APD/GBA (Belgium) - 16/2025
From GDPRhub
| APD/GBA - 16/2025 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 6(1)(a) GDPR Art. 10(2) GBW Article 125, § 1(1) WEC |
| Type: | Complaint |
| Outcome: | Other Outcome |
| Started: | 19.07.2023 |
| Decided: | 24.01.2025 |
| Published: | 24.01.2025 |
| Fine: | n/a |
| Parties: | DPG Media |
| National Case Number/Name: | 16/2025 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | Gegevensbeschermingsautoriteit (in NL) |
| Initial Contributor: | tjk |
The DPA dismissed numerous challenges to the admissibility of complaints facilitated by noyb. The DPA found that the mere fact that data subjects were noyb volunteers couldn't in and of itself show that there was no legitimate, direct and personal interest at hand.
English Summary
Facts
On 19 July 2023, data subjects filed complaints again four Belgian news websites. The data subjects had visited the websites and, considering that the cookie banners were not GDPR compliant, filed these complaints, mandating noyb to represent them under article 80(1) GDPR. As these websites belong to the same group, the DPA decided to join the cases.
The DPA made a settlement proposal to the controller which ended up being withdrawn after the controller expressed his disagreement with some sections. The controller eventually appealed the withdrawal decision to the Court of Appeal of Brussels (also referred to as Market Court). Upon that court's decision the DPA invited the parties to file submissions limited to the admissibility of the case.
The controller mainly argued that the case was inadmissible because the data subjects were volunteers with noyb when they filed their complaints and that they did not sufficiently prove that their data was processed. It considered that the complaints were initiated by noyb, instrumentalising its volunteers in an attempt to abuse the right to file a complaint. The controller concluded that the data subjects had therefore not validly given a mandate to noyb under Article 80(1) GDPR. It added that these complaints also aimed at using the control-mechanism pursuant to Article 80(2) GDPR while this Article had not been implemented in Belgian law.
The data subjects argued that they had standing to file complaints under Article 77 GDPR and that their professional situation was not a reason to restrain the application of Article 80(1) GDPR as it does not contain further conditions or formal requirements.
Holding
The DPA held, that neither the fact that the data subjects visited the websites at issue from noyb's work computers nor that the data subjects were volunteers at noyb at the time or that noyb provided assistance for data subjects to file GDPR complaints shows an artificial creation of violations or an abuse of law. According to the DPA this follows from Article 77 GDPR which allows data subjects to file complaints if they consider that their rights have been violated. Considering that the data subjects present themselves as interested parties who initiated the complaints themselves and the lack of provisions prohibiting employees or trainees to be represented by their respective organisation within the meaning of Article 80(1) GDPR, the DPA declared the complaint admissible.
The DPA also stated that it is not even required in all circumstances that the data subject's personal data was processed in order to file a complaint, because under Article 77 GDPR, the fact that the data subjects believe that the processing of the websites at issue infringe on their GDPR rights is sufficient to file a complaint.
Therefore the DPA found the data subject's actions admissible opening the procedure to discussing the complaints' merits, meaning the existence of cookie violations on the controller's websites.
Comment
In former decisions, the DPA rejected complaints lodged by noyb volunteers, considering that they lacked standing. However in this decision the DPA stated to never have argued that the fact that data subjects was also volunteering at noyb when the complaint was lodged is a sufficient element to reject complaints. However, they argue that this did "play into the contextualization" of the motives of the decisions rejecting complaints. The DPA also stated, that the fact that noyb allegedly used fictitious mandates in the past, or committed an abuse of law, is not in itself sufficient to establish a fictitious mandate in the present case, or for there to be an abuse of law. "Allegedly" in this case means, that the DPA had ruled so in the past.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/23
Dispute resolution
Decision 16/2025 of 24 January 2025
File number: DOS-2023-03278
Subject:treatmentonthegroundofcomplaintsdirectedagainstDPGMediarelating
to cookies on the websites ‘hln.be’, ‘demorgen.be’, ‘vtm.be’ and ‘7sur7.be’
The Dispute resolution of the Data Protection Authority, composed of Mr
Hielke HIJMANS, sole chair;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of
personal data and on the free movement of such data, and repealing
Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the “GDPR”;
Having regard to the law of 3 December 2017 establishing the Data Protection Authority,
hereinafter referred to as “WOG”;
Having regard to the internal rules of procedure, as approved by the Chamber of
Representatives on 20 December 2018 and published in the Belgian Official Gazette on
15 January 2019;
Having regard to the documents in the file;
Has taken the following decision regarding:
Complainants: X1, hereinafter referred to as “first complainant”, and X2, hereinafter referred to as “second complainant”, both
represented by noyb -European Center for Digital Rights, hereinafter referred to as “the
complainants”;
Defendant: DPG Media, represented by Mr. M AARTEN STASSEN , hereinafter referred to as “the
defendant” Decision 16/2025 — 2/23
I. Facts and procedure
1. The subject of the file relates to four complaints filed on 19 July 2023
with the Data Protection Authority and relating to the websites (1)
https://www.hln.be (complaint first complainant), (2) https://www.demorgen.be (complaint first
complainant), (3) https://www.vtm.be (complaint first complainant) and (4) https://www.7sur7.be (complaint
second complainant). All four complaints were declared admissible by the First Line Service on 24 August 2023 and
transferred to the Dispute Resolution Chamber. 1
2. On 21 September 2023, the parties in the file were informed, in summary,
that the Dispute Chamber intended to make a settlement proposal.
3. On 20 October 2023, a settlement proposal was sent to the parties, whereby the
Dispute Chamber exercised its authority under Article 95, §1, 2° of the
Act of 3 December 2017 establishing the Data Protection Authority (hereinafter:
"WOG").
4. On 30 October 2023, the representative of the complainants submitted a response to the
settlement proposal, in which she addressed a number of requests to the Dispute Chamber
to amend or adjust the conditions for the settlement. The
Dispute Chamber did not adjust the settlement proposal in response to these
2
requests.
