APD/GBA (Belgium) - 20/2023
From GDPRhub
| APD/GBA - 20/2023 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 2(4) GDPR Article 21(3) GDPR Article 24 GDPR Article 58(2)(c) GDPR Article 95 LCA |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 21.02.2023 |
| Decided: | |
| Published: | 08.03.2023 |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 20/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | French |
| Original Source: | APD (in FR) |
| Initial Contributor: | Fahim.h.i. |
A complaint for unsolicited direct marketing. The Belgian DPA affirms the importance of a data subject’s right to objection for data processing under Article 21 GDPR and the principle of liability under Article 2(4) GDPR and Article 24 GDPR.
English Summary
Facts
The complainant, the data subject, had been receiving advertising newsletters to his emails for a period of several years from the data processor, with unsuccessful attempts to unsubscribe. In 2022, upon receiving another promotional email, he replied back, again stating his wish to unsubscribe. He also mentioned failure to comply would push him to complain to the authorities, to which the processor replied “Go Ahead!”. Following this the data subject filed a complaint with the Belgian DPA.
Holding
The Belgian DPA found a breach of Article 21 GDPR, as this provides the data subject the right to object to data processing. According to Article 21(3) GDPR, when a data subject objects to the processing for the specific purposes of direct marketing, the relevant data can no longer be processed for that purpose. There was an additional breach in Article 2(4) GDPR and Article 24 GDPR, which relates to the principle of liability. This puts an obligation on the data processor to comply with the principles of the GDPR and be capable of demonstrating this compliance.
Therefore due to the above violations, pursuant to Article 58(2)(c) of the GDPR and national law, the Belgian DPA issued a warning to the data processor with regards to their obligations under the provisions. Also included in the decision was an order to comply with their existing requests for objection to processing, within a period of 30 days after this decision was rendered.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/5
Litigation Chamber
Decision 20/2023 of March 8, 2023
File number: DOS-2023-00605
Subject: Complaint for non-respect of the right of opposition
The Litigation Chamber of the Data Protection Authority, constituted by Mr.
Hielke Hijmans, President,
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 relating to
the protection of natural persons with regard to the processing of personal data
personal data and the free movement of such data, and repealing Directive 95/46/EC (Regulation
General on Data Protection), hereinafter GDPR;
Having regard to the Law of 30 July 2018 relating to the protection of natural persons with regard to
processing of personal data (hereinafter LTD);
Having regard to the law of 3 December 2017 establishing the Data Protection Authority (hereinafter
ACL);
Having regard to the internal regulations as approved by the House of Representatives on 20
December 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Made the following decision regarding:
The complainant: X, hereinafter “the complainant
The data controller: Y, hereinafter “the defendant”; Decision 20/2023- - 2/5
I. Facts and procedure
1. Under the terms of the complaint, the complainant indicates that on several occasions he requested the exercise
of its right of opposition to the defendant. He explains that he tried 5 to 10 times to unsubscribe
advertising newsletters from the defendant, without success, and having made his first request
objection (as provided for in Article 21 of the GDPR) in 2020. However, a promotional email
was sent by the defendant to the plaintiff on December 24, 2022.
2. Following this, the Complainant sent an email to the Respondent dated December 26, 2022,
clearly indicating that he no longer wishes to receive advertising emails, failing which he
would complain. The defendant simply answered “Go ahead! ".
3. On February 5, 2023, the complainant filed a complaint with the Authority for the Protection of
data. On February 21, 2023 the complaint was declared admissible by the Service de Première
line of the Data Protection Authority and the complaint was forwarded to the same
date to the Litigation Chamber under Article 60 and 62, § 1 LCA.
II. Motivation
4. The GDPR does not define what is meant by “marketing processing” or
for the purposes of "direct marketing" according to the English terminology. In its Recommendation
01/2020 of January 17, 2020 relating to the processing of personal data to
for direct marketing purposes, the APD indicates that it should be understood as “direct marketing”
as “any communication, whether solicited or unsolicited, aimed at promoting a
organization or a person, services, products, whether paid for or
free, as well as marks or ideas, sent by an organization or a person
acting in a commercial or non-commercial context, directly to one or more
natural persons in a private or professional context, by any means,
involving the processing of personal data” (page 8 of the Recommendation
- definition).
5. The processing of the complainant's e-mail address by the defendant is, with regard to this
definition, personal data (article 4.1 of the GDPR) processed for the purposes of
marketing (direct marketing) within the meaning of Article 21 of the GDPR. The latter was therefore based on
exercise their right to object pursuant to Article 21.2 of the GDPR.
