APD/GBA (Belgium) - 38/2024

From GDPRhub
Revision as of 16:12, 18 March 2024 by Nzm (talk | contribs) (Created page with "{{DPAdecisionBOX |Jurisdiction=Belgium |DPA-BG-Color= |DPAlogo=LogoBE.png |DPA_Abbrevation=APD/GBA |DPA_With_Country=APD/GBA (Belgium) |Case_Number_Name=38/2024 |ECLI= |Original_Source_Name_1=APD |Original_Source_Link_1=https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-38-2024.pdf |Original_Source_Language_1=French |Original_Source_Language__Code_1=FR |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_So...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
APD/GBA - 38/2024
LogoBE.png
Authority: APD/GBA (Belgium)
Jurisdiction: Belgium
Relevant Law: Article 7(3) GDPR
Type: Complaint
Outcome: Rejected
Started: 09.08.2022
Decided: 21.02.2024
Published:
Fine: n/a
Parties: n/a
National Case Number/Name: 38/2024
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): French
Original Source: APD (in FR)
Initial Contributor: nzm

The DPA dismissed a cookie complaint regarding the absence of a “withdraw consent” option as the controller set one up before the DPA’s investigation.

English Summary

Facts

A data subject represented by noyb (European Centre for Digital Rights) complained that a website did not provide a “withdraw consent” or similar options. Therefore, noyb considered that the cookie banner infringed both the GDPR as well as the ePrivacy directive as it was not as easy to give consent as it was to withdraw it.

On 9 August 2022, the data subject lodged a complaint with the Belgian DPA (“APD”).

Holding

On 24 August 2022, the APD visited the controller’s website and discovered that the cookie banner included an "Accept all" button, a “Reject all” button and a “Cookie settings” button. The APD therefore considered that the sole infringement invoked by the data subject was no longer founded. These findings were still applicable on 19 February 2024, thus, the APD decided to close the case.

Additionally, the APD also found that none of the categories of non-essential cookies were ticked by default.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

1/6





                                                                      Litigation Chamber

                                                       Decision 38/2024 of February 21, 2024


File number: DOS-2022-03263


Subject: Complaint due to the processing of personal data through

of a website, without the valid consent of the person concerned



The Litigation Chamber of the Data Protection Authority, made up of Mr.

Hielke HIJMANS, president, sitting alone;


Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the

protection of natural persons with regard to the processing of personal data and

to the free movement of these data, and repealing Directive 95/46/EC (general regulation on the
data protection), hereinafter “GDPR”;


Having regard to the Law of December 3, 2017 establishing the Data Protection Authority, hereinafter

“ACL”;


Having regard to the Law of July 30, 2018 relating to the protection of individuals with regard to

processing of personal data, hereinafter “LTD”;

Having regard to the Internal Regulations as approved by the House of Representatives on

December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;


Considering the documents in the file;


Has taken the following decision regarding:



The complainant: X, hereinafter “the complainant”, represented by NOYB - EUROPEAN CENTER FOR

                    DIGITALR IGHTS, Goldschlagstraße 172/4/3/2 – 1140 Vienna (Austria)


The defendant: Y, hereinafter “the defendant” Decision 38/2024 — 2/6




I. Facts and procedure


 1. The complaint concerns processing of personal data through the page

       internal […], without the valid consent of the person concerned.

       The complainant states that she visited the website on 22-10-2021. This web page presented

       a “banner” of a consent management platform (hereinafter, “Z1”) provided by

       Z2. Ended on 10-06-2022, the complainant signs a mandate of representation, in accordance

       in Article 80(1) GDPR, with NOYB.

       The complaint mentions several personal data processing operations,

       in the context of providing the web page, allegedly based on consent

       of the person concerned. More precisely, the complaint alleges an infringement of the GDPR as well

       than the ePrivacy Directive (ePD), namely that it would not be as easy to withdraw your

       consent than giving it. According to the complaint, the option to accept the activities

       of processing concerned appears prominently in the banner, but the complainant does not

       was able to easily find the option allowing him to withdraw his consent. There was no

       notably no clearly visible button entitled “withdraw consent” or options

       similar. The complaint also specifies that despite the possibility that Z2 offers to display on

       all pages have a floating and permanently visible icon, allowing people to

       concerned to return to their cookie settings in order to withdraw their consent, the

       defendant deliberately chose not to activate this option.

 2. On August 9, 2022, the complainant filed a complaint with the Data Protection Authority.


 3. On August 9, 2022, the First Line Service of the Data Protection Authority

       declares the complaint admissible on the basis of articles 58 and 60 of the LCA, and transmits it
                                                                    er
       to the Litigation Chamber in accordance with article 62, § 1 of the LCA.


II. Motivation


 4. Based on the facts described in the complaint file as summarized above, and on the

       basis of the powers assigned to it by the legislator under article 95, § 1

       of the LCA, the Litigation Chamber decides on the follow-up to be given to the file; as it happens,

       the Litigation Chamber decides to proceed with the classification without further action of the complaint,

       in accordance with article 95, § 1, 3° of the LCA, for the reasons set out below.