5. On 17, 23 and 28 November 2023, various exchanges took place between the defendant, DPG Media, and the
Dispute Resolution Chamber in the context of the settlement procedure - during which the complaining party was always able to read a copy.
6. On 1 December 2023, the Dispute Resolution Chamber made a decision to withdraw the decision
on the settlement proposal.
7. The defendant lodged an appeal against the decision of 1 December 2023 to withdraw the settlement proposal with the
Market Court, in accordance with Article 108 § 1 WOG,
handled there under the file number 2023/AR/1613. On 6 September 2024, the
Market Court declared this appeal admissible, but not well-founded, in a judgment.
8. On 5 February 2024, the Dispute Resolution Chamber invited the parties to conclude
in accordance with Article 95, §1, 1° in conjunction with Article 98 of the Law of 3 December 2017 establishing
1
The admissible complaints are transferred by the First Line Service to the Dispute Resolution Chamber (Article 62, § 1 of the Law of 3 December 2017 establishing the Data Protection Authority).
2 Temporarily following the settlement procedure in the present case, the Dispute Resolution Chamber published a
settlement policy on its website, of which an updated second version was published in December 2024,
available via: https://www.gegevensbeschermingsautoriteit.be/publications/regelingsbeleid-van-de-
geschillenkamer.pdf. Decision 16/2025 — 3/23
of the Data Protection Authority (“WOG”). DPG Media appealed against this decision to the Market Court in a case with file number 2024/AR/439.
9. On 9 October 2024, the Market Court ruled on the appeal against the letter of
5 February 2024, in which the appeal of DPG Media was declared admissible and well-founded.
The Disputes Chamber delivered this judgment to the parties in the administrative procedure on
22 October 2024, the day after receipt thereof.
10. The Disputes Chamber then gave both parties the opportunity – in an ad hoc
procedure that is not explicitly provided for by the legislator – to first take a position on the mandate and
the (procedural) interest of the complainants and their representative, in accordance with the
annulment judgment of the Market Court, before taking a decision within the meaning of Article 95 § 1 WOG.
11. This decision follows and takes into account (i) the positioning that the complainants submitted via their
representative Noyb on 15 November 2024, and (ii) the positioning that the
defendant submitted to the Dispute Chamber on 20 December 2024 – limited to the
(procedural) interest and the mandate when submitting the disputed complaints.
12. In accordance with Article 95, § 2, 3° of the WOG and Article 47 of the internal
rules of order of the GBA, the parties may request a copy of the file. If one
of the two parties wishes to make use of the possibility to consult and
copy the file, it must contact the secretariat of the Dispute Chamber, preferably via […].
II. Reasoning
II.1. Procedural context: Marktenhof judgment of 9 October 2024
13. In its judgment, the Marktenhof rules that the appeal against the letter of 5 February 2024
is admissible, because the letter (i) contains a list of alleged infringements, 3
and (2) uses the wording “based on the documents in the file, including
the complaint form”, and this does not suggest that the file is more substantiated than
the complaint form submitted by Noyb. For that reason, the Marktenhof states that the
4
appeal is admissible “in this very specific context”.
3Cf. Marktenhof, 24 February 2021, 2020/AR/1159, §3.7: “In order to guarantee the full exercise of the rights of the defence and the right to a fair trial, it is therefore essential that the party, the party being prosecuted, must be fully and definitively informed of the factual and legal aspects that are imputed to it in the proceedings before the Litigation Chamber. ” Free translation of: “Il est dès lorsessentiall, afin de garantir le plein
the exercise of defense and the execution of an appropriate process, which is part of the task of pouring out suites,
The preparation of the procedure for the room contention, the preparation and the final information about the elements
fait et de droit qui lazy sont reprochés.”
4Marktenhof, October 9, 2024, 2024/AR/439, p. 22. Decision 16/2025 — 4/23
14. In its judgment of 9 October 2024, the Market Court declared the appeal against the letter of 5
February 2024 well-founded and the decision contained in that letter of the Dispute
Chamber
– which included the commissioning within the meaning of Article 95 § 1° WOG and the invitation to
conclude within the meaning of Articles 98-99 WOG – annulled because of (i) a
formal and material lack of reasoning, and (ii) the lack of mention of the
remedies that can be instituted against it.
15. As regards the lack of reasoning, the Market Court refers to an earlier
decision of the Dispute Chamber in a file to which the complainant had referred in the
present proceedings. In that file, the Inspection Service had taken action and
the Dispute Chamber – after following the procedure on the merits as referred to in
Article 98 et seq. WOG – had dismissed the complaint, strongly summarized because of the
fictitiousness of the mandate granted. Now that the complaining party had mentioned the latter file
in the current procedure, the Market Court states in its judgment:
“In the 'comparable' file DOS-2021-
06483 explicitly cited by NOYB itself, the Dispute Chamber decided on 24 January 2024 (i.e. before taking the
now Contested Decision) (document 21 GBA Decision 22/2024) to dismiss the complaint
because 'NOYB does not demonstrate sufficient interest to take action' and that 'the
actual complainant has no interest in the proceedings'.
[…]
In the present case, DPG Media has made it plausible that the
Dispute Chamber should have motivated in the Contested Decision why it
apparently reserved its judgment on the alleged lack of procedural interest on the part of NOYB
until after the full proceedings had been
conducted.
[…]
In the present case, the Market Court is of the opinion that no justification
is provided for the different treatment of supposedly comparable
situations and that the Market Court is therefore not able to examine whether the
5 Decision 22/2024 of the Dispute Chamber dated 24 January 2024, publicly available via:
https://gegevensbeschermingsautoriteit.be/publications/besluit-ten-gronde-nr.-hierna4.ook, “VOO-
decision”.
