APD/GBA (Belgium) - 32/2022
|APD/GBA (Belgium) - 32/2022|
|Relevant Law:||Article 5(1)(c) GDPR|
Article 5(1)(e) GDPR
Article 6(1)(f) GDPR
Article 14 GDPR
Article 15 GDPR
Article 21 GDPR
|National Case Number/Name:||32/2022|
|European Case Law Identifier:||n/a|
|Original Source:||Belgian DPA (in FR)|
The Belgian DPA held that, under the GDPR, direct marketing via email may not require the data subject's consent. However, it is still necessary to inform the data subject pursuant to Article 14 GDPR at the latest at the time of initial contact.
English Summary[edit | edit source]
Facts[edit | edit source]
In April 2020, the data subject requested not to receive any more direct marketing messages from the controller.
In May 2020, the data subject requested from the controller information on any processing of personal data concerning him pursuant to Article 15(1) GDPR after receiving further direct marketing messages via his email and on his mobile phone despite his previous request. Specifically, he asked about the origin of the acquisition of his personal data that allowed the controller to contact him and about the legal basis for the processing to which he claimed that he had not given consent.
The controller responded to the request by stating that it had obtained the data from a contact provider but limited itself to providing only the name of the company. Furthermore, it acknowledged that the data subject had received further messages due to human error.
In September 2020, the data subject filed a complaint with the Belgian DPA (APD/GBA). He complained both about the direct marketing messages which he claimed required consent (Article 6(1)(a) GDPR) and about the reaction to his access request which according to him had violated Articles 15(1), 5(1)(c) and (e) and 14(2)(e) GDPR.
Holding[edit | edit source]
The DPA partly upheld the complaint. It ordered the controller to comply with the data subject's right to access pursuant to Article 15(1)(g) GDPR. Furthermore, it formulated a warning with regard to the data controller's mentioning of the right to object to the processing in the message with which it first comes into contact with the data subject, so that the data processing in this respect will respect the transparency requirement set out in Articles 5(1)(a), 12, 14 and 21(4) GDPR in the future.
Regarding the direct marketing messages by the controller, the DPA dismissed the complaint. It held that the controller did not require the data subject's consent because it had sufficient legitimate interest in accordance with Article 6(1)(f) GDPR. According to the DPA, this was supported by Recital 47 GDPR which specifically states that direct marketing may be carried out with legitimate interest. Since the data subject's email address was publically available online, the DPA held that he had to have the reasonable expectation that that email address would be used to send him messages and that the controller had thus made use of publicly available information.
In addition, regarding his mobile phone number, the DPA obliged the controller to provide information on the source that formed the basis of the processing since it was unclear how the number was obtained by the controller and thus, it was not possible to assess whether that information had been obtained lawfully.
Comment[edit | edit source]
The decision did not take into account Article 13 ePrivacy Directive which covers unsolicited communications.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.