APD/GBA (Belgium) - 111/2025
From GDPRhub
| APD/GBA - 111/2025 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 12(3) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 30.06.2025 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 111/2025 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | French |
| Original Source: | APD (in FR) |
| Initial Contributor: | Le |
The DPA issued a warning to a controller for failing to inform a data subject on the actions taken following their objection to the processing of their personal data for direct marketing within one month.
English Summary
Facts
Between 14 and 20 January 2025, the data subject received several emails for direct marketing purposes from the controller. On 15 and 20 January 2025, the data subject exercised his right to object but the controller failed to respond.
On 4 February 2025, the data subject lodged a complaint with the DPA against the controller.
On 13 February 2025, the data subject informed the DPA that he continued to receive direct marketing emails from the controller.
The controller claimed that he had unsubscribed the data subject from his direct marketing email platform on 14 January 2025 and deleted his email address from his contact file on 20 January 2025.
Holding
The DPA found that the controller may have failed to comply with Article 12(3) GDPR by not informing the data subject on the measures taken following his objection request within one month.
The DPA decided to issue a warning to the controller.
Comment
The purpose of this decision is to inform the controller, of the fact that it may have committed a breach of the provisions of the GDPR, in order to enable it to still comply with the aforementioned provisions. It is not a decision on the merits.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/6 Litigation Division Decision 111/2025 of June 30, 2025 File number: DOS-2025-00515 Subject: Complaint regarding the lack of information regarding the measures taken following an objection request The Litigation Division of the Data Protection Authority; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter "GDPR"; Having regard to the Law of December 3, 2017 establishing the Data Protection Authority, hereinafter "LCA"; Having regard to the Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, hereinafter the "Framework Law"; Having regard to the internal regulations as approved by the Management Committee of the Data Protection Authority on 25 April 2024 and published in the Belgian Official Journal on 31 May 2024, hereinafter the "ROI"; Having considered the documents in the case file; Has taken the following decision concerning: The complainant: X, hereinafter "the complainant"; The defendant: Y, hereinafter "the defendant". Decision 111/2025 — 2/6 I. Facts and Procedure 1. On 4 February 2025, the complainant filed a complaint with the Data Protection Authority against the defendant. 2. The subject of the complaint concerns emails sent to the complainant for direct marketing purposes, and a failure to respond to the complainant's request to opt out. 3. As an appendix to his complaint form, the complainant attaches several screenshots of emails allegedly sent to him by the defendant for direct marketing purposes, these emails taking place between January 14 and 20, 2025. These screenshots also include emails from the complainant exercising his right to opt out on January 15 and 20, 2025. 4. On February 13, 2025, the complainant informed the DPA that he continued to receive emails for direct marketing purposes from the defendant. 5. On March 7, 2025, the complaint was declared admissible by the Frontline Service on the basis of Articles 58 and 60 of the LCA1 and the complaint was forwarded to the Litigation Division pursuant to Article 62, § 1 of the LCA2. The complainant was informed of the admissibility of his complaint on the same date pursuant to Article 61 of the LCA. 6. On March 24, 2025, in accordance with its information obligation under Article 95, § 2 of the LCA, the Litigation Division informed the parties of the existence of this file and of the content of this complaint. It specified that the defendant had the possibility to consult and copy the file at the secretariat of the Litigation Division. The defendant was also informed that it had 14 days to submit its observations. 7. On the same day, the defendant communicated its observations to the Litigation Chamber and to the complainant. In summary, the defendant noted that it had unsubscribed the complainant from its mailing lists. To this end, it provided a screenshot indicating that the complainant's email address had been deleted from the complainant's contact record – an action taken on January 20, 2025. On March 25, 2025, the defendant provided a screenshot indicating that the complainant had been unsubscribed from the program allowing the sending of emails for direct marketing purposes – an action taken on January 14, 2025. In any event, the defendant requested to be kept informed if the problems reported by the complainant persist. The complainant did not respond. 1 Pursuant to Article 61 of the LCA, the Litigation Chamber hereby informs the parties that the complaint has been declared admissible. 2 Pursuant to Article 95, § 2 of the LCA, the Litigation Chamber hereby informs the parties that, following this complaint, the file has been forwarded to it. Decision 111/2025 — 3/6 II. Motivation 8. The Litigation Chamber notes that the complainant objected to the defendant sending emails for direct marketing purposes on January 15 and 20, 2025. The complainant claims to have made this request previously, but does not provide proof of this, so the Litigation Chamber will only consider the requests made on January 15 and 20, 2025. The Litigation Chamber further notes that the defendant unsubscribed the complainant from the platform allowing the sending of emails for direct marketing purposes on January 14, 2025, and deleted the complainant's email address from his contact file on January 20, 2025. The complainant indicated in his complaint form that on the day he filed his complaint, he was still receiving emails for direct marketing purposes from the defendant – February 4, 2025. However, he does not provide any evidence of this. 9. The Litigation Chamber therefore notes that there was processing of personal data, and more specifically, the sending of emails by the defendant for direct marketing purposes to the complainant's email address – a point which the parties do not dispute. 