APD/GBA (Belgium) - 159/2023

From GDPRhub
Revision as of 10:07, 31 December 2023 by Stefanragossnig (talk | contribs) (Created page with "{{DPAdecisionBOX |Jurisdiction=Belgium |DPA-BG-Color= |DPAlogo=LogoBE.png |DPA_Abbrevation=APD/GBA |DPA_With_Country=APD/GBA (Belgium) |Case_Number_Name=159/2023 |ECLI= |Original_Source_Name_1=APD/GBA - Beslissing 159/2023 van 1 december 2023 |Original_Source_Link_1=https://www.gegevensbeschermingsautoriteit.be/publications/art95-schikking-nr.-159-2023.pdf |Original_Source_Language_1=Dutch |Original_Source_Language__Code_1=NL |Original_Source_Name_2= |Original_Source_...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
APD/GBA - 159/2023
LogoBE.png
Authority: APD/GBA (Belgium)
Jurisdiction: Belgium
Relevant Law: Article 4(11) GDPR
Article 6(1)(a) GDPR
Article 7(3) GDPR
Article 5(3) ePrivacy Directive 2002/58/EC
Type: Complaint
Outcome: Upheld
Started: 19.07.2023
Decided: 24.11.2023
Published: 01.12.2023
Fine: n/a
Parties: Mediafin
noyb
National Case Number/Name: 159/2023
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): Dutch
Original Source: APD/GBA - Beslissing 159/2023 van 1 december 2023 (in NL)
Initial Contributor: Stefan Ragossnig

The Belgian DPA proposed a settlement between the data subject and Mediafin concerning the setting of cookies on www.tijd.be. Inter alia, Mediafin shall ensure that the withdrawal of consent doesn´t take more clicks than the granting of consent.

English Summary

Facts

On 19 July 2023, the data subject (through noyb) filed a complaint against Mediafin with the Belgian DPA . The complaint concerned the practices of the setting of cookies on the website https://www.tijd.be/.

The data subject first complained about a missing "decline" option at the first level of the consent banner. Second, it stated that the cookie banner used misleading button colours and third, that it is not as easy to withdraw consent as it is to give it.

On 20 October 2023, a settlement proposal was sent to the parties. The data subject responded on 30 October 2023 demanding some modifications to the proposed settlement which the DPA denied on 6 November 2023.

Mediafin accepted the proposal on 24 November 2023.

Holding

In its settlement decision the Belgian DPA held that Mediafin shall comply with three conditions:

(1) Mediafin shall provide the cookie-setting banner on https://www.tijd.be/ with a "refuse all" option at the same level as the "agree and close" option within one month of the decision. (2) The "refuse all" option shall be displayed no less (visually) attractive than the "agree and close" option. The data subjects demand to modify this condition - namely that both options should be identical in size, colour, shape, contrast and location - was rejected. The DPA stated that the controller is free to display the "refuse all" option even more appealing. (3) Mediafin shall within one month of the decision ensure that it does not take more clicks to withdraw than to give consent on the website https://www.tijd.be/. The clicks shall be counted from the moment the data subject reaches the cookie setting page. This cookie setting page shall be accesible on every page of the litigious website. This shall be done to meet the requirements of collecting valid consent under the GDPR and Article 5(3) ePrivacy Directive 2002/58/EC as well as these three addition cumulative requirements: (i) the ability to withdraw consent, (ii) the ability to withdraw consent at any time and (iii) withdrawal of consent must be as easy as giving consent (requirements stated by the "Cookie Banner Taskforce" of the EDPB).

The DPA did not impose a fine, because it did not feel the need for a sanction.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

1/23



                                                                          Dispute Chamber


                                              Decision 159/2023 of December 1, 2023





File number: DOS-2023-03281


Subject: settlement decision following a complaint regarding the use of cookies at

Mediafin (website “DeTijd”)



The Disputes Chamber of the Data Protection Authority, composed of Mr

Hielke HIJMANS, sole chairman;


Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of

personal data and regarding the free movement of such data and to the revocation of

Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”;


Having regard to the law of 3 December 2017 establishing the Data Protection Authority,

hereinafter “WOG”;

In view of the internal rules of order, as approved by the House of Representatives

Representatives on December 20, 2018 and published in the Belgian Official Gazette on

January 15, 2019;


Considering the documents in the file;


Has made the following decision regarding:


Complainant: Mr

                   Digital Rights, with registered office at [...], hereinafter “the complainant”, and



Settling party: Mediafin NV, with registered office in [...], hereinafter “the settling party”. Decision 159/2023 — 2/23



I. Pre-Settlement Procedure


    I.1. The complaint


 1. On July 19, 2023, the complainant, through his representative, submits a complaint to the

       Data Protection Authority (“GBA”) against the settling party. 1


 2. The subject of the complaint concerns various elements related to it

       placing cookies on the website https://www.tijd.be/. The complaint refers to the following

       the complainant relevant legislation regarding the granting of consent. The complaint makes

       the link with “misleading cookie banners and 'dark patterns'”. The complaint also refers to

       reports and communications from both the European Data Protection Committee and

       the Belgian GBA relating to the obligations when placing cookies

       where personal data are processed.


