Court of Appeal of Brussels - 2020/AR/1160 (Second Interim Decision)
From GDPRhub
| Hof van Beroep - 2020/AR/1160 | |
|---|---|
 | |
| Court: | Court of Appeal of Brussels (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 6(4) GDPR Article 7 GDPR Article 12 GDPR Article 17 GDPR Article 24 GDPR Article 94(2) GDPR Art. 12 Directive on privacy and electronic communications (ePrivacy Directive) 133 WEC |
| Decided: | 24.02.2021 |
| Published: | |
| Parties: | Proximus N.V. APD/GBA |
| National Case Number/Name: | 2020/AR/1160 |
| European Case Law Identifier: | |
| Appeal from: | APD/GBA (Belgium) 2020/AR/1160 |
| Appeal to: | Not appealed |
| Original Language(s): | Dutch |
| Original Source: | Arrest van 24 februari 2021 van het Marktenhof AR 1160 (in Dutch) |
| Initial Contributor: | Matthias Smet |
The Belgian DPA (APD/GBA) fined a telecom operator €20,000 for failure to comply with a data subject's request to remove her data, and for the illegal sharing of her data with other telephone directories. Following an appeal by the telecom operator, the Court of Appeal of Brussels referred several questions to the CJEU regarding the interaction between the GDPR and ePrivacy Directive.
English Summary
Facts
In this case Proximus had failed to grant a woman's right of erasure of her personal data and had passed the data on to other telephone directories and directory enquiry services even after receiving several complaints and correspondence from the data subject. On request of the data subject, Proximus had changed the code linked to the data subject's data from 'visible' to 'confidential'. After adjusting the code regarding publication, Proximus received new contact details of the person concerned from her operator, as a result of which the data in the underlying database was automatically overwritten with the new data from the operator.
The Belgian DPA imposed a fine of €20,000 on the defendant defendant for infringement of Articles 6, 7 and 12 of the GDPR. In the contested decision, the Belgian DPA found the infringement of Article 6, 7, 12, 13 and 24 GDPR sufficiently proven.
In addition, the DPA ordered the defendant to cease any further disclosure of personal data of subscribers to third parties of telephone directory or inquiry services when Proximus acquired these data only as a provider of telephone directories and directory enquiry services, taking into account a transition period in order to give Proximus (and the telecommunications sector in a broader context) the opportunity to develop a new privacy compliant system.
Holding
With regard to the question of whether consent is required to be included in telephone directories or not and what scope of this consent is, the Court of Appeal also considered that:
1° In situations where the e-Privacy Directive specifies the rules laid down in the GDPR, these specific provisions of the e-Privacy Directive as lex specialis prevail over the more general provisions of the GDPR. (principle of Lex specialis derogate legi generali)
2° Article 12(1) and recital 38 of the ePrivacy Directive refer to the requirement of informed consent within the meaning of Directive 95/46/EG of subscribers for being included in public directories. Following article 94 GDPR that states that all references to 95/46/EG should be considered as references to GDPR, the abovementioned articles thus refer to ‘consent’ in the light of GDPR and thus the condition for a valid consent (Article 7 GDPR) must be met.
3° This consent relates to the purpose of publication of the personal data in the directories, but not to the identity of the directory provider. Consequently, the court states that the consent given will also be valid for subsequent processing of the personal data by other directory providers, provided that this processing serves the same purpose
Given the fact that this is a complex matter which raises some questions that are not yet tackled by the legislator, the Brussels Court of Appeal stayed the proceedings to request the Court of Justice for a preliminary ruling regarding following questions:
1° Should Article 72.2 of the e-Privacy Directive 2002/58/EC, read in conjunction with Article 2(f) of that directive and with Article 95 of the General Data Protection Regulation to be interpreted as allowing a national supervisory to be interpreted as permitting a national supervisory authority to require the 'consent' of a subscriber within the meaning of the General Data Protection Regulation as the basis for the publication of the subscriber's personal data in public directories and directory enquiry services, both those published by the operator itself and by thirdproviders, providers, in the absence of national legislation to the contrary?
2° Should the right of erasure contained in Article 17 of the General Data Protection Regulation be interpreted as precluding a national supervisory authority from considering a request by an individual for removalfrom public directories and directory enquiry services as a request for erasure within the meaning of Article 17 of the General Data Protection Regulation?
3° Must Article 24 and Article 5(2) of the General Data Protection Regulation be interpreted as precluding a national supervisory authority from concluding from the accountability obligation contained therein that the controller must take appropriate technical and organisational measures to inform third-party controllers, namely the telephone service provider and, inter alia, providers of telephone directories and directory enquiry services who have received data from that controller, of any withdrawal of consent by the data subject in accordance with Article 6 juncto Article 7 of the Regulation?
4° Must Article 17.2 of the General Data Protection Regulation be interpreted as precluding a national supervisory authority from ordering a provider of public directories and directory enquiry services who is requested to cease disclosing data relating to an individual to take reasonable steps to inform search engines of that request for deletion of data?
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
Date the reception:01/04/2021
Page 2
Repertory number2a2t | /585Date of judgmentFebruary 24 , 2021roll number2o2olARltt60IssueLlrtreached:,anAwarded aari1'IIIiIIIiyou are not to be offered thereceiverInterim judgment : preliminary questionsOffered onNot to registerCourt of AppealBrusselssection Marktenhof19d" room ARoom for market businessJudgmentlProvided toLuxcmbourgtnt{e0 2. 03. Z0Z1onftir,JHoll€titJon€lirJkhÍ- covEn 0r -0000r,q3gasB-0001,-00e.s- u r-01-t,-'ll ffi lilllllllllllllllllllllllllllllllllllllllllllllilJC-129/21 - 1
Page 3
Court of Appeal Brussels - 202ol AR/!160 - p. 2ONPROXIMUS NV, public limited company of public law, ON 0202.239.951, withregistered office at 1030 BRUSSELS Avenue Koning Albert ll,27,requesting party,represented by mr. CRADDOCK Peter and mr. VAN BOGGET Eline, lawyers, bothwith office at 1000 BRUXELLES, Terhulpsesteenweg 120,against the decision No. 42/2020 of 30 July 2020 of the Dispute Resolution Chamber of thedata protection authority,ïEGEN ;The DATA PROTECTION AUTHORITY, independent public institution, supervisoryauthority, ON 0694.679.950, with registered zetelte 1000 BRUSSELS, Printing Street 35,defendant,represented by mr. ROETS Joos, mr. BUGGENHOUDT Claire and mr. CLOOTS Elke, lawyers,all with offices in 2018 ANTWERP, Oostenstraat 38 box 201,***In view of the procedural documents:o the decision no. 4212020 of 30 July 2020 of the Disputes Chamber of theData Protection Authority (hereinafter the " Contested Decision",o petition for higher appeal filed by Proximus on 28 August 2020o the interlocutory judgment of the Marktenhof of 15 September 2020 in which the Marktenhof deProvisional uiwoerbaarheid of the contested decision cancels and claim deadlinescaptureUo the conclusion filed by Proximus on December 2 , 2020,o the conclusion deposited by the GBA on 13 januari2O2LJ-nlee Er,-000Ír,9ïgega-ttCIup-0Eps-01,-0]-fllEfiHEIffiJ
Page 4
