APD/GBA (Belgium) - 170/2022
|APD/GBA - 170/2022|
|Relevant Law:||Article 5(1)(b) GDPR|
Article 5(1)(c) GDPR
Article 5(1)(a) GDPR
Article 6(1) GDPR
Article 12(1) GDPR
Article 12(2) GDPR
Article 13 GDPR
Article 14 GDPR
Article 21 GDPR
Article 25 GDPR
|Parties:||Mister X (the data subject)|
La Radio Télévision Belge de la Communauté française (RTBF) (the controller)
|National Case Number/Name:||170/2022|
|European Case Law Identifier:||n/a|
|Original Source:||Autorité de Protection des Données (ADP) (in FR)|
English Summary[edit | edit source]
Facts[edit | edit source]
The controller was a press organisation/public service broadcaster. The data subject filed a complaint with the Belgian DPA on 18 June 2018 because the controller’s live service for web streaming was only accessible on Belgian territory, and only for data subjects who would provide their personal data (such as email address, Facebook - or Google accounts). The data subject also complained that it was not possible to connect to the live service if he disabled cookies and trackers of third-party companies on the controller’s website.
The investigation service of the DPA (the investigation service) started an investigation into the controller. In its report, the investigation service reported the following findings:
Finding 1: The investigation service determined that the processing of registration data was based on legitimate interest, while the processing of data related to personalisation (profiling) was based on legitimate interest and/or consent. However, the investigation service considered that because the controller was likely an ‘autonomous public undertaking’ (Article 5 LTD (Data protection act)), legitimate interest could not be used as a legal basis. According to the investigation service, legitimate interest of the controller could not be used for processing carried out by public authorities in the performance of their tasks (Article 6(1) GDPR). Moreover, legitimate interest as a legal basis requires a balancing of the interests involved and the controller did not prove that such a balancing exercise was conducted. Finally, the DPA held that the controller could not switch from consent to legitimate interest as a legal basis for the processing of data for personalisation purposes.
Finding 2, 3 and 4: Regarding the processing for advertising profiling and the possibility of objecting, the controller's management contract allowed the controller to use 'content recommendation algorithms. However, the definition of ‘content recommendation algorithms' did not include advertising, according to the investigation service. Because of this lacking definition, the investigation service questioned compliance with Article 5(1)(b) GDPR). Additionally, the provisions of Articles 12(2), 21 and 25 GDPR did not appear to be satisfied because the data subject could not refuse advertising profiling at the time of registration. The controller also did not appear to allow easy opposition to this profiling after registration. Finally, the controller was supposed to update the purposes on the registration form to add the purpose of advertising profiling. However, the controller did not modify the registration form as of 9 January 2020, which resulted in a breach of Articles 12(1), 13 and 14 GDPR).
Finding 5 and 6: The investigation service also held that there was a difference between the mechanism of connection to the live service and registration to the platform of the controller using social networks (Facebook and Google). This difference lacked clarity and explanation, which was incompatible with Articles 12(1), 13 and 14 GDPR, according to the investigation service. Moreover, the mechanism used (under the guise of logging in using a Facebook account) was in fact the creation of a user account at the controller, using the data subject’s Facebook data. The data subject was not informed about the workings of this mechanism, which breached articles 5(1)(a), 5(1)(b) and 5(1)(c) GDPR as well as Articles 12(1), 13 and 14 GDPR.
Holding[edit | edit source]
Despite the findings by the investigation service, the DPA closed the proceedings regarding some findings, while for other findings the DPA stated that it would continue to investigate.
