APD/GBA (Belgium) - 51/2024

APD/GBA - 51/2024
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 6 GDPR Article 13(1) GDPR Article 27 GDPR
Type:	Complaint
Outcome:	Partly Upheld
Started:
Decided:
Published:	02.04.2024
Fine:	n/a
Parties:	n/a
National Case Number/Name:	51/2024
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Dutch
Original Source:	GBA (in NL)
Initial Contributor:	nzm

The DPA considered that online fingerprinting must, in principle, be based on the data subject's consent.

English Summary

Facts

The controller offers services that allow a device user to remain identified even when browsing in incognito mode or using a VPN by assigning them a unique identifier. A demo on the controller’s website showed that a unique ID is assigned to each visitor of the website, which, when combined with the user’s location, allows to track, among other things, the number of visits.

The data subject sent an access request and indicated that he may decide to delete this data after receiving the access request.

Since contacting the controller, the data subject had been receiving marketing emails.

The data subject lodged a complaint with the Belgian DPA (“APD”). The complaint was twofold: on the one hand, the data subject criticized the services provided by the controller and considered that there was probably no legal basis for these processing operations. On the other hand, they challenged the controller’s failure to provide a positive response to their erasure request.

The data subject also indicated that other parties could potentially use the same technology in a way that does not comply with the GDPR.

The data subject attached a mail summary which shows an email exchange between the data subject and the controller, but the actual content of the email exchange was not shared with the APD.

Holding

Regarding the legal basis of the processing operations, the APD noted that the controller’s privacy policy did not clearly state the legal basis under Article 6 GDPR. The APD found a possible violation of Article 13(1) GDPR which requires the controller to inform the data subject of the legal basis.

Moreover, the APD pointed out that this processing, which uses, among other things, location and IP address to assign a unique ID to a visitor, must in principle be based on consent. The APD therefore found a possible breach of Articles 5(1)(a) and 6 GDPR.

Regarding the use by other parties of the technology, the APD indicated that the complaint is specifically directed towards the controller, and that it is up to each controller to ensure that their processing activities are in compliance with the GDPR. Therefore, the APD only examined the activities that took place under the responsibility of the controller.

Regarding the access and erasure request, the APD considered that it appeared from the elements provided that there was an email exchange between the data subject and the controller, but as the content of this communication had not been provided, the DPA could not assess whether the controller’s response met the requirements of the GDPR.

Nonetheless, the APD added that if personal data is obtained by submitting an erasure request, it cannot be used thereafter to send out marketing emails, under the principle of purpose limitation under Article 5(1)(b) GDPR. The APD therefore found a possible violation of Article 5(1)(b) GDPR.

Finally, the APD also noted that the controller had not appointed a representative in the European Union under Article 27 GDPR.

Thus, the APD issued a warning for (i) failing to comply with the information obligation under Article 13 GDPR, (ii) for using the contact details of the data subject to send marketing emails and thus possibly violating Article 5(1)(b) GDPR, (iii) for failing to appoint a representative in the European Union under Article 27 GDPR and (iv) for possibly violating Articles 6 and 5(1)(a) GDPR.

Comment

As this is a 'prima facie' decision, not much information is available. The Litigation Chamber of the DPA has ruled solely based on the complaint without having a procedure. The controller could demand for a procedure within 30 days after the decision.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

1/7



                                                                          Dispute Chamber


                                                      Decision 51/2024 of April 2, 2024


File number: DOS-2023-03422


Subject: warning due to failure to appoint a representative in the

Union and conducting a demo (online fingerprinting)



The Disputes Chamber of the Data Protection Authority, composed of Mr

Hielke HIJMANS, sole chairman;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

on the protection of natural persons with regard to the processing of

personal data and regarding the free movement of such data and to the revocation of

Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”;


Having regard to the law of 3 December 2017 establishing the Data Protection Authority,
hereinafter “WOG”;


In view of the internal rules of order, as approved by the House of Representatives

Representatives on December 20, 2018 and published in the Belgian Official Gazette on

January 15, 2019;


Considering the documents in the file;


Has made the following decision regarding:


The complainant:



The defendant: Y, hereinafter “the defendant” Decision 51/2024 — 2/7



I. Facts and procedure


 1. The defendant offers services that enable a user of a device
                                                                                                  1
       continue to identify you, even when surfing in incognito mode or using a VPN.
       This provides a demo on the website, giving the visitor to the website a unique experience

       ID is assigned.


 2. The subject of the complaint concerns the processing that takes place in the context of the

       running this demo on the defendant's website. The complainant criticizes it

       assigning the unique ID.