Court of Appeal Brussels - 2020/ AR/1760 - p. 3After hearing the parties' lawyers in open court on January 28 , 2021 (viavideoconference) and having regard to the documents which they have filed after the case into consideration wastaken for ruling on February 24 , 2021.l. Facts and orocedural antecedents1.Proximus offers certain telephone directories and information services (1207.be and 1307.be on the one handand the telephone services 1207 and 1307 on the other hand) , in accordance with the provisions of the law of13 June 2005 on the electronic communications {below the WEC).This telephone directory and information services of Proximus (hereinafter referred to as the Proximus 6idsen)contain the name, address and telephone (contact details) of subscribers of thedifferent providers of public telephone services (operators). These operatorsprovide such contact details regularly to Proximus, as the provider of theProximus Gids, except for the contact details of subscribers who have expressed their wishto not be mentioned in the Proximus Guides.There are other telephone directories, such as the White Pages (wltteeids.be), infobel.be, del212.be,opendi.be etc. These guides (hereinafter the Third Guides) are published by third parties ,In accordance with an agreement with FCR Media, the publisher of the White Pages (and Gouden Gids),send Proximus contact information of subscribers in the Proximus Guides appearto FCR Media.In the databases of the Proximus Guides and Third Guides is there a distinctionmade between subscribers who are allowed to appear in a telephone directory , and subscribers who are not ina telephone wishing to appear too. In practice, this distinction is translated into onecode in the record for a subscriber: "NNNNN" for the first category (contact informationmay appear) and "XXXXX" for the second category (contact details remain secret).On 13 January 2019 had a person (the complainant in the context of the procedure for theDisputes Chamber of the Data Protection Authority) via the website contact form at1207, be the following request : "[...] Please do not include this telephone number in the White Pages,at 7207,be, ... Gradg contact only via e-msil",Proximus paste the relevant record on and flagged it as "secret" ( "XXXXX"),in accordance with the Complainant 's request , and confirmed a correct processing of therequest via e-mail on January 28 , 2019 to the Complainant: "The number [...] is currently notincluded in the edition of the Guide. The info is also not available on the information (1207)f-nlee Er,-0rEEreesesa-000i-00es-0r,-0r-i'l2,3llIslElilffiJ
Page 5
Court of Appeal Brussels-2020/AR(LI60 - p. 4and on the website (www.1207.be). You will find the latest update on our website www.7207.beof all published entries".4.On January 31 , 2019, Proximus received from the operator (Telenet) of the Complainant, in the contextof a routine provision of the contact details of its subscribers, newcontact details regarding the Complainant. ln this operator information it stated that thecontact details of the complainant not as secret should be considered ( "NNNNN").This information coming from the operator (Telenet) was automatically processed in theProximus Guides. Consequently, in the case of the Complainant, the contact details of theComplainant (automatically) again publicly available (with now "NNNNN" as a replacementof the previous "XXXXX").On 1.4 August 2019 submitted the complainant a new request in through the L207.becontact, with the following question: "Please my phone not to mention onyour website(s) http://www.7207.be. Please only send your confirmation to [e-moilodres]".proximus confirmed to the Complainant that his entry had been "deleted". Consequently , thecode "XXXXX" re- set.6.That same day, namely on 14 August 2019 submitted the complainant a complaint in with theData protection authority against "the 1207 service of Proximus SA under public law",In this complaint, the complainant which, despite its request to the not mentioning histelephone number, "[t] phone number yet recorded is already certainly www.7207.be,www.7307.be, Www.w.llteaids,be, www.infobel,be. www.dg,7272.be and very likelyso also on the associated intelligence services 7207, 7307 and in paper versions of the WitteGuide(s) êD!@Lh{.On September 5 , 2019 , the Complainant again contacted Proximus, this time regarding thepublication of his data in a Third Guide, namely-wwWi-nÍobelcen.Proximus replied that:Dear[...]Your data has also been forwarded to other directories or information services thathave asked [Proximus] to supply subscriber data , they were alsoat the height gebrocht are [sic] of your vroag to your data no longer use.l-rarr 0r-0BCI0r9qsess-000q-BEes-ÍlL-0I-il5.7lEíÍEffiJ
Page 6
Court of Appeal Brussels-2020/ARh1.60- p. 5However, [Proximus] hasno insight into the internal procedures of these other publishers, Forfor a faster treatment of your pregnancy, it is best to contact them directly :For www.witteaids.be you can email to info@fcrmedia.be or contact them at078/151525 For www.infobel.com you can email to info@infobel.com or call themat 02/3792940"Although Proximus previously contacted these two Third Guides regarding the case ofthe complainant and his desire for the publication of his contact stop to turn, hasIn its own words, Proximus does not control the internal functioning of Third- Party Guides.8On August 27 , 2019 , the Frontline Service of theData Protection Authority, the complaint is admissible and was the complaint transferredto the Disputes Chamber.On September 12 , 2019, both the Complainant and Proximus were informed that thefile was ready for a treatment on the merits and both parties were invitedtheir conclusions about to make and this according to one by the Data Protection Authoritydrawn up conclusion calendar,On March 3, 2020, both parties were invited, on the initiative of the Disputes Chamber,for a hearing. Proximus was invited to present some legal positions,including the qualification of the Complainant 's request .Only Proximus appeared at the hearing on 1 April 2020 .On July 1 , 2020, the Disputes Chamber made a "form for response against intendedfine "about to Proximus in which the Dispute Resolution Chamber its intention expressed to ato impose a fine of EUR 20,000 .On 22 July 2020 Proximus sent this form to the Dispute Resolution Chamber that she herresponse to the proposed fine on the basis of the specialcircumstances of the case.On July 30 , 2020, the Disputes Chamber took the Contested Decision.ll. Subject matter of the claimsl. The appeal of Proximus extends it to:[-poeE 0],-0000r9isega-000s-00eg-01,-0r-fl910.lEh*Ebs#J
Page 7
OOaaBrussels Court of Appeal - 2O2O/ ARlt160 - p. 6Declare the action admissible and well founded and, accordingly,Further judging after the interim order of 76 September 2020,In main order, Proximus is claiming a complete reform of the contested decision tofollowing reasons.There are several conflicting and contra legem interpretations about"consent" means the basis of the contested decision.so serve drtt. 72 ePR and 133 WEC do indeed act as lex speciolis with regard to theAVG (lex to generolis) be considered for olle aspects that they control;so should the request of the complainant to be too gekwolificeerd ols a request torectification within the meaning of art. 16 AVG and not ols the withdrawal of "consent".Also Proximus was entitled to contact the complainantback in the phone book to publish, and this was no breach of art 6, paragraph 7, in conjunction withart.7 GDPR .Furthermore has Proximus no obligation to request the Kloger oan to theAny operator or provider of a directories provide and mookt they thereforeno infringement of art. 24 juncto art. 5 para. 2 GDPR.No action can be taken on the order from Proximus toto delete the complainant's personal data , in accordance with Art. 6 in conjunction with 7 GDPR, as itThe Complainant's request is merely a request for rectification within the meaning of art. 76 GDPR and norequest for erasure in accordance with ort. 77 GDPR.In any event , even if your Court should declare that it is nevertheless a request forerasure concerned - quod non -, was this in no way lead to liability on the part von Proximusto some "left" or information to third parties let erase accordance ort. 79, in fineGDPR,The processing activities performed by Proximus regarding the transfer ofcontoctgegevens von subscribers von point e operotoren other aonbieders ofdirectories and directory inquiry services, in accordance with the case law of the Court ofJustice and advice of the BIPT do not constitute an infringement of art. 6 AV6. It was therefore not possibleare ordered to cease such processing activities .The processing activities carried out by Proximus , in accordance with the WEC and the jurisprudence of theCourt of Justice, do not infringe art, 12 GDPR.In view of all the above, to decide that any fine is also unjustified ,In subordinate order. entitled to say that the GDPR legal basis for herprocessing activities as a provider of directories and directory inquiry services,the legitimate interest may be, as well as the right to say that in view of theregulatory framework (jurisdiction and advice from regulators), (i) an assumptionno legitimate interest ols AVG legal basis no the judgment to be delivered not as a consequencel- nler 0r,-CI0EELcqgegê-000b-0Bpg-0r-01-ilaaaOlEIAEffiJ