Comment[edit | edit source]
This decision is a consequence of a settlement decided in decision 168/2022 by the Belgian DPA. Decision 168/2022 is one of the 10 cases opened by the Belgian DPA on "Cookie on press websites". For a summary of one of these settlement decisions and some context for all of these decisions, click this link.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/9 Litigation Chamber Decision on the merits 170/2022 of 22 November 2022 File number: DOS-2018-04762 Subject: Complaint relating to the use of the "Auvio" service of RTBF The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke Hijmans, chairman, and Messrs. Dirk Van Der Kelen and Christophe Boeraeve, members; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and to the free movement of such data, and repealing Directive 95/46/EC (General Regulation on the data protection), hereinafter "GDPR"; Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter ACL); Having regard to the Law of 30 July 2018 relating to the protection of natural persons with regard to processing of personal data (hereinafter the LTD); Having regard to the internal regulations as approved by the House of Representatives on 20 December 2018 and published in the Belgian Official Gazette on January 15, 2019; Considering the documents in the file; Having regard to decision 168/2022 of November 22, 2022 of the Litigation Chamber; Made the following decision regarding: The plaintiff: Mr. X, hereinafter “the plaintiff”; The defendant: The Belgian Radio Television of the French Community (RTBF), a company autonomous public of a cultural nature, Hereinafter “the RTBF” or “the defendant”; Counsel for Maître Peter Craddock and Maître Eline Van Bogget, Decision on the merits 170/2022 - 2/9 I. Facts and procedure 1. On June 18, 2018, the complainant lodged a complaint with the Data Protection Authority data (APD) against the defendant. 2. Under the terms of the complaint, the complainant denounces the fact that the RTBF live service (web streaming – Auvio) is accessible on Belgian territory only if visitors provide their personal data (e-mail address/login via their Facebook accounts or Google). He also points out that the process of connecting to the live service does not does not work if the user deactivates cookies and trackers from third-party companies used by the RTBF website. 3. On October 15, 2018, the complaint was declared admissible on the basis of Articles 58 and 60 of the LCA and the complaint is forwarded to the Litigation Chamber under Article 62, § 1 of the ACL. The complainant is informed of this on the same date. 4. On October 23, 2018 the Litigation Chamber decides to request an investigation from the Service d'Inspection (SI), pursuant to Articles 63, 2° and 94, 1° of the LCA. 5. On October 29, 2018, in accordance with Article 96, § 1 of the LCA, the Chamber's request Litigation to proceed with an investigation is forwarded to the IS. The complainant is informed of this at this same date. 6. On January 28, 2020, the IS investigation is closed, the report is attached to the file and the file is transmitted by the Inspector General to the President of the Litigation Chamber (art. 91, § 1 and § 2 of the ACL). The investigation report is based on two technical analysis reports July 1, 2019 and January 9, 2020 respectively. 7. According to its report, the IS makes the following observations: - As to the legal basis underlying the processing of registration data of a part and data related to personalization (profiling) on the other hand (finding 1): The SI notes that the RTBF declares that it bases the lawfulness of the processing of registration data on the legitimate interest on the one hand and the legality of the processing of data related to the personalization on legitimate interest and/or consent on the other hand. The IS reminds that according to Article 6.1. of the GDPR, the legitimate interest of the data controller cannot constitute a basis for the lawfulness of the processing carried out by the public authorities in the execution of their missions. The IS refers to article 5 of the LTD whose definition "of public authority" is broad and seems to him to encompass the defendant as as an autonomous public enterprise. The IS also adds that the use of interest legitimate requires balancing the interests involved and underlines that the defendant does not provide any element which tends to show that this balance Decision on the merits 170/2022 - 3/9 was realized. Finally, with regard to the consent invoked in addition with regard to the lawfulness of personalization-related data processing, the IS recalls that the data controller cannot switch from the basis of lawfulness of consent to that of of legitimate interest. - As to the legitimacy of the processing of personal data for the purposes of advertising profiling and the possibility of opposition (findings 2, 3 and 4): the IS falls that if the RTBF management contract allows it to use algorithms for content recommendation, the definition of this term does not include advertising. His concludes that the legitimacy of the advertising profiling purpose of the processing in the of the RTBF (and therefore compliance with Article 5.1.b) of the GDPR) can therefore be implemented. doubt. Since at the time of registration, the user cannot refuse profiling advertising and that the platform does not seem to allow easy opposition to this below, the IS concludes that the stipulations of articles 12.2., 21 and 25 of the GDPR do not seem to be encountered. Finally, the IS observes that updating the purposes in the registration form by including the purpose of advertising profiling has, at the dated January 9, 2020, not carried out even though the defendant was there engaged. the IS concludes that this appears to be inconsistent with the provisions of Articles 12.1. 