APD/GBA (Belgium) - 117/2022
|APD/GBA - 117/2022|
|Relevant Law:||Article 6(1) GDPR|
Article 12(3) GDPR
Article 15 GDPR
Article 21(2) GDPR
Article 21(3) GDPR
|National Case Number/Name:||117/2022|
|European Case Law Identifier:||n/a|
|Original Source:||Beslissing 117/2022 van 26 juli 2022 (in NL)|
|Initial Contributor:||Enzo Marquet|
The Belgian DPA held that a controller can rely on legitimate interest as a legal basis to send former customers direct marketing if the relationship ended 'not that long ago' and the data subject did not object to this processing.
English Summary[edit | edit source]
Facts[edit | edit source]
The data subject was a former customer of the controller (which remained unknown). The data subject received direct marketing from the controller. The data subject objected to the further processing of its personal data while also requesting access to all personal data processed by the controller and the legal basis used to send the direct marketing.
The controller responded within 30 days, confirming that the data subject would no longer receive direct marketing and provided all processed data, including the applicable legal bases.
The data subject then submitted a complaint at the DPA stating that the controller cannot rely on legitimate interest for processing its email adress as the data subject was a former, not current customer.
Holding[edit | edit source]
The DPA held that a controller is allowed to rely on legitimate interest to send direct marketing, including former customers under certain conditions, pursuant to Recital 47 GDPR and its Guidance 01/2020 on Direct Marketing (nr. 168).
In its Guidance, it was stated that when there was no relationship between the controller and data subject, or when it goes back a long time, legitimate interest cannot be invoked, as direct marketing is not part of the data subject's reasonable expectations.
The DPA followed that because the relationship between the controller and the data subject ended not that long ago (around two years prior), a contrario, the data subject could reasonably expect that his data would still be used for direct marketing. Hence the controller could use legitimate interest as a legal basis.
In addition, the controller confirmed that the processing for direct marketing is only done up to two years after the cancellation of the service.
The DPA therefore held that the controller did not breach the GDPR and dismissed the case.
Comment[edit | edit source]
It seems like the Belgian DPA is contradicting itself, as in its Guidance 01/2020 on Direct Marketing, the DPA specifically states that the 'soft op-in' exception for direct marketing is only applicable to current customers.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/5 Dispute room Decision 117/2022 of 26 July 2022 File number : DOS-2021-07812 Subject : Use of data for commercial communication The Dispute Chamber of the Data Protection Authority, composed of Mr Hielke Hijmans, sole chairman; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and revocation of Directive 95/46/EC (General Data Protection Regulation), hereinafter GDPR; In view of the law of 3 December 2017 establishing the Data Protection Authority, hereinafter WOG; Having regard to the internal rules of procedure, as approved by the Chamber of Representatives on 20 December 2018 and published in the Belgian Official Gazette on January 15, 2019; Having regard to the documents in the file; Has made the following decision regarding: The complainant: X, hereinafter referred to as “the complainant” The controller: Y, hereinafter “the defendant”, Decision 117/2022 - 2/5 I. Facts procedure 1. On 29 December 2021, the complainant shall lodge a complaint with the Data Protection Authority against the controller. 2. The subject of the complaint concerns the receipt of unsolicited advertising from [...], a controller brand intended for digitally active customers. As a result of this, the lower has exercised his right to object with regard to the controller, as well as requested access to the data concerning him processed personal data. The complainant indicated that he would like to know in particular what legal basis is the basis for the processing of his personal data for commercial purposes. The controller responded to this within the legal term of 30 days by not only confirming that the complainant will no longer receive marketing information would receive more, as well as provide an overview of the data processed with in each case the indication of the legal basis. The complainant argues that the controller cannot rely on the legal basis 'legitimate interest' for the processing of his e-mail address for marketing activities, since the controller only deals with his data as a former customer, but not as a current customer. 3. On January 13, 2022, the complaint will be declared admissible by the Frontline Service on pursuant to Articles 58 and 60 WOG and the complaint pursuant to art. 62, 1 WOG submitted to the Disputes Chamber. II. Justification 4. On the basis of the elements in the file known to the Disputes Chamber, and on the basis of the powers conferred on it by the legislator on the basis of Article 95, § 1 WOG allocated, the Disputes Chamber decides on the further follow-up of the file; in this case the Disputes Chamber will dismiss the complaint in accordance with Article 95, § 1, 3° WOG, based on the motivation below. 5. When a complaint is dismissed, the Disputes Chamber must make its decision 1 step-by-step motivation and: - to pronounce a technical dismissal if the file is not or not sufficiently contains elements that could lead to a conviction, or if there is insufficient 1Brussels Court of Appeal, Section Marktenhokamer A, Market Affairs Chamber, judgment 2020/AR/329, 2 September 2020, p. 18., Decision 117/2022 - 3/5 there is a prospect of conviction for a technical impediment, as a result of which she cannot reach a decision; - or to declare a policy dismissal, ifdespite the presence of elements that may lead to a sanction, the continuation of the investigation of the dossier does not seem appropriate in light of the priorities of the Data Protection Authority, as specified and explained in the dismissal policy of the Disputes Chamber . 2 6. In the event that more than one ground is being discarded, the discarded grounds (resp. technical dismissal and policy dismissal) should be treated in order of importance. 3 7. In the present file, the Disputes Chamber will dismiss the complaint, on the basis of technical considerations. There is one motive at the basis of the decision of the Disputes Chamber why it considers it undesirable to follow up further to the file and therefore decided not to proceed to, inter alia, a treatment against ground. 