Court of Appeal of Brussels - 2022/AR/953: Difference between revisions
No edit summary |
No edit summary |
||
| Line 76: | Line 76: | ||
}} | }} | ||
The Belgian Market Court annulled a decision of the Belgian DPA which | The Belgian Market Court annulled a decision of the Belgian DPA issued after an investigation which was opened on the basis of an administrative act that did not comply with the motivation requirements. | ||
== English Summary == | == English Summary == | ||
=== Facts === | === Facts === | ||
This ruling is the result by an appeal of Rossel & Cie, a large media company (controller), which was fined €50.000 by the Belgian DPA after an investigation | This ruling is the result by an appeal of Rossel & Cie, a large media company (controller), which was fined €50.000 by the Belgian DPA after an investigation on their cookies practices (see [https://www.gegevensbeschermingsautoriteit.be/publications/arrest-van-22-februari-2023-van-het-marktenhof-ar-953-beschikbaar-in-het-frans.pdf here] for the DPA decision and [[APD/GBA (Belgium) - 103/2021|here]] for the GDPRhub summary). | ||
The Belgian law empowers the board management of the DPA to issue a referral in order to open an ''ex officio'' investigation (Article 63(1) of the Law establishing the Belgian DPA). This referral needs to indicate that there are "''serious indications<nowiki>''</nowiki> of a practice that could give rise to an infringement of the fundamental principles of personal data protection''<nowiki>''</nowiki>. | |||
In this case, the referral | In this case, the board management issued a referral on 16 January 2019 without mentioning any reference to <nowiki>''serious indications''</nowiki> of potential infringements, or any evidence for that matter. The investigation was however considered open on that date. On 7 March 2019, an handwritten note was drawn up by the investigation service (so, not by the management board (!)) containing several reasons for starting the investigation, among others the high amount of visitors of the controller's websites. | ||
On 16 June 2022, the DPA issued decision 103/2022 | On 16 June 2022, the DPA issued decision 103/2022, fining the controller for several GDPR related violations. The controller appealed this decision at the Market Court in Brussels, stating that the DPA's board management referral did not indicate the reasons to investigate. Ir was thus irregular, and implied that the investigation service was irregularly seized. As a result, the DPA decision was also invalid. | ||
===Holding=== | ===Holding=== | ||
The court confirmed that the management board had issued the referral to investigate the controller on 16 January 2019. The referral constituted the only administrative act leading up to decision 103/2022. The internal note of the investigation service of 7 March 2019 could not be | The court confirmed that the management board had issued the referral to investigate the controller on 16 January 2019. The referral constituted the only administrative act leading up to decision 103/2022. The internal note of the investigation service of 7 March 2019 could not be considered as (a part of) the referral, and was therefore not an administrative act. | ||
The court | The court then assessed if <nowiki>''</nowiki>the referral<nowiki>''</nowiki> was compliant with the requirement of motivation of administrative acts. Specifically, this motivation requirement would obligate the DPA to properly explain the presence of <nowiki>''</nowiki>serious evidence<nowiki>''</nowiki>, pursuant to Article 63(1) LCA. The court concluded that the referral itself did in contain any specific arguments for the existence of <nowiki>''</nowiki>serious evidence<nowiki>''</nowiki>. Therefore, the DPA had failed to properly motivate its reasons for the referral. | ||
The court stated that this irregularity of the referral led to the irregularity of decision 103/2022. | The court stated that this irregularity of the referral led to the irregularity of decision 103/2022. It therefore annulled the DPA decision and ordered the DPA to pay the costs of the proceedings. | ||
==Comment == | ==Comment == | ||
The court highligted several paragraphs of decision 103/2022 in which the DPA incorrectly stated that the referral contained the reasons for starting the investigation. These were in particular paragraphs 63, 65, 69 and 71. | The court highligted several paragraphs of decision 103/2022 in which the DPA incorrectly stated that the referral contained the reasons for starting the investigation. These were in particular paragraphs 63, 65, 69 and 71. | ||
Revision as of 11:10, 29 March 2023
| Hof van Beroep - 2022/1527 | |
|---|---|
 | |
| Court: | Court of Appeal of Brussels (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 4(11) GDPR Article 6(1)(a) GDPR Article 7(1) GDPR Article 7(3) GDPR Article 12(1) GDPR Article 13 GDPR Article 14 GDPR Article 63(1) LCA |
| Decided: | 22.02.2023 |
| Published: | |
| Parties: | SA Rossel et Cie |
| National Case Number/Name: | 2022/1527 |
| European Case Law Identifier: | |
| Appeal from: | APD/GBA (Belgium) 103/2023 |
| Appeal to: | |
| Original Language(s): | French |
| Original Source: | GBA (in French) |
| Initial Contributor: | kv33 |
The Belgian Market Court annulled a decision of the Belgian DPA issued after an investigation which was opened on the basis of an administrative act that did not comply with the motivation requirements.
