APD/GBA (Belgium) - 109/2023
From GDPRhub
| APD/GBA - 109/2023 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 12(3) GDPR Article 21(2) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 20.06.2023 |
| Decided: | 09.08.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 109/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | French |
| Original Source: | APD/ GBA (Belgium) (in FR) |
| Initial Contributor: | n/a |
The Belgian DPA found a violation of Article 21(2) GDPR when a controller did not respect the data subject's right to object to direct marketing.
English Summary
Facts
Following the receipt of unwanted direct marketing emails, on 15 June 2022, the data subject had requested the controller (an estate agent) to remove him from its real estate mailing list. The controller did not respond to these requests.
After contacting the controller several more times by email on 27 June 2022, and 4 May 2023 to request the removal of his email from their database to no effect, the data subject lodged a complaint with the Data Protection Authority on 20 June 2023.
Holding
The Belgian DPA found a violation of Article 21(2) GDPR and Article 12(3) GDPR.
Firstly, Article 21(2) establishes the right for a data subject to object to processing for direct marketing purposes. The Belgian DPA held that the controller was in violation of this provision by disregarding the data subject’s multiple objections to processing.
Secondly, the Belgian DPA found that the controller was in breach of Article 12(3) GDPR. Article 12(3) GDPR establishes a one-month time limit for facilitating requests made under Articles 15-22 GDPR. The controller failed to respond to the data subject’s request within this timeframe.
No fine was issued in this case. However, the controller was ordered to comply with Article 21(2) GDPR and to consider the erasure request under Article 17 GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/6
Litigation Chamber
Decision 109/2023 of August 9, 2023
File number: DOS-2023-02708
Subject: Deletion of e-mail address from a mailing list for the purpose of
marketing
The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke
Hijmans, chairman;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and
to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the
data protection), hereinafter “GDPR”;
Having regard to the Law of 3 December 2017 establishing the Data Protection Authority, hereinafter
“ACL”;
Having regard to the internal regulations as approved by the House of Representatives on 20
December 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Made the following decision regarding:
The plaintiff: X, hereinafter “the plaintiff”; .
.
.
The defendant: Y, hereinafter: “the defendant”. Decision 109/2023 – 2/6
I. Facts and procedure
1. The subject of the complaint concerns the non-respect of the right of opposition exercised by the complainant
following the receipt of unwanted e-mails for direct marketing purposes.
asked the defendant – a real estate agency – on several occasions and without success
to remove it from its mailing list of real estate advertisements, but the defendant would not have
did not respond to these requests.
2. On June 20, 2023, the complainant lodged a complaint with the Data Protection Authority
given against the defendant.
3. On June 30, 2023, the complaint is declared admissible by the Front Line Service on the
1
basis of Articles 58 and 60 of the LCA and the complaint is forwarded to the Litigation Chamber
st 2
pursuant to Article 62, § 1 of the LCA.
4. Pursuant to article 95 § 2, 3° of the LCA as well as article 47 of the rules of order
inside the DPA, a copy of the file may be requested by the parties. If one of
parties wishes to make use of the possibility of consulting the file, the latter is required to
contact the secretariat of the Litigation Chamber, preferably via the address
litigationchamber@apd-gba.be.
II. Motivation
II.1. Applicable right
5. Article 21.2 of the GDPR provides that any data subject, whose personal data
personal are used for prospecting purposes, "has the right to oppose at any time
to the processing of personal data concerning him for such purposes of
prospecting, including profiling insofar as it is linked to such prospecting”. THE
third paragraph of the same article provides that "when the data subject
objects to processing for prospecting purposes, the personal data are
no longer processed for these purposes. » When a person objects to the processing of personal data
prospecting purposes, it must not provide any justification for its request for opposition.
1Under article 61 LCA, the Litigation Chamber informs the parties by this decision, of the fact that the complaint has been
declared admissible.
2
Pursuant to Article 95, § 2 LCA, by this decision, the Litigation Chamber informs the parties of the fact that following
this complaint, the file was forwarded to him.