Page 8
2Court of Appeal Brussels - 2020 / AR/1160 - p. 7is the only process in the onrechtmotig past has been , and (ii) theprocessing, in accordance with these words of personal waervon then wasconsidered that processing on "consent" rLtsttte, is allowed .a whole subordinate order. a reasonable and sufficient lunge tolerance period - fromat least 78 months - to be granted in order to allow the intervention of the regulators, thelegislator, all operotoren and all oanbieders to insure for a solution to findthat can meet the requirements imposed by the lJw Hof , if necessary , in view of theregulatory framework (judicial proceedings and opinions of regulotoren) and the need for asector- wide approach,tn each aevol. order the Data Protection Authority to pay all costs of theproceedings at first oanleg and in groad von appeal herein include the cost von theapplication, the roll-out rights, the legal compensation on the part of the vdnoppellante provisionally budgeted at EUR 72,000 , and all possible implementation andcollection costs.The GBA asks the Marktenhof :- In main order to explain dot the claim Proximus unfounded is;- In the subordinate order: before making a decision on the substance , the following preliminary ruling:questions to the Court of Justice to ask:1. "Must Article 72.2 of E-Privacy Directive 2002/58 / EC, somen read with Article 2.f) ofthis Directive and with ortikel 95 of the General Regulation Data, so beexplained to the toeloat which a national supervisory dutoriteit a consent ' ofthe subscriber in the sense of the General Data Protection Regulation required ifbasis for the publication of its personal data in public telephone directories anddirectory inquiry services, both those issued by the operator itself and by third partiesproviders, in the absence of national legislation to the contrary?";2. "Is the right to erasure from ortikel 77 von the General RegulationData that are interpreted the dot itself precludes it a nationalsupervisory authority a request from a subscriber to request information from public telephone directories and -intelligence to be removed ols a request for erasure within the meaning vonArticle 77 of the General Data Protection Regulation qualifies?";3. "Should Article 24 and Article 5.2 of the General Data Protection Regulationexplains dot they are against it venetten which a notionole supervisory authority fromthe doarin anchored accountability distracting to the controller theappropriate technical and orgonisatorische measures should be taken to thirdverwerkingsverontwoordelijken, to know the phone that staon bidder and point e aonbieders ofdirectories and directory inquiry services containing data from thesereceiving controller, to inform about the withdrawal of theconsent by the data subject in accordance with Article 6 Junao Article 7 of the Regulation?";4. "Must Article 77.2 of the General Regulation Data so beexplained which it is precluding the national regulatory authority aJ-elee 0r,-0000rqïsesê-00u?-00es-0ir-01-;-llEffiEffiJ
Page 9
Brussels Court of Appeal - 2020/ AR/L]'6O - p. 8provider of public directories and directory inquiry services who is requested todata of a person no longer openbaor to moken, recommends to reasonable moat arrange totake to search engines on the height to adjust to the request for erasure? ";- Anyway Proximus to pay for the cost von the proceedings by including alegal compensation, estimated on the part of the defendant at EUR 7,440 .lll. Resources raised by the parties partProximity:First plea -contrd legem interpretation of the legal basis for the processing1. First sub-ground: the lex specialis nature of WEC and e-Privacy Directive does not require any specificregulation2, Second sub-ground: no withdrawal of "consent" but rectification3. Third sub-ground: the re-publication did not constitute an unlawful further processing of thecontact details of the complainant4. Fourth sub-agent: no obligation to any request from a person concerned to give tothe source of the personal data or third parties other than recipientsSecond plea for rectification v. request for erasureThird ground - permitted transfer of personal data to other providersFourth plea - compliance with transparency obligationIn subordinate order: applicability of another legal basis under the GDPR atdenial of lex speclalls nature of art. 12, paragraph I and paragraph 2 e-Privacy Directive and art. 133, 91WECIn (more) subordinate order: a Definite tolerance periodGBA:First defense: Article L2.2 of the ePrivacy Directive and Article 133, I 1, WECrequire a "consent" within the meaning of the GDPR; the accountability obligation under the GDPRrequires the other venruerkingsvêrantwoordelijken be informed about thewithdrawal of that consent with regard to one controller (defenceagainst the first plea in the applicationfFirst part of the defence: Article 12.2 e-Privacy Directive and Article 133 WECcontain no lex specialis regarding the withdrawal of the permission {breach of Article 6.1in conjunction with Article 7 GDPR)l-eoce 0r,-0Ír00r,qqsass-B0Bê-00es-0r-0r-illETÊEffiJ
Page 10
Court of Appeal Brussels - 2020/AR/I160 - p. 9ïsecond part of the defence: the request addressed to Proximus withdraws thepermission to publish in and is not a request for rectification (infringement of article 5.1juncto article T AVG)Third part of the defense: the republication constitutes an unlawfulprocessing of personal data (infringement of article 6.1 in conjunction with article 7 of the GDPR )Fourth part of the defence: a controller submits a third partyinforming controllers (infringement of Article 24 and 5.2 GDPR)Second vemreermiddel: the request of the complainant 's request for erasure in themeaning of Article 17 GDPR; third party controllers must be authorized by Proximusbe informed about this venukThe first part of the defense: the request of the complainant 's request todata erasure (Art. 17 GDPR)Second part of the defence: Proximus can be ordered to make reasonablemeasures to take to third controllers on the amount to be set bythe request for erasure (Article 17.2 of the GDPR)Third venue: the transfer of personal data by Proximus to a third partyproviders of directories and directory services is unlawful {infringement of article6 GDPRFourth defense: the transparantiepllcht was not observed (infringement of Article 12in conjunction with article 13 GDPR)Fifth defense: there is no other option for the data processing at issuehelpful legal basis under the AVG availableSixth venue: the contested decision imposes an appropriate tolerance periodlV. The Contested DecisionOn July 30, 2020, the Disputes Chamber will make a decision on the merits. In her decision no.42/2020 (hereinafter: "the contested decision") , the Disputes Chamber considers infringements of thefollowing provisions proved:s. Article 6 of the GDPR in conjunction with Article 7 of the GDPR , as Proximus continued to publish anddecision drill set von the personal data of the kloger in telefoonaidsen respectively.tg,lgphoneinformationandservices. no to the withdrawal of consent, wot makes dot thefurther processing by Proximus became unlawful;l-noee 0r-000ur,cr5sEga-000r-00ps-01,-0r-flL ffiJ
Page 11