8. With regard to the claimant's claim that the use of his e-mail address for direct marketing purposes is not possible on the basis of the 'legitimate interest' of the controller, the Disputes Chamber points out that the consent, but the legitimate interest of the controller as legal basis applies to process and thus use the complainant's e-mail address for direct marketing purposes. Recital 47AVGexplicitlydeterminesthatthe processing of personal data for direct marketing purposes considered carried out with a view to a legitimate interest (Article 6.1 f) GDPR). This legal basis also applies in respect of former customers. like this Data Protection Authority in its Recommendation No. 01/2020 of 17 January 2020 regarding the processing of personal data for direct marketing purposes, 5 expressly (in margin no. 168) that when the controller never does any has had a relationship with a data subject, or this relationship goes back a long time without that this has meanwhile been followed, the legitimate interest cannot be invoked, because the receipt of a direct marketing message does not belong to the 2 In this regard, the Disputes Chamber refers to its dismissal policy as set out in detail on the GBA's website: https://www.dataprotectionauthority.be/publications/sepotbeleid-van-de-geschillenkamer.pdf 3 cf. Title 3 – In which cases is my complaint likely to be dismissed by the Disputes Chamber? from the dismissal policy of the Disputes Chamber. 41.The processing is only lawful if at least one of the following conditions is met: a) the data subject has consented to the processing of his/her personal data for one or more specific purposes; […] f) the processing is necessary for the purposes of the legitimate interests pursued by the controller or of a third party, except where the interests or fundamental rights and freedoms of the data subject that require the protection of personal data outweigh those interests, with especially when the person concerned is a child. 5https://www.dataprotectionauthority.be/publications/aanbeveling-nr.-01-2020.pdf, Decision 117/2022 - 4/5 reasonable expectations of the data subject. However, in the present case, the the complainant only canceled his subscription in 2019, so not so long ago in view of the facts dating back to 2021, so it can be argued a contrario that the complainant former customer could reasonably expect his data to be immediately marketing would be used. In addition, the controller has confirmed to the complainant that the data of former customers after the termination of the contract can only be processed for a maximum period of 2 years for marketing activities. The complainant himself states that he is a former customer of the controller, so that it can use the complainant's data for advertising purposes, such as in this case for the launch and offer of a new digital brand that is under the control of the controller, even if the the complainant never made use of the new telecom brand. 9. On the other hand, the controller must comply with the objection that can be made by the data subject at any time against the processing of personal data concerning him, without the data subject having to do so 6 must provide some justification (Article 21.2 AVG and Article 21.3 AVG). The controller has within the period of one month after receipt of the complainant's request (Article 12.3 GDPR) to stop sending direct marketing messages received, followed by confirmation of the deletion of the personal data of the complainant. 10. The Disputes Chamber decides that the controller has no infringement committed to Article 6.1 of the GDPR. In addition, the controller has within the legal period of one month, appropriate action has been taken on the complainant's request because he was provided with the requested information, as well as his e-mail address no longer is used for direct marketing purposes, so that no infringement was committed committed to Article 12.3 AVG in conjunction with Article 15 AVG and Article 21.2 and 21.3 AVG. III. Publication and communication of the decision 11. Given the importance of transparency with regard to the decision-making of the Litigation Chamber, this decision is published on the website of the Data Protection Authority. On the other hand, it is not necessary for the identifiers of the parties are disclosed directly. 6See in that regard also Recital 70 of the GDPR: When personal data is processed for direct marketing, the data subject, whether it concerns initial or further processing, should have the right to always have an objection free of charge to this processing, including in the case of profiling insofar as this relates to direct marketing. That right must be expressly, clearly and separately from other information, be brought to the attention of the data subject., Decision 117/2022 - 5/5 12. In accordance with its disclaimer policy, the Dispute Chamber will make the decision to the defendant 7 to transfer . After all, the Disputes Chamber has decided to cancel its dismissal decisions to notify the defendants ex officio. However, the Disputes Chamber waives such notice when the complainant has requested anonymity with regard to of the defendant and the notification of the decision to the defendant, even if it is pseudonymised, nevertheless makes it possible to 8 (re)identify . However, this is not the case in the present case. FOR THESE REASONS, the Disputes Chamber of the Data Protection Authority decides, after deliberation, to dismiss the present complaint on the basis of Article 95, § 1, 3° of the WOG. Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the notice against this decision, an appeal may be lodged with the Marktenhof (court of profession Brussels), with the Data Protection Authority as defendant. Such an appeal may be lodged by means of a petition against the contradiction that the 9 the statements listed in article 1034ter of the Judicial Code should contain .It adversarial petition must be submitted to the registry of the Marktenhof in accordance with article 1034quinquies of the Ger.W. , or via the e-Deposit IT system of Justice (Article 32ter of the Ger.W.). To enable the complainant to consider other possible remedies, the Disputes Chamber the complainant to the explanation in its dismissal policy. 11 (get.) Hielke HIJMANS Chairman of the Disputes Chamber 7Cf. Title 5 – Will the dismissal of my complaint be published? Will the counterparty be notified? of the Disputes Chamber's dismissal policy. 8Ibid. 9The petition states, on pain of nullity: 1° the day, month and year; 2° the surname, first name, place of residence of the applicant and, where appropriate, his capacity and his national register or company number; 3° the surname, first name, place of residence and, where applicable, the capacity of the person to be summoned; 4° the subject matter and the brief summary of the grounds of the claim; 5° the court before whom the claim is brought; 6° the signature of the applicant or of his lawyer. 10The application with its annex, in as many copies as there are interested parties, shall be sent by registered letter sent to the clerk of the court or deposited at the clerk's office. 11 cf. Title 4 – What can I do if my complaint is closed? of the Disputes Chamber's dismissal policy.