6
The complainant had designated this file as ‘comparable’ with the file at issue, pending the
administrative procedure. Decision 16/2025 — 5/23
judgment of the Dispute Chamber on this point is not manifestly unreasonable.” (the
7
Dispute Chamber emphasizes)
16. This judgment shows that the Market Court designates Decision 22/2024 of 24 January 2024
as a relevant document that the Dispute Chamber must include in the present proceedings,
although, in accordance with previous case law of the Market Court, administrative
decisions (just like judicial decisions) have no precedent value. Each 8
file must after all be assessed in concreto within the circumstances. The 9
VOO decision on the merits of January 2024, originally foreign to the present
procedure, was part of the case-file at the time of the annulled decision and the
invitation to submit conclusions in the present file was not part of the documents, and
the defendant had at no time prior to the letter of February 2024
argued the relevance of the VOO file or the decision in that file in the present
procedure. The defendant already had full access to the file prior to and
during the settlement procedure prior to the administrative procedure, and had already had the right
to access, among other things, the exchanges between the First Line Service and Noyb
in connection with the (procedural) interest of the complainants from
September 2023.
17. The Dispute Chamber therefore understands from the judgment of the Market Court
a special obligation to state reasons within the present file, whereby the Dispute Chamber
must explain the different treatment between this file and the file that gave rise to decision
22/2024 of 24 January 2024 ("VOO file"), and should have done so
anyway because of the complainant's statement that the VOO file would be
similar.
18. This decision of the Dispute Chamber is not a pre-emption of the final
position of the Data Protection Authority with regard to an appeal in cassation
against the judgment of the Market Court of dd. 9 October 2024 in the file with file number 2024/AR/439
and does not prejudice any right or remedy in this regard, nor does it contain any adverse
recognition.
II.2. Special motivation for authorisation
II.2.1. The discretionary authority under Article 95 § 1 WOG and the procedural
interest of the VOO decision
19. Firstly, in the phase preceding the hearing on the merits, the point of the
authorisation and the determination of the (procedural) interest on the part of the complaining party in the
7Marktenhof, 9 October 2024, 2024/AR/439, p. 26.
8
Marktenhof, 1 December 2021, 2021/AR/1044, p. 17.
9Marktenhof, 10 December 2023, 2023/AR/817, p. 39-40. Decision 16/2025 — 6/23
the present file is not treated in any procedurally different way from the VOO file. The
Dispute Chamber did not ask the Inspectorate Service to investigate the
mandate and the (procedural) interest in the VOO file; the questions of the Dispute Chamber
10
merely followed the findings in this investigation. More importantly, however, the choice to
initiate such an investigation with the Inspectorate Service falls within the discretionary
11
authority of the Dispute Chamber. Within the European Economic Area,
more than 100,000 complaints are filed each year, which must all be handled by the supervisory authorities
"with due diligence and care",
and not all Belgian complaints can be submitted to the Inspection Service for an investigation.
13
20. Secondly, with regard to the relevance of the decision in the VOO file,
the complainants state in their position before the Dispute Resolution Chamber, regarding the "comparable" nature
with the VOO file:
"Moreover, the e-mail from noyb in this context was taken out of context by DPG Media and the Market Court
with regard to the wording "comparable" file. noyb
merely meant that this concerns complaints procedures that concern the same
subject matter, namely unlawful cookie banners, and that in such cases it is
customary to demonstrate via HAR files that cookies are actually placed
14
where personal data are processed.” (the Dispute Chamber emphasizes)
It is therefore said that the complainants expressly dispute that they have labeled the VOO file as
“comparable” on the point of the mandate and the (procedural) interest.
The Dispute Chamber notes that this dispute on the part of the complainants – a fortiori now
the complainants did not intervene in the proceedings before the Market Court which gave rise to the
judgment of 9 October 2024 – is important for the further explanation in this
decision. 21. Thirdly, it should be noted that the parties have not limited their positions to the
decision in the VOO file, but have also mentioned other files in their
position. In particular, the parties also mention decision 112/2024 of 6
10
The same also applies to the Roularta decision; see Decision 112/2024 of 6 September 2024, §30.
1Article 94, 1° WOG.
12CJEU judgment of 26 September 2024, TR v. Land Hessen, C-768-21, §32; CJEU judgment of 9 January 2025, Österreichische
Datenschutzbehörde v. F.R., C-416/23, §36. 13
In Belgium, since 2018, many hundreds of complaints have been filed each year, cf. Data Protection Authority,
annual reports 2016-2023, available at: https://www.gegevensbeschermingsautoriteit.be/burger/de-
autoriteit/jaarverslagen; on the European figures, cf. European Commission communication of 25 July 2024, Second report on
the application of the General Data Protection Regulation, COM(2024) 357 final, section 2.3, see also 2.5.2 with regard to
"Difficulties handling a high number of complaints".
14
Complainants' position, 15 November 2024, par. 63. Decision 16/2025 — 7/23
15
September 2024 of the Dispute Resolution Chamber (the "Roularta decision"). In view of these
references, and in view of the special obligation to state reasons that the Market Court has introduced in
these specific circumstances as a result of the reference to other files,
the Dispute Chamber will also address these aspects – albeit to a limited extent.
22. In this context, the Dispute Chamber further notes, and purely for the sake of completeness, that the
defendant only challenged the mandate and the (procedural) interest (in February
2024) following the transparent and immediate publication of the VOO decision on the
website of the GBA (in January 2024), just as the complainants felt moved to
lodge the complaints after reading the settlement decisions of the Dispute Chamber in
files initiated by the Management Board of the Data Protection Authority. The transparency of the Dispute Chamber and, by extension, the GBA – publication of decisions is not mandatory now that the Dispute Chamber
decides on a publication on a case-by-case basis – has given rise to all
16
legal and factual debates before us today. The Dispute Chamber
welcomes this debate, but at the same time clarifies that the debate with arguments on the merits
must take place in the context in which the legislator has provided for it, namely
during the proceedings on the merits within the meaning of Articles 98 et seq. of the WOG.
II.2.2. The concrete assessment of the alleged similarity with the VOO (and Roularta) decision
23. In their respective positions of 15 November 2024 and 20
December 2024, the parties both comment on the similarities and differences between the files at issue
and – in particular – the elements in the VOO decision, and as mentioned above also the
Roularta decision.