 3. The complaint specifically states three alleged practices that are offensive to him

       website exposed. First, the fact that there is “no 'decline' option at the first level

       of the consent banner”. Secondly, that the 'cookie banner' would be used

       creating “misleading button colors”. As the third complaint, the complaint states: “It is not so

       easy to withdraw consent as it is to give consent.”


 4. On August 3, 2023, the First Line Service of the GBA will contact the complainant with the question

       for information “about the complainant's interest in filing the complaint”.

 5. On August 24, 2023, the complaint will be declared admissible by the First Line Service on

       on the basis of articles 58 and 60 of the WOG and the complaint is filed on the basis of article 62, § 1

       of the WOG transferred to the Disputes Chamber. 4


 6. On September 1, 2023, thereafter, the complainant's representative shall inform the

       First-line service a document that further explains the interests of the complainant.


 7. In the document dated September 1, 2023, the complainant's representative refers to

       the admissibility conditions in the WOG - which the complaint complies with - and states that it

       “It is therefore not clear to [the representative] why your First Line Service

       authority requests further substantiation of the complainant's interest in the

       filing the complaint.” The representative points out that the complainant's details




1 During the procedure it was sometimes the case that the complaint was submitted on July 18, 2023, as stated on the complaint itself by
the complainant, but formally speaking the complaint only reached the GBA the following day.
2
 In particular Article 10/2 of the Act of 30 July 2018 on the protection of natural persons with regard to
the processing of personal data, B.S. 05/09/2018 (in implementation of provisions of the “e-Privacy Directive”) and article
6.1.a. GDPR.
3In accordance with Article 61 of the WOG, the Disputes Chamber hereby informs the parties that the complaint is admissible
declared.

4In accordance with Article 95, § 2 of the WOG, the Disputes Chamber hereby informs the parties that the file will be sent to
has been transferred to her as a result of this complaint. Decision 159/2023 — 3/23


       have been effectively processed, and that the complainant is a data subject within the meaning of the GDPR,

       and further states: “The complaint therefore does not merely pursue a public interest in surviving relatives

       protection of every data subject who visits the website.”


 8. In order to ensure an efficient process, the Disputes Chamber will not investigate further
       aspects relating to the interests of the complainant, which have already been discussed in

       the communications between the complainant's representative and the First Line Service.



    I.2. The settlement offer


 9. On September 21, 2023, the Disputes Chamber will send a letter to both the

       representative of the complainant and the settling party, whereby the Disputes Chamber

       communicates to the parties involved that it intends to proceed

       settlement proposal in the file, pursuant to Article 95, § 1, 2° WOG. Creates the notification
       also mentioning the fact that the Disputes Chamber - through communication - has extended the term

       for arresting the Inspection Service on the basis of Article 96, § 1 WOG, eight. The

       Parties can also view the administrative file from this moment onwards if they wish

       to inspect it, which they both subsequently request.


 10. The settlement proposal will be transferred to the settling parties on 20 October 2023
       to the complainant. The content of this settlement proposal is included unchanged in the

       appendix to this settlement decision, and forms an integral part of it. 5 In this

       settlement offer, in particular, all procedural and substantive conditions

       included, as well as the periods within which the parties must respectively respond.



    I.3. Thecomplainant's response


 11. On October 30, 2023, the complainant's representative will send a letter to the

       Dispute Chamber. The complainant's representative will send the letter on November 3, 2023

       also to the settling party, now that it was unclear to the representative that they
       also had to deliver the document to the settling party.


 12. In her response to the settlement proposal, the complainant requests the proposal on several grounds

       “to clarify or adjust points”. The complainant concludes with the following paragraph:

       “The complainant points out that if the content of the settlement proposal is changed to...

       in favor of the defendant [settling party] and/or not (fully) to the above
       requests will be met, the complainant is forced to appeal

       the final settlement decision.”





5It should be noted, however, that an “erratum” was inserted under section f) as the initial text incorrectly stated “(in
In this case, this does not concern a complaint file). Decision 159/2023 — 4/23


13. The Disputes Chamber will reconsider the requests in the light of a clear decision

      of the complainant under section II of this decision, after which the Disputes Chamber in concrete terms

      responds to requests.

14. The Disputes Chamber responded on November 6, 2023 that the settlement proposal was

      the complainant's requests are not changed. The Disputes Chamber does indicate that

      intends to make the decision without omitting the identification data of the

      settling party in accordance with art. 95, §1, 8° WOG.


   I.4. The requests of the settling party and the realization of the settlement


15. On November 16, 2023, the settling party will submit a response regarding the

      settlement offer. She states that she “agrees in principle” to the terms of the agreement

      settlement proposal, but requests clarification on some points. The settling party

      requests, among other things, clarification regarding the format and essential elements of the

      “clear document” referred to in the first and second conditions in the
      settlement offer. For clarification, the settling party attaches appendices to its letter that:

      according to her, could produce such a clear document based on the

      adjustments that it had already made to the contested website at that time.


16. In view of the requests for clarification from the settling party, the
      Dispute Chamber postponed for seven days on November 17, 2023, in extension of the term

      determined under section d) of the settlement proposal.


