On 19 July 2021 the Litigation Chamber of the Belgian Data Protection Authority (DPA) issued a decision on the merits following the defendant's failure to execute a light decision based on article 95(1)(5) of the Law of 3 December 2017 on the creation of the DPA (the LCA). By this decision on the merits, the DPA reprimanded the defendant and gave an order to follow up the requests for the exercise of the plaintiff's rights in accordance with its first light decision.
On 14 April 2020 the DPA – applying article 58(2)(c) of the EU General Data Protection Regulation (GDPR) and 95(1)(5) of the LCA – adopted Decision 12/2020 against the defendant and ordered it, before any decision on the merits, to do the following within one month:
- comply with the plaintiff's request to exercise its rights of opposition and erasure (articles 21(2) and 17(1)(c) of the GDPR) and therefore to cease any processing of the plaintiff's personal data for prospecting purposes (article 21(3) of the GDPR); and
- erase the personal data concerning the plaintiff (article 17(1)(c) of the GDPR).
By the same decision, a compliance order was also sent to the defendant, pursuant to article 19 of the GDPR.
The defendant failed to comply with the requirements of Decision 12/2020 within one month. Therefore, the DPA, as announced in the decision, decided to deal with the case on the merits based on article 98 of the LCA.
In the decision, the DPA noted that the defendant had sent promotional emails to the plaintiff's email address and that the processing of this email address had continued for the same prospecting purposes despite the plaintiff's opposition. The plaintiff had exercised his right of opposition on several occasions yet continued to receive emails of the same type.
Accordingly, the DPA concluded that the defendant had breached:
- article 21(2) of the GDPR;
- article 17(1)(c) of the GDPR– since the plaintiff had not asserted any other basis of lawfulness to the support of which the processing of the plaintiff's data could have continued for a purpose distinct from that of direct marketing; and
- article 12(3) of the GDPR.
Based on these breaches, the DPA issued the defendant a reprimand accompanied by a compliance order.
In cases where a complaint does not relate to a high societal or personal risk, but the grounds invoked therein indicate a sufficiently high personal risk, the DPA may consider applying the light procedure provided for in article 95 of the LCA.
If the facts illustrated in the complaint are sufficiently clear to establish a breach of the GDPR, the DPA may make a decision without seeking the arguments of the defendant against which the complaint is lodged, within the framework of a light decision as provided for in article 95 of the LCA. In such cases, the LCA provides no obligation to seek the data controller's point of view – this enables the DPA to offer a faster response to the needs of the citizen within the framework of a simplified procedure.
The DPA will therefore take a light decision (eg, a warning or order to respond to the complainant's request to exercise their rights) based on the facts as reported to it, without first collecting the opposing party's point of view. For example, in the context of the light procedure, if a data controller has not responded to a data subject's request for rectification of their data within the legal deadline and the complaint contains all of the necessary evidence, the DPA may order the data controller to act on the complainant's request.
However, rendering a decision without having heard the defendant's arguments runs the risk of important factual or legal circumstances (eg, force majeure or technical reality) not being considered. Such circumstances could lead the DPA to qualify its decision. In accordance with the principle of good administration, before rendering a decision, it is important to hear the arguments of all parties that may be affected thereby. DPA decisions must be well founded both in law and in fact, as well as impartial (ie, without prejudging or favouring one party because the other has not been heard).
Therefore, the DPA renders its light decisions "prima facie" (ie, based on an appearance of right) and gives the defendant the possibility to file an internal appeal to contest the decision if it wishes.
If the defendant decides to comply with the decision, the dispute is closed and a solution acceptable to both parties is obtained in a simple and quicker manner based on the procedure provided for in article 95 of the LCA. If, however, the defendant contests the decision, the DPA will start a procedure on the merits based on article 98 of the LCA, which implies that all of the parties will be invited to exchange their arguments and evidence.
Therefore, to manage the number of cases where these decisions turn into procedures on the merits (ie, procedures that involve exchanges of arguments between parties) based on article 98 of the LCA, the DPA must be careful to limit the light decisions it makes based on an appearance of law. Therefore, the DPA will deal with complaints in this way only in well-defined cases, such as:
- where a complaint does not represent a high societal or personal impact but nevertheless implies, in the DPA's judgment, a sufficiently significant effect on the rights and freedoms of the data subject. Such a complaint can be dealt with by a decision other than a classification without further action if the evidence provided by the plaintiff enables efficient processing with regard to the means to be implemented to investigate the complaint via the light procedure and given the volume of complaints received. If the DPA receives so many such complaints that it cannot manage within a reasonable period given its means, the DPA will close the complaint without further action and refer the plaintiff to the mechanism provided for by the Federal Public Service Economy; and
- where the complaint falls within the cases specifically referred to in the classification policy without further action. For example, the policy provides that such light decisions may be taken under certain conditions in matters of unsolicited direct marketing, if the processing by the DPA can be efficient, particularly in view of the volume of complaints received.
For further information on this topic please contact Andrine Like or Paul Van den Bulck at AKD by telephone (+32 2 629 42 39) or email ([email protected] or [email protected]). The AKD website can be accessed at www.akd.eu.