24. It is beyond dispute that the complaints were not made in the same way in the
three files.
25. As regards the VOO decision, reference can be made to the following facts and timeline.
15The respective complainants or their representative did not lodge an appeal with the Market Court against the VOO and Roularta decisions to dismiss.
16
In any event, the transparency of the GBA and its Dispute Chamber undeniably leads to a higher quality of the
arguments and the legal debate, and differs from the transparency of many other administrative and judicial
authorities; there are various reasons for the latter, see, among others, VANDERSTICHELE, G., “Contribution to a vision for the
judiciary in a digital society (1)”, Substack, 13 January 2025, available at:
https://gvanderstichele.substack.com/p/bijdrage-aan-een-visie-voor-de-
rechtspraak?r=4rtka&utm campaign=post&utm medium=web&triedRedirect=true. Decision 16/2025 — 8/23
i. On 30 May 2021, Noyb sends a pre-litigation letter to VOO, in which it sends a
“draft complaint” to VOO in order to encourage the latter to take action on the basis of the alleged
infringements reported by Noyb; 17
ii. On 31 May 2021, Noyb publishes a press release – also mentioned in the VOO
decision – in which it clarifies that, as an association, it has sent 560 similar
draft complaints to companies in 33 countries, and that it intends to increase this
further to “10,000 further complaints”. The press release
explicitly describes Noyb’s working method, both in text and visually.
a) In text, inter alia:
“In order to tackle this very widespread problem, noyb has developed a system
that automatically detects different types of violations. The noyb legal team
assesses each website, while the system
19
automatically generates a GDPR complaint.” (the Dispute Chamber underlines and
emphasizes)
This shows that within this specific project (i) it is Noyb as an association that
searches for infringing controllers and not on the initiative of specific
data subjects with current and existing grievances within the meaning of the
GDPR, (ii) that Noyb uses automated means for this purpose,
which further demonstrates the distance between the ultimately involved complainant and the
origin of the complaint, and (iii) that Noyb explicitly does not speak of data subjects or
complainants, but of its “legal team” for the investigation of the targeted
controllers. The latter makes it abundantly clear that the
ultimate complainants did not act as persons involved in a private capacity,
but as employees (whether voluntary or not, and regardless of their specific status)
of the association Noyb.
17
Decision 22/2024 of 24 January 2024, recital 4.
18 Decision 22/2024 of 24 January 2024, recital 24 and its footnote 5.
19
Free translation of the following passage from the English press release: “To address this extremely wide-spread issue, noybhas
developedasystemthatautomaticallydiscoversdifferenttypesofviolations.Thenoyblegalteamreviewseachwebsite,while
thesystemautomaticallygeneratesaGDPRcomplaint.” The press release is mentioned in the VOO decision; Decision
22/2024 of 24 January 2024, recital 24 and its footnote 5. Decision 16/2025 — 9/23
b) Visually, the textual explanation is only further confirmed in the same press release:
20
From left to right, the timeline distributed by Noyb itself reads in Dutch:
“Global Scan” – “List of Targeted Persons” – “In-depth Review” – “Draft Complaint” –
“Settlement Option” – “Formal Complaint”;
iii. Only on 2 August 2021, after VOO had failed to adapt its practices
in accordance with the proposals made by Noyb, did the complainant grant a mandate; 21
iv. On 10 August 2021, Noyb finally lodged a complaint
22
with the Data Protection Authority on behalf of the complainant in that file.
26. The timeline in VOO can thus be presented as follows:
20Decision 22/2024 of 24 January 2024, recital 24 and its footnote 5; the press release from Noyb entitled “Noyb aims to end ‘cookie banner terror’ and issues more than 500 GDPR complaints” is available at: https://noyb.eu/en/noyb-aims-end-cookie-banner-
terror-and-issues-more-500-gdpr-complaints. 21Decision 22/2024 of 24 January 2024, consideration 6.
22Decision 22/2024 of 24 January 2024, consideration 1.
23
The visualisation is intended solely to clarify the considerations of the Dispute Chamber and for the good understanding of the parties and the other reader; it does not contain any supporting reasons for the decision in question, and in the event of
ambiguity in the difference between the diagram and the text of the decision, the text prevails in any case. Decision 16/2025 — 11/23
which an employee would have established on instruction, and regardless of the voluntary nature of the
complaint);
3) The trick – which goes beyond filing the complaint in a manner that
constitutes an abuse of rights – to be able to use de facto Article 80.2 of the GDPR, which
is not activated in Belgium, in order to be able to raise global and accessory
issues in function of the policy objectives of the Noyb association.
Furthermore, with regard to the Roularta case, reference is made in full to the grounds for dismissal
used in that decision. 27
29. In conclusion: from the statements of both the representatives of Noyb and
the complainants, certain prior instructions could be established in the VOO and Roularta files from Noyb to the (future) parties concerned or
complainants. For example, in the VOO case, the complainant explicitly stated that the files were
‘assigned’ to him (Decision 22/2024, § 46). Such statements are absent in the present administrative
file. In the two aforementioned files, there were also publicly available elements
that further demonstrated this objective distinction. In the VOO case, for example,
Noyb sent “pre-litigation letters” to VOO, among others, based on visits that
followed the automated identification of a “target list”, i.e. a “list of those targeted”
(Decision 24/2024, §24). In the Roularta case, for example, a project
had been initiated by Noyb that had already established the identity of the companies in question
within a media-driven project with 101 complaints (Decision 112/2024, §40).
II.2.3. Concrete answers to the (sub-)pleas of the parties in relation to (procedural) interest and
mandate
30. It has already been demonstrated above that the present case differs in nature and
constellation of facts from both the VOO case and the Roularta case. Below, the
Dispute Chamber will further discuss the arguments of the defendant in particular, in order to
conclude that in this case there is a legitimate, direct and personal
interest on the part of the complainants, as well as that there is no abuse of rights.