17. On November 23, 2023, the Disputes Chamber replied that the clear document that
      was transferred in the message of 16 November 2023, which is sufficient for the first one

      two conditions. The Disputes Chamber confirms that it is no longer necessary

      is to transfer the relevant document (or documents) after the present one

      settlement decision is made. The Disputes Chamber also handles a number of other matters

      clarifications and then states that the settling party until 28 November 2023

      has to decide whether or not to accept the settlement proposal.

18. On November 24, 2023, the settling party confirms that it fully agrees to all

      conditions in the settlement proposal. The Disputes Chamber confirms this on the same day

      a settlement has been formally concluded by the notice of the settling party, which

      will lead to the present settlement decision. Decision 159/2023 — 5/23


II. Terms of the settlement and reasons for rejected requests



    II.1. General considerations

 19. During the settlement procedure no changes were made to the

       settlement proposal formulated conditions for the settlement; the conditions stated in

       were included in the settlement proposal, apply pursuant to the settlement. They become in

       this section is not included and are shown in the appendix to this decision.


 20. The Disputes Chamber also clarifies that they agree with a
       does not regard the settlement offer as a confession, which could be used in particular

       be considered as an aggravating circumstance in determining the sanction for future cases

       procedures at the Disputes Chamber.


 21. The Disputes Chamber then confirms once again that the documents that have been submitted

       by the settling party, are sufficient for what was requested under the first and
       second condition, regarding the provision of a “clear document” that

       shows the technical adjustments.


 22. The Disputes Chamber clarifies that, in the light of adequate procedural progress, the

       settlement procedure is divided into a settlement proposal on the one hand, and a

       settlement decision on the other. This method ensures that the procedural start and end
       endpoint is clear to all parties involved, including the options for

       appeal in these phases through the addition of the appeal clauses. Taking one

       settlement decision also facilitates the transparency of the settlement procedure, now that the

       Disputes Chamber fully opts for such transparency.


 23. In conclusion, the present decision is a prima facie decision taken by the

       Disputes Chamber in accordance with Article 95 of the WOG on the basis of the complaints submitted by the complainant
       complaint submitted, in the context of the “procedure prior to the decision at

       merits” and not a decision on the merits of the Disputes Chamber within the meaning of Article 100 of

       the WOG.



    II.2. The denied requests of the complainant


 24. The complainant submitted several requests to the Disputes Chamber, which the

       did not persuade the Disputes Chamber to adjust the settlement proposal. The

       The Disputes Chamber will publish this settlement decision on the
       website of the Data Protection Authority (see section III of this decision), such as






6Section 3, Subsection 2 of the WOG (Articles 94 to 97). Decision 159/2023 — 6/23


     also requested by the complainant, which constitutes a separate decision separate from

     the settlement on the basis of Article 95, §1, 8° WOG.

25. The Disputes Chamber explains below why it will not discuss the others

     requests. It should be noted that the motivation is included in this

     decision, so that the motives follow clearly within the general structure

     process economics.

26. Firstly, with regard to the first condition in the settlement proposal, the

     complainant “explicitly add that this condition means that the 'refuse all' option is

     the same, first 'layer' should be provided as the 'agree and close' option”.

      • The Disputes Chamber rejects this request for the following reason. It's not clear

          which sense this request would produce a different concrete result on the disputed

          website than the current wording in the first condition. The Dispute Chamber

          considers that the proposed change is not an improvement (cf. section c.1. of the
          settlement proposal) would bring about the stipulated condition.


27. Secondly, in relation to the second condition, the complainant requests “to add

     that displaying 'no less (visually) attractive' means, among other things, but not

     is limited to the fact that both the 'reject all' option and the 'agree and close' option are the same
     size, color, shape, contrast and location of the button/option.”


      • The Disputes Chamber rejects this request for the following reason. It's not on the

          Dispute Chamber, nor to the complainant, to determine that buttons are (exactly) the same

          properties should have. This choice belongs to the
          controller. It's true that buttons are exactly the same

          properties, are clearly equivalent to granting permission. a

          contrario, it cannot be ruled out that the controller will opt for this

          to display the “refuse all” option more attractively, or to innovate

          use of colors (which, for example, represent business and equivalent options) that
          facilitate the person concerned in making his or her choice. The more general

          condition formulated in the settlement proposal regarding “no less (visual)

          attractive” presentation of the choices is therefore sufficient for the Disputes Chamber.