3 In the absence of a legal definition of the notion of prospecting or direct marketing, the APD has defined it as “Any
communication, whether solicited or unsolicited, aimed at promoting an organization or a person, services, products,
whether paid or free, as well as brands or ideas, addressed by an organization or a person
acting in a commercial or non-commercial context, directly to one or more natural persons in a
private or professional, by any means, involving the processing of personal data. ", see
Recommendation n°1/2020 of January 17, 2020 relating to the processing of personal data for the purposes of
direct marketing, page 8, available at https://www.autoriteprotectiondonnees.be/publications/recommandation-n-01-
2020.pdf Decision 109/2023 – 3/6
6. Article 12.3 of the GDPR provides that the controller needs to respond to the
request from a data subject exercising their rights under Articles 15 to 22 of the GDPR
within one month of receipt of the request. The manager of
processing also informs within the same period if it needs an extension of the period
orifthecontrollerdoesnotfollowupontherequestmadebytheperson
concerned (article 12.4 GDPR).
II.2. Application to the present case
7. On June 15, 2022, after receiving an email purporting to promote real estate in
location, the complainant had expressed his wish to be removed from the “email loop” of the
defendant.
8. Subsequently, it appears from the documents in the file that the defendant continued to send
prospecting emails to the complainant. 4
9. On June 27, 2022, the Complainant again contacted the Respondent by email for him
ask to be removed from their real estate ad mailing list.
10. The defendant did not comply with this second request either, because the exhibits of the
record show that the defendant continued to send the same type of emails to the
complainant.5
11. On May 4, 2023, the complainant again expressed his wish to be removed from the list of
recipients of the emails in question. The defendant did not respond to this
request.
12. In the Complaint Form, the Complainant indicates that the Respondent would also have
contacted by phone. During this telephone call, the complainant allegedly reiterated his
requests to no longer appear on the list of recipients of real estate advertisements of the
defendant. However, the Litigation Chamber does not have evidence proving
the existence of this phone call.
13. The Litigation Chamber finds that the complainant's data (his email address
containing his first and last name) have been used for direct marketing purposes. There
Litigation Chamber also considers that the requests submitted by the plaintiff
constitute opposition requests within the meaning of Article 21 of the GDPR because their requests
intended to ensure that his contact details were no longer used for a particular purpose, namely
direct marketing purposes.
4According to the documents provided by the complainant, the complainant was contacted on May 23, 2022, May 31, 2022, June 1, 2022, June 9,
2022, June 13, 2022, June 15, 2022, June 17, 2022 and June 27, 2022.
5According to the documents provided by the complainant, the complainant was contacted on July 12, 2022, July 22, 2022, August 26, 2022, July 7,
September 2022, October 25, 2022, November 4, 2022, November 9, 2022 and January 10, 2023. Decision 109/2023 – 4/6
14. It is the responsibility of the Respondent, in its capacity as controller, to follow up on the
the exercise of the rights of the persons concerned, in compliance with the conditions of
Article 12 of the GDPR, mentioned in point 6 of this decision.
15. The Litigation Chamber considers that on the basis of the aforementioned facts, there is reason to
conclude that the defendant may have committed a violation of the provisions of the GDPR,
which justifies that in this case, the Litigation Chamber takes a decision
in accordance with Article 95, § 1, 5° of the LCA, more specifically to order the
respondent to comply with the complainant's request to object to the processing of his
data for direct marketing purposes under Article 21.2 of the GDPR.
16. This decision is based on the fact that the complainant provides evidence of the disputed emails from
direct marketing, the exercise of its right on several occasions as well as proof of
persistent processing of his data despite his requests and after the expiry of a
month provided for in Article 12.3 of the GDPR.
17. Furthermore, in his complaint form, the complainant expressed the wish that all of the
his personal data is erased from any of the defendant's servers.
As this request was not made directly to the defendant, the
Litigation Chamber invites the defendant to consider this request
erasure within the meaning of Article 17 of the GDPR.