Court of Appeal Brussels -2020/ARht60 - p. 10b. Article 6 GDPR, as Proximus unlawfully passes on personal data among othersother providers of telefoonaidsen and telefooninlichtinoendiensten without which they avalid legal basis log may attest to the legality of that transfer asproces rki ng va n pe rsoo nsgegeve ns;c Article 72 jundo Article 73 AVG, given there regarding the complainant ACreate tronspgronteinformation, has been provided by Proximus, and given Proximus' exercise of the rights of theCER ne o nvol d oe nth faci I iTee rt;d. Article 24 and Article 5.2 of the GDPR , given Proximus 's obligations andresponsibilities as controller not nokomt by possend3 technicaland oranoisotoric moatrealities to ensure that the processing is in accordance with theprovisions of the GDPR, whereby the operator of the complainant is informed about thewithdrawal of the consent, as well as where the third party providers of telephone directories and -intelligence services to which Proximus has transferred the personal data areinformed of the withdrawal of the consent.According to previously submit the Dispute Resolution Chamber, the following corrective moat settle on toProximity:a. Proximus is ordered to comply fully and without delay with the withdrawal of theconsent by the complainant and as such the limitations of the personal data of thecomplainant In accordance with drtikel 6 in conjunction with Article 7 AVG to inform tbe (an. 58.2.d) AVG andart, 700, 5 1, 9", GBA law);b. Proximus is reprimanded because they no transparonte information to kloger verschofthas, and omdot they exercise of the rights of the kloger facilitated inadequatewhich in battle is with the ortikelen 12.7 and 12.2 AVG (art 58.2.b) AVG and art. 700, 5 7.5', GBA law);c. Proximus is reprimanded because it has verzaokt oon its obligations andresponsibilities of the controller in accordance with Article 24 GDPR to AVGappropriate technical and organizational measures to take in order to ensure thethe processing which it performs in accordance with the AVG happen (art 58.2.b) AVG andort. 700, 9 1, 5", 6BA Act);d. Proximus is ordered to comply with the data subject's requests to exercise his or her right toerasure out to practice, and this within one month after the notification of thisdecision (Art. 58.2.c) GDPR and Art. 700, 5 7, 6", GBA Act);e. Proximus it is banned to continue to proceed with the processing waor it ononrechtmotige manner (ORT. 6 AVG) personal data by the lobs aon third-party providers ofteleÍoongidsen and directory inquiry services, when they this personal information onlyobtained is as provider of telephone directories and directory inquiry services with atolerance period of one year after the notification of the decision (a tolerance periodword within the transfer as processing could continue to take place, in order to Proximus, and byassociotie the sector, the opportunity to give a new law in accordance with system development for theto foclitate transfers ); Proxlmus must serve the Disputes Chamber within the year after the notificationof this decision about the changes thereto (art. 58.2. f) AVG and art.700.9 7.8'.68A law);l-nlee 0I-00u0r,rqsegs-801,0-0Bes-0r-0I-;-llEH*ÍIffiJ
Page 12
Court of Appeal Brussels - 2020/AR/1160 - p. 11f. Proximus gets a odminístratieve fine of 20.000 EUR imposed for infringementvon of the items 6, 7 and 12 AVG (Art. 83 AVG and the art. 700, 73 ", and 707 GBA-law).V. Legal framework.: tpeoasseliike legal instrumentsIn the present case are two clusters of instruments of European Union law of applicationaIn the first place Directive 95/46 and the Regulation of the European Parliament andthe Council of 27 April 2016 on the protection of natural persons inrelating to the processing of personal data and to free movementof that data and to repeal of Directive 95/46 / EC (OJ 2016 L 119, p. 1)(hereinafter GDPR) and,secondly, Directive 2O02lS8lEG of the European Parliament and of the Councilof 12 July 2002 on the collection of personal data and theprotection of the personal privacy in the sector of electroniccommunication (hereinafter ePrivacy Directivel {OJ No L 207, 31/07/2002 p. 0037 -0047) as amended and converted into the Belgian law by the WEC,OGDPR : relevant provision (the Marktenhof emphasizes the relevant wording)Article 4, paragraph 11, of the AVG defines consent of the person concerned as every Fri [e,specific, informed and unambiguous expression of will with which the person concerned isby means of a statement or an unambiguous active act concerning him hemprocessing of personal data .Article 5.2: The verwerkingsverontwoordelijke is responsible for the enforcement of paragraph 7 andcould this show ( "verontwoordingsplicht").Article 6 3. and 4.:The legal basis for the in paragraph 7, point c) and e), referred to treatment should beestablished at:(o) Union law; orb) lidstatelijk law on the verwerkingsverontwoordeliike of toepossing is.The purpose of the processing in which legal established or is with respect to the inthe processing referred to in paragraph 7, point e), is necessary for the fulfillment of a toak ofgeneral property or for the exercise of the public authority that odn thecontroller has been granted. That legal basis allowed specific provisions bebevotten the application von rules von this regulation oon to pdssen, includingof the general terms and conditions regarding the lawfulness of processing by thedata controller; the types of data processed ; The involved; the entitieswhat and the purposes for which the personal data may be provided; thetarget limitation; the storage periods; and the processing activities and procedures, includingmeasures to ensure a lawful and proper processing, which zoolspoint e specific processing situations as referred to in Chapter IX, European Union law or theItpotr 0r,-0000r53sesê-00r,r,-00as-01,-0r-flL ffiJ
Page 13
Brussels Court of Appeal - 20201 AR/II60 - p. 12Member State law must respond to an objective of general interest and mustbe proportionate to the legitimate aim pursued .4. When the processing is for a purpose other than that for which the personal data isverzomeld not based on the consent of the person concerned or in a European Union law bepolingor a provision under Member State law which, in a democratic society, is a necessaryand proportionate moot rule is to safeguard of the in Article 23, paragraph 7, providedobjectives, the controller keeps the data controller in the assessment of the question whether theprocessing for a purpose other compatible is the purpose woar for personalwere initially collected, among other things, taking into account:each union of the purposes for which the personal data are collected,and the purposes of the intended further processing;the framework in which the personal data are collected, in particular what theratio between the parties concerned and the data controller betreÍt;the nature of the personal data, in particular oÍ special categories ofpersonal data are processed, in accordance with Article 9, and olpersonal data on convictions and criminal offenses areproces RKT, ove ree n is accordingly a rti ke I 70;the possible consequences of the intended further processing for thethose involved;the existence of possende wadrborgen, wodonder possibly encryption oJpseudonymization.Item L2: The controller takes possende measures that thethe person concerned in the articles L3 , and 74 referred to inform the motion, and in the articles 15 to andcommunication referred to in Articles 22 and 14 in connection with the processing in a concise,tronsporonte, comprehensible and easily accessible form and in clear and simplelanguage receives in the particular wonneer the information specific for the intended child is. Theinformation is in writing or by other means, including by, if this fitting is,provided electronically . If the data subject so requests, the informationbe communicated orally, on the condition that the identity of the person concerned isproven by other means .Article 13.2 and 32. Noast the in paragraph 7 referred to information provided to the verwerkingsverontwoordelijke thedata subject when obtaining the personal data, the following additional informationto ensure fair and transparent processing:a)b)c)d)e)a)b)the period during which the personal data will be stored, oJif that is not possible . the criterio for bepoling of the term;that the data subject has the right to revoke the controllerto inzoge of and rectification or erasure of the personal data , or restriction ofthe processing concerning him , as well as the right to object to the processingmaking and the right to gegevensoverdroagbaorheid;when the processing of Article 6, paragraph 7, point o), or article g, paragraph 2, point a), isl-noor 0r-000urïiseEA-u0r,e-00es-0r-01-;-llc)Efr#EhffiJ
Page 14