28. Thirdly, in relation to the third condition, the complainant states as follows

     text change for:


          “The defendant undertakes to, within a period of one month,
          to develop and implement a mechanism on the website of [...] that

          meets the requirements stated in the aforementioned

          policy documents and an equivalent effect; it also connects Decision 159/2023 - 7/23


          defendant undertakes that withdrawal of consent will not require any more steps (in

          matter “clicks”) than is necessary for giving consent. On all

          pages of the website must be permanently visible and visually distinguishable

          option is available to reopen the cookie settings with one click. Same

          number of steps for withdrawing consent is counted from the moment
          that the end user reopens the cookie settings. This is done via a

          equivalent number of steps once the end user leaves the page

          has reached cookie settings; this page must be clearly accessible at any

          page of the contested website. The technical adjustments made by the defendant

          does this, will be recorded in a clear document at the time of

          the implementation, and forwarded to the Disputes Chamber and the complainant. Both it
          carrying out the technical implementation, such as drawing up and forwarding

          the document reflecting the implementation will be published within one month of the

          settlement decision made.” (the underlined parts are missing in the current one

          condition three of the settlement proposal)





      • The Disputes Chamber rejects this request to change the condition in its entirety
          the next reason. The Disputes Chamber takes note of the complainant's view that

          a “permanently visible and visually distinguishable option” on all web pages

          of the contested website. The Disputes Chamber, which reaches a reasonable and reasonable settlement with the settlement

          wishes to reach a technically feasible comparison, considers that it is not an option

          to require such adjustments through a settlement.

29. Fourthly, the complainant requests “an order to cease unlawful processing

     added with regard to the website”, which should read as follows:


       “The defendant undertakes that data that are processed because of
       to delete cookies that have not been placed in accordance with the content of this settlement decision

       and that the defendant communicates this obligation to erase to all recipients to whom the

       personal data has been provided in this context. Evidence of this erasure of

       personal data and the communication of this obligation to erase

       personal data to all recipients is recorded in a clear document

       at the time of implementation, and forwarded to the Disputes Chamber and the
       complainant. Both this erasure of personal data and the communication of this

       obligation to erase personal data from all recipients and forward it

       the document reflecting the implementation will be published within one month of the

       settlement decision made.” Decision 159/2023 — 8/23


       • The Disputes Chamber rejects this request for the following reason. The complainant has opted out

          based on the elements available in the administrative file, not addressed to the

          controller following the alleged violation of his rights.

          The Disputes Chamber therefore does not consider it appropriate here and now to do such a thing

          to propose a condition, let alone address an “order” to the settling party.
          The complainant is of course free to address any data controller

          with regard to which the complainant can exercise his rights within the conditions

          of the legislation.

30. Fifth, the complainant requests that an administrative fine be imposed via

     the settlement “in view of Article 83(1) GDPR”.


       • The Disputes Chamber rejects this request for the following reason. Imposing one

          administrative fine is a power that can be exercised by the
          Dispute Chamber pursuant to Article 100, §1, 13° WOG. In that sense, nothing can be done by the

          the complainant intended the administrative fine to be imposed at this stage beforehand

          to the substantive treatment under Article 95 WOG. It is correct that Article 107 WOG

          points out that the legislature wished that with settlements – without clarifying whether

          This could indeed also amount to sums of money under Article 95WOG

          collected, but this is not a requirement for the settlement instrument, as is already the case
          stated by the Disputes Chamber in the settlement proposal. The settlement aims to

          to arrive at a general solution to the complainant's grievances, without

          sanctions should be taken. The Disputes Chamber points out in this regard

          efficient process flow.

31. Sixth, the complainant requests that the settlement decision “shall include that

     defendant [settling party] waives any civil and other rights

     claims related to the settlement, for example but not limited to the

     case of negative reporting regarding the settlement.”

       • The Disputes Chamber rejects this request for the following reason. This does not concern any

          essential request in light of the complainant's grievances expressed in his

          complaint.

32. Seventh, the complainant requests that the settlement decision be published on the

     website of the Data Protection Authority.


       • The Disputes Chamber can grant this request, through section III of this decision. Decision 159/2023 — 9/23



III. Publication of the decision


 33. Considering the importance of transparency with regard to decision-making

       Dispute Chamber, this decision will be published on the website of the
       Data Protection Authority. The name and personal data of the

       complainant, as these are not relevant for transparency regarding the

       settlement procedure.


 34. However, the Disputes Chamber does choose the names of the representative of the

       complaining to the settling party. After all, it is in the social interest that

       the citizen can become aware, in the most transparent manner, of settlement procedures

       lead to (visual) interventions on frequently visited websites such as the website at issue. Per

       definition, after all, the journalistic publications on this contested website are aimed at one
       wide audience, and the visitor to such a website has an interest in taking note of it

       the data protection related aspects. The Disputes Chamber points out for the sake of completeness

       points out that the complainant's representative himself publicized the complaint.



    FOR THESE REASONS   ,


    the Disputes Chamber of the Data Protection Authority will decide


       - on the basis of Article 95, § 1, 2° of the WOG, the settlement as accepted by the

           settling party on November 24, 2023, subject to the terms and conditions

           laid down and clarified in the present decision and its appendix.



Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the

notice, an appeal against this decision will be filed with the Market Court (court of

appeal Brussels), with the Data Protection Authority as defendant.

Such an appeal can be lodged by means of an inter partes petition

must contain statements listed in Article 1034ter of the Judicial Code. It

an objection petition must be submitted to the registry of the Market Court









7The petition states, under penalty of nullity:
 1° the day, month and year;
 2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
    company number;
 3° the surname, first name, place of residence and, where applicable, the capacity of the person to be
    summoned;
 4° the subject matter and brief summary of the grounds of the claim;
 5° the judge before whom the claim is brought;
 6° the signature of the applicant or his lawyer. Decision 159/2023 — 10/23


in accordance with Article 1034quinquies of the Dutch Civil Code. , 8 or via the e-Deposit

IT system of Justice (Article 32ter of the Judicial Code).