31. In particular, the Dispute Chamber will discuss the three grounds in the
defendant's position prior to this decision, the titles of which are as follows:
First ground: the incorrect representations and objectively verifiable inaccuracies in the
Complaints are of such a nature that it cannot be reliably demonstrated that the
Respondent has processed personal data of the Complainants, as a result of which the
Complainants cannot be considered as
27 Decision 112/2024 of 6 September 2024, section II.3. Decision 16/2025 — 12/23
“data subjects” within the meaning of Article 4.1 GDPR may be qualified to file a complaint against the Respondent under
Article 77 or Article 80.1 GDPR, which means that they have no
interest in bringing the present proceedings.
Second plea: Since noyb had determined all aspects of the Complaints independently of a data subject’s order before generating the circumstances that gave rise to the Complaints and then submitting them to the GBA, noyb was the actual complainant in the Complaints, while noyb does not have the right in Belgium to submit complaints independently of a data subject’s order and therefore used the Complainants as a means to submit the Complaints under Article 80.1 GDPR in conjunction with Article 77 GDPR, it is clear that noyb attempted to artificially create a legal interest in the present proceedings in order to achieve its predetermined objectives, which is an abuse of rights and as a result of which the Complaints should be dismissed.
First sub-plea: the Complaints are part of noyb’s “Cookie Banners” project.
Second sub-plea: the Complaints were part of a sub-project and were generated by
noybbased on specific selection criteria deliberately determined by noyb.
Third sub-plea: the Complainants worked as legal interns on behalf of noyb in the
generation of the Complaints.
Fourth sub-plea: noyb does not have the right in Belgium to file a complaint with the
GBA independently of the assignment of a data subject and therefore uses the
procedure under Article 80.1 GDPR to circumvent the lack of a right under
Article 80.2 GDPR, which constitutes abuse of rights.
Third plea: Comparison with Decision 22/2024 of 24 January 2024 of the
Dispute Resolution Chamber.
32. Firstly, the fact that the complainants made these observations on Noyb's work computers is not in itself an objection and does not detract from the fact that the complainants' personal data may also be processed. In fact, as the
Dispute Chamber also emphasised in the Roularta decision, it is not in itself problematic for the filing of the complaint that Noyb was the complainants' internship supervisor at the time of the mandate, and that Noyb (either expressly or tacitly) offered a forum to
complainants to file GDPR complaints based on their own grievances, because this in itself
does not indicate the artificial creation of grievances or a procedural interest, a fictitious
mandate, or abuse of rights.
29
The complainants rightly point out in their position that Article 77 of the GDPR provides for a low-threshold
28Decision 112/2024 of 6 September 2024, recital 98.
29Complainants' position, 15 November 2024, par. 29. Decision 16/2025 — 13/23
right to complain and that the complaints sufficiently demonstrate that the complainants – who
present themselves in full as data subjects who themselves took the initiative to lodge the complaints – have an 30
interest in lodging the complaints.
It should be emphasized that the forum that Noyb offers for filing complaints, including to persons who work for the association (as interns or in other capacities), does not constitute a problem in itself - certainly not to the extent that it is sufficient to reject the complaint for this reason, precisely because it does not expressly constitute an abuse of rights or artificially create a (procedural) interest. 31
33. Secondly, the Disputes Chamber reads in the first ground of appeal the position of the
defendant that the latter disputes that the personal data of the complainants themselves would
have been processed. However, it is not even required in all circumstances that the personal data of the complainant
have been processed in order to be able to file a complaint. 32
34. In any case, the complainants expressly state that they visited the websites on 10
February 2023 and that "their personal data were processed by DPG Media via cookies." 33
As the complainants note in their position, as Belgian or
Dutch-speaking citizens respectively, they are “partly dependent on DPG
Media” for their news gathering, given the limited number of media providers in Belgium.
Even if there were a dispute about the specific moment of the complainants’ visit –
despite the complainants’ statements applied according to the principle of good
faith 34 – the fact that the complainants believe that the processing of the
disputed websites infringes the processing of their personal data is sufficient to be able to
file a complaint with the GBA. In that sense, the Court of Cassation has already clarified the following:
“By ruling on that basis that an infringement of Article 5, paragraph 1, c), GDPR has not been
proven and annulling the contested decision of the claimant, while it is not
required that the complainant's personal data have actually been processed
in order for the claimant to be able to impose corrective measures or an
administrative fine in response to a complaint, after establishing that a practice exists
30 Complainants' position, 15 November 2024, par. 46: “The complainants actually visited the DPG Media websites themselves and on
their own initiative, without being publicly prompted to do so in any way. In particular, after
taking note of the settlement decision already reached by the GBA with regard to the websites, the complainants had problems with DPG Media's cookie
banner practice.” (the Dispute Chamber emphasises and underlines)
31Cf. In the same sense, Dispute Chamber Decision 113/2024, 6 September 2024, §89.
32Cass., V t. GBA, C.20.03223.N, ECLI:BE:CASS:2021: ARR.20211007.1N.4, §6:
“By holding on that ground that an infringement of Article 5, paragraph 1, c), GDPR has not been proven and by annulling the contested decision of the
claimant, while it is not required that the complainant's personal data have actually been processed in order for the
claimant to be able to impose corrective measures or an administrative fine in response to a complaint, after
establishing that a practice exists that gives rise to an infringement of the principle of minimum data processing,
the appeal judges do not justify their decision in law.” (the Dispute Chamber underlines).”
33 Position of the complainants, 15 November 2024, par. 11.
34 See Article 1.9, paragraph 1 of the Civil Code: “Good faith is presumed.” Decision 16/2025 — 14/23
which gives rise to an infringement of the principle of minimal data processing, the appeal judges do not justify their decision in
law.”35 (the Dispute Chamber underlines).