6. In accordance with recital 70 of the GDPR, in the event of the processing of personal data
personnelforprospectingpurposes,thepersonconcernedhastheright,atanytimeandwithout
costs, to oppose this processing, and whether or not it is an initial processing or a
further processing. Article 21.3 of the GDPR provides in this respect that "When the person Decision 20/2023- - 3/5
concerned opposes processing for prospecting purposes, the personal data
personal are no longer processed for these purposes”.
7. In the context of direct marketing, such opposition must therefore give rise
immediatelyandwithoutadditionalexaminationpurelydiscontinuedalltreatmentof
dataofthepersonconcernedforthesedirectmarketingpurposes(Recommendation
of the Data Protection Authority n° 01/2020 of January 17, 2020 relating to
processing of personal data for direct marketing purposes, e.g. 53).
8. The Litigation Division also recalls the principle of liability, and that in its
quality of data controller, in accordance with articles 5.2 and 24 of the GDPR, the
defendant is required to comply with the principles of the GDPR and must be able to
demonstrate.
9. As indicated above, the Complainant indicated that he had tried on numerous occasions to
unsubscribe from Defendant's advertising email service via the "unsubscribe" button
you”, without success. It also emerges from the examination of the documents in the file that, at the request of the
plaintiff to stop sending him advertising mail, failing which he would wear
complaint, the respondent responded “Go ahead! to the complainant. This response is a
clear indication of ignorance of its obligations under the GDPR on the part of the
defendant, as well as the fact that it does not respond to the opposition request of the
complainant.
10. The Litigation Chamber finds a breach of Articles 21 of the GDPR (right
opposition), as well as articles 2.4 and 24 GDPR (principle of liability).
11. The purpose of this decision is to inform the defendant, allegedly responsible for the
processing, because it may have violated the provisions of the GDPR,
to enable it to comply with the aforementioned provisions.
12. This decision is a prima facie decision taken by the Litigation Chamber
pursuant to Article 95 of the LCA on the basis of the complaint submitted by the complainant,
within the framework of the "procedure prior to the substantive decision", to be differentiated from a decision
on the merits of the Litigation Chamber within the meaning of Article 100 of the LCA.
13. If, however, the controller does not agree with the content of this
prima facie decision and believes that he can make factual and/or legal arguments
which could lead to another decision, the latter may address to the Chamber
Litigation a request for processing on the merits of the case via the e-mail address
litigationchamber@apd-gba.be, within 30 days of notification of the
this decision. If necessary, the execution of this decision is suspended.
during the aforementioned period. Decision 20/2023- - 4/5
14. In the event of further processing of the case on the merits, pursuant to Articles 98, 2° and 3°
juncto article 99 of the LCA, the Litigation Chamber will invite the parties to introduce their
conclusions and attach to the file all the documents they deem useful. If applicable, the
this decision is permanently suspended.
15. With a view to transparency, the Litigation Division finally emphasizes that a
dealing with the case on the merits may lead to the imposition of the measures mentioned in
section 100 of the LCA.
III- Publication and communication of the decision
16. Given the importance of transparency with regard to the process
decision-making and the decisions of the Litigation Chamber, this decision will be published on the
website of the Data Protection Authority. However, it is not necessary for this
so that the identification data of the parties are directly communicated.
FOR THESE REASONS ,
THE CONTENTIOUS CHAMBER decides, after deliberation:
The Litigation Chamber of the Data Protection Authority decides, subject to
the introduction of a request by the data controller for substantive processing,
in accordance with articles 98 e.s. of the ACL:
- pursuant to Article 58.2.c of the GDPR and Article 95, § 1, 5° of the LCA, orders to
comply with requests from the data subject to exercise their right to object,
in compliance with article 21 of the GDPR. This compliance is to be carried out in
within 30 days of notification of this decision, and the Litigation Chamber must
be informed of its execution within the same period;
- pursuant to Article 58.2.c) of the GDPR and Article 95, § 1, 4° of the LCA, to formulate a
admonishment to the defendant to follow up on the exercise requests of the subjects of
future rights Decision 20/2023- - 5/5
Under article 108, § 1 of the LCA, this decision may be appealed in a
period of thirty days, from the notification, to the Court of Markets, with the Authority of
data protection as defendant.
Such an appeal may be introduced by means of an interlocutory request which must contain the
1
information listed in article 1034ter of the Judicial Code. The interlocutory motion must
be filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C.
jud. , or via the e-Deposit information system of the Ministry of Justice (article 32ter du C.jud.).
(Sr.) Hielke HIJMANS
President of the Litigation Chamber
1The request contains on penalty of nullity:
(1) indication of the day, month and year;
2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualities and his national register number or
Business Number;
3° the surname, first name, domicile and, where applicable, the capacity of the person to be summoned;
(4) the object and summary statement of the means of the request;
(5) the indication of the judge who is seized of the application;
6° the signature of the applicant or his lawyer.
2 The request, accompanied by its appendix, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court office.
