APD/GBA (Belgium) - 37/2024
From GDPRhub
| APD/GBA - 37/2024 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 6(1)(a) GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | 09.08.2022 |
| Decided: | 21.02.2024 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 37/2024 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | French |
| Original Source: | APD (in FR) |
| Initial Contributor: | nzm |
The DPA dismissed a cookie complaint regarding the absence of a “Reject all” button on the first layer of the cookie banner, as the “Confirm my choices” button meant that no cookies were placed since none of the categories of non-essential data were ticked by default.
English Summary
Facts
A data subject represented by noyb (European Centre for Digital Rights) complained that a website did not provide a “refuse” option on the first layer of the cookie banner. On 9 August 2022, the data subject lodged a complaint with the Belgian DPA (“APD”).
On 24 August 2022, the APD found that the cookie banner did not include a “reject all”, but required the data subject to choose between accepting all the cookies and confirming the default selection. The APD also discovered that none of the categories of non-essential data were ticked by default. Clicking on the “Confirm my choices” button meant that no cookies were placed, in the same way as a button allowing non-essential cookies to be rejected.
The APD also noted that the cookie banner could be recalled at any time during the visit by means of a floating icon in the bottom left-hand corner of the web page in order to change the cookie settings.
Holding
The APD held that the sole violation cited in the complaint was no longer founded after 24 August 2022, presumably due to measures taken by the controller after the data subject’s visit to the website regarding the "Confirm my choices" button. Indeed, since that date, clicking on this button meant that no none essential cookies were placed on the device. The DPA therefore decided to dismiss the complaint given that the subject of the complaint had disappeared before the complaint was transferred to the APD.
Additionally, the DPA also noted that since the date of the complaint, the controller also added a “Reject all” button.
Comment
In this decision, the APD seems to have considered that the "Confirm my choices" button was equivalent to a "Reject all" button.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/6
Litigation Chamber
Decision 37/2024 of February 21, 2024
File number: DOS-2022-03262
Subject: Complaint due to the processing of personal data through
of a website, without the valid consent of the person concerned
The Litigation Chamber of the Data Protection Authority, made up of Mr.
Hielke HIJMANS, president, sitting alone;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the
protection of natural persons with regard to the processing of personal data and
to the free movement of these data, and repealing Directive 95/46/EC (general regulation on the
data protection), hereinafter “GDPR”;
Having regard to the Law of December 3, 2017 establishing the Data Protection Authority, hereinafter
“ACL”;
Having regard to the Law of July 30, 2018 relating to the protection of individuals with regard to
processing of personal data, hereinafter “LTD”;
Having regard to the Internal Regulations as approved by the House of Representatives on
December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Has taken the following decision regarding:
The complainant: X, hereinafter “the complainant”, represented by NOYB - EUROPEAN CENTER FOR
DIGITALR IGHTS, Goldschlagstraße 172/4/3/2 – 1140 Vienna (Austria)
The defendant: Y, hereinafter “the defendant” Decision 37/2024 — 2/6
I. Facts and procedure
1. The complaint concerns the processing of personal data through the site
internet […], without the valid consent of the complainant.
The complainant states that she visited the website on October 28, 2021, in. This web page
presented a “banner” of a consent management platform (hereinafter, “Z1”)
provided by Z2. On 10-06-2022, the complainant signed a representation mandate,
in accordance with Article 80(1) GDPR, with NOYB.
The complaint mentions several personal data processing operations,
in the context of providing the web page in its entirety, allegedly based
on the consent of the person concerned. More specifically, the complaint raises a
violation of the GDPR as well as the ePrivacy Directive (ePD), namely the absence of an option
allowing you to “refuse” cookies, at the first level of information in the banner
Cookies.
2. On August 9, 2022, the complainant filed a complaint with the Data Protection Authority.
3. On August 9, 2023, the First Line Service of the Data Protection Authority
declares the complaint admissible on the basis of articles 58 and 60 of the LCA, and transmits it
to the Litigation Chamber in accordance with article 62, § 1 of the LCA.
II. Motivation
4. Based on the facts described in the complaint file as summarized above, and on the
er
basis of the powers assigned to it by the legislator under article 95, § 1
of the LCA, the Litigation Chamber decides on the follow-up to be given to the file; as it happens,
the Litigation Chamber decides to proceed with the classification without further action of the complaint,
er
in accordance with article 95, § 1, 3° of the LCA, for the reasons set out below.
5. In matters of dismissal, the Litigation Chamber is required to provide reasons for its decision.
decision by step and to:
- pronounce a classification without technical follow-up if the file does not contain or not
sufficient evidence likely to lead to a sanction or if it includes a
technical obstacle preventing it from rendering a decision;
- or pronounce a classification without further opportunity, if despite the presence
of elements likely to lead to a sanction, the continuation of the examination of the
file does not seem appropriate given the priorities of the Authority of
1Market Court (Brussels Court of Appeal), September 2, 2020, judgment 2020/AR/329, p. 18. Decision 37/2024 — 3/6
data protection as specified and illustrated in the Privacy Policy
classification without further action by the Litigation Chamber. 2
6. In the event of dismissal based on several reasons for dismissal, these
last (respectively, classification without technical follow-up and classification without follow-up
3
opportunity) must be treated in order of importance.