35. Nowhere can the defendant irreversibly prove (for example on the basis of statements
or press releases from complainants or Noyb) that the visits on 10 February 2023 were not made by the
complainants or that there was any deception in the submission of evidence –
at most it concerns carelessness on the part of the representative in framing and
dating certain pieces of evidence:
a. The fact that after the initial visit by the complainants on 10 February 2023,
there were also other persons from Noyb who gathered evidence
in preparation for the mandate and the complaint, does not prove that the
initial visits were not made by complainants and/or that the personal data
of the complainants were or were not processed;
b. The fact that further screenshots were taken by other persons of
other aspects of the cookie banners, or in relation to the banner regulating the
withdrawal of consent, with the evidence that other laptops were used to
take those screenshots, does not prove that it was not the complainants who
visited the websites of their own accord on 10 February 2023 and
decided to file a complaint;
c. The fact that on the day of the visits by the complainants, i.e. 10 February 2023,
cookies were allegedly refused – and not on later dates – and that it is therefore established
that no personal data of the complainants were processed and that therefore no
complaint can be filed, fails on two points as a matter of law, since (i) the
complainants cannot be asked – if they had indeed refused the cookies, as the defendant
claims – to participate in the allegedly infringing practice in order to be able to file a complaint, and (ii) it is the complainants
who, according to their statements on 10 February 2023, established the
allegedly infringing practice and at that time were “of the opinion” that an
infringement of the personal data concerning them could be established for which they mandated Noyb
in accordance with Article 80.1 GDPR. For this
last aspect, the complainants rightly refer to recital 142 of the preamble to the GDPR, which
35Cass., C.20.03223.N, available at: https://juportal.be/JUPORTAwork/ECLI:BE:CASS:2021:ARR.20211007.1N.4 NL.pdf;
§6:
36
Ibid.
37See the wording of Article 77.1 GDPR and recital 142 of its preamble in the light of Article 80.1 GDPR. Decision 16/2025 — 15/23
that a data subject may write to a representative as soon as he or she “considers” that his or her rights under the GDPR have been infringed.
36. Thirdly, the defendant, also in its first ground of appeal, states that all kinds of incorrect
evidence is provided, because, for example, documents are provided that only
mention the URL “https://myprivacy.dpgmedia.be”, and not the websites that are the subject of the
disputed complaints, such as Het Laatste Nieuws or De Morgen.38 This is an apparently
unhelpful argument, because it is precisely the first URL that every
website visitor can end up at when visiting the aforementioned two disputed
websites to give or withhold permission for cookies to be placed.
In addition, the defendant fails to state which screenshots would then
have been manipulated in concreto, so that the actual representations of the disputed
cookie banners indicate a lack of (procedural) interest on the part of the
complainant for the initial visits and their grievances that existed in that context.
In any case, nothing in this context points to a defective mandate or
a lack of procedural interest; the defendant is of course free to dispute the truthfulness or pertinence of certain documents in the context of the substantive handling of the case.
It is not at all relevant or appropriate for the preparation of the case that the
Dispute Chamber has already ruled on the sufficient evidentiary nature of
certain documents for establishing an infringement, such as the HAR files that the
complainants enclosed. The defendant's arguments in this regard will therefore not be dealt with further
in the interests of the proper administration of justice. 37. Fourthly, in the first sub-plea of its second plea, the defendant points to the
subdivision of the disputed complaints – on the defendant’s website – of the
complainants under the project “Cookie Banners”, and the defendant states that Noyb in this case
artificially created complaints despite the drafting of Article 80.1 GDPR
(with a distinction with regard to Article 80.2 GDPR, which was not ‘activated’ in Belgian
legislation). The fact that certain complaints are subdivided under certain projects does not in itself
indicate that Noyb would have drawn up and submitted these complaints artificially –
and in particular not at the initiative of the complainants concerned. The fact that Noyb – after the request to do so by the complainants – allegedly
coordinated with those complainants, and that it could place complaints under a certain
category of activities and projects, can hardly be seen as an element that is
sufficient in itself to speak of an artificially created complaint (or, to the extent that the
defendant refers to this, abuse of rights or a fictitious mandate).
38
Position of the defendant, 20 December 2024, §§25-32.. Decision 16/2025 — 16/23
38. Fifthly, in its second sub-plea under its second plea, the defendant points out that
the complaints formed part of a sub-project generated by Noyb
on the basis of specific selection criteria determined by Noyb:
a. The elements that the defendant puts forward in connection with the subdivision on the
publicly available websites of Noyb confirm that the complaints as a sub-
project appear to be explicitly separate from certain other (cookie) projects,
in particular those projects in which Noyb centrally and in a coordinated manner
determines themes and controllers within this or that project actions set up by itself;
b. The fact that the complainants jointly intended to file the complaints,
with the aim of being represented by Noyb and to have these complaints
placed under the categories of other cookie banner complaints, does not
demonstrate any prior instruction indicating abuse of rights or a lack of procedural interest in the relationship between the complainants and Noyb;
c. Where the defendant states that Noyb does not state that it acts on behalf of
specific complainants and in that context states that specific consideration was given to the
settlement decisions of the GBA against certain media companies – be it
stated that it is indeed Noyb who, as representative of the complainants,
files a complaint with the supervisory authority under the wording of Article 80.1 GDPR.