13 and 14 GDPR. - Regarding the use of social network data for login/registration purposes (findings 5 and 6): the IS concludes that the difference between the connection mechanism to Auvio on the one hand and registration to the platform via social networks (Facebook, Google) on the other hand lacks clarity and explanations in contravention with the articles 12.1, 13 and 14 GDPR. The IS adds that the mechanism used (under cover of the connection via a Facebook account) is in fact the creation of an RTBF account with the provision of Facebook data of the user, without the latter being informed. The IS concludes that this process is in contradiction with articles 5.1.a), 5.1.b) and 5.1.c) of the GDPR as well as as Articles 12.1, 13 and 14 of the GDPR. er 8. On March 17, 2020, the Litigation Division decides, pursuant to Article 95, § 1, 1° and article 98 of the LCA, that the case can be dealt with on the merits. 9. On the same date, the parties concerned are informed by registered letter of the provisions as set out in article 95, § 2 as well as in article 98 of the LCA. They are also informed, pursuant to Article 99 of the LCA, of the deadlines for transmitting their submissions, i.e. April 14 and May 14, 2020 for the defendant and April 29 for the complainant. 10. On March 19, 2020, the defendant requested a copy of the file (art. 95, §2, 3° LCA), which is transmitted to it on March 25, 2020. It also expresses the wish to be Decision on the merits 170/2022 - 4/9 heard by the Litigation Chamber in accordance with Article 51 of the Rules of Procedure domestic ODA. 11. On April 14, 2020, the Litigation Chamber receives the submissions in response from the defendant. On May 14, 2020, she received the conclusions of the summary of this last. argument can be summarized as follows. The first part of the defendant's conclusions tends to show that the findings of the IS investigation must be discarded as soon as the establishment of the said report and technical analysis reports has not been made in accordance with the principles of good administration. As to the merits, the defendant denies that there was any breach in its chief. 12. On April 28, 2020, the Litigation Chamber received the complainant's submissions in response. In general, the complainant denounces the attitude of the defendant and insists in particular on the practice of cookies, the lack of transparency and the question of the relevance of the collection of personal data as a mandatory step to access online news content. II. Motivation 13. Under Article 100 LCA, the Litigation Chamber has the power to: 1° dismiss the complaint without follow-up; 2° order the dismissal; 3° order a suspension of the pronouncement; 4° propose a transaction; (5) issue warnings or reprimands; 6° order to comply with requests from the data subject to exercise these rights; (7) order that the person concerned be informed of the security problem; 8° order the freezing, limitation or temporary or permanent prohibition of processing; 9° order the processing to be brought into conformity; 10° order the rectification, restriction or erasure of the data and the notification of these to the recipients of the data; 11° order the withdrawal of accreditation from certification bodies; 12° to issue periodic penalty payments; 13° to impose administrative fines; 14° order the suspension of cross-border data flows to another State or a international body; Decision on the merits 170/2022 - 5/9 15° forward the file to the public prosecutor's office of the Brussels Court, who informs it of the follow-up data on file; 16° decide on a case-by-case basis to publish its decisions on the website of the Protection Authority Datas 14. When a complaint is forwarded to it by the First Line Service (SPL) which declared it admissible, or by the IS after an investigation report as in the present case, the Chamber Litigation will first examine whether it is technically possible to render a decision with regard to said complaint. Otherwise, this complaint will necessarily be closed. not followed up for technical reasons. 15. In support of the arguments which follow and on the basis of the powers conferred on him granted by the legislator under section 100.1. of the LCA, the Litigation Chamber decides to proceed with the dismissal of the complaint in accordance with article 100.1., 1° of the ACL. 16. In matters of dismissal, the Litigation Chamber must justify its decision by step and: - to pronounce a classification without technical continuation if the file does not contain or not sufficient elements likely to lead to a sanction or if it includes a technical obstacle preventing him from rendering a decision; - or pronounce a classification without continuation of opportunity, if in spite of the presence of elements likely to lead to a sanction, the continuation of the examination of the file does not seem to him timely given its priorities. 