Considering the documents in the file; Made the following decision regarding: The complainant: Mr. The defendant: Mrs. Y, hereinafter “the defendant”. Decision 157/2023 — 2/7 I. Facts and procedure 1. The complaint relates to the insufficient compliance with the complainant's right to to object to the receipt of unwanted direct marketing emails. The complainant will receive direct marketing from the defendant on June 21, 2023. On June 22, 2023 requests the complainant to be unsubscribed from the mailing list. Confirmed the same day the defendant that the complainant was unsubscribed from the newsletters. On September 6 2023, the complainant informs the defendant that he is still receiving direct marketing. After the complainant receives direct marketing again on October 6, 2023, the complainant brings informs the defendant that he will file a complaint with the GBA. 2. On October 7, 2023, the complainant will submit a complaint to the Data Protection Authority against the defendant. 3. On October 20, 2023, the complaint will be declared admissible by the First Line Service on under Articles 58 and 60 of the WOG1 and the complaint is filed under Article 62, § 1 of the WOG transferred to the Disputes Chamber2 . II. Justification 4. The complainant wishes to unsubscribe from the defendant's newsletters. The GDPR does not define what is meant by “direct marketing”. To date, none exists legal, official or generally accepted definition of this concept at European level. Building on Recommendation No. 02/2013 of the CBPL of January 30, 2013 regarding direct marketing and protection of personal data on the one hand and the proposal of regulation of the European Parliament and of the Council of 18 September 2019 on respect for privacy and the protection of personal data in electronic communications and repealing Directive 2002/58/EC123 , the GBA proposes to define the concept of direct marketing as follows: “Any communication, in any form, solicited or unsolicited, originating from a organization or person and aimed at the promotion or sale of services, products (al without payment), as well as brands or ideas, addressed by an organization or person acting in a commercial or non-commercial context, who directly 1 In accordance with Article 61 of the WOG, the Disputes Chamber hereby informs the parties that the complaint is admissible declared. 2 In accordance with Article 95, § 2 of the WOG, the Disputes Chamber hereby informs the parties that the file will be sent to has been transferred to her as a result of this complaint. 3 The text can be found via this link: https://eur-lex.europa.eu/legalcontent/EN/TXT/PDF/?uri=CONSIL:ST_12293_2019_INIT&from=EN Decision 157/2023 — 3/7 is addressed to one or more natural persons in a private or professional context and which involves the processing of personal data.” 4 5. The (unsolicited) communication is aimed at promoting the activities and the promoting the defendant's image to the public, in this case cooperation to the development of legislation. The message is addressed to identified persons natural persons (cf. the address by name of the recipients) and becomes sent via electronic communication, more specifically by e-mail. The Dispute Chamber therefore concludes that the newsletters received by the complainant are direct marketing to finish. 6. Article 21.2 GDPR stipulates that every data subject whose personal data is used for direct marketing has the right to “object to the processing of him concerning personal data for such marketing, including profiling relates to direct marketing". The third paragraph of the same article stipulates that "[w]hen the data subject objects to processing for direct marketing, the personal data will no longer be processed for these purposes." When a data subject objects to the processing of data for direct marketing purposes, he does not have to justify his objection. 7. In accordance with Article 12.3 GDPR, the controller provides the person concerned without delay and in any case within one month of receipt of the request pursuant to Articles 15 to 22 GDPR information about the action taken on the request is given. Depending on the complexity of the requests and the number of requests that period may be extended by a further two months if necessary. The the controller shall inform the data subject within one month of receipt of the request of such extension. 8. The Disputes Chamber determines that the complainant's personal data, such as his email address, have indeed been used for direct marketing, since the complainant is a direct marketing email on June 22, 2023. The Disputes Chamber also states fixed the request dated. June 23, 2023 from the complainant to be removed from the mailing list constitutes the exercise of his right to object within the meaning of Article 21.2 GDPR, because his request that his data may no longer be used for a specific purpose, namely direct marketing. 9. It is the responsibility of the defendant, in her capacity controller, to respond to the exercise of the rights of the data subjects in accordance with the conditions of Article 12.3 of the GDPR (see above, marginal number 5). The Disputes Chamber notes that the answer dated June 23, 2023 of the 4 https://www.gegevensbeschermingsautoriteit.be/publications/aanadvies-nr.-01-2020.pdf Decision 157/2023 — 4/7 defendant to the request for removal from the complainant's mailing list in a timely manner answer constitutes a response in accordance with Article 12.3 GDPR. However, the complainant submits documents which shows that he received another direct marketing email on October 6, 2023. The The Disputes Chamber can deduce from this that appropriate action may not have been taken to the complainant's objection. 