 3. On March 22, 2023, the complainant would submit a request for access, together with a request for

       erasure of data, addressed to the defendant. The request was as follows

       formulated: “I want a copy of all the information you have about me and my decide [sic] (as

       per GDPR regulation) after which I want all data to be deleted. Thanks. Also please stop this

       service."


 4. The email overview that the complainant has added to the complaint shows how a
       email exchange takes place between the complainant and the defendant on March 23, 2023

       March 29, 2023. The actual content of this email exchange was not communicated to the

       Shared dispute room.


 5. Since contacting the defendant, the complainant has been receiving marketing emails,

       starting from May 23, 2023. At the time of filing the complaint, the

       last email dated August 10, 2023.

 6. On August 13, 2023, the complainant submits a complaint to the

       Data Protection Authority against the defendant.


 7. On August 30, 2023, the complaint will be declared admissible by the First Line Service on
                                             2
       on the basis of Articles 58 and 60 WOG and the complaint is filed on the basis of Article 62, § 1 WOG
                                             3
       transferred to the Disputes Chamber.

 8. In accordance with Article 95, §2,3°WOG as well as Article 47 of the internal order regulations

       The parties can request a copy of the file from the GBA. If either

       parties wish to make use of the option to consult and copy

       the file, he must contact the secretariat of the Disputes Chamber, at

       preferably via litigationchamber@apd-gba.be.





1[…]

2In accordance with Article 61 of the WOG, the Disputes Chamber hereby informs the parties that the complaint is admissible
declared.
3In accordance with Article 95, § 2 of the WOG, the Disputes Chamber hereby informs the parties that the file will be sent to
has been transferred to her as a result of this complaint. Decision 51/2024 — 3/7


II. Justification


 9. The complaint is twofold; on the one hand, the complainant criticizes the services provided by the defendant

       grants, on the other hand, it points out that the defendant has failed to provide a (favorable) response

       her request for data erasure.

 10. The complaint primarily concerns the legality of the defendant's services.

       These are demonstrated, among other things, on the home page of the website

       defendant shown. This demonstration assigns a unique ID to each visitor to the

       website, which in combination with the user's location allows (under

       other) to keep track of the number of visits. The complainant indicates that there is probably none

       there is a legal basis for this processing.

 11. When checking whether the processing in this case was carried out lawfully, the Disputes Chamber noted

       Please note that the defendant's privacy policy does not clearly state the legal basis

       of Article 6 GDPR they base their processing activities. As a result, the

       Disputes Chamber determines a possible violation of Article 13.1.c) GDPR, whereby the

       controller is obliged to inform the data subject
       processing purposes for the processing of personal data.


 12. Furthermore, the Disputes Chamber notes that such processing, including:

       the location and IP address are used to assign a unique ID to a visitor, in

       principle must be based on the consent of a data subject. This seems fine
       not necessarily satisfied. The Disputes Chamber therefore notes a possible infringement

       to articles 5.1.a) and 6 GDPR.


 13. The complainant also emphasized in her complaint that other parties may have the same

       could use technology in a way that does not comply with the GDPR. It is

       However, it is important to note that the complaint is specifically directed against the defendant, and the
       It is up to each controller to ensure that their own

       processing activities are in accordance with the GDPR, as specified in Article 24 of

       the GDPR. Therefore, the Dispute Chamber will only investigate the activities that take place

       under the responsibility of the defendant, and will not elaborate further on possible

       processing activities that may be carried out by any other entities

       executed. It is up to each controller to check each time

       whether their processing activities are carried out in accordance with the GDPR.

 14. In addition, the complainant indicates in her complaint that she has submitted a request for access

       data erasure in accordance with Articles 15 and 17 GDPR has been submitted to the

       defendant, but has not received a favorable response. When viewing the



4
 See […] (consulted on March 8, 2024). Decision 51/2024 — 4/7


     documents added to the complaint show that there was indeed email contact

     between the complainant and the defendant. So it appears that the defendant has

     responded to the complainant's requests, but the content of this communication is

     not provided to the Disputes Chamber. That is why the Disputes Chamber cannot assess whether
     the defendant's response meets the requirements of the GDPR.


15. In this context, the Dispute Chamber recalls that the right to erasure of data

     Article 17 GDPR is not an absolute right. The first paragraph of Article 17 GDPR lists an exhaustive list

     number of situations in which the controller is obliged to implement
     indicate the right to erasure of data of a data subject. A request for erasure

     in accordance with Article 17.1 of the GDPR should not be carried out by the

     controller if there is an exception in accordance with the third paragraph

     this article applies. It is unclear whether the defendant is in this case

     invokes an exception. The Disputes Chamber cannot therefore rule on one

     potential violation of Article 17 GDPR on the part of the defendant.