   (transl.) Hielke HIJMANS

   Chairman of the Disputes Chamber





























































8
 The petition with its attachment will be sent by registered letter, in as many copies as there are parties involved.
deposited with the clerk of the court or at the registry. Decision 159/2023 — 11/23





Annex - settlement proposal Decision 159/2023 - 12/23





        Dispute Chamber Only by e-mail:



                                                       For the attention of Mediafin

                                                       Havenlaan 86c, bus 309, 1000 Brussels


Secretariat Contact person: Mr. Y
T: +32 (0)2 274 48 56
Email: litigationchamber@apd-gba.be
                                                       Via email address: […]


                                                       Defendant


                                                       By email:

                                                       For the attention of NOYB-European Center for Digital

                                                       Rights, representative of Mr. X


                                                       Via email address: […]


                                                       Complainant





                                                                                                      Bi






      Your reference Our reference Attachment(s) Date

      NOYB: C-062-10 DOS-2020-03281 1 20/10/2023



     Subject: application of art. 95, § 1, 2° WOG – settlement proposal in the complaint file

     because of mr. X regarding cookies at Mediafin (de Tijd website)



     Dear,


                                                            9
     The Disputes Chamber first refers to the letter it previously sent to the defendant and complainant

     with the notification that the Disputes Chamber intended to submit a settlement proposal

     to the parties in the current file. The present document contains this

     settlement offer.

     In the context of a large number of files that are before the Disputes Chamber,

     resulting in long processing times for all files, the Disputes Chamber pursuant to Article 95

     § 1, 2° of the Act Establishing the Data Protection Authority (“WOG”) 10 decided to



     9Letter by registered mail dated September 21, 2023.
     10
      B.S. January 10, 2018. Decision 159/2023 — 13/23



to propose a settlement in the aforementioned file by means of this letter (

“settlement offer”). The Disputes Chamber also takes into account the fact that a large

number of complaints regarding cookies are currently being processed. Although the theme “cookies”

belongs to the priorities of the Data Protection Authority, serves the Disputes Chamber

to carefully choose the treatment of its files, so that it covers various socially relevant matters


can handle (complaint) files with the necessary speed. The Belgian legislator has to

underlines the need for the Disputes Chamber to be able to act selectively,

to ensure effective enforcement. 12




This settlement proposal is made without any adverse acknowledgment and binds the Disputes Chamber

in no way whatsoever with regard to any position taken in refusing it

settlement offer. The Disputes Chamber refers in particular to its powers to:

whether or not to determine infringements and, if necessary, to use the hair below

European and Belgian law granted sanctioning powers. In this case it belongs

to the possibilities of the Disputes Chamber to review the file - in the event of a refusal or


if the Disputes Chamber withdraws the settlement proposal - to continue in a different manner.



If the party to whom the settlement proposal is addressed expressly refuses the proposal,

the Disputes Chamber will continue the file.






     a) Procedural positioning of the settlement proposal and the settlement

The settlement proposal in this case is within the scope provided for by the legislature

“procedure prior to the decision on the merits” at the Disputes Chamber. 15 The

The Dispute Chamber therefore does not take any position regarding the necessity of any

investigative measures 16 by the Inspection Service, or the need to open the file (subsequently)


otherwise continue in accordance with the provisions of Article 95 WOG.




11 See the press release from the Data Protection Authority in this regard, available at:
https://www.gegevensbeschermingsautoriteit.be/burger/de-gba-stelt-haar-priorheden-voor-het-jaar-2023-vast

12Belgian Chamber of Representatives, Explanatory Memorandum to the Bill establishing the
Data Protection Authority, Doc. 2648/001 (Parliamentary term 54), available via:
https://www.dekamer.be/kvvcr/showpage.cfm?section=/flwb&language=nl&cfm=/site/wwwcfm/flwb/flwbn.cfm?lang=N&leg
islat=54&fileID=2648, 51; see also: E. Degraeve, “Titre 11. Autorité de control” in C. DE TERWANGNE and K. ROSIER, Le
                                                         re
Règlement sur la protection des données (RGPD/GDPR) – 1 edition, Larcier, 2018, (593)607 : « [L'autorité de contrôle]peut
It is important to exercise the missions of control and appreciation of the suitability of the plain text that is addressed. »
13See Article 58 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and with regard to free movement
of that data and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”;
14See article 100 WOG.

15See section 6.3.2. and articles 94-97 of the WOG.
16 Cfr. Article 94, 1° and 2° WOG; also compare the notification in the notification dated. 21/09/2023 to parties: “This notification was encountered
period as referred to in Article 96, §1 WOG of 30 days to apprehend the Inspection Service until the moment that the

Disputes Chamber determines that the settlement proposal does not lead or cannot lead to an actual settlement.” Decision 159/2023 — 14/23





Now the procedure for the Disputes Chamber of the Data Protection Authority cannot be the same
with the criminal law procedure, “the settlement” as provided

are not equated with the Belgian legislator under Article 95 §1 2° WOG

“amicable settlement” from criminal law. After all, the settlement within the meaning of the WOG has a sui

generic character.