Court of Appeal Brussels-2020/AR/1160- p. 13geboseerd, dot the person the right to consent to any time todraw without that undermines the legitimacy of the von processingbasis of consent before its withdrawal;which the person concerned the right has a complaint in to serve in a supervisoryauthority;whether the provision of personal data is a legal or contractual obligationis do not be a prerequisite to an agreement to close, and whether thethe person concerned is obliged to provide the personal data and what the possibleconsequences if this information is not provided;the existence of geautomotiseerde decision-making, by including the inprofiling referred to in Article 22 ( 7) and ( 4) and, at least in those cases, usefulInformation about the underlying logic and to belong and the expectedconsequences of that processing for the data subject.3. When the controller intention is personal furthervenuerken for a purpose other than dot for which the personal data are verzomeld,provided the verwerkingsverontwoordelijke the data subject prior to further processinginformation on that purpose and any relevant further information referred to in paragraph 2.Article 24:Taking account of the oard, the omvong, the context and the doelvan processing as wellthe terms waarschljnlljkheid and severity Ultee ongoing risks to the rights and freedomsvon natural persons, affects the controller appropriate technlsche andorganizational measures to ensure and to be able to demonstrate that the processingcarried out in accordance with this Regulation. Those measures will beevaluated and updated if necessary .ArticlelT:7. The data subject has the right of the controller without unreasonablevertroging erasure von him on personal data to obtain and thecontroller is obliged to process personal data without unreasonable delaydelete if one of the following applies :4) (...)) the data subject withdraws consent to which the processing pursuant to Article 6,paragraph 7 (a) or Article 9(2)(o) rests in, and there is no other legal basisfor the processing;(,.,)Art. 94( 2) GDPR also provides that "References to the repealed Directive [Directive95/46/ECl shall be construed as references to this Regulation". In other words, anylegal reference to a provision or concept under Directive 95/46/EC interpretedto be taken as a reference to the equivalent provision or concept under the GDPR.l-eler Er-00utlr,r9sesê-0ur,3-u0eg-01,-01-ild)e)nL fiffiJ
Page 15
Brussels Court of Appeal - 20201 AR/7760 - p. 14Article 95:"This Regulation lays natural persons or legal entities not uanvullendeobligations with regard to processing in connection with the provision ofpublic electronic communications services in public communications networks in theUnion, to the extent they are on land von subject to Directive 2002/58 / EC are of particularobligations with the same objective."e-Privacvrichtliin and WEC: /elevonte bepallnaeqArticle 1 of the ePrivacy Directive states:SCOPE n g ssfeer e n OBJECTI II i ng7. This Directive hormoniseert the regulatory von Member States which need is for an equallevel of protection of fundamental rights and freedoms - in particular the lawa personal life - in the processing von personal data in the sectorelectronic communications waor secure and to to ensure the free movement ofSuch data and ven electronic communicatieapporatuur and services in theCommunity.2. For the purposes of paragraph 7, the provisions of this Directive constitute aSpecification vdn and a complement to Council Directive 95/46 / EC. In addition, they provideprotection of the legitimate interests of subscribers who are legal entities .Article 2f of the ePrivacy Directive states:f) "consent" by a user , or subscriber: the consent of the person concerned ln the meaningvo n DIRECTIVE n I 5/46 / EC ;Article 12 of the ePrivacy Directive states:7. Members shall ensure that subscribers, free of charge and before entering the subscriber list,are recorded at the height be of the purposes of printed orelectronic subscriber lists that are or may become available to the publicobtained through directory information services, in which their personal data may beare included, as well as any further possibilities of use on the basis ofsearch functions included in the electronic versions of the subscriber lists.2. Member States shall eruoor the subscribers the opportunity krfigen Zeff to determine whether, andif so, which personal data will be included in a public subscriber list ,if that data is relevant for the purposes of the subscriber list as far as specifiederuan by the provider, and the data daarln to correct or verify, to leavedisappear. The Nlet incorporated z $ n ln a public abonneelíjst ol the veriflcatie,correction or deletion of personal data from such lists will not incur any costswith zlch.l-none 0r-u0CI0t93gesg-001,q-00?s-0r-01-,*-lL frr#J
Page 16
Brussels Court of Appeal - 2O2O/ AR/t160 - p. 153. Member States may verlongen to the separate approval of the obonnees also obtainedshould be used for purposes of a public directory other than searching forvon contact a person on Bosis of his nadm and, in appropriate cases, anm i ni m to m aa nta I o nd e re i the ntificatie ge give ns;4 The members 7 and 2 shall apply to subscribers who naturally are people. The Member States shall ensure there,within the framework of Community law and applicable national law, also for thatthe legitimate interests of other subscribers and natural persons in relation totheir inclusion in public abonneeliisten sufficient ziin protected.This last article was transposed into Belgian law as follows: article 133 WEC:"5 7. The providers of the public telephony service shall bring their subscribers, free of charge andbefore they are picked up ln a telephoto wage guide ol a telephone inquiry service, inthe height of :1" the purposes of the telephone directory or directory inquiry service;2'het free character von the opnome in the telephone ol the directory inquiry service;3 "in , where appropriate, the applications of the tele wage guide , or theteleÍooninlichtlngendlenst deviate from the search for personal data on the basis ofthe Naom and, where appropriate, the living room, accommodation ol location von subscribers,Only the personal dle relevant meaning for the purposes statedin accordance with the first paragraph and where the subscriber concerned has indicated that he/shemay be included in the relevant telephone directory or the directory inquiry servicemay set out to be in the directory Oi telephone inquiry.To this end, the states operotor two oparte vrdgen to the subscriber :1" or he wishes his address details to be listed in the universal telephone guide and lnd e you ntve rse le i nlichti ngendi e nst;2 " , or he wishes to be listed ziin address data in other remote work guides or otherI n I ic htl ng e n di e n th n.For the record, or it does not record in the telephone directory or the directory inquiry service ofthe minimum personal data of a subscriber may not be asked for compensation.If the telephone directory or the directory inquiry service can be used for otherapplications don the search for personal data on bosis of the name and, where appropriateconse, the residence or the office of the subscriber, MOG , the telephone directory or thedirectory inquiry service only offer these applications if the subscriber concernedhas given his clear consent to this.Under permission of the purposes of this article verstaon free, specific and upinformation-based expression of will, with which the subscriber concerned or his legalRepresentative aanvoordt which personal data relating to him for thein the previous paragraph toepossing shall be processed.5 2. Each subscriber is entitled to the personal information on him relate in toosee in accordance with the conditions stipulated by or pursuant to the law of December 8 , 7992l-nlcr 0r-CIo00r,icsass-0ur,g-00es-01,-Er-fllEsilEffiJ
Page 17
