Telenet – Complaint Upheld (Belgium, 2021)

The complainant states that finding how to exercise their right to opt-out of receiving direct marketing on the website of the telecom provider (Telenet) is very difficult. Sending a request for further information also led to no solution. The DPA's inspection states the following: 1. The use of a large number of documents, which makes the provision of information complex, unclear and difficult to understand; 2. The presence of erroneous information; 3. The use of techniques that may have an impact on the choices of the data subject including the granting of free consent and whether or not to become acquainted with the information or the exercise of rights; 4. The construction of the information in the form of a maze in which the data subject cannot easily access the information; 5. The default choices set by Telenet that are not the most privacy friendly and always allow profiling; 6. The mandatory quasi-automatic acceptance of communication of data via cookies; 7. Combined with the lack