In addition, the Disputes Chamber states the precise facts framed in time and space

the reason for the settlement proposal (infra). Although the Litigation Chamber, such as

mentioned earlier, hic et nunc does not make a statement about the existence of infringements, it must

on the elements present in the file in order to proceed with the settlement proposal

to go. This concerns the elements that the complainant experienced as offensive. The settlement offer

thus relates to certain facts within a certain time frame and within a certain

(technical) context, where facts that go beyond this time frame and context are not included

scope of the settlement. If a settlement is entered into, this will apply

have on the elements as reflected in the complaints of the complaining party, in this case between the

time of filing the complaint and the date of the formal settlement decision. The

The disputed period only concerns the period between the date of filing the complaint and the date

of the formal settlement decision following this settlement proposal.


In general, the Disputes Chamber frames the settlement procedurally as follows:



    1. The settlement under the WOG is a settlement between:

        - On the one hand, the Disputes Chamber, which undertakes to terminate the procedure, whereby it:

            among other things, refrains from potentially imposing corrective measures,

        - and on the other hand, the defendant who undertakes to pay a sum of money and/or

            to comply with certain conditions.

    2. The settlement in principle entails an acknowledgment of the facts on the part of the settling party,

        but is not an admission of a violation of current legislation.

    3. The scope of the settlement is in all cases limited to the facts and the time frame

        that are expressly stated in the settlement proposal, respectively. the settlement are stated.






17See in particular Articles 216bis and 216ter of the Code of Criminal Procedure regarding the extinguishing of public
criminal proceedings relating to certain infringements by fulfilling certain conditions such as paying a
sum of money, as well as agreeing to implement certain measures; A.RIGLOLET, Contratdetransaction,
Larcier, Brussels, 2021 ; A. RAES, T. VAN WYNSBERGE, S. DE KEULENAER, E. DEVEUX, K. DECRAMER, A. DELADRIERE, “The
extended amicable settlement: an 'added value' or 'win-win' situation? practice.”, Panopticon, no. 36(2), 2015,
(88) M. FERNANDEZ-BERTIER and N. VAN DER EECKEN, “La transaction penale élargie déclarée inconstitutionnelle : vers une
motivation de la transaction et un contrôle jurisdictionnel suffisant et effectiveif », Droit Pénal de l'Entreprise, 2016, no. 3, (213)213. Decision 159/2023 — 15/23


    4. The complainant will be heard in the realization of a possible settlement

        following a complaint. The complainant is being heard about his views on both

        use of the settlement instrument in this case, if the contents of the

        settlement proposal on the other.

        The complainant has the opportunity to take a position with regard to the proposed

        settlement, at the latest within 14 days of receiving the settlement proposal.

        This period does not prevent either party from providing an explanation

        regarding the settlement proposal in writing or verbally (infra).

    5. A settlement is formalized by means of a settlement decision, with the procedure

        the procedure prior to the settlement is outlined in a transparent manner, and

        whereby the conditions in the settlement proposal and those ultimately stipulated

        settlement terms are expressly included (in principle by reference

        to the settlement proposal, attached to the settlement decision).
    6. All parties involved retain the right to make comments, in principle in writing

        about the settlement proposal and its contents.

    7. An unaccepted or otherwise unsuccessful settlement does not allow the continuation of the matter

        file is unaffected and has no impact on any alternative handling of the file

        file.



    b) Substantive conditions of settlement proposal


    b.1.) De Tijd (www.tijd.be)

    b.1.1) first complaint of the complainant in his complaint dated. July 18, 2023



 First complaint of the complainant in his complaint dated. July 18, 2023:

 “Violation type 1: No 'decline' option on the first information level of the
 consent banner”. In support of this complaint, the complainant adds the following two:

 screenshots in the attachment:



                                          1. Complaint, appendix 2














18In light of Article 77 of the General Data Protection Regulation, the complainant has a more extensive role than in
settlement procedures at other regulators, see e.g. the mere notification to the complaining party in the settlement procedure
at the Belgian Competition Authority, cf. article IV.59 in fine of the Code of Economic Law of 28/02/2013 (B.S.
29/03/2013). Decision 159/2023 — 16/23































                                                 2. Complaint, appendix 3





























 Prima facie relevant elements from policy positions and documents of the

 Data Protection Authority.




      1. The positions of the “Cookie Banner Taskforce” of the European Committee for
           Data protection 19 and the press release of the
                                                     20
           Data Protection Authority. An excerpt from that press release:




19European Data Protection Board, January 18, 2023, Report of the Work undertaken by the Cookie Banner
Taskforce, available in English at: https://edpb.europa.eu/our-work-tools/our-documents/other/report-work-
undertaken-cookie-banner-taskforce_en

20Data Protection Authority press release, February 10, 2023, Cookie banners: the EDPB publishes examples of non-
compliant practices” available at
https://www.dataprotectionauthority.be/burger/nieuws/2023/02/10/cookiebanners-de-edpb-published-
examples-of-non-compliant-practices. Decision 159/2023 — 17/23


         “Missing a “deny all” button at the same level as the button

         “accept everything”. Most data protection authorities, including the DPA,
         believed that this was an infringement and that the user of a website

         at the same time must have the option to accept or refuse the
         placing/reading cookies on his device.”