Court of Appeal Brussels - 2020/AR/1160 - p. 16to protect von the personal privacy with respect von the processing vonpersonal data.In addition, each subscriber is entitled to receive free of charge, in accordance with the procedures and under theconditions determined by the King, nd advice from the Commission for the Protectionof the privacy and the lnstitute, the personally identifiable information on himrelate have to allow correct or to have it removed from the telephone directory ol , thete I eloo n i n I i chtí n g en d i e n st,It is undisputed that there is no Royal Decree .Proximus refers to slot also yet to Article 45.3 WEC as a relevant provisionthe present case:Excluding costs for the obonnees, keep the people which oan subscribers publictelephone services provide the data separately with regard to the subscribers whoasked not to be included ín a directory so that the subscribers thetelephone can receive without DDT their data therein mentioned stoon.fl. Discussion and assessments by the Marktenhofa. Admissibility of the appealThe admissibility of the appeal lodged by Proximus is not contested by theGBA. The appeal was filed in a timely manner and formally regular.b. 6round of the caseFIRSTË MEANS OF PROXIMUSPosition Proximus (strong summary)According to the WEC, subscribers must request themselves not to be included in atelephone directory or directory inquiry service and so in the absence of such a request,it is recorded, confirming that no question is of 'consent' within the meaning ofDirective 95146/ÊG but that there is an autonomous concept (the choice of the subscriber) .It also clearly follows from this that there can never be "consent" in the sense of theGDPR.Under Article 45.3 WEC is there no consent of the subscriber is required but is ita so-called 'opt-out' system where the subscriber must ask not to be recordedturn into.Position of the GBA is strongly summarized)l-ee. 0r-ti000r,trg?EA-001,h-E0ps-01,-Et-fllEi#IíffiJ
Page 18
Court of Appeal Brussels-2020/AR/|L60 * p. 17Members 2 t, em 4 of Article 133, S 1, WEC determine which personal data of asubscriber may be included in a telephone directory or a directory inquiry serviceand under what conditions. Proximus believes in incorrectly to subscribers do not have toconsent to the inclusion of their data in a telephone directory or adirectory inquiry service, as the word "consent" is not explicitly mentioned in Article133, S 1, paragraphs 2 to 4, WEC. However , those provisions can only be construed asa legal basis for the processing of the relevant personal data based is ona "consent" of the subscriber within the meaning of the GDPR. Would judge otherwiseindeed contradict :o the wording of Article L2.2 in conjunction with Article 2.f) of the ePrivacy Directive,o Article 8 of the Charter of the Fundamental Rights of the European Union (hereinafter:"EU Charter"),o the case law of the Court of Justice,o the guidelines of the Article 29 Working Party and of theEuropean Committee for data protection, ando the parliamentary preparation of the WEC.According to the GBA requiring article L2.2 of the e-Privacy Directive and article 133, S 1, WEC soa consent of the subscribers within the meaning of the GDPR so that providers ofdirectories and directory inquiry services should be allowed to share their personal dataprocessing and transmitting.Verdict Marktenhof7, Requirement of consentAVG has to target the fundamental rights and freedoms of naturalpersons, and in particular their right to protection of personal data, to protectand the free movement of personal data within the EU to ensure. To achieve this goalranges are in the AVG common rules on dataestablished order to ensure a consistent effective protection ofpersonal data across the Union and to prevent differences in the free movement ofpersonal data within the internal market. The rules should provide for abalance between the (potential) benefits of data processing and the (potential)cons.The e-Privacy Directive, the harmonization to aim of the legislation of the Member States whichnecessary to ensure an equal level of protection of fundamental rights and freedoms -in particular the right to privacy and confidentiality - at theprocessing of personal data in the electronic communications sector to ensureand to ensure the free movement of such data and of electroniccommunication equipment and services in the Community. With the e-Privacy Directive,has therefore endeavored to ensure respect for the provisions laid down in Articles 7 and 8 of the Charter Handto guarantee established rights . ln this regard, the e-Privacvrichtliin-on it is def-nor 0r,-00CI8r,isesê-E0r?-00pg-0r,-0I-i'llEH*IEffiJ
Page 19
Court of Appeal Brussels - 20201 AR/1160 - p. 18Regulations of the GDPR in connection with the processing of personal data in the sectorele, ktronische communication "soecificeren and to fill" (the Marktenhof underlines).In this case , there is an interaction or interaction between the GDPR and the e-mail.Privacy Directive because the disputed processing operations within the material scopeof both the GDPR and the e-Privacy Directive. Ratio temporis has been de since 25 May 2018AVG is the legal successor of Directive 95/46/EC.Article 95 and Recital 173 of the GDPR confirm the lex generalis-lex specialis relationshipbetween the AVG and the e-Privacy Directive, which in Article 95 states to the AVG naturalpersons or entities Horticultural aanvullende.Jgrplichtínsen oqleqt with regard toprocessing in connection with the provision of publicly available electroniccommunication services in public communication networks in the EU, to the extent that they areunder the ePrivacy Directive are subject to specific obligations with the sameobjective.Some provisions of the ePrivacy Directive "specify" the provisions of the GDPR withrelating to the processing of personal data in the electronic sectorcommunication. In accordance with the principle of lex specialis derogote legi generali,Special provisions have precedence over the general rules in the situations in which theyspecifically intended to regulate. ln situations where the e-Privacy Directive does not comply with the rules of the GDPR"specifies" (ie makes more specific) get the (specific) provisions of the e-Privacy Directive as "lex speciolis" takes precedence over the (more general) provisions of theGDPR.Since 25 May 2018, the term consent" in the e-Privacy Directive must be read gelezenas a reference to the definition of consent" in the GDPR (because the definition of"consent" from the e-Privacy Directive refers to Directive 95/46/EC, and in accordance with art. 94,paragraph 2 AVG should all references to Directive 95/46 / EC should be read as referencesto the GDPR).Proximus states that subscribers do not have to consent (in the sense of the ÁV6/ with the recordingof their data in a telephone directory or a directory inquiry service, now the word"consenti" is not explicitly mentioned in Article t2, paragraphs 1 and 2 of the ePrivacy Directive andAlso not in Article 133, 5 1, paragraphs 2 till 4 WEC which the GBA explicitly admits.Article I2.2 of the ePrivacy Directive and Article 133, 5 1, WEC require an expression of the will of thesubscribers that providers of telephone directories and directory inquiry services theirmay process personal data. Or which wishes by a choice of law is likeProximus for holding or an authorization within the meaning of the AVG as the GBA suggests, is atBased on the above texts themselves , however, not clear.Although the Court of Justice has in the Deutsche Telekom judgment (C-543/09 of 5 May2011) considered:"58. Immediately all should eraon to recall it from artikelT2, paragraph 7, von Directiveon privacy and electronic communications and from recital 38 in the preamble tol-elee 0r-r0u0r,qcsasa-0urê-00es-Er,-0r-illEPTEIffiJ
Page 20
Court of Appeal Brussels -2020/ARl7160* p. 19This directive follows dot subscribers before it in openbore directories areinformed of the purposes of these guides and of ollespecial applications, with nome on the basis von search functions which are includedin the electronic versions of the guides. This prior information provides the concernedsubscriber the opportunity to obtain a free, specific and information- based consentwithin the meaning of the ortikelen 2, sub h, and 7, sub a, of 95/46 directive to give the publicotievon him concerning personal data in public telephone directories."But also has the Court in that judgment, the special nature of thisMechanism recognized, and made it a goal-bound "consent" is to notattached is in certain pre-identified service provider:6L As the Advocate General observed in point 722 of her Opinion , it follows froma contextual and systematic interpretation of Article 72 of the Directive onprivacy and electronic communications that in artikelT2, paragraph 2, referredconsent relates to the purpose of the publication of the personal datain a public telephone directory, and not on the identity of a telephone directory provider Ínthe special.62First of all , it was not possible from Article 72(2) of the Directive on privacy