17. If the dismissal takes place on the basis of more than one reason (respectively technical or opportunity), the reasons for dismissal must be dealt with in order important. 18. In the present case, the Litigation Chamber issues a decision without any technical follow-up application of article 100.1., 1° of the LCA on the basis of the reasoning which follows (points 19 to 27) and within the limits of the grievances concerned. 19. On November 22, 2022, the Litigation Chamber took decision 168/2022 with regard to the defendant. Pursuant to this decision, the Litigation Chamber adopted, with regard to facts identical to those reported in the second part of the complaint by the complainant of the findings 1 (with regard to advertising profiling only) 2, 3 and 4 of the report 1 See. the dismissal policy note from the Litigation Chamber, point 3.1. https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre- litigation.pdf Decision on the merits 170/2022 - 6/9 investigation of the IS – point 7), one of the measures listed in article 100.1 of the LCA recalled below above, or a transaction (article 100.1.4° LCA). 20. Said settlement decision 168/2022 extends “to potential infringements under the law of 13 June 2005 (in force at the time of the findings of the APD Inspection Service in the 2 file), as well as potential violations of the General Data Protection Regulation. data (GDPR), with regard to cookies and, more generally, the storage and consent to the placement and further processing of information on the device of the user as a data subject. The transaction decision relates to the websites involved and mentioned in the file and concerns the party to which the proposal of 3 transaction is addressed”. 21. This settlement decision 168/2022 is addressed to the same party as the defendant of the this decision, or to RTBF. 22. The object of the transaction also relates, as has just been mentioned, to “the offenses potential GDPR, with regard to cookies and, more generally, the storage and consent to the placement and further processing of information on the device of the user as a data subject”. The settlement thus covers the “cookies” grievance as a whole raised by the complainant under the terms of his complaint (second part) as well as findings 1 (only for advertising profiling), 2, 3 and 4 of the IS investigation report as recalled in point 7 above. 23. Finally, Decision 168/2022 specifies that “the transaction relates only to a specific period: 4 the period from May 25, 2018 to November 11, 2020”, i.e. the date of submission of the last IS report in said file. 24. Within the limits of this decision 168/2022, the Litigation Chamber has thus exhausted its referral as to the facts denounced by the complainant and as to the corresponding "cookie" grievances. The Dispute Chamber therefore dismisses the plaintiff's complaint with regard to these grievances. for technical reasons and this, within the same material and temporal limits. 25. Decision 168/2022 specifies in the same way that “the transaction exhausts the powers of the Litigation Chamber to take corrective measures in respect of infractions within the limits of the legal elements and provisions described above and in the transaction proposal, as well as within the period [read the period] referred to above. The Chambre Litieuse stresses that the transaction does not affect the powers of the courts and 2The settlement decision comes in the context of an own initiative investigation carried out by the Inspection Service on the problem of data processing via cookies in the Belgian media sector, including those operated by the defendant. 3Point 19 of decision 168/2022 of the Litigation Chamber. 4Point 20 of decision 168/2022 of the Litigation Chamber. Decision on the merits 170/2022 - 7/9 courts nor those of other authorities to examine infringements where appropriate. The transaction in this case binds only the Litigation Chamber of the Authority of 5 Belgian data protection”. 26. As mentioned above, the object of the transaction formalized in the decision 168/2022 is limited to the period from May 25, 2018 to November 20, 2020, the date on which the SI has closed its findings in the said file, which exceed the date of January 28, 2020 on which the IS closed its investigation initiated following the complainant's complaint (point 7). 27. For the period from November 20, 2020 to date, the Litigation Chamber does not have findings that support the grievances invoked by the complainant. For this reason, the Chamber Litigation is therefore not in a position to find any breach in the head of the defendant and classifies the complaint without follow-up as regards this technical reason also to support of criterion A.1. of its classification policy note without follow-up. 28. With regard to grievances related to data processing in the context of connection and registration on the Auvio platform (first part of the complainant's complaint and findings 1 (in regarding registration)), 5 and 6 of the inspection report), the Litigation Chamber decides to continue examining it, as these grievances are not covered by its settlement decision 168/2022. The defendant having requested to be heard in this case, the Litigation Chamber will schedule a hearing in the presence of the parties in due course. 