Court of Appeal of Brussels - 2022/AR/953
| Hof van Beroep - 2022/1527 | |
|---|---|
 | |
| Court: | Court of Appeal of Brussels (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 4(11) GDPR Article 6(1)(a) GDPR Article 7(1) GDPR Article 7(3) GDPR Article 12(1) GDPR Article 13 GDPR Article 14 GDPR Article 63(1) LCA |
| Decided: | 22.02.2023 |
| Published: | |
| Parties: | SA Rossel et Cie |
| National Case Number/Name: | 2022/1527 |
| European Case Law Identifier: | |
| Appeal from: | APD/GBA (Belgium) 103/2023 |
| Appeal to: | |
| Original Language(s): | French |
| Original Source: | GBA (in French) |
| Initial Contributor: | kv33 |
The Belgian Market Court annulled a previous decision of the Belgian DPA, which had fined a large media company €50,000 for multiple GDPR violations regarding cookies. This DPA decision was annulled by the court because the DPA's managment comittee had provided sufficient evidence in the referral to the DPA's investiagtion service.
English Summary
Facts
This ruling is the result by an appeal of a large media company (controller), which was fined €50.000 by the Belgian DPA. (3) For the detailed summary of the facts of this DPA decision, see this link to the full decision (in French) and the link to a detailed summary on GDPRHub (103/2022 - 16 June 2022).
This decision of the Belgian DPA was the result of a larger investigation regarding the placement of cookies on Belgian media websites. (4) On 16 January (JUNE) 2019, the DPA’s management board took the decision (from here: "The refferal") to instruct the DPA’s investigation service to launch a sector enquiry into cookies on news websites (4), pursuant to the procedure described in Article 63(1) LCA (Law establishing the Belgian DPA). Article 63(1) LCA allowed the management board to enquire the investigation service to start an investigation when there were "serious indications" of a practice that may give rise to an infringement of the fundamental principles of personal data protection. However, the refferal itself did not contain any refference to "serious indications" of potential infringements.
On 7 March 2019, an internal note was drawn up by the investiagtion service (so not by the managment board) (40) This note contained several reasons for starting the investigation. One of these reasons was the high amount of visitors of the controller's websites.
After the investigation was concluded, the DPA issued decision 103/2022 in which it determined the following violations:
First, the controller violated Article 6(1)(a) GDPR and Article 129 ECL by placing unnecessary cookies on its website without asking for consent first. These were in particular cookies placed by third party domains which were not proven to be strictly necessary.
Second, the controller violated Articles 4(11), 6(1)(a) and 7(1) GDPR for the collection of consent using the so called "further browsing" technique. This means that data subjects would consent to receive cookies if they chose to further browse the controller’s website.
Third, the controller violated article 6(1)(a) GDPR again because of the deposit of unnecessary cookies, in this case, social networking and audience measurement cookies, before consent was obtained from data subjects;
Fourth, the controller violated articles 4(11), 6(1)(a) and 7(1) GDPR because of the way the controller allowed data subjects to select third party “partners” to whom personal data was sent. The controller had set a selection screen to allow sharing with these partners by default.
Fifth, the controller violated articles 4(11), 12(1), 13 and 14 GDPR because the controller only mentioned 13 partners in the cookie policy with whom it would sent personal data , whereas the partner selection screen accessible on the cookie banner only referred to some 500 such partners.
Sixth, the controller violated articles 12(1), 13 and 14 GDPR, because the controller failed to prove that the mandatory information was provided in a sufficiently accessible manner and/or in the language of the data subjects at the time of the DPA’s inspection.
Lastly, the controller violated Article 7(3) GDPR because the controller added new cookies on its website after data subjects had withdrawn their consent consent without a relevant justification. (8)
In the decision, the DPA explicitly stated that the refferal contained several elements which justified the existence of serious evidence "within the meaning of Article 63(1) of the LCA, while this was not the case. These elements were not described in the referral, but in the internal note of the inspection service of 7 March 2019.
The controller appealed this decision at the Market Court in Brussels. According to the controller, the DPA did not present serious evidence in order to justify the violations and also stated that the initial referral of the DPA’s management committee to its inspection service was irregular. The controller stated that the subsequent procedure was therefore also invalid.
