Court of Appeal of Brussels - 2021/AR/320

From GDPRhub
Court of Appeal of Brussels - 2021/AR/320
Courts logo1.png
Court: Court of Appeal of Brussels (Belgium)
Jurisdiction: Belgium
Relevant Law: Article 5(1)(a) GDPR
Article 6 GDPR
Article 12 GDPR
Article 13 GDPR
Article 14 GDPR
Article 31 GDPR
Decided: 07.07.2021
Published: 07.07.2021
Parties: Family service
ADP/GBA
National Case Number/Name: 2021/AR/320
European Case Law Identifier:
Appeal from: ADP/GBA
04/2021
Appeal to:
Original Language(s): Dutch
Original Source: Hof van Beroep Brussel 07082021 (in Dutch)
Initial Contributor: Matthias Smet

The appeal against a decision of the litigation chamber is not a second chance to the party against whom the complaint is directed. The Court should not interfere with the assessment of the administration. That would violate the separation of powers between the administration and the courts.

It is not for the Court of Appeal to repeat the fact-finding process in order to substitute itself for the national DPA.

The Court, adjudicating with full jurisdiction, conducts a legality and proportionality review of the administrative fine and will reduce or cancel the fine only in case of serious and proven circumstances which have not or not sufficiently been taken into account by the litigation chamber.

English Summary

Facts

On 27 January 2021 the Belgian DPA imposed an administrative fine of 50.000 EUR on defendant (a company that offers gift boxes to (expectant) mothers) for not complying with the core data protection principle of processing personal data in a fair, lawful and transaparent manner.

The defendant appealed the decision and claimed that several procedural principles have been violated in the decision of the Belgian DPA.

Both parties, but especially defendant make comparisons in their summary conclusion with other decisions of the litigation chamber or the Court of Appeal, from which they can derive support for their positions in this case by assigning a binding precedent value to previous decisions. However, unlike the Anglo-saxon system, the Belgian legal system does not assign any binding precedent value to decisions.

The most important aspects are shortly described hereafter:

  • Violation of rights of defence: The defendant claimed they did not have the opportunity of becoming acquainted with the complete file of the case of the Belgian DPA and however the Belgian DPA admits that the file was not fully complete when it was initiated, the court stated that defendantdid not report during the proceedings that documents were still missing afterwards, and therefore that defendant did not sufficiently demonstrate that its rights on this point were violated.
  • Violation of duty to state reasons (invoked facts/violations): Defendant argues that the Belgian DPA can only base its decision on reasons whose factual existence has been duly proven. The court reminds the parties that it is not up to the court to re-examine the facts and to take the place of the Belgian DPA. It can only verify whether the invoked facts actually exist.
  • Violation of duty to state reasons (legal basis): Defendant complained about the content and motivation of the contested decision with regard to 'consent' or 'legitmate interest' as a legal basis, but the court clearly states that the defendant could not sufficiently demonstrate that the consent met all the requirements (free, specific, unambiguous, informed). It also points to the absence of a 'balancing test' in which defendant had objectively considered beforehand whether the interests of the defendant outweigh the reasonable expectations, interests and rights of those involved.
  • Art. 13 & 14 GDPR vs. confidentiality/trade secret Defendant did not mention the third parties to whom personal data was disclosed on its website and justified the absence of this info by the rules of trade secret and confidentiality. however, it has been conclusively proven in the contested decision that the defendant's core activities consist of disclosing personal data of its 'customers' to third parties and thus touch the core of GDPR. The court confirms that the contested decision is sufficiently reasoned (both factual and legal reasons)

Dispute

Holding

The Brussels Court of Appeal declares the appeal admissible but unfounded.

The key take-aways of the decision of the Brussels Court of Appeal are:

  • The appeal against a decision of the litigation chamber is not a second chance to the party against whom the complaint is directed. The Court should not interfere with the assessment of the administration. That would violate the separation of powers between the administration and the courts.
  • The Belgian legal system does not assign any binding precedent value, either to administrative or judicial decisions. Any decision of an administration is specific and does not extend to a case other than the one under consideration. The court always relies on concrete facts of the submitted case.
  • The Court of Appeal will only It is not for the Court of Appeal to repeat the fact-finding process in order to substitute itself for the national DPA.
  • The Court, adjudicating with full jurisdiction, conducts a legality and proportionality review of the administrative fine and will reduce or cancel the fine only in case of serious and proven circumstances which have not or not sufficiently been taken into account by the litigation chamber.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

Court of Appeal Brussels -2021/AR/320- p. 4






      In this context, various companies that offer products and services are
      (future) mothers turn to NDPK so that there is an advertisement, a sample or promotion

      will be included in the magazine, guide or Pink Box that is offered.



      NDPK states that it only transfers the email addresses of (expectant) mothers to
      its long-term partners, namely [...], [...] and [...].



      In addition to these three partnerships, NDPK offers other companies that offer products and
      offer services to (expectant) mothers, the data (after permission) for the

      decision, on a temporary basis and for one-time use. NDPK states

      that it is not possible to name all potential partners
      when she asks the permission of (future) mothers. Only the activities

      can be indicated.



      On September 19, 2019, the Data Protection Authority received a complaint from a
      courage there who had registered by filling in a reply card for the receipt

      of the Pink Boxes.


      The complaint followed a call the complainant received on her mobile number, in which a
     Dutch company called "Kinderfeest" offered her a package of children's books. It

     Dutch company knew her name, her date of birth, the name and date of birth of

     her son, her e-mail address and her mobile number. Kinderfun informed the complainant that
     her details were communicated to Kinderfun by NDPK. The complainant argues that the

     transfer of its data was done in a non-transparent manner, in particular to companies

     which she could not find anywhere in NDPK's privacy policy, and that she did not
     was aware that NDPK sold its data to commercial partners who

     could contact by telephone after submitting its details to NDPK.



      The complainant has requested NDPK to remove her data from its files and to

     to stop the transmission of its data. However, the complainant notes that even after the

     submitting an objection to NDPK still commercial offers from third partners

     from NDPK.


      On September 30, 2019, the First-line Service of the GBA declares the complaint admissible on

     pursuant to Articles 58 and 60 of the Law of 3 December 2017 'establishing the
     Data Protection Authority' (hereinafter: "WOG"). She will forward the complaint to the

     Disputes Chamber, in accordance with Article 62, § 1, WOG. The complainant will be informed of this at 30

     September 2019 pursuant to Article 61 WOG.