APD/GBA (Belgium) - 117/2022
From GDPRhub
| APD/GBA - 117/2022 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 6(1) GDPR Article 12(3) GDPR Article 15 GDPR Article 21(2) GDPR Article 21(3) GDPR |
| Type: | Complaint |
| Outcome: | Other Outcome |
| Started: | 29.12.2021 |
| Decided: | 26.07.2022 |
| Published: | 26.07.2022 |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 117/2022 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | Beslissing 117/2022 van 26 juli 2022 (in NL) |
| Initial Contributor: | Enzo Marquet |
The Belgian DPA held that a controller can rely on legitimate interest as a legal basis to send former customers direct marketing if the relationship ended 'not that long ago' and the data subject did not object to this processing.
English Summary
Facts
The data subject was a former customer of the controller (which remained unknown). The data subject received direct marketing from the controller. The data subject objected to the further processing of its personal data while also requesting access to all personal data processed by the controller and the legal basis used to send the direct marketing.
The controller responded within 30 days, confirming that the data subject would no longer receive direct marketing and provided all processed data, including the applicable legal bases.
The data subject then submitted a complaint at the DPA stating that the controller cannot rely on legitimate interest for processing its email adress as the data subject was a former, not current customer.
Holding
The DPA held that a controller is allowed to rely on legitimate interest to send direct marketing, including former customers under certain conditions, pursuant to Recital 47 GDPR and its Guidance 01/2020 on Direct Marketing (nr. 168).
In its Guidance, it was stated that when there was no relationship between the controller and data subject, or when it goes back a long time, legitimate interest cannot be invoked, as direct marketing is not part of the data subject's reasonable expectations.
The DPA followed that because the relationship between the controller and the data subject ended not that long ago (around two years prior), a contrario, the data subject could reasonably expect that his data would still be used for direct marketing. Hence the controller could use legitimate interest as a legal basis.
In addition, the controller confirmed that the processing for direct marketing is only done up to two years after the cancellation of the service.
The DPA therefore held that the controller did not breach the GDPR and dismissed the case.
Comment
It seems like the Belgian DPA is contradicting itself, as in its Guidance 01/2020 on Direct Marketing, the DPA specifically states that the 'soft op-in' exception for direct marketing is only applicable to current customers.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/5
Dispute room
Decision 117/2022 of 26 July 2022
File number : DOS-2021-07812
Subject : Use of data for commercial communication
The Dispute Chamber of the Data Protection Authority, composed of Mr Hielke
Hijmans, sole chairman;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of
personal data and on the free movement of such data and revocation of
Directive 95/46/EC (General Data Protection Regulation), hereinafter GDPR;
In view of the law of 3 December 2017 establishing the Data Protection Authority,
hereinafter WOG;
Having regard to the internal rules of procedure, as approved by the Chamber of
Representatives on 20 December 2018 and published in the Belgian Official Gazette on
January 15, 2019;
Having regard to the documents in the file;
Has made the following decision regarding:
The complainant: X, hereinafter referred to as “the complainant”
The controller: Y, hereinafter “the defendant”, Decision 117/2022 - 2/5
I. Facts procedure
1. On 29 December 2021, the complainant shall lodge a complaint with the Data Protection Authority
against the controller.
2. The subject of the complaint concerns the receipt of unsolicited advertising from [...], a
controller brand intended for digitally active customers.
As a result of this, the lower has exercised his right to object with regard to
the controller, as well as requested access to the data concerning him
processed personal data. The complainant indicated that he would like to know in particular
what legal basis is the basis for the processing of his personal data
for commercial purposes.
The controller responded to this within the legal term of 30
days by not only confirming that the complainant will no longer receive marketing information
would receive more, as well as provide an overview of the data processed with
in each case the indication of the legal basis.
The complainant argues that the controller cannot rely on the
legal basis 'legitimate interest' for the processing of his e-mail address for
marketing activities, since the controller only deals with his data
as a former customer, but not as a current customer.