The fact that Noyb designates itself as the submitter of the complaints is
simply correct (insofar as this would further constitute a pertinent evidence for the
presence of abuse of rights or a fictitious mandate);
d. The fact that the file numbers are all the same as the list (on websites)
of Noyb that show settlement decisions of the GBA containing, among other things, a
previous settlement with the defendant, again does not at all demonstrate that it is Noyb who gave a prior instruction to the
complainants; at most
this single fact shows that the complainants made use of the information
available on Noyb's website(s);
e. The fact that the evidence was placed in a folder stating that it
concerns part of "ongoing projects" proves - again -
no prior instruction, but merely that the complainants made use of the
facilities offered to them at Noyb, where they took advantage of the forum
offered to them to file their grievances in the form of complaints (and according
to their wording under "projects") with Noyb as their
representative; Decision 16/2025 — 17/23
f. The fact that (one of) the complainants has or has stored the complaint in an English-language folder is by no means a relevant element and proves, again, only that the complainants made use of the facilities offered to them at Noyb, where they made use of the forum offered to them to file their grievances in the form of complaints (and according to their wording under “projects”) with Noyb as representative;
g. The fact that the complainants use the same categorisation as that of
Noyb, which speaks of certain types of infringements, does not prove a prior instruction from
Noyb; it merely shows that the complainants used the instruments (including templates, standard paragraphs, etc.) that
were offered to Noyb, where they used the forum that was offered to
them to file their grievances in the form of complaints (and according to their wording
under "projects") with Noyb as representative;
h. The fact that after the complainants' first visits to the websites and after the
emergence of their grievances in this regard, other employees of Noyb also gathered evidence
while at that time there was no formal mandate for Noyb, does not prove a prior instruction from
Noyb whereby the grievances of the complainants would have been 'sent'; this only proves that there was already coordination before the formal mandate of Noyb, which is not problematic in itself and can be considered good practice to ensure that no complaints are filed that are not preceded by careful gathering of evidence and preparation;
i. The fact that one of the complainants takes the floor in the press release of Noyb regarding the
disputed complaints and is referred to as a “legal intern at noyb” (and not as one of the
complainants), also proves no prior instruction from Noyb
this person as complainant – prior to the grievances arising – and the
quote 39 shows that the complainant in question (by using “we”) himself also experienced the
practice as grievous.
39. Sixthly, the defendant refers in the third sub-plea of her second
plea to the fact that both complainants worked as legal interns “on behalf of Noyb”
when generating the complaints. It should be noted once again that it is indisputable that
the complainants were indeed trainees (“interns”) at the time they arose and visited the disputed websites, but that the law nowhere precludes a
internship supervisor or employer from representing his or her trainees or employees in the
39The full quote, reproduced in the defendant’s position of 20 December 2024 (§92), reads: “We are shocked that
despite the clarity of the applicable cookie requirements, the news websites concerned still do not respect the basic principles
that apply to the design of cookie banners. Respecting the privacy of their users is particularly important
as these websites have many visitors.” Decision 16/2025 — 18/23
lodging complaints within the meaning of Article 80.1 GDPR.
The Dispute Resolution Chamber has also never stated that the mere fact that complainants were also "trainees" or "interns" at the time of filing the complaint, or had any other function as an employee at Noyb, in itself constitutes a sufficient element to reject complaints filed within a representation relationship under Article 80.1 GDPR.
However, this did play a role in the contextualisation of the reasons for the decisions in which complaints were rejected (particularly in the VOO and Roularta files), because there was
undeniable (including publicly available) evidence that proved that the grievances could not be traced back to the complainants concerned - and that their
personal data processing was artificially constructed (which also entails a risk of damage, as the Dispute Resolution Chamber explained in the
Roularta decision).
40. Furthermore, the defendant cites a number of additional factual elements that it
finds relevant in this context, which also do not give the Disputes Chamber any reason
to reject the complaints.
41. It is irrelevant that Noyb states that the persons in question are trainees or
volunteers, and that therefore there can allegedly be no question of any coercion. The
41
Disputes Chamber emphasises – just as it did in the Roularta and Mediahuis decisions –
that an internship relationship does indeed imply a certain subordination (for example,
because a successful or unsuccessful internship can have consequences for a person's professional
career), and that there can therefore indeed be a risk of coercion, as well as
possible conflicts of interest. 42. The fact that the defendant discusses the status of the volunteer in detail in his position is not relevant in that sense, since it is not relevant to the Dispute Chamber – and never has been – that the status of “volunteer” allegedly entails less risk of coercion than the status of an employee. The only thing that could change the position here is if there is evidence that there were specific projects or instructions to file specific complaints, which – indeed – could indicate, for example, a conflict of interest. 43. In the same context, the defendant also refers to a case before the Court of Justice, which was brought by the complainants, to argue that Noyb had also been brought before the Court of Justice
40Decision of the Dispute Chamber 112/2024, 6 September 2024, § 77.
41
Decision 113/2024 of the Dispute Chamber, available at:
https://gegevensbeschermingsautoriteit.be/publications/besluit-ten-gronde-nr.-113-2024-van-6-september-2024.pdf.
42This could also be a risk in a relationship between a volunteer employee and the provider of the
voluntary workshop.
43Cf. Decision of the Dispute Resolution Chamber 112/2024, 6 September 2024, § 79. Decision 16/2025 — 19/23
(former) employees. This case is not relevant, because the
access to justice for the supervisory authorities in each case differs from that of
the courts and tribunals and, in addition, the case had nothing to do with
representation before the supervisory authority within the meaning of Article 80.1 GDPR.
44. Seventh, in the fourth sub-ground of its second ground, the defendant argues, in summary, that there is an abuse of rights because Article 80.2 of the GDPR has not been implemented in Belgian legislation and that Noyb is therefore instrumentalising the complainants in order to be able to exercise the right to complain via Article 80.1 of the GDPR. The Dispute Chamber reiterates that the fact that Noyb has allegedly used fictitious mandates in the past or has committed an abuse of rights is not sufficient in itself for there to be a fictitious mandate in the present case or an abuse of rights. Where the defendant argues that Noyb has lodged a complaint "independently of a person concerned", her argument fails as a matter of law; in this case, there is a clear mandate of representation for the two complainants involved, and the complainants state that they themselves took the initiative for the complaints. 45. Eighth, as regards the distinction with the VOO file, the defendant argues in its third ground of appeal that many elements are similar to the present file. The differences, however, according to the defendant (strongly summarized) are that in the VOO case the Inspectorate intervened and the processing of personal data of complainants was demonstrated, which would not be the case here. However, the Disputes Chamber does not see how in the VOO case the processing of personal data was more established than in the present case, and how the intervention of the Inspectorate in this case could have demonstrated more that the complainants had actually visited the disputed websites themselves on 10 February 2023 (and in that sense, could have provided more evidence to the contrary – which entails proving a negative fact, since the complainants argue the contrary). None of the elements put forward by the defendant indicate that
here too there would be a fictitious mandate (or a lack of procedural interest or
the presence of abuse of rights), precisely because the VOO file differs substantially
from the present case in the constellation of facts (supra, section 3.3).