7. In this case, the Litigation Chamber decides to proceed with a classification without further action.
the complaint on grounds of expediency. The decision of the Litigation Chamber is based
more precisely on a reason for which it considers it inappropriate to pursue
the follow-up of the file, and therefore decides not to proceed, among other things, with an examination
of the case as to its merits.
8. In this case, the Litigation Chamber was able to note, on August 24, 2022, that the
cookie banner did not include a button allowing you to reject all cookies
(“Reject All”), but required a choice from the user between accepting all cookies,
on the one hand, and confirmation of the default selection, on the other hand. However, the Chamber
litigation was also able to observe, during this visit to the site concerned,
that none of the categories of non-essential cookies were checked by default. The second
choice offered by Z1 (“CONFIRM MY CHOICES”) therefore resulted in the absence of placement of
cookies, as well as a button allowing you to reject all non-essential cookies:
It therefore appears that the only violation invoked by the complaint is no longer founded from the
aforementioned date, presumably due to the measures taken by the defendant after
2In this regard, the Litigation Chamber refers to its policy of classification without further action as developed and published on the
website of the Data Protection Authority: https://www.autoriteprotectiondonnees.be/publications/politique-de-
classification-without-suite-of-the-contentious-chamber.pdf.
3Cf. Title 3 – In what cases is my complaint likely to be dismissed by the Litigation Chamber? of the
policy of dismissal without further action by the Litigation Chamber. Decision 37/2024 — 4/6
the visit to the site by the complainant. The Litigation Chamber therefore decides to classify
without further action on the complainant's grievance, taking into account the fact that the subject of the complaint has disappeared
made of the measures taken by the controller before the transfer of the complaint to the
4
Litigation Chamber by the APD Front Line Service.
9. In the alternative, the Litigation Chamber was also able to observe, on the occasion of this
visit to the site concerned, that the cookie banner could be recalled at any time during
of the visit, by means of a floating icon at the bottom left of the internet page, in order to
modify the settings relating to cookies:
10. The Litigation Chamber further emphasizes that the above findings are still
of application from February 19, 2024, with the exception of the addition of an explicit button
“REJECT ALL” since the date of the complaint:
11. In this regard, the Litigation Chamber recalls that the European Committee for the Protection of
(EDPB) adopted, on January 17, 2023, the report established by the working group on
4Cf. criterion B.6 in the Dispute Chamber's policy of dismissal. Decision 37/2024 — 5/6
5
cookie banners (“Cookie Banner Taskforce”), in which the supervisory authorities
European countries have notably adopted a common position on the ban on the use
pre-selected preferences authorizing the placement and reading of cookies
essential, as well as the obligation to provide the possibility for users to withdraw their
consent at any time, and easily. The Litigation Chamber notes that the
data controller has, in this case, configured the cookies banner so
complies with the requirements listed in the above-mentioned report.
12. Finally, the Litigation Chamber specifies that it is not necessary to rule on
the complainant's interest in taking action in the specific case, given the reasons for dismissal
stated above.
III. Publication and communication of the decision
13. Considering the importance of transparency regarding the process
decision-making and the decisions of the Litigation Chamber, this decision will be published on the
website of the Data Protection Authority. However, it is not necessary for this
so that the identification data of the parties are directly communicated.
14. In accordance with its policy of dismissal, the Litigation Chamber
6
will communicate the decision to the defendant. Indeed, the Litigation Chamber decided to
communicate the decisions of dismissal to the defendants by default. There
Chambre Litigation, however, refrains from such communication when the complainant
requested anonymity vis-à-vis the defendant and when the communication of the decision to the
7
defendant, even pseudonymized, nevertheless risks allowing his reidentification. This
is not the case in the present case.
FOR THESE REASONS ,
the Litigation Chamber of the Data Protection Authority decides, after
deliberation, to classify this complaint without further action in application of article 95,§ 1, 3°
of the LCA.
5
EDPB – Report on the work undertaken by the Cookie Banner Taskforce (adopted on 17 January 2023), available at the link
following: https://edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf.
6Cf.Title 5–Will the classification without further action be published? Will the opposing party be informed? of the classification policy
without further action by the Contentious Chamber.
7Ibidem. Decision 37/2024 — 6/6
er
In accordance with article 108, § 1 of the LCA, an appeal against this decision may be lodged,
within thirty days from its notification, to the Court of Markets (court
of Appeal of Brussels), with the Data Protection Authority as defendant.
Such an appeal may be introduced by means of an interlocutory request which must contain the
information listed in article 1034ter of the Judicial Code. The interlocutory request must be
9
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , Or
via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. judic.).
To enable it to consider any other possible course of action, the Litigation Chamber refers
the complainant to the explanations provided in its policy of dismissal. 10
(sé). Hielke HIJMANS
President of the Litigation Chamber
8The request contains barely any nullity:
1° indication of the day, month and year;
2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualifications and his national register number or
Business Number;
3° the surname, first name, address and, where applicable, the status of the person to be summoned;
4° the object and summary of the grounds of the request;
5° indication of the judge who is seized of the request;
6° the signature of the applicant or his lawyer.
9 The request, accompanied by its annex, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court registry.
10Cf. Title 4 – What can I do if my complaint is closed? of the Chamber's policy of dismissal
Contentious.