English Summary
Facts
This ruling is the result by an appeal of Rossel & Cie, a large media company (controller), which was fined €50.000 by the Belgian DPA after an investigation on their cookies practices (see here for the DPA decision and here for the GDPRhub summary).
The Belgian law empowers the board management of the DPA to issue a referral in order to open an ex officio investigation (Article 63(1) of the Law establishing the Belgian DPA). This referral needs to indicate that there are "serious indications'' of a practice that could give rise to an infringement of the fundamental principles of personal data protection''.
In this case, the board management issued a referral on 16 January 2019 without mentioning any reference to ''serious indications'' of potential infringements, or any evidence for that matter. The investigation was however considered open on that date. On 7 March 2019, an handwritten note was drawn up by the investigation service (so, not by the management board (!)) containing several reasons for starting the investigation, among others the high amount of visitors of the controller's websites.
On 16 June 2022, the DPA issued decision 103/2022, fining the controller for several GDPR related violations. The controller appealed this decision at the Market Court in Brussels, stating that the DPA's board management referral did not indicate the reasons to investigate. Ir was thus irregular, and implied that the investigation service was irregularly seized. As a result, the DPA decision was also invalid.
Holding
The court confirmed that the management board had issued the referral to investigate the controller on 16 January 2019. The referral constituted the only administrative act leading up to decision 103/2022. The internal note of the investigation service of 7 March 2019 could not be considered as (a part of) the referral, and was therefore not an administrative act.
The court then assessed if ''the referral'' was compliant with the requirement of motivation of administrative acts. Specifically, this motivation requirement would obligate the DPA to properly explain the presence of ''serious evidence'', pursuant to Article 63(1) LCA. The court concluded that the referral itself did in contain any specific arguments for the existence of ''serious evidence''. Therefore, the DPA had failed to properly motivate its reasons for the referral.
The court stated that this irregularity of the referral led to the irregularity of decision 103/2022. It therefore annulled the DPA decision and ordered the DPA to pay the costs of the proceedings.
Comment
The court highligted several paragraphs of decision 103/2022 in which the DPA incorrectly stated that the referral contained the reasons for starting the investigation. These were in particular paragraphs 63, 65, 69 and 71.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
Brussels Court of Appeal -2022/AR/953 -p. 2
IN QUESTION:
SA Rossel et Cie (hereafter “Rosse!”), BCE 0403.537.816, whose registered office is located at
1000 Brussels, rue Royale 100,
Requesting Party,
Having as counsel Me Etienne Wéry, lawyer, whose firm is established in [...].
AGAINST:
The Data Protection Authority (hereinafter the "DPA"), BCE0694.679.950, located at 1000
Brussels, rue de laPresse35,
Opposing party
With the advice of My Evrard de Lophem, Grégoire Ryelandt and Clara Delbruyère,
lawyers, whose practice is established [...].
Having regard to the procedural documents and in particular
the decision rendered by the Litigation Chamber of the Authority for the Protection of
Data, June 16, 2022 (decision number: 103/2022, file number:
DOS-2020-02998);
Rosse's request! filed on July 13, 2022;
-
The schedule recorded at the introductory hearing of July 27, 2022;
°
the conclusions n l of Rosse! filed November 30, 2022;
the summary conclusions of the APD submitted on January 16, 2023;
the records of exhibits filed by the parties;
Heard the advice of the parties Rossel and APD at the public hearing of January 25, 2023.
rPAGE 01-00003160840-0 □□2- □□42- □1- □1-�
..J
I