16. It is clear that if personal data is obtained by submitting a

     request for data deletion, it cannot subsequently be used for the purpose

     sending out marketing emails. This is in line with the purpose limitation principle of Article 5.1.b)

     GDPR. The purpose limitation principle requires that the purpose of the processing be defined
     at the time the data is collected and writes as a starting point for all

     successive processing operations may not exceed the defined purpose.


17. In this context, the Disputes Chamber must determine that the further use of the
     contact details of the complainant for marketing purposes, cannot be seen as

     compatible further processing within the meaning of Article 6.4 GDPR. She therefore proposes a

     possible violation of Article 5.1.b) GDPR.


18. Finally, the Disputes Chamber notes that there is no representative of the
     controller is appointed on European territory. This

     obligation is included in Article 27 GDPR.


19. The foregoing is all the more striking because the defendant does on his website

     advertises that it meets the requirements of the GDPR (“GDPR compliant”). From the
     This appears prima facie not to be the case.


20. The Disputes Chamber is of the opinion that on the basis of the above analysis

     concluded that the defendant may have violated the provisions of the GDPR
     was committed, which justifies taking one in this case

     decision on the basis of Article 95, § 1, 4°, WOG, more specifically the defendant

     to issue a warning for failure to comply with the information obligation

     of Article 13 GDPR, for the use of the complainant's contact details for Decision 51/2024 - 5/7



       sending marketing emails and thus Article 5.1.b) of the GDPR

       violations, as well as for failing to appoint a representative in the Union
       in accordance with Article 27 GDPR. The Disputes Chamber also proposes a possible

       violation of Article 6 GDPR j° Article 5.1.a) GDPR is established, due to the existence of a

       possible unlawful processing, for which they also charge the defendant

       gives a warning.


       Finally, the Disputes Chamber warns on the basis of Article 95, §1, 4°, WOG, if still

       relevant, to comply with the request for data erasure (and access) from the

       complainant.

 22. This decision is a prima facie decision taken by the Disputes Chamber

       in accordance with Article 95 of the WOG on the basis of the complaint submitted by the complainant

       complaint, in the context of the “procedure prior to the decision on the merits” and none

       decision on the merits of the Disputes Chamber within the meaning of Article 100 of the WOG.


       The Disputes Chamber thus warns the defendant that an infringement is likely

       is committed on Article 5.1.a)j°Article 6GDPR,Article 5.1.b),Article 5.1.a)j°Article 13andArticle

       27 GDPR due to the current processing activities.

 23. The purpose of this decision is to inform the defendant of the fact that this

       may have committed an infringement of the provisions of the GDPR and this in the

       the opportunity to still comply with the aforementioned provisions.


 24. If the defendant does not agree with the content of the present primafacie

       decision and is of the opinion that it can apply factual and/or legal arguments

       that could lead to a different decision, this can be done via the e-mail address

       litigationchamber@apd-gba.be send a request to hear the merits of the case

       to the Disputes Chamber within 30 days after notification of this
       decision. The implementation of this decision will, if necessary, continue for a period of time

       suspended for the aforementioned period.


 25. In the event of a continuation of the merits of the case, the

       Dispute Chamber the parties on the basis of Articles 98, 2° and 3° in conjunction with Article 99 WOG

       invite them to submit their defenses as well as any documents they consider useful in the case

       file to add. If necessary, the present decision will be permanently suspended.

 26. Finally, for the sake of completeness, the Disputes Chamber points out that a hearing on the merits

       of the case may lead to the imposition of the measures stated in Article 100 of the WOG. 6



5
 Section 3, Subsection 2 of the WOG (Articles 94 to 97).
6Article 100. § 1. The Disputes Chamber has the authority to:
 1° to dismiss a complaint;
 2° to order the dismissal of prosecution;
 3° order the suspension of the ruling; Decision 51/2024 — 7/7


Such an appeal can be lodged by means of an inter partes petition

                                                                                                        7
must contain statements listed in Article 1034ter of the Judicial Code. It

an objection petition must be submitted to the registry of the Market Court
                                                                       8
in accordance with Article 1034quinquies of the Dutch Civil Code. , or via the e-Deposit

IT system of Justice (Article 32ter of the Judicial Code).







(get). Hielke H IJMANS

Chairman of the Disputes Chamber

















































7The petition states, under penalty of nullity:

 1° the day, month and year;
 2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
     company number;
 3° the surname, first name, place of residence and, where applicable, the capacity of the person to be
     summoned;
 4° the subject matter and brief summary of the grounds of the claim;

 5° the judge before whom the claim is brought;
 6° the signature of the applicant or his lawyer.
8The application with its attachment will be sent by registered letter in as many copies as there are parties involved
deposited with the clerk of the court or at the registry.