10. The Disputes Chamber is of the opinion that on the basis of the above analysis concluded that the defendant had violated the provisions of the GDPR committed, which justifies taking a decision in this case decision on the basis of Article 95, § 1, 5° of the WOG, more specifically the defendant order to comply with the claimant's request to object to the processing of his data for direct marketing purposes in accordance with Article 21.2 GDPR. 11. This decision is a prima facie decision taken by the Disputes Chamber in accordance with Article 95 of the WOG on the basis of the complaint submitted by the complainant, in the context of the “procedure prior to the decision on the merits” 5 and none decision on the merits of the Disputes Chamber within the meaning of Article 100 of the WOG. The Disputes Chamber has thus decided, on the basis of Article 58.2.c) GDPR and Article 95, § 1, 5° of the WOG, to order the defendant to comply with the request of the data subject to exercise his rights, in particular the right to object such as determined in article 21.2 GDPR. 12. The purpose of this decision is to inform the defendant of the fact that it has committed an infringement of the provisions of the GDPR and this is possible to still comply with the aforementioned provisions. 13. However, if the defendant does not agree with the contents of this fine facie decision and is of the opinion that it may allow factual and/or legal arguments funds that could lead to a different decision can be made via the e-mail address litigationchamber@apd-gba.be send a request to hear the merits of the case to the Disputes Chamber within 30 days of notification decision. The implementation of this decision will be carried out if necessary suspended for the aforementioned period. 14. In the event of a continuation of the merits of the case, the Dispute Chamber the parties on the basis of Articles 98, 2° and 3° in conjunction with Article 99 WOG invite them to submit their defenses as well as any documents they consider useful in the case file to add. If necessary, the present decision will be permanently suspended. 5 Section 3, Subsection 2 of the WOG (Articles 94 to 97). Decision 157/2023 — 5/7 15. Finally, for the sake of completeness, the Disputes Chamber points out that a hearing on the merits of the case may lead to the imposition of the measures stated in Article 100 WOG6 . III. Publication of the decision 16. Considering the importance of transparency with regard to decision-making Dispute Chamber, this decision will be published on the website of the Data Protection Authority. However, it is not necessary that the identification details of the parties are disclosed directly. 6 Article 100. § 1. The Disputes Chamber has the authority to: 1° to dismiss a complaint; 2° to order the dismissal of prosecution; 3° order the suspension of the ruling; 4° to propose a settlement; 5° formulate warnings and reprimands; 6° order that the data subject's requests to exercise his rights be complied with; 7° to order that the person concerned is informed of the security problem; 8° order that processing be temporarily or permanently frozen, restricted or prohibited; 9° to order that the processing be brought into compliance; 10° the rectification, restriction or deletion of data and its notification to the recipients of the data recommend data; 11° order the withdrawal of the recognition of certification bodies; 12° to impose penalty payments; 13° to impose administrative fines; 14° the suspension of cross-border data flows to another State or an international institution command; 15° to transfer the file to the public prosecutor's office in Brussels, who will inform it of the follow-up given to the file; 16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. Decision 157/2023 — 6/7 Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the notice, an appeal against this decision will be filed with the Market Court (court of appeal Brussels), with the Data Protection Authority as defendant. FOR THESE REASONS, the Disputes Chamber of the Data Protection Authority decides, with reservations from the submission of a request by the defendant for a hearing on the merits in accordance with Article 98 et seq. of the WOG, to: - on the basis of Article 58.2.c) of the GDPR and Article 95, § 1, 5° of the WOG the order the defendant to comply with the data subject's request to exercise its rights, in particular the right to object (Article 21.2 GDPR), and to delete the personal data from the mailing list immediately marketing purposes and this within 30 days from the notification of this decision; - order the defendant to contact the Data Protection Authority (Dispute Chamber) by e-mail within the same period of the consequences this decision will be given via the email address litigationchamber@apd-gba.be; and - in the absence of timely implementation of the above stated by the defendant, to consider the merits of the case ex officio in accordance with Articles 98 et seq. of the WOG. Decision 157/2023 — 7/7 Such an appeal can be lodged by means of an inter partes petition must contain information listed in Article 1034ter of the Judicial Code7 . It an objection petition must be submitted to the registry of the Market Court in accordance with article 1034quinquies of the Ger.W.8 , or via the e-Deposit IT system of Justice (Article 32ter of the Judicial Code). (get). Hielke HIJMANS Chairman of the Disputes Chamber 7 The petition states, under penalty of nullity: 1° the day, month and year; 2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or company number; 3° the surname, first name, place of residence and, where applicable, the capacity of the person to be summoned; 4° the subject matter and brief summary of the grounds of the claim; 5° the judge before whom the claim is brought; 6° the signature of the applicant or his lawyer. 8 The petition with its appendix will be sent by registered letter in as many copies as there are parties involved deposited with the clerk of the court or at the registry.