     2. The “cookie checklist” of the Belgian Data Protection Authority

         “I do not provide an “accept all cookies” (or similar) button without the same

         “low” a “refuse all not strictly necessary cookies” (or similar) button
         provided"



 Proposal condition one settlement proposal:

 The defendant provides a similar “refuse all” option on the “De Tijd” website
 place where “agreement and conclusion” is now indicated, within one month after the date of the

 settlement decision, or implements a practice of equivalent effect within the same

 period of time. The technical adjustments that the defendant makes for this purpose are recorded in a document

 clear document at the time of implementation, and forwarded to the

 Dispute Chamber and the complainant. Both the implementation of the technical implementation and the

 preparation and forwarding of the document showing the implementation is done within the

 month after the settlement decision.



    b.1.2) second complaint of the complainant in his complaint dated. July 18, 2023



 Second complaint of the complainant in his complaint dated. July 18, 2023:
 “Violation type 2: Misleading button colors, more specifically, the complainant is advised to use

 a different and more eye-catching color for accepting cookies a

 would infringe the relevant legislation. In support of this complaint, the complainant adds:

 following two screenshots in the attachment:



                                         1. Complaint, appendix 2


















21A copy of this “cookie checklist” is attached to this settlement proposal; This is until publication on the website
document confidential. Decision 159/2023 — 18/23




























                                          2. Complaint, appendix 3


























 Prima facie relevant elements from policy positions and documents of the

 Data Protection Authority.


     1. The “cookie checklist” of the Belgian Data Protection Authority
         I do not use techniques that can be qualified as “deceptive design”.

         (e.g. nudging through the use of color)


     2. The positions of the “Cookie Banner Taskforce” of the European Committee for
         Data protection and the press release from the Data Protection Authority.

         An excerpt from that press release and from the January 17 Task Force report
         2023 respectively:







22See also our earlier press release: https://www.gegevensbeschermingsautoriteit.be/burger/nieuws/2023/02/24/deceptive-
design-patterns-how-to-recognize-and-avoid-these-on-social-networks Decision 159/2023 — 19/23



         Misleading design. The task force draws attention to several species
         misleading practices regarding banner formatting.


         To assess the conformity of a banner, it must be determined on a case-by-case basis

         the contrast and colors used are not clearly misleading to the
         users and do not lead to an unintended and therefore invalid consent from the

         users. Consequently, it was also agreed that a case-by-case analysis is necessary to
         specific cases, although some examples have been identified
                                                                                          23
         features that clearly conflict with the provisions of the ePrivacy Directive.


 Proposal condition two settlement proposal:

 The defendant undertakes to follow the option where a “refuse all” option

 of the possible acceptance of condition 1 of the present settlement proposal – behind

 is not less (visually) attractive than the partially or

 fully accept the placing of cookies that are not strictly necessary, and this within one

 month after the settlement decision. The technical adjustments that the defendant makes for this purpose

 are recorded in a clear document at the time of implementation, and

 forwarded to the Disputes Chamber and the complainant. Both the implementation of the technical

 implementation, as well as drafting and forwarding the document that implements it

 will be made within one month of the settlement decision.



    b.1.2) The complainant's third complaint in his complaint dated. July 18, 2023



 The complainant's third complaint in his complaint dated. July 18, 2023:

 “Violation type 3: it is not as easy to withdraw consent as it is to

 to give permission”. In support of this complaint, the complainant adds the following two:

 screenshots in the attachment:



                                          1. Complaint, appendix 4

















23Original text in English: In order to assess the conformity of a banner, a case-by-case verification must be carried out
in order to check that the contrast and colors used are not obviously misleading for the users and do not result in an
unintended and, as such, invalid consent from them. As a result, it was also agreed that a case-by-case analysis would be
necessary to address specific cases, although some examples of features manifestly contradictory to the e-privacy Directive
provisions have been identified. Decision 159/2023 — 20/23

























 Prima facie relevant elements from policy positions and documents of the

 Data Protection Authority.



     1. The “cookie checklist” of the Belgian Data Protection Authority:
         I provide a mechanism to withdraw consent as easily as withdrawing it

         such as by placing a clearly visible link or button where the cookie
         settings can be managed and consent can be withdrawn with one click

         become;


     2. The positions of the “Cookie Banner Taskforce” of the European Committee for
         Data protection and the press release of the Data Protection Authority.

         An extract from the Taskforce report of 17 January 2023:
         In addition to the consent collection requirements to be valid in
         be in accordance with the GDPR and pursuant to Article 5(3) E-Privacy Directive

         three additional cumulative conditions required: (i) the ability to
         withdraw consent, (ii) the ability to withdraw consent at any time

         withdraw, (iii) withdrawing consent should be as easy as giving it
         of consent. 24


 Proposalconditionthreesettlementproposal:ThedefendantcommitstoOoom,withinone

 period of one month, to develop and implement a mechanism on the website of
 “The Time” that meets the requirements stated in the aforementioned

 policy documents; the Defendant also undertakes that the withdrawal of the

 consent does not involve more steps (in this case “clicks”) than are necessary for giving the consent

 permission. This is done via an equivalent number of steps as soon as the end user completes the

 has reached the cookie settings page; this page must be clearly accessible from any user

 page of the contested website.