andelectronic communications are inferred that the subscriber has a selectivedecision powers have in favor of certain providers of openboredirectory inquiry services and directories. It is the publication itself vonpersonal data in a telephone directory that has a special purpose , whichharm may prove to be for a subscriber. When the subscriber has consentedin the publication of its data in a telephone directory that has a special purposeis, will he , however, about the general interest not to have them to resistagainst the publication of the same data in another comparable telephone directory.63 In the second affirms paragraph 39 of the preamble to the Directive that the transmissionvdn personal von obonnees oan third parties permitted is when daaroan ,, thefor in word [is] connected dot the data not for other purposes [. ,,]are used other than that word for which they are collected".64 Thirdly , the Directive on privacy and electronic communications mentions acase where in renewed or specific consent von the obonnee can beto provide. Thus , in accordance with Article 72 ( 3) of that Directive , Member States mayrequire that the separate consent of the subscribers must also be obtainedfor point e purposes of a public directory than the search ofcontact details of a person on Bosis von his naem eh in appropriate, aminimum number of other identifiers. From recital 39 in the preamble to thatdirective follows that a new consent of the subscriber must be obtained"[if] the portion that collects the data of the subscriber or a third party to whom thedata has been forwarded, wish to use the data for another purpose ",Won a subscriber by the company that has him a phone numbergranted, at the height is brought von the fact to him onl-ponE 0r-Buu0r,rqge.sa-00r9-00es-0r,-0r-;ll65EtrTEffiJ
Page 21
Court of Appeal Brussels - 2020/ AR/7!60 - p. 20personal oan a third company such as Deutsche Telekom, canare passed on to be published in a public telephone directory , andthe subscriber to the publication von this data in a similar directory, in this casewhich von this company heefi agreed, need for the transmission of the sameinformation from another company that produces a printed or electronic publicdirectory aims to publish or make aims to provide dot these guides throughintelligence accessible , then also no new authorization von thesubscriber to be obtained if it is ensured that the data concernedwill not be used for any other purpose don dÍe word for they with a viewthe first publication thereof are verzomeld. The in ortikel12, paragraph 2, von Directiveregarding privacy and electronic communications, permission from ato duly informed obonnee for the publicotie von him onpersonal data in a openbore directory does indeed relate to the targetof this publication and therefore also includes any subsequent processing of this data bythird party companies which operate on the mdrkt for publicdirectory inquiry services and telefoongidseh on condition dot this processinghas the same purpose.66If a subscriber has given permission for the passing on of himconcerning personal data of a particular company with a view to theit published in a openbore telephone von this company, can ittransmitting the same data oen another company to a publicdirectory aims to publish without dot the subscriber doar a newconsent is given, moreover, no ofbreuk do the core von lawto the protection of personal data, as recognized in Article 8 of the Charter.67 On the second vrodg must be answered dot artikelT2 of the Directiveon privacy and electronic communications thus should be interpretedit not in the way a state aon national legislation which a company providing publicpublishes telephone directories, imposes an obligation to disclose personal data of subscribersvon other telephone service providers wdorover they have by to give to athird party company that publishes a printed or electronic public telephone directoryor causes dot these guides through its intelligence toegonkelijk withoutdoar for a new permission von the obonnees noodzokelijk is on for Answeredthe subscribers before the first of their inclusion von data in a publicdirectory on the have been informed of the purpose of this guide and the fact itThis information would be communicated oen a dnderetelephone service provider , and it is guaranteed to the data after theby giving them not will be used for purposes other than those point e woar forthey have been collected with a view to their first publication ,However, this "purpose-relatedness" of the "consent" is not expressly stated in art.L2, paragraph 2 e-Privacy Directive. According to the Court of Justice , this follows from a "contextual andsystemotic interpretation" of art. 12 e-Privacy Directive.Also in the subsequent judgments Planet 49 C-673/L7 of 1 October 2019 and Orange Romania C-6L / 19 November november 2020 , the Court is about not more pronounced.l-rlar ur,-0000r9ïsass-00e0-00ps-01-0r-lllEffiEffiJ
Page 22
Brussels Court of Appeal - 2020/ AR/L160 - p, 212. Withdrawal of consentIt is above inadequate disputed or disputable that no specific legislation has beenelaborated with regard to the withdrawal of that expression of will or 'consent' by a subscriber,neither in the e-Privacy Directive, nor in the WEC, nor in an implementing decree. Does this meanthen automatically that all provisions of the GDPR apply in full, also inthis particular context of telephone directories with the consequences as below furtherindicated ?3. CompetitionProximus states that if the GDPR conditions on consent apply, thereno new providers can enter the market in practice, while the ratio legisthe e-Privacy Directive precisely the liberalization of the market, and there was also claimedProximus an incompatibility has arisen between the GDPR and certain articles of the WEC.The GBA disputes this claim and argues that the application of the GDPR to the furthertransfer of data by providers of directories and directory inquiry servicesdoes not create a competitive disadvantage for other (including new) suppliers ofsimilar services, provided that they provide the necessary subscriber data, pursuant to the Articles45, 5 2, ên 46, S 2, WEC, directly from the telephone service providers, andthis without the re-authorization of the subscriber must be obtained. Theeffective competition on the market for telephone directories andtelephone inquiry services are therefore guaranteed according to the GBA .The Marktenhof notes on which the GBA is authorized to AVG to maintain and theBelgian Institute for Postal Services and Telecommunications (BIPT) as referred to in Article 13of the Law of 17 January 2003 with regard to the status of the regulator of theThe Belgian postal and telecommunications sector is in principle competent for the enforcement ofthe ePrivacy Directive and has not taken a recent position on the matter. The claim of theGBA that effective competition is guaranteed, lijkl primo focie not conclusiveproved to be.4. Wos the republishing an unlawful processing of personal data ?As already explained in the statement of facts, was the underlying database of Proximusa few days after the first adjustment of the 'paramete/about publication automaticallyoverwritten by the telephone service provider / operator of the complainant, namely Telenet.As a result of this transfer, the complainant 's personal data were -also automatically - published in the public telephone directories and information servicesthat Proximus offers. Proximus , in its third sub-appeal, argues that the republication ofthe personal data after the withdrawal of the consent by the complainant is not unlawfulused to be. Proximus will have thereby assumed that the information which thetelephone service provider/operator must always take precedence over its own subscribersl-pler 0I-0800r,1ïgegê-00ar,-00es-0r-0r-;-lL ffiJ
Page 23