3. On January 13, 2022, the complaint will be declared admissible by the Frontline Service on
pursuant to Articles 58 and 60 WOG and the complaint pursuant to art. 62, 1 WOG
submitted to the Disputes Chamber.
II. Justification
4. On the basis of the elements in the file known to the Disputes Chamber, and on the basis
of the powers conferred on it by the legislator on the basis of Article 95, § 1 WOG
allocated, the Disputes Chamber decides on the further follow-up of the file; in this case
the Disputes Chamber will dismiss the complaint in accordance with Article 95,
§ 1, 3° WOG, based on the motivation below.
5. When a complaint is dismissed, the Disputes Chamber must make its decision
1
step-by-step motivation and:
- to pronounce a technical dismissal if the file is not or not sufficiently
contains elements that could lead to a conviction, or if there is insufficient
1Brussels Court of Appeal, Section Marktenhokamer A, Market Affairs Chamber, judgment 2020/AR/329, 2 September
2020, p. 18., Decision 117/2022 - 3/5
there is a prospect of conviction for a technical impediment,
as a result of which she cannot reach a decision;
- or to declare a policy dismissal, ifdespite the presence of elements
that may lead to a sanction, the continuation of the investigation of the
dossier does not seem appropriate in light of the priorities of the
Data Protection Authority, as specified and explained in the
dismissal policy of the Disputes Chamber . 2
6. In the event that more than one ground is being discarded, the discarded grounds (resp.
technical dismissal and policy dismissal) should be treated in order of importance. 3
7. In the present file, the Disputes Chamber will dismiss the complaint,
on the basis of technical considerations. There is one motive at the basis of the
decision of the Disputes Chamber why it considers it undesirable to follow up further
to the file and therefore decided not to proceed to, inter alia, a treatment against
ground.
8. With regard to the claimant's claim that the use of his e-mail address for direct
marketing purposes is not possible on the basis of the 'legitimate interest' of the
controller, the Disputes Chamber points out that the consent,
but the legitimate interest of the controller as
legal basis applies to process and thus use the complainant's e-mail address
for direct marketing purposes. Recital 47AVGexplicitlydeterminesthatthe
processing of personal data for direct marketing purposes
considered carried out with a view to a legitimate interest (Article 6.1 f) GDPR).
This legal basis also applies in respect of former customers. like this
Data Protection Authority in its Recommendation No. 01/2020 of 17 January 2020
regarding the processing of personal data for direct marketing purposes, 5
expressly (in margin no. 168) that when the controller never does any
has had a relationship with a data subject, or this relationship goes back a long time without
that this has meanwhile been followed, the legitimate interest cannot
be invoked, because the receipt of a direct marketing message does not belong to the
2 In this regard, the Disputes Chamber refers to its dismissal policy as set out in detail on the GBA's website:
https://www.dataprotectionauthority.be/publications/sepotbeleid-van-de-geschillenkamer.pdf
3
cf. Title 3 – In which cases is my complaint likely to be dismissed by the Disputes Chamber? from the
dismissal policy of the Disputes Chamber.
41.The processing is only lawful if at least one of the following conditions is met:
a) the data subject has consented to the processing of his/her personal data for one or more specific
purposes;
[…]
f) the processing is necessary for the purposes of the legitimate interests pursued by the
controller or of a third party, except where the interests or fundamental rights and
freedoms of the data subject that require the protection of personal data outweigh those interests, with
especially when the person concerned is a child.
5https://www.dataprotectionauthority.be/publications/aanbeveling-nr.-01-2020.pdf, Decision 117/2022 - 4/5
reasonable expectations of the data subject. However, in the present case, the
the complainant only canceled his subscription in 2019, so not so long ago in view of the
facts dating back to 2021, so it can be argued a contrario that the complainant
former customer could reasonably expect his data to be immediately
marketing would be used. In addition, the controller has
confirmed to the complainant that the data of former customers after the termination of the
contract can only be processed for a maximum period of 2 years for
marketing activities. The complainant himself states that he is a former customer of the
controller, so that it can use the complainant's data for
advertising purposes, such as in this case for the launch and offer of a new digital
brand that is under the control of the controller, even if the
the complainant never made use of the new telecom brand.