18. This decision is a prima facie decision taken by the Litigation Chamber
pursuant to Article 95 of the LCA on the basis of the complaint lodged by the complainant/the
complainant, in the context of the "procedure prior to the substantive decision" and not a
decision on the merits of the Litigation Chamber within the meaning of Article 100 of the LCA.
19. The purpose of this decision is to inform the defendant, allegedly responsible for the
processing, because it may have violated the provisions of the GDPR,
in order to enable it to still comply with the aforementioned provisions.
20. If, however, the defendant does not agree with the content of this decision
prima facie and believes that it can make factual and/or legal arguments that
could lead to another decision, it may send the Litigation Chamber a
request for treatment on the merits of the case via the e-mail address litigationchamber@apd-
gba.be, within 30 days of notification of this decision. The case
applicable, the execution of this decision is suspended for the period
aforementioned.
21. In the event of further processing of the case on the merits, pursuant to Articles 98, 2° and 3°
juncto article 99 of the LCA, the Litigation Chamber will invite the parties to introduce their
6Section 3, Subsection 2 of the ACL (sections 94 to 97 inclusive). Decision 109/2023 – 5/6
conclusions and attach to the file all the documents they deem useful. If applicable, the
this decision is permanently suspended.
22. In the interests of transparency, the Litigation Division finally emphasizes that a
dealing with the case on the merits may lead to the imposition of the measures mentioned in
7
section 100 of the ACL.
III. Publication of the decision
23. Given the importance of transparency regarding the decision-making process of the Chamber
Litigation, this decision is published on the website of the Protection Authority
Datas. However, it is not necessary for this purpose that the identification data
of the parties are communicated directly.
7Art. 100. § 1. The litigation chamber has the power to
1° dismiss the complaint without follow-up;
2° order the dismissal;
3° pronouncing the suspension of the pronouncement;
4° to propose a transaction;
5° issue warnings and reprimands;
6° order to comply with requests from the data subject to exercise his or her rights;
7° order that the person concerned be informed of the security problem;
8° order the freezing, limitation or temporary or permanent prohibition of processing;
9° order compliance of the processing;
10° order the rectification, restriction or erasure of the data and the notification thereof to the recipients of the
data ;
11° order the withdrawal of accreditation from certification bodies;
12° to issue periodic penalty payments;
13° to issue administrative fines;
14° order the suspension of cross-border data flows to another State or an international body;
15° forward the file to the public prosecutor's office in Brussels, who informs it of the follow-up given to the file;
16° decide on a case-by-case basis to publish its decisions on the website of the Data Protection Authority. Decision 109/2023 – 6/6
FOR THESE REASONS,
the Litigation Chamber of the Data Protection Authority decides, subject to
the introduction of a request by the defendant for treatment on the merits in accordance with
to articles 98 e.s. of the ACL:
- pursuant to Article 58.2.c) of the GDPR and Article 95, § 1, 5° of the LCA, to order
the defendant to comply with the request of the person concerned to exercise
his rights, more specifically the right of opposition for direct marketing purposes (article
21.2 of the GDPR), and this within 30 days from the date of notification of this
decision ;
- to order the defendant to inform by e-mail the Data Protection Authority
data (Litigation Chamber) of the follow-up given to this decision, in the
same deadline, via the e-mail address litigationchamber@apd-gba.be; And
- if the defendant does not comply in good time with what is requested of it
above, to deal ex officio with the case on the merits, in accordance with articles 98 e.s. of
the ACL.
In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged,
within thirty days of its notification, to the Court of Markets (court
d'appel de Bruxelles), with the Data Protection Authority as defendant.
Such an appeal may be introduced by means of an interlocutory request which must contain the
8
information listed in article 1034ter of the Judicial Code. The interlocutory motion must be
9
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , Or
via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.).
(se). Hielke HIJMANS
President of the Litigation Chamber
8
The request contains on pain of nullity:
(1) indication of the day, month and year;
2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
Business Number;
3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
(4) the object and summary statement of the means of the request;
(5) the indication of the judge who is seized of the application;
6° the signature of the applicant or his lawyer.
9The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.