Court of Appeal Brussels*2020/ARlt160 - p. 22on the information that providers of directories and directory inquiry services directlyreceived from those subscribers. Proximus believes this argument to be able to rely on Article133, 5 1, paragraph 3, WEC, that the responsibility to give consent to a subscriberquestions for the publication of his personal data to the operator .According to the GBA and since neither the WEC nor an implementing decree (nor in Article in12 of the e-Privacy Directive), a specific regulation has been elaborated on thatcorrections and deletions, such a request must be made in accordance with Article 16 GDPR (for (improvements) or Article 17 GDPR (for deletions) can be addressed to étLgyerwerkinesverantwoordeliike within the meaning of the AVG - and therefore also to any provider of atelephone directory or directory inquiry service.The Marktenhof wonders, however , now that it clearly appears from the text of the WEC that theoperator plays the main role in the relationship with the subscriber, not the provider of a telephonedirectory or directory inquiry service, or legally allowed for the provider to thepersonal data received from the operator over the personal data in its owndatabase to be trusted. A different view would possibly conflict are with the letterand the spirit of art. L2, paragraph 2 e-Privacy Directive and art. 133, $1, paragraph 2 to paragraph 4 WEC.5. If there is an obligation to pass on any request from a data subject to the source ofthe personal data or third parties including recipients ?Proximus argues in its fourth sub-ground that the controller under theAVG only the recipients of personal data in knowledge must draw from certainrequests of stakeholders, but not the person or organization which the data hasprovided.The GBA tries to find a legal basis for this in the general obligation in art, 24AVG to "appropriate technical and organizational measures in order to waor secure and tocan show that the processing is carried out in accordance with [the GDPR] ".According to the GBA , this amounts to a "one-stop shop" mechanism for the withdrawal of"permission":"Wonneer there several distinguished its controllers, which each of themprocessing perform the same permission as basis have a permissionthat the data subject has with one or more of those data controller(s)given is sufficient dot the person concerned for the withdrawal of that consentpointing to one of the controllers to processing on the basis of the von by thedata subject carries out given consent. In which sense, in Article 24 (in this case togetherconsidered with Article 6 and ortikel 7) AVG a principle of a single window to read,where the person concerned himself enkeltot one controller serves to establish "(para. 81 of the contested decision).Moreover, states the GBA explicitly to this , the result is that thecontroller to whom the subject is focused, "the necessary technical andorganizational moat takes control, in order to ensure dot the person himselfl-paer 0r,-0000J,ïqsesê-00ee-00es-0r-0r-i'llffi ErffiËJ
Page 24
Court of Appeal Brussels - 2020/ AR/1760 - p. 23does not have to address each individual controller " {para. 82 of thecontested decision).Specifically in the context of telephone directories, would such a statement mean that nomatters who a subscriber contacts - a provider or the operator; there isthe recipient of his application expects it transmits the information to all otherproviders and the relevant operator. In other words , according to thereasoning of the GBA also providers (for example a search engine such as Google)should inform.Due to the above-mentioned questions and reasons , the Marktenhof decides a number ofquestions to ask to the Court of Justice of the European Union in applyingArticle 267 Treaty on the Functioning of the European Union and as claimed bythe GBA in subordinate order.!."Should Article 72.2 of the e-Privocy Directive 2002/58/EC, read together with Article 2.f) ofthis Directive and with ortikel95 von the General Regulation Data, so beexplained that toeloat which a national supervisory authority a permission " vonthe subscriber in the sense of the General Data Protection Regulation required ifbasis for the publication of its personal data in public telephone directories andteleÍooninlichtingendiensten both which issued by the operator itself ols by thirdproviders, in the absence of national legislation to the contrary?";2."Should the right to erasure under Article 77 of the General RegulationData as to be interpreted in that it is on it resistance to anotionole supervisory outoriteit a request from a subscriber to from publicdirectories and - intelligence to be removed ols a request todata erasure within the meaning of Article 77 of the General Data Protection Regulationqualifies?";3. "Are Article 24 and Article 5.2 of the A eneral Regulation Data asexplains dot they preclude it a notionale supervisory authority fromaccountability enshrined therein distracting dot the verwerkingsverontwoordelijke theappropriate technical and organisotorische measures should be taken to thirdcontrollers, to know the telefoondienstdonbieder and point e providers vontelephone records and directory inquiry services that collect data from thesecontroller have onntongen, informing about the withdrawal of theconsent by the data subject in accordance with Article 6 in conjunction with Article T of the Regulation?";. "Must Article 77.2 von the General Regulation Data so beexplained that it precludes dot a national supervisory outoriteit ao provider of public directories and directory inquiry services requestedthe data von a person not longer open drill to moken, recommends to reasonablemoat arrange to take to search engines on the height to draw from dot request todata erasure?";l- eoe e 0r,-CIo00r,9isesa-00e3-00es-0r-0r-il|L EfficJ
Page 25
Brussels Court of Appeal - 2O2Ol AR/I1'6O - p, 24FOR THESE REASONSTHE COURTRight to contradiction ;Having regard to Article 24 of the Law of 15 June 1935 on the use of languages in court cases;Receives the appeal from Proximus,Before doing justice on the merits,Decision the following preliminary questions to propose to the Court:L."Should Article 72.2 of the e-Privocy Directive 2002/58/EC, read in conjunction with Article 2.f) of thisDirective and with Article 95 of the General Data Protection Regulation , as interpretedthat it allows a national supervisory authority to obtain a 'consent' from the subscriber in thesense of the General Data Protection Regulation required as a basis for the publication ofits personal data in public directories and directory inquiry services, both thoseissued by the operator itself as well as by third-party providers, in the absence of different nationallegislation in this matter? ";Z. "Should the right to erasure from ortikel 17 von the General RegulationData thus be interpreted to it precludes the nationalsupervisory authority a request from a subscriber to access public directories and -intelligence services to be deleted as a request for erasure within the meaning of Article 77of the General Data Protection Regulation qualifies?";3. "Are Article 24 and Article 5.2 of the General Regulation von Qegevensbescherming so beexplained dot they preclude the national supervisory outoriteit from the doarinveronkerde accountability ofleidt the controller the appropriate technicaland organisotorische measures should take to third controllers, to know thetelephone service provider and other providers of directories and directory inquiry servicesDetails of these have received verwerkingsverontwoordelijke, to inquire about thewithdrawal of consent by the data subject in accordance with Article 6 in conjunction with Article 7 von deregulation?";4."Should Article 77.2 of the General Data Protection Regulation be interpreted as meaning thatit precludes a national supervisory authority, a provider of openboredirectories and telefoonínlichtingendiensten which is called the data von a personl- ele e 0r-00o0r,qqsesa-00eq-00es-0r-0I-fllEI*EI#ffiJ
Page 26
Court of Appeal Brussels - 2020/ AR/1760 - p. 25openboar longer to make orders to reasonable moot arrange to take to search engines on theheight to ask dot request for erasure? ";Says that the registry is subject to the present judgment, in accordance with the Recommendations to the national courts,authorities about the pending making preliminary proceedings 2019 / C380 / 01 zaltoezenden tothe Registry of the Court of Justice, Rue du Fort Niedergruinewald, L-2925 Luxembourg - GreatDuchy of Luxembourg.Suspend the handling of the case and sends the case to the special role of the chamber inawaiting the answer to these preliminary questions.Retains the verdict on the charges forThis judgment was handed down by the Marktenhof - Chamber Nineteen A of the Court of Appeal inBrussels on February 24 , 2021 byM. BOSMANSAM WITTERO. DUGARDYNB. VANDERGUCHTCouncilor dd. chairmancouncilorDeputy Councilor Raadclerk