 5. In matters of dismissal, the Litigation Chamber is required to provide reasons for its decision.
                          1
       decision by step and to:






1Market Court (Brussels Court of Appeal), September 2, 2020, judgment 2020/AR/329, p. 18. Decision 38/2024 — 3/6



            - pronounce a classification without technical follow-up if the file does not contain or not

                sufficient evidence likely to lead to a sanction or if it includes a

                technical obstacle preventing it from rendering a decision;

            - or pronounce a classification without further opportunity, if despite the presence

                of elements likely to lead to a sanction, the continuation of the examination of the

                file does not seem appropriate given the priorities of the Authority of

                data protection as specified and illustrated in the Privacy Policy

                classification without further action by the Litigation Chamber. 2


 6. In the event of dismissal based on several reasons for dismissal, these

       last (respectively, classification without technical follow-up and classification without follow-up

       opportunity) must be treated in order of importance.3


 7. In this case, the Litigation Chamber decides to proceed with a classification without further action.

       the complaint on grounds of expediency. The decision of the Litigation Chamber is based

       more precisely on a reason for which it considers it inappropriate to pursue

       the follow-up of the file, and therefore decides not to proceed, among other things, with an examination

       of the case as to its merits.

 8. In this case, the Litigation Chamber was able to note, on August 24, 2022, that the

       site concerned by the complaint presented a cookie banner including not only a

       button allowing you to reject all (non-essential) cookies, but also included

       a functional URL address at the bottom of the page, entitled “Cookie Settings”:




























2
 In this regard, the Litigation Chamber refers to its policy of classification without further action as developed and published on the
website of the Data Protection Authority: https://www.autoriteprotectiondonnees.be/publications/politique-de-
classification-without-suite-of-the-contentious-chamber.pdf.
3Cf. Title 3 – In what cases is my complaint likely to be dismissed by the Litigation Chamber? of the
policy of dismissal without further action by the Litigation Chamber. Decision 38/2024 — 4/6



       It therefore appears that the only violation invoked by the complaint is no longer founded from the

       datementioned.TheContentiousChamberconsequentlydecidestoclassifywithoutfurther

       the complainant's grievance, taking into account the fact that the subject of the complaint has disappeared due to the

       measures taken by the controller before transferring the complaint to the Chamber
                                                                       4
       Litigation by the APD Front Line Service. The Litigation Chamber

       further emphasizes that the above findings still apply as of 19

       February 2024:



























 9. In the alternative, the Litigation Chamber was also able to observe, on the occasion of this

       visit to the site concerned, that none of the categories of non-essential cookies were checked

       by default. The Litigation Chamber recalls in this regard that the European Committee of

       Data Protection (EDPB) adopted, on January 17, 2023, the report established by the group
                                                                                   5
       work on cookie banners (“Cookie Banner Taskforce”), in which the

       European supervisory authorities have notably adopted a common position on

       the prohibition of using pre-selected preferences authorizing the placement and

       reading of non-essential cookies, as well as the obligation to provide the possibility for
       users to easily withdraw their consent at any time. Bedroom

       litigation notes that the data controller has, in the present case, configured

       the cookies banner in accordance with the requirements listed in the report

       aforementioned.


 10. Finally, the Litigation Chamber specifies that it is not necessary to rule on

       the complainant's interest in taking action in the specific case, given the reasons for dismissal

       stated above.



4Cf. criterion B.6 in the Dispute Chamber's policy of dismissal.

5EDPB – Report on the work undertaken by the Cookie Banner Taskforce (adopted on 17 January 2023), available at the link
following: https://edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf. Decision 38/2024 — 5/6



III. Publication and communication of the decision



 11. Considering the importance of transparency regarding the process

        decision-making and the decisions of the Litigation Chamber, this decision will be published on the

        website of the Data Protection Authority. However, it is not necessary for this

        so that the identification data of the parties are directly communicated.


 12. In accordance with its policy of dismissal, the Litigation Chamber
                                                        6
        will communicate the decision to the defendant. Indeed, the Litigation Chamber decided to

        communicate the decisions of dismissal to the defendants by default. There

        Chambre Litigation, however, refrains from such communication when the complainant

        requested anonymity vis-à-vis the defendant and when the communication of the decision to the

        defendant, even pseudonymized, nevertheless risks allowing his reidentification. This 7

        is not the case in the present case.




     FOR THESE REASONS     ,


     the Litigation Chamber of the Data Protection Authority decides, after

     deliberation, to classify this complaint without further action in application of article 95,§ 1, 3° er

     of the LCA.




In accordance with article 108, § 1 of the LCA, an appeal against this decision may be lodged,

within thirty days from its notification, to the Court of Markets (court

of Appeal of Brussels), with the Data Protection Authority as defendant.


Such an appeal may be introduced by means of an interlocutory request which must contain the

information listed in article 1034ter of the Judicial Code. The interlocutory request must be

filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 9


via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. judic.).







6
 Cf.Title 5–Will the classification without further action be published? Will the opposing party be informed? of the classification policy
without further action by the Contentious Chamber.
7Ibidem.

8The request contains barely any nullity:
 1° indication of the day, month and year;
 2° the surname, first name, domicile of the applicant, as well as, where applicable, his qualifications and his national register number or
     Business Number;

 3° the surname, first name, address and, where applicable, the status of the person to be summoned;
 4° the object and summary of the grounds of the request;
 5° indication of the judge who is seized of the request;
 6° the signature of the applicant or his lawyer.
9 The request, accompanied by its annex, is sent, in as many copies as there are parties involved, by letter

recommended to the court clerk or filed with the court registry. Decision 38/2024 — 6/6




To enable it to consider any other possible course of action, the Litigation Chamber refers

the complainant to the explanations provided in its policy of dismissal. 10








(sé). Hielke HIJMANS



President of the Litigation Chamber


































































10Cf. Title 4 – What can I do if my complaint is closed? of the Chamber's policy of dismissal
Contentious.