APD/GBA (Belgium) - 39/2024
From GDPRhub
| APD/GBA - 39/2024 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 80(1) GDPR |
| Type: | Complaint |
| Outcome: | Other Outcome |
| Started: | 29.06.2020 |
| Decided: | 22.02.2024 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 39/2024 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | French |
| Original Source: | APD (in FR) |
| Initial Contributor: | nzm |
The DPA considered that an e-reputation consultancy company was not a non-profit body and did not have statutory objectives which are in the public interest under Article 80(1) GDPR, and therefore could not represent a data subject.
English Summary
Facts
In 2007, the newspaper “La Dernière Heure Les Sports” (“controller”) published an article on their website which reported that a person (“data subject”) was found guilty of manslaughter as well as for contravention of legislation on the use of work equipment and on health and safety at work following the death of an employee of the company for which the data subject was a managing director. Adjustments had been made since the accident, so the court decided to suspend the data subject’s sentencing. He was however declared civilly liable and ordered to pay compensation to the parents of the deceased worker.
In 2018 and 2019, the data subject requested the removal of this URL 3 times, using the standard form made available online by the controller for the dereferencing of results. The second and third requests were made by a French e-reputation consultancy company on behalf of the data subject. The responded indicated that after considering the balance of interests and rights, they decided not to block the URL. On 18 June 2020, the e-reputation consultancy company lodged a complaint with the Belgian DPA (“APD”) on behalf of the data subject. The company also attached a mandate received from the data subject which says the following: “I, the undersigned X [read data subject] (...) declare and certify that company X1 [read e-consultancy company] (...) is authorised to represent me on an exclusive basis in relation to publishers and hosts of Internet sites, in order to carry out the assignment entrusted to it”.
The controller asked that the APD consider the complaint inadmissible as it was brought by a company incorporated by French law, thus breaching Article 80(1) GDPR.
Holding
Article 80(1) GDPR states that the data subject has the right to mandate (i) a non-for-profit body, organization or association (ii) which has been properly constituted with the law of a Member state and (iii) has statutory objectives which are in the public interest and is active in the field of data protection, to lodge a complaint on their behalf.
The APD considered that the e-consultancy company is not a non-for-profit body, organization or association and does not have statutory objectives which are in the public interest, as evidenced by the terms and conditions of the company’s website which refer to “the sale of the following services: e-reputation cleansing (request for deletion of URLs) and Serp-Sculpting”, for which different prices are set.
The APD concluded that the company does not fulfill the requirements of Article 80(1) GDPR, and therefore cannot represent a data subject.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/10
Litigation Chamber
Decision on the merits 39/2024 of February 22, 2024
File number: DOS-2020-02861
Subject: Complaint for refusal of dereferencing by a search engine –
representation of the complainant within the meaning of section 80.1. GDPR
The Litigation Chamber of the Data Protection Authority, made up of Mr.
Hielke HIJMANS, president, and gentlemen Yves Poullet and Jelle Stassijns, members;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the
protection of natural persons with regard to the processing of personal data and
to the free movement of these data, and repealing Directive 95/46/EC (General Regulation on the
data protection), hereinafter “GDPR”;
Having regard to the Law of December 3, 2017 establishing the Data Protection Authority (hereinafter
“LCA”);
Having regard to the Law of July 30, 2018 relating to the protection of individuals with regard to
processing of personal data (hereinafter “LTD”);
Considering the internal regulations as approved by the House of Representatives on
December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
Has taken the following decision regarding:
The complainant: Mr. X1, hereinafter “the complainant”;
Represented by Madame X2, e-reputation consultant of the company X3
The defendants: Y1, hereinafter “the first defendant”;
Y2, hereinafter “the second defendant”;
Hereinafter collectively referred to as “the defendants”; Decision on merits 39/2024 — 2/10
Having for advice Master Gerrit VANDENDRIESSCHE,
qerrit.vandendriessche@altius.com and Master Louis-Dorsan JOLLY, louis-
dorsan.jolly@altius.com, lawyers whose practice is established in 1000 Brussels,
avenue du Port 86C, box 414.
I. Facts and procedure
1. The subject of the complaint filed on June 18, 2020 with the Data Protection Authority (APD)
speakscomplainantrepresentedbytheFrenchcompanydee-reputationX3,concernstherefusalby
the first defendant to dereference a depressed article from the newspaper La Dernière Heure
Les Sports published on this newspaper's website in 2007 under the title “..” […].