II.3. The decision to deal with the merits (Article 95, §1, 1° WOG)
46. Taking these considerations into account, in accordance withArticle 95, §1, 1° WOG, the
44
Dispute Chamber decides to deal with the merits of the file, of which
45
notice is given here and in which the parties will be able to submit defences.
44Art. 95, § 1, 1° of the Act of 3 December 2017 establishing the Data Protection Authority.
45Art. 98 of the Act of 3 December 2017 establishing the Data Protection Authority. Decision 16/2025 — 20/23
47. As regards the procedural point concerning the (procedural) interest of the complainants and
the mandate of their representative, this constitutes a prima facie decision, since the
substantive debates also allow – and had always allowed – arguments and
means to be put forward that will lead to a decision under Article 100
WOG, including a decision to discontinue the proceedings.
48. Given the continuation of the hearing of the case on the merits, the Dispute Chamber will
invite the parties, pursuant to Articles 98, 2° and 3° in conjunction with Article 99 of the
WOG, to submit their defences and to add all documents that they consider useful to the
file. 49. For the sake of completeness, the Dispute Chamber points out that a hearing on the merits of the case may lead to the imposition of the measures referred to in Article 100 of the WOG. 46
50. Given the previous exchanges with the parties in Dutch and the fact that the defendant's registered office is located in a monolingual Dutch language area, Dutch is used as the procedural language.
51. Based on the documents in the file, including the complaint form, the
Dispute Chamber determines that the scope of this case relates to the following
alleged infringements by the defendant:
1. Alleged infringements of art. 10/2 of the law of 30 July 2018 on the
protection of natural persons with regard to the processing of
personal data (B.S. 5/9/2018, hereinafter “GBW”), in conjunction with, on the one hand, article
125, §1, 1° of the Law of 13 June 2005 on electronic communications
(B.S. 20/6/2005, hereinafter “WEC”; this provision is referred to in art. 10/2 GBW) and
on the other hand, with article 6.1.a. of the General Data Protection Regulation
(EU 2016/679, publ. 4/5/2016, hereinafter “GDPR”): the complainants state in each of the four
46
Article 100. § 1. The Dispute Resolution Chamber has the power to:
1° dismiss a complaint; 2° to order the dismissal of the prosecution;
3° to order the suspension of the judgment;
4° to propose a settlement;
5° to issue warnings and reprimands;
6° to order that the data subject's requests to exercise his rights be complied with;
7° to order that the data subject be informed of the security problem;
8° to order that the processing be temporarily or definitively frozen, restricted or prohibited;
9° to order that the processing be brought into line;
10° to order the correction, restriction or erasure of data and the notification thereof to the recipients of the
data;
11° to order the withdrawal of the recognition of certification bodies;
12° to impose penalty payments;
13° to impose administrative fines;
14° to order the suspension of cross-border data flows to another State or an international
institution; 15° to transfer the file to the public prosecutor's office in Brussels, who will inform it of the
follow-up given to the file;
16° to decide, on a case-by-case basis, to publish its decisions on the website of the
Data Protection Authority. Decision 16/2025 — 21/23
complaints for each of the four websites at issue that the consent requirements
would not be respected, in particular because there is no "refuse" option
at the first level of information of the cookie banner. In this sense, the alleged
infringements concern the fact that there is no valid consent within the framework of the
Belgian implementing provisions of the e-Privacy Directive (EU 2002/58) in conjunction
with the aforementioned provisions of the GDPR, as regards
personal data processing that takes place as a result of the placement of cookies;
2. Alleged infringements of Articles 5.1.a. GDPR and 6.1.a. GDPR: the complainants state in each of the four complaints that the use of different colours for the cookie banner used in the context of the granting of consent would be misleading in this case. In this sense, the alleged infringements concern respect for the principles of lawfulness, propriety and transparency, as well as the valid granting of consent.
The Dispute Resolution Chamber also raises ex officio, in view of the apparent connection, the
consent requirements under the aforementioned Articles 10/2GBW and 125, §1, 1°
WEC in this context – given the link with the placing of cookies and
consent requirements in those statutory provisions. The defendant must therefore also include these
articles in its defence in this regard;
3. Alleged infringements of art. 4(11) in conjunction with art. 7.3 GDPR: the complainants state in each of their four complaints that withdrawing consent is not as easy as giving consent in the context of placing consent. In this sense, all complaints state that the data subjects must first go through a number of steps on the websites in question in order to be able to withdraw any consent, after which the withdrawal of any consent given – for example but not limited to the case where a data subject had previously accepted all cookies simultaneously – could only be done separately. The Dispute Resolution Chamber also raises the consent requirements under the aforementioned Articles 10/2 GBW and 125, §1, 1° WEC ex officio in this context, given the link with placing cookies and consent requirements in those legal provisions. The
complaint concerning the website ‘7sur7’ also mentions in this context an alleged infringement
of art.5.1.a.GDPR, since it would not be proper or transparent that the
section on the cookie policy on the website in question does not contain a button or link to
adjust cookie preferences, and that the section mentioned would also not be
available on the website in question. The defendant must therefore also include these articles
in the defence in this regard. Decision 16/2025 — 23/23
Such an appeal can be lodged by means of an inter partes application that
must contain the information listed in article 1034ter of the Judicial Code. The 47
inter partes application must be submitted to the registry of the Market Court
48
in accordance with article 1034quinquies of the Judicial Code. , or via the e-Deposit
information system of Justice (Article 32ter of the Judicial Code).
Hielke H IJMANS
Chairman of the Dispute Chamber
47
The application shall state, under penalty of nullity:
1° the day, month and year;
2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
company number;
3° the surname, first name, place of residence and, where applicable, the capacity of the person to be
summoned;
4° the subject and brief summary of the means of the claim;
5° the judge before whom the claim is brought;
6° the signature of the applicant or his lawyer.
48The application and its attachment shall be sent by registered letter, in as many copies as there are parties involved, to the clerk of the court or deposited at the registry.