9. On the other hand, the controller must comply with
the objection that can be made by the data subject at any time against the
processing of personal data concerning him, without the data subject having to do so
6
must provide some justification (Article 21.2 AVG and Article 21.3 AVG). The
controller has within the period of one month after receipt of
the complainant's request (Article 12.3 GDPR) to stop sending direct marketing messages
received, followed by confirmation of the deletion of the
personal data of the complainant.
10. The Disputes Chamber decides that the controller has no infringement
committed to Article 6.1 of the GDPR. In addition, the controller has within the
legal period of one month, appropriate action has been taken on the complainant's request
because he was provided with the requested information, as well as his e-mail address no longer
is used for direct marketing purposes, so that no infringement was committed
committed to Article 12.3 AVG in conjunction with Article 15 AVG and Article 21.2 and 21.3 AVG.
III. Publication and communication of the decision
11. Given the importance of transparency with regard to the decision-making of the
Litigation Chamber, this decision is published on the website of the
Data Protection Authority. On the other hand, it is not necessary for the
identifiers of the parties are disclosed directly.
6See in that regard also Recital 70 of the GDPR: When personal data is processed for direct
marketing, the data subject, whether it concerns initial or further processing, should have the right to
always have an objection free of charge to this processing, including in the case of profiling insofar as this
relates to direct marketing. That right must be expressly, clearly and separately from other
information, be brought to the attention of the data subject., Decision 117/2022 - 5/5
12. In accordance with its disclaimer policy, the Dispute Chamber will make the decision to the defendant
7
to transfer . After all, the Disputes Chamber has decided to cancel its dismissal decisions
to notify the defendants ex officio. However, the Disputes Chamber waives
such notice when the complainant has requested anonymity with regard to
of the defendant and the notification of the decision to the defendant, even if
it is pseudonymised, nevertheless makes it possible to
8
(re)identify . However, this is not the case in the present case.
FOR THESE REASONS,
the Disputes Chamber of the Data Protection Authority decides, after deliberation,
to dismiss the present complaint on the basis of Article 95, § 1, 3° of the WOG.
Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the
notice against this decision, an appeal may be lodged with the Marktenhof (court of
profession Brussels), with the Data Protection Authority as defendant.
Such an appeal may be lodged by means of a petition against the contradiction that the
9
the statements listed in article 1034ter of the Judicial Code should contain .It
adversarial petition must be submitted to the registry of the Marktenhof
in accordance with article 1034quinquies of the Ger.W. , or via the e-Deposit
IT system of Justice (Article 32ter of the Ger.W.).
To enable the complainant to consider other possible remedies, the
Disputes Chamber the complainant to the explanation in its dismissal policy. 11
(get.) Hielke HIJMANS
Chairman of the Disputes Chamber
7Cf. Title 5 – Will the dismissal of my complaint be published? Will the counterparty be notified?
of the Disputes Chamber's dismissal policy.
8Ibid.
9The petition states, on pain of nullity:
1° the day, month and year;
2° the surname, first name, place of residence of the applicant and, where appropriate, his capacity and his national register or
company number;
3° the surname, first name, place of residence and, where applicable, the capacity of the person to be
summoned;
4° the subject matter and the brief summary of the grounds of the claim;
5° the court before whom the claim is brought;
6° the signature of the applicant or of his lawyer.
10The application with its annex, in as many copies as there are interested parties, shall be sent by registered letter
sent to the clerk of the court or deposited at the clerk's office.
11
cf. Title 4 – What can I do if my complaint is closed? of the Disputes Chamber's dismissal policy.