2. This article relates legal facts concerning the complainant. It mentions the name and
of the first name of the complainant and informs Internet users about his conviction by the
labor courts in 2007.
3. Specifically, the article reports that in 2007, the complainant was convicted of
of involuntary manslaughter due to lack of foresight or precaution, as well as
contravention of the legislation on the use of work equipment and on signaling
safety and health at work. This conviction follows the death (…) of a
worker of the company ... of which the complainant was general manager.
4. In view of the adjustments made since the accident when adopting its decision and
in order not to compromise the professional activities of the complainant, the court seized
decided to suspend the sentencing. As reported in the article by
press, the complainant was nevertheless declared civilly responsible and was sentenced to
compensate the parents of the deceased worker.
5. It appears from the documents in the files transmitted by the defendants and from the documents produced
by the complainant that before the referral to the APD, the dereferencing of this URL was requested
3 times from the first defendant, via the standard form made available
online by the latter for the purpose of dereferencing search results.
6. Thus, the defendants report that in 2018, the son of the plaintiff, Mr. S.D., introduced
in the name of his father a first request for dereferencing of the disputed URL. There
first respondent acknowledged receipt of the request the same day, analyzed and processed
the request and responded to it the next day, i.e. (…), motivating its response by indicating that it
had decided not to intervene regarding this URL due to factors such as
the relevance of it in the context of the professional life of the complainant. Decision on merits 39/2024 — 3/10
7. The complainant's son reiterated his request by email addressed to the first respondent
later in 2018 and the first respondent responded to her the same day that she maintained
her decision.
8. At the end of 2019, Madame X4, e-reputation consultant for the company X3, introduced on behalf of the
complainant a second request for dereferencing of the same disputed URL via the
online form of the first respondent.
9. The first respondent acknowledged receipt of the request the same day and, after analysis
of the request, given that the press article only concerned the professional life of the
complainant, requested (…) more information on the “current” profession of the
complainant (i.e. that exercised at the time of the reference request) in order to be able to
continue to review the request.
10. Mrs. X4 indicated the next day that the content of the disputed press article was
related to a job that the complainant was still doing. On this basis, the first
defendant stated in November 2019 that she had decided not to dereference the URL
contentious due to factors such as the relevance of the latter in the context of life
professional of the complainant.
11. In May 2020, Madame X2, also an e-reputation consultant for X3 company, introduced
in the name of the complainant a third request for dereference always from the same URL
disputed via the first defendant's online form. The first defendant
acknowledged receipt of the request the same day and indicated a week later that she had
decided not to proceed with the requested referencing for reasons similar to those
mentioned in the context of the first two requests addressed to him.
Madame X2 reiterated her request in a June 2020 email addressed to the first
defendant. The first respondent responded the next day that she maintained her
position.
12. On several occasions therefore, the first defendant considered that it was not required to
give a favorable response to the request for dereferencing of the disputed URL in the
terms below and invited the complainant to contact the APD in the event of disagreement with this
decision.
“After examining the balance between the interests and rights associated with the content in
question, including factors such as the relevance of the latter in the context
of your client's professional life, (read the search engine) has decided to
don't block it.
For the moment, we have decided not to take any action regarding this URL.
(…)”. Decision on merits 39/2024 — 4/10
13. As explained in point 1, the complainant represented by the French company e-
reputation X3 already mentioned, on June 18, 2020, filed a complaint with the APD.
14. This complaint form is sent to the APD by the company X3 on behalf of the complainant. He is there
thus stated by the said company that:
“the refusal of (read the search engine) does not respect, in our opinion, the
latest clarifications from the Council of State on the application of the right to
dereferencing. Regarding an article relating a conviction relating to our
client for facts dating from 1998 and a judgment rendered in 2006, the inclusion of
this processing of personal data in the engines is not relevant to this
day and has very significant repercussions in his life. There is no character
strictly necessary to maintain these links justifying the refusal of (reads the engine
of research). Furthermore, regarding an accident, our client having no role
in public life and the facts being very old, we do not understand the refusal
from (read the search engine). (…)
Our request for the Right to be Forgotten has been refused. Following which we contacted the
writing. We had several discussions with the lawyers in charge, but they
unfortunately did not result in a common agreement. You will find attached
all exchanges in question. This is why we allow ourselves today
to file a complaint for the reasons mentioned above in order to contest
1
these decisions which do not seem fair to us.