24In addition to the requirements for the collection of consent to be valid in accordance with the GDPR and under Article 5(3)
ePrivacyDirective, three additional cumulative conditions aremandatory(i)thepossibilitytowithdraw consent, (ii)theabilityto
withdraw consent at any time, (iii)withdrawal of consent must be as easy as to give consent. Decision 159/2023 — 21/23


    c) Written and oral exchanges with parties


        c.1.: written exchanges


        The settlement proposal is the starting point of the settlement procedure. The conditions

        However, this proposal may be used during the further course of the settlement procedure

        be clarified or otherwise adjusted, especially in the case of such adjustments

        bring improvements in light of data protection legislation.
        Such requests do not automatically extend the term.



        In principle, the parties contact the Disputes Chamber in writing when they:

        consider it useful to make certain adjustments to the terms of the settlement proposal

        to do. It is up to the Disputes Chamber to decide on the basis of this communication

        parties to make an adjustment to the settlement proposal.



        In this sense, a constructive attitude on the part of the parties is encouraged. The

        Disputes Chamber expects requests to be made in a reasonable and proportionate manner.

        When, in the view of the Disputes Chamber, the requests demonstrate the fact that a
        settlement is little or not likely, this may lead to the withdrawal of the agreement

        settlement offer.



        c.2. verbal exchanges



        Both parties can request oral explanation of the settlement proposal or

        direct subsequent communications to the Disputes Chamber, whereby it is up to the Disputes Chamber
                                                                                                 25
        able to assess the relevance of such verbal exchanges.

        It goes without saying that this is a favor and that the Disputes Chamber will take this into account

        purely in function of an efficient process flow.


        An official report will be drawn up that, in principle, merely records the occurrence of the incident

        determines the oral explanation moment.



        Both parties are free to participate in the Disputes Chamber

        organized oral explanation moments. The conversations are confidential.

        No communication may be made to third parties about the content of what has been discussed.





25 “Settlement discussions” are a well-known legal practice within the regulatory landscape, compare in particular the
procedure before the Belgian Competition Authority in articles IV.55 et seq. (“Subsection 4 – Settlement procedure”)
of the Economic Law Code of 28/02/2013 (B.S. 29/03/2013) and the mention of such settlement discussions
there. Decision 159/2023 — 22/23


    d) Term

Mediafin must respond within 30 days of receipt of this settlement proposal

comment. The (representative of the) complainant can do so within 14 days of receipt

in this letter take a position on the initial settlement proposal and the underlying one

conditions.




    e) The existence of other controllers and/or processors

This settlement proposal is only addressed to Mediafin. It does not take a position on whether and to what extent

there are other actors responsible for the potential breaches that gave rise

to the present settlement proposal.



    f) Validation of the settlement

When the settlement proposal becomes a formal settlement decision by express

acceptance by the party to whom the settlement proposal is addressed within the aforementioned

period, an appeal can be lodged against this by any “grievous party”. 26



The final settlement does not prejudice the rights of any individuals [ERRATUM]

who have suffered damage to claim compensation before a civil court

on the basis of, among other things, Article 82 GDPR.




    g) Appeal against the settlement offer

Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the

notice to appeal against this decision to make a settlement offer

registered with the Market Court (Brussels Court of Appeal), with the

Data Protection Authority as defendant.


Such an appeal can be lodged by means of an inter partes petition
                                                                                                27
The entries listed in Article 1034ter of the Judicial Code must contain.




26
  Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the notification, this
decision will be appealed to the Market Court (Brussels Court of Appeal), with the

Data Protection Authority as defendant.

Such an appeal may be lodged by means of a petition against the objection referred to in Article 1034ter of the

Judicial Code must contain listed entries. The petition must be contradicted
submitted to the registry of the Market Court in accordance with Article 1034quinquies of the Dutch Civil Code, or via the Deposit

IT system of Justice (Article 32ter of the Judicial Code).

27The petition states, under penalty of nullity:

 7° the day, month and year;
 8° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
    company number; Decision 159/2023 — 23/23



an objection petition must be submitted to the registry of the Market Court
                                                                       28
in accordance with Article 1034quinquies of the Dutch Civil Code. , or via the e-Deposit

IT system of Justice (Article 32ter of the Judicial Code).




Yours faithfully












Hielke Hijmans

Chairman of the Disputes Chamber

















































 9° the surname, first name, place of residence and, where applicable, the capacity of the person to be
     summoned;
 10°the subject matter and brief summary of the grounds of the claim;
 11° the judge before whom the claim is brought;

 12° the signature of the applicant or his lawyer.
28The petition with its attachment will be sent by registered letter in as many copies as there are parties involved
deposited with the clerk of the court or at the registry.