10. With regard to direct marketing, Article 21 of the GDPR provides in its second paragraph that "Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to the processing of personal data concerning him or her for such direct marketing purposes, including profiling to the extent that it is related to such direct marketing." Finally, the third paragraph of the same article provides that: "Where the data subject objects to the processing for direct marketing purposes, the personal data shall no longer be processed for such purposes." 11. The modalities of this right are provided for in Article 12 of the GDPR. In particular, attention should be paid here to the second paragraph of Article 12 of the GDPR, which provides that "The controller shall facilitate the exercise of the rights granted to the data subject under Articles 15 to 22. […]" as well as to the third paragraph of the same article, which provides that "The controller shall provide the data subject with information on the measures taken following a request made pursuant to Articles 15 to 22, as soon as possible and in any event within one month of receipt of the request. If necessary, this period may be extended by two months, taking into account the complexity and number of requests. The controller shall inform the data subject of this extension and the reasons for the postponement within one month of receipt of the request. […]". 12. A combined reading of these provisions shows that when the data subject exercises their right to object to the sending of emails for direct marketing purposes, Decision 111/2025 — 4/6 not only must the data controller comply with this right in all cases – the right to object being an unconditional right with regard to direct marketing – but must also inform the data subject of the measures taken to this end as soon as possible, and in any case within a maximum period of one month, with certain exceptions. 13. It appears from the documents in the case file and the responses provided by the defendant to the Litigation Chamber and to the complainant in response to the prior information notification letter of March 24, 2025, that the defendant complied with the complainant's request. However, it does not appear from the same documents in the case file and the same responses from the defendant that the latter also informed the complainant of the measures taken to this end. The oldest email available to the Litigation Chamber in which the complainant objected to the sending of emails to direct marketing companies is dated January 15, 2025. Given that the defendant did not request an extension of the deadline, and therefore had until February 17, 2025, to act as described in point 12 of this decision, it did not fully act as it should have done. 14. Consequently, the Litigation Chamber notes that the defendant may have failed to comply with Article 12.3 of the GDPR by not informing the complainant of the measures it had nevertheless taken following the complainant's request for objection, which was required of it by that provision. 15. Based on the facts mentioned above, the Litigation Chamber decides to issue a warning for the future to the defendant for possibly having committed a breach of Article 12.3 of the GDPR. 16. This decision is a prima facie decision taken by the Litigation Chamber in accordance with Article 95 of the LCA on the basis of the complaint filed by the complainant, as part of the "procedure prior to the substantive decision"3 and not a decision on the merits of the Litigation Chamber within the meaning of Article 100 of the LCA. 17. The purpose of this decision is to inform the defendant, the alleged controller, that it may have committed a breach of the provisions of the GDPR, in order to enable it to continue to comply with the aforementioned provisions. 18. If the defendant disagrees with the content of this prima facie decision and believes it can provide factual and/or legal arguments that could lead to a new decision, it may request a review by the Litigation Chamber in accordance with the procedure established by Articles 98 juncto 99 of the LCA, known as the "procedure on the merits" or "determination of the case on the merits." This request must be sent to the email address litigationchamber@apd-gba.be within 30 days of the date of the decision. Section 3, Subsection 2 of the LCA (Articles 94 to 97 inclusive) Decision 111/2025 — 6/6 legal matters that could lead to a different decision, it may, on the one hand, send a request to the Litigation Chamber to consider the merits of the case via the email address litigationchamber@apd-gba.be, within 30 days of notification of this decision. If applicable, the execution of this decision is suspended during the aforementioned period. Furthermore, the defendant may file an appeal against this decision in accordance with Article 108, § 1 of the LCA, within 30 days of notification, with the Market Court (Brussels Court of Appeal), with the Data Protection Authority as the defendant. Such an appeal may be filed by means of an interlocutory application, which must contain the information listed in Article 1034ter5 of the Judicial Code. The interlocutory application must be filed with the registry of the Market Court in accordance with Article 1034quinquies of the Judicial Code, or via the Ministry of Justice's e-Deposit information system (Article 32ter of the Judicial Code). (Sé). Hielke HIJMANS Director of the Litigation Chamber 5. The application must contain, under penalty of nullity: 1° the day, month, and year; 2° the surname, first name, and address of the applicant, as well as, where applicable, their position and national register number or company number; 3° the surname, first name, address, and, where applicable, the position of the person to be summoned; 4° the subject matter and a summary of the grounds for the application; 5° the name of the judge hearing the application; 6° the signature of the applicant or their lawyer. 6 The application, accompanied by its annex, shall be sent, in as many copies as there are parties involved, by registered letter to the clerk of the court or filed with the registry.
