APD/GBA (Belgium) - 11/2022

Summary

The Belgian Data Protection Authority (APD/GBA) issued a reprimand to the owner of the website 'YourOnlineChoices' for violating GDPR articles 12 and 13. The DPA found that the website improperly handled cookie consent, specifically regarding interest-based advertising preferences, and required the owner to maintain a processing register. The decision also addressed the DPA's competence in cross-border data processing cases.

Full text

Help APD/GBA (Belgium) - 11/2022: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 14:54, 16 July 2026 view sourceBms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators228 editsTag: Visual edit← Older edit Latest revision as of 12:51, 29 July 2026 view source Sfl (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators522 editsm Line 36: Line 36: |GDPR_Article_Link_6=Article 13 GDPR|GDPR_Article_Link_6=Article 13 GDPR |EU_Law_Name_1=Article 5.3 ePrivacy Directive 2002/58/EC|EU_Law_Name_1=Article 5(3) ePrivacy Directive 2002/58/EC |EU_Law_Link_1=https://eur-lex.europa.eu/eli/dir/2002/58/oj|EU_Law_Link_1=https://eur-lex.europa.eu/eli/dir/2002/58/oj Latest revision as of 12:51, 29 July 2026 APD/GBA (Belgium) - 11/2022 Authority: APD/GBA (Belgium) Jurisdiction: Belgium Relevant Law: Article 4(1) GDPR Article 4(11) GDPR Article 5(1)(a) GDPR Article 7 GDPR Article 12 GDPR Article 13 GDPR Article 5(3) ePrivacy Directive 2002/58/EC Type: Complaint Outcome: Partly Upheld Started: Decided: 21.01.2022 Published: Fine: None Parties: n/a National Case Number/Name: 11/2022 European Case Law Identifier: n/a Appeal: Unknown Original Language(s): English Original Source: https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-11-2022.pdf (in EN) Initial Contributor: Matthias Smet The Belgian DPA issued a reprimand against a website owner for violating Article 12 and Article 13 GDPR and ordered them to comply with their processing register. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The respondent owns a website 'YourOnlineChoices', through which data subjects can control their ad experience online. When browsing the web and visiting different websites, they can control which non-essential (e.g. for advertising purposes) cookies they accept or refuse. If they choose to turn off interest-based advertising, they still see advertisements on the internet, but these are not adapted to their suspected interests or preferences. The Belgian DPA received a complaint via the Internal Market Information (IMI) system from the Berlin DPA regarding the illegitimate use of cookies on a website. More specifically, the complainant stated that (i) the tool for selecting advertising preferences did not work (cookie opt-out option for third parties does not work) and that consent was therefore not freely given; (ii) the website forced users to accept cookies in order to be able to select their advertising preferences. Holding On cross-border processing - competence of the Belgian DPA The DPA first had to determine whether it was competent. According to Article 56 GDPR "the supervisory authority of the main establishment[...] of the controller shall be competent to at as lead supervisory authority for cross-border processing[...]". The Belgian DPA was found to be competent because the defendant had its sole place of business in Belgium, although its activities were deemed to substantially affect or be likely to affect data subjects in several Member States, including Germany. Obligation to set cookies in order to select advertising preferences on the website & "Cookie wall" practice (violation of Article 7 GDPR) - Complaint not upheld Second, the DPA had to determine whether the operator of the website lawfully placed a cookie on the complainant's device. The complainant argued that their consent was not freely given because they could not have used the website without giving it. Indeed, in its recent guidelines, the EDPB condemned the practice of making the provision of a service or access to a website conditional on accepting the placement of non-necessary cookies on the user's device. However, in this case the cookie in question was strictly necessary for the functioning of the website. The respondent indeed showed that the fact that the cookie needed to be placed in order to use certain parts of the website (namely the homepage / terms and conditions / Protecting your privacy-page) and thus the legal basis in order to process this personal data and place this cookie was not consent, but legitimate interest of the data controller (Article 6(1)(f) GDPR) Use of cookies without prior information given to the user (violation of the transparency principle - Article 5 GDPR) - Complaint upheld Third, the DPA assessed whether it was lawful to place the aforementioned cookie without providing certain information about such processing. The DPA restated that the purpose of the transparency principle is that the data subject should be able to determine what the scope and consequences of the processing encompass before it occurs. Thus, controllers are required to at least provide information on (i) the duration of the operation of cookies and (ii) whether the cookie is a first or third party one. When viewing the website, the DPA's investigation showed that even before any information could be delivered to the user, a cookie was loaded in the browser because it was otherwise technically impossible to display the necessary information in the user's language. The DPA held that due to the absence of language selection by the user, it would have been appropriate to display the information regarding the use of cookies in English, a widespread language commonly used by other websites. Thus, the Belgian DPA issued a reprimand to the operator of 'YourOnlineChoices.com' for violating Article 12 GDPR and Article 13 GDPR and ordered them to comply with their processing register - specifically to mention the third party countries personal data was sent to. Additionally, the Belgian DPA also shares some interesting insights regarding the processing of cookies: definition of 'trackers'; different types of cookies; valid consent under GDPR and ePrivacy Directive - transparency obligations Comment This decision of the Belgian DPA differs from others because it provided a significant amount of background and additional information regarding 'best practices' when using cookies. Side note for discussion: The investigation service of the Belgian DPA stated about 'non-identifiable information to analyse site activity to improve navigation' that 'although this information is not identifiable, it is still considered personal data'. How does this reconcile with the definition of 'personal data' in Article 4(1) GDPR that clearly refers to 'identified or identifiable natural persons'? Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the French original. Please refer to the French original for more details. 1/32 Litigation Chamber Decision on the merits 11/2022 of 21 January 2022 File number: DOS-2018-05968 Subject: Cross-border cookie complaint The Litigation Chamber of the Data Protection Authority, made up of Mr. Hielke Hijmans, chairman, and Messrs. Yves Poullet and Christophe Boeraeve, members, resuming the affair in this composition; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC (general regulation on data protection), hereinafter GDPR; Having regard to the law of 3 December 2017 establishing the Data Protection Authority (hereinafter ACL); Having regard to the internal regulations as approved by the House of Representatives on 20 December 2018 and published in the Belgian Official Gazette on January 15, 2019; Considering the documents in the file; made the following decision regarding: the complainant: Mr. X the defendant: Y. represented by his counsel, Maître Rue, Chaussée de La Hulpe, 177/12, 1170 Brussels., Decision on the merits 11/2022 - 2/32

Entities