Holding
JURISDICTION
The court determined that it had full jurisdiction to annul and potentially adjust the annulled decision. (36) The court also determined that the subject matter of the appeal was the reversal of the entire DPA decision 103/2022, and not the annulment of any procedural act by either the management committee or the inspection service leading up to the decision. (36 - 37)
WHAT COUNTS AS THE OFFICIAL REFERRAL TO THE INVESTIAGTION SERVICE, PURSUANT TO ARTICLE 63(1) LCA?
The court investigated the documents in the administrative file of decision 103/2022 and confirmed that the managment board had taken the decision to investigate the controller on 16 January 2019. This decision was the only refference to the investigation service which could fall under Article 63(1) LCA. This decision was the only document that could be seen as the official refferall from the managment board to the investiagtion service pursuant to Article 63(1) LCA. This referral was therefore the only administrative act that was assessed by the Market Court. (39)
The court excluded the internal note of the investigation service of 7 March 2019, since this could not be seen as (a part of) the referral. It was both drawn up by the investiagtion service itself (and not by the managment board). Also, itwas drawn up after the offical referral had already been sent on 16 January 2019. Therefore, this internal note could not fall under Article 61(3) LCA. (40)
SUFFICIENTLY MOTIVATED?
The court continued by citing Belgian Law (Article 3 of the law of 29 July 1991 for the motivation of adminstrative acts), stating that the motivation for administrative acts has to disclose the factual and legal considerations on which the decision to take the adminstrative act is based. (41) The motivation has to be 'sufficient' and 'satisfactory'. (41) 'Satisfactory' in this sense means that the decision must be supported by facts and reasoning. There also has to be a reasonable relationship between the decision and its intended goal. This obligation to motivate an adminstrative act is meant to allow the party against which the decision is taken to defend itself/himself/herself. (41) The court went on to assess if the referral was compliant with this motivation requirement. This motivation requirement would require the DPA to properly explain that there was 'serious evidence', pursuant to Article 63(1) LCA.
The court also clarified that it was normally not within its power to assess the precence of "evidence" of a potential infringement under Article 63(1) LCA, except in the case of a blatant disregard for the principles of good administration in this area, or a manifest error of assessment. The court was only allowed to a control of 'regularity and legallity'. This included a review to assess compliance with the requirement to motivate an administrative act. (43)
The court concluded that the refferal itself did in contain any specific arguments for the existence of "serious evidence", which is a necessary factor in Article 63(1) LCA. The term "serious evidence" did not even appear in the decision. The Court stated that any other documentation in the administrative file could not mitigate this fact since it was not part of the referral. This resulted in a failure to state reasons for the decision to start an investigation.
The court stated that this failure to motivate the administrative act, in this case the referral, had consequences for the decision 103/2022. This decision incorrectly stated that the refferal contain several elements which justified the existence of serious evidence "within the meaning of Article 63(1) of the LCA, while this was not the case. Therefore, the contested decision was factually incorrect and had to be annuled. The DPA was also orderded to pay the costs of the proceedings (€1800) and a registration fee (€400).
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
Brussels Court of Appeal -2022/AR/953 -p. 2
IN QUESTION:
SA Rossel et Cie (hereafter “Rosse!”), BCE 0403.537.816, whose registered office is located at
1000 Brussels, rue Royale 100,
Requesting Party,
Having as counsel Me Etienne Wéry, lawyer, whose firm is established in [...].
AGAINST:
The Data Protection Authority (hereinafter the "DPA"), BCE0694.679.950, located at 1000
Brussels, rue de laPresse35,
Opposing party
With the advice of My Evrard de Lophem, Grégoire Ryelandt and Clara Delbruyère,
lawyers, whose practice is established [...].
Having regard to the procedural documents and in particular
the decision rendered by the Litigation Chamber of the Authority for the Protection of
Data, June 16, 2022 (decision number: 103/2022, file number:
DOS-2020-02998);
Rosse's request! filed on July 13, 2022;
-
The schedule recorded at the introductory hearing of July 27, 2022;
°
the conclusions n l of Rosse! filed November 30, 2022;
the summary conclusions of the APD submitted on January 16, 2023;
the records of exhibits filed by the parties;
Heard the advice of the parties Rossel and APD at the public hearing of January 25, 2023.
rPAGE 01-00003160840-0 □□2- □□42- □1- □1-�
..J
I