15. In support of the complaint lodged by the complainant, the company X3 attaches a “mandate” received from
complainant whose text reads as follows: “I, the undersigned X1 [read the complainant] (…) declare and
certifies that the company X3 (…) is authorized to represent me exclusively with the
publishers and hosts of websites in order to carry out the mission assigned to it
entrusted”.
16. On June 29, 2020, the complaint was declared admissible by the First Line Service (SPL) of
ODA on the basis of articles 58 and 60 of the LCA and the complaint is transmitted to the Chamber
Litigation under article 62, § 1 of the LCA.
er
17. On July 28, 2020, the Litigation Chamber decides, under Article 95, § 1, 1° and
article 98 of the LCA, that the file can be processed on its merits.
18. On this same date, the parties concerned are informed by registered mail of the
provisions as set out in article 95, § 2 as well as article 98 of the LCA. They are
1It is the Litigation Chamber which underlines. The underlined elements demonstrate that it is indeed the X3 company which introduced the
complaint on behalf of his client, the complainant. Decision on merits 39/2024 — 5/10
also informed, under article 99 of the LCA, of the deadlines for transmitting their
conclusions.
19. The deadline for receipt of the defendants' response submissions has been set
on September 8, 2020, that for the complainant's reply conclusions on September 28
2020 and that for the defendants' reply conclusions as of October 20, 2020.
20. On August 26, 2020, the defendants requested a copy of the file (art. 95, §2, 3° LCA),
which was sent to them on August 27, 2020.
21. By their same letter of August 26, 2020, the defendants agree to receive all
communications relating to the case by electronic means and express their wish,
subject to in-depth examination of the file, to have recourse to the possibility of being heard
in accordance with section 98 of the LCA.
22. On September 8, 2020, the Litigation Chamber received the conclusions in response from the
defendants.
23. The complainant does not submit a reply.
24. On October 20, 2020, the Litigation Chamber received the conclusions in reply and
summary of the defendants. Their argument can be summarized as follows:
- Primarily, the defendants consider that the complaint is inadmissible in that it
is introduced by the French company X3 on behalf of the complainant in violation of the
prescribed in section 80.1. of the GDPR read in conjunction with article 220.2 of the LTD;
- In the alternative, if the Litigation Chamber were to consider that the complaint is
validly introduced, the defendants argued at the time that it was appropriate to
stay the proceedings (…).
- In the alternative, the defendants argue that the complaint is unfounded in this regard.
that there is no reason to pursue the second defendant who is not responsible for
treatment. There is also no reason to order the dereferencing of the article.
contentious since the conditions for dereferencing are not met, the result
of the balancing of the interests present revealing a preponderant interest of the
public to access the information contained in the referenced article. The seriousness of the source
journalistic, the accuracy of the facts reported, the link of the facts with the activities
professional performance of the complainant both at the time and on the day the conclusions were drawn up,
and the role played by the latter in public life as businessmen are as much
criteria invoked by the search engine to support its decision not to
dereference. The defendants conclude that the referencing of the disputed article
is necessary for freedom of expression and information within the meaning of Article 17.3.a) of the
GDPR and none of the grounds in Article 17.1.a) to f) of the GDPR are applicable. Decision on merits 39/2024 — 6/10
II. Motivation
25. The Litigation Chamber recalls that under the terms of article 77.1 of the GDPR, “without prejudice
any other administrative or judicial remedy, any person concerned has the right
to lodge a complaint with a supervisory authority, in particular in the State
member in which his habitual residence is located, his place of work or the place where the
violation would have been committed, if it considers that the processing of personal data
personnel concerning it constitutes a violation of these regulations”.
26. This article 77.1. is supplemented by article 80.1. of the GDPR which provides for its part that “the
data subject has the right to mandate a body, organization or
non-profit association, which has been validly constituted in accordance with the law of a
Member State, whose statutory objectives are of public interest and is active in the field
the protection of the rights and freedoms of the persons concerned within the framework of the
protection of personal data concerning them, so that it introduces a
claim in his name, exercises in his name the rights referred to in articles 77, 78 and 79 and
exercises on his behalf the right to obtain compensation referred to in article 82 when the law of a State
member foresees it” .2
27. Regarding the conditions provided for by Belgian law in execution of article 80.1. of the GDPR,
they appear in article 220.2. of the LT, are cumulative and the following:
Ҥ 2. In the disputes provided for in paragraph 1, a body, an organization or a
non-profit association must:
1° be validly constituted in accordance with Belgian law;
2° have legal personality;
3° have statutory objectives of public interest;
4° be active in the field of protecting the rights and freedoms of individuals
concerned in the context of the protection of personal data
for at least three years.
§3.The body, organization or non-profit association provides proof, through
presentation of its activity reports or any other document, that its activity
2 It is the Litigation Chamber which underlines. See. also the first part of recital 142 of the GDPR: (142):
Where a data subject considers that his or her rights under this Regulation are infringed, he or she should have the
right to apply for a non-profit body, organization or association, constituted in accordance with the law of a
Member State, whose statutory objectives are of public interest and which is active in the field of data protection
of a personal nature, so that he lodges a complaint in his name with a supervisory authority, exercises the right to a
legal recourse on behalf of the data subject or, if provided for by the law of a Member State, exercise the right
to obtain redress on behalf of affected individuals.
3The preparatory work of the LTD mentions that the condition of 3 years applies both to the existence of the personality
legal and for the exercise of activities in the field of data protection. See. House of Representatives, Draft
of law relating to the protection of individuals with regard to the processing of personal data, Doc. Parl.,
DOC 54 31/26/001 (article by article commentary – article 220). Decision on merits 39/2024 — 7/10
has been in effect for at least three years, that it corresponds to its corporate purpose and that
This activity is related to the protection of personal data.
28. In this case, it appears from the file as reported above in points 13-15 that it is the company
X3 (..), an e-reputation consultancy company established in Marseille in France, which has
submits the complaint on behalf of the complainant and represents the latter in the exercise
of his right to complain (complaint) within the meaning of article 77.1. of the GDPR before the Chamber
Litigation (APD).
29. The Litigation Chamber notes that the company X3 is a company in the form of a
joint stock company (..).
30. The Litigation Chamber is of the opinion that there are serious doubts as to the compatibility
with the GDPR of the condition set by the Belgian legislator in article 220.2.1° of the LTD in
what the non-profit body, organization or association must be validly
constituted in accordance with Belgian law. Indeed, the Belgian legislator introduced in doing so a
more restrictive condition than that provided for in section 80.1. of the GDPR which requires that this
body, this non-profit organization or association is constituted
in accordance with the law of a Member State.
31. This consideration has no impact in this case since, in any hypothesis, the company
X3 does not meet the other conditions of article 80.1 GDPR, read in combination with
article 220.2 of the LTD, since it is not a “body, organization or
non-profit association” and also has no “statutory purpose of public interest. He
it is a commercial company as evidenced for example by its General Conditions
sales available on its internal website […] under the terms of which it is a question of “sale
of the following services: E-reputation cleaning (request for deletion
URL) and Serp-Sculpting. » for which different prices are established.
32. In support of the above, the Litigation Chamber concludes that this company does not meet
therefore in no way the conditions of article 80.1 GDPR, read in combination with article
220.2 of the LTD recalled above and that the complainant could not and cannot validly
be represented by this company to exercise the right conferred by section 77.1. of
GDPR.
33. The Litigation Chamber adds that in this it follows the defendants' argument
except on the consequences that they think they can draw from the absence of deposit of
4
The preparatory work of the LTD specifies with regard to article 220.2. that “it is the choice to limit this right to
non-profit bodies, organizations and associations validly constituted in accordance with Belgian law and
in particular to the law of June 27, 1921 on non-profit associations, foundations, European political parties and
European political foundations. House of Representatives, Bill relating to the protection of natural persons
with regard to the processing of personal data, Doc. Parl., DOC 54 31/26/001 (article by article commentary –
section 220). Decision on merits 39/2024 — 8/10
conclusions in reply by the complainant on this point in particular. Unlike this
that the defendants expose, the absence of filing of conclusions by the complainant (point 23)
- and therefore argumentation in response to the defendants' thesis as to its
non-compliant representation - does not amount to acquiescence on the part of the complainant.
The latter remains free to conclude or not, certainly depriving himself if necessary of supporting his
complaint and to defend oneself in the light of the arguments developed by the parties
defendants. However, it cannot be deduced from this that he acquiesces in the defense of these
this.