29. With regard to the settlement decision (168/2022) for which it opted as decision to classify this complaint without action for part, the Litigation Chamber calls that it is sovereignly incumbent upon it as an independent administrative authority - in the compliance with the relevant articles of the GDPR and the LCA - to determine the measure(s) corrector(s) and appropriate sanction(s). 30. Thus, it is not for the plaintiff to ask the Litigation Chamber to order such or such corrective measure or sanction. If, notwithstanding the foregoing, the Complainant nevertheless had to ask the Litigation Chamber to pronounce one or the other measure and/or sanction, it is therefore not for the latter to justify why it does not would not accept one or the other request made by the complainant. These considerations leave intact the obligation for the Litigation Chamber to justify the choice of measures and sanctions which it deems (among the list of measures and sanctions made available to it by articles 58 of the GDPR and 95.1 and 100.1 of the ACL) appropriate to condemn the complaining party 55 Point 21 of decision 168/2022 of the Litigation Chamber. 6In this sense, Decision 168/2022, like this decision to close without further action, leaves the jurisdiction of the the DPA to decide, for the period after November 20, 2020, if it were to be newly seized of it, on any shortcomings that would persist to this day with regard to the facts denounced by the complaint Decision on the merits 170/2022 - 8/9 7 cause . In this case, the Litigation Chamber refers to points 19-27 above concerning its decision to dismiss the complainant's complaint on a technical ground. III. Publication of the decision 31. Given the importance of transparency with regard to the decision-making process and the decisions of the Litigation Chamber, this decision will be published on the website of the DPA by deleting the direct identification data of the complainant and the named persons, whether natural or legal, excluding the defendant. 32. The Litigation Chamber judges that the identification of the defendant is necessary since that this Decision refers to Decision 168/2022 adopted by the Chamber Litigation against the defendant and whose operative part (transaction) is the basis of this classification decision without technical follow-up. The identity of the defendant having been published under this decision 168/2022, the omission of the identity of the same defendant in the terms of this decision would make no sense. Its explicit mention allows overwhelmingly the better understanding and coherence of these two decisions of the Litigation Chamber. FOR THESE REASONS, the Litigation Chamber of the Data Protection Authority decides, after deliberation: - to close the complaint without further action under article 100.1.1° of the LCA with regard to concerns grievances covered by decision 168/2022 of the Litigation Chamber - to continue the examination of the merits of the complaint for the remainder (point 28 above). In accordance with Article 108, § 1 of the LCA, an appeal against this decision may be lodged, within thirty days of its notification, to the Court of Markets (Court d'appel de Bruxelles), with the Data Protection Authority (DPA) as a party defendant. 7 Litigation Chamber, Decision on the merits 81/2020. See also the note from the Litigation Chamber relating to the complainant's position (point D. page 4 in fine). https://www.autoriteprotectiondonnees.be/publications/note-relative-a-la- position-of-the-complainant-in-the-procedure-within-the-litigation-chamber.pdf: “The conclusions of the complainant must deal with the content of the complaint and not, for example, the nature of the sanction that the Litigation Chamber must impose according to the complainant. The complainant is of course free to give an opinion on the sanction to be imposed, but the Chamber Litigation is not obliged to adopt this opinion, nor to refute the arguments of the plaintiff concerning the imposition of the sanction”. Decision on the merits 170/2022 - 9/9 Such an appeal may be introduced by means of an interlocutory request which must contain the information listed in article 1034ter of the Judicial Code. 8 The interlocutory request must be filed with the registry of the Market Court in accordance with article 1034quinquies of the C. jud. , or via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. jud.). (Sr.) Hielke H IJMANS President of the Litigation Chamber 8 The request contains on pain of nullity: (1) indication of the day, month and year; 2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or Business Number; 3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned; (4) the object and summary of the grounds of the application; (5) the indication of the judge who is seized of the application; 6° the signature of the applicant or his lawyer. 9 The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter recommended to the court clerk or filed with the court office.