III. Corrective measures and sanctions
34. Under the terms of article 100.1 of the LCA, the Litigation Chamber has the power to:
1° close the complaint without further action;
2° order the dismissal of the case;
3° pronounce a suspension of the sentence;
4° propose a transaction;
5° issue warnings or reprimands;
6° order to comply with the requests of the person concerned to exercise their rights;
7° order that the person concerned be informed of the security problem;
8° order the freezing, limitation or temporary or definitive ban on processing;
9° order compliance of the processing;
10° order the rectification, restriction or erasure of the data and the notification of
these to the recipients of the data;
11° order the withdrawal of the accreditation of certification bodies;
12° give fines;
13° issue administrative fines;
14° order the suspension of cross-border data flows to another State or a
international body;
15° transmit the file to the public prosecutor of the King of Brussels, who informs him of the
follow-up given to the file;
16° decide on a case-by-case basis to publish its decisions on the website of the Authority of
Data protection. Decision on merits 39/2024 — 9/10
35. In matters of dismissal (article 100.1.1° LCA), the Litigation Chamber must
motivate your decision step by step and:5
- pronounce a classification without technical follow-up if the file does not contain or not
sufficient elements likely to lead to a sanction or if it includes a
technical obstacle preventing it from rendering a decision;
- or pronounce a classification without further opportunity, if despite the presence of elements
likely to result in a sanction, the continuation of the examination of the file does not seem to him
not appropriate given the ODA priorities as specified and illustrated in
6
the Disposition Policy of the Litigation Chamber.
36. In the event of classification without follow-up on the basis of several reasons (respectively, classification
without technical and/or appropriate action), the reasons for classification without action must be
treated in order of importance .7
37. In the present case, the Litigation Chamber decides to proceed with a classification without
continued for technical reasons on the basis of article 100.1.1° of the LCA due to the absence
compliance of the complainant's representation with articles 80.1. of the GDPR and 220.2. of the
LTD applied in combination with section 77.1. of the GDPR and therefore, the absence of
validity of the complaint lodged which prevent it from taking any decision
on the merits of the request.
38. The Litigation Chamber specifies in this regard that this classification without technical follow-up
leaves intact the complainant's right to lodge a complaint with the same subject matter as the complaint
leading to this decision in compliance with the conditions of admissibility of the
complaints. This decision to classify without technical action does not in any way prejudge
of the merits as to the merits of the complainant's delisting request that the
Litigation Chamber could be required to examine whether it should be validly
entered in the future.
39. The Litigation Chamber having thus granted the request made by the
principal defendants without ruling on the merits of the plaintiff's request,
it decides to adopt this decision without convening the hearing requested by these
the latter only, the complainant not having for his part requested to be heard.
5Market Court (Brussels Court of Appeal), September 2, 2020, 2020/AR/329, p. 18.
6https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
contentious.pdf .
7Clearance policy of the Litigation Chamber, 06/18/2021, point 3 (“In what cases is my complaint
likely to be closed without further action by the Litigation Chamber?”), available on
https://www.autoriteprotectiondonnees.be/publications/politique-de-classement-sans-suite-de-la-chambre-
contentieuse.pdf Decision on the merits 39/2024 — 10/10
IV. Publication of the decision
40. Given the importance of transparency regarding the decision-making process of the Chamber
Contentious, this decision is published on the APD website. However, it is not
in view of all the specific elements and considerations of the case, not
necessary for this purpose that the identification data of the parties to this decision are
directly mentioned.
FOR THESE REASONS ,
the Litigation Chamber of the Data Protection Authority decides, after
er
deliberation, to dismiss this complaint in accordance with article 100, § 1,
1° of the LCA.
In accordance with article 108, § 1 of the LCA, an appeal against this decision may be lodged,
within thirty days from its notification, to the Court of Markets (court
of Appeal of Brussels), with the Data Protection Authority as defendant.
Such an appeal may be introduced by means of an interlocutory request which must contain the
8
information listed in article 1034ter of the Judicial Code. The interlocutory request must be
filed with the registry of the Court of Markets in accordance with article 1034quinquies of the C. jud. , or 9
via the e-Deposit information system of the Ministry of Justice (article 32ter of the C. judic.).
(sé). Hielke H IJMANS
President of the Litigation Chamber
8The request contains barely any nullity:
1° indication of the day, month and year;
2° the name, first name, domicile of the applicant, as well as, where applicable, his qualifications and his national register number or
Business Number;
3° the surname, first name, address and, where applicable, the status of the person to be summoned;
4° the object and summary of the grounds of the request;
5° indication of the judge who is seized of the request;
the signature of the applicant or his lawyer.
9 The request, accompanied by its annex, is sent, in as many copies as there are parties involved, by letter
recommended to the court clerk or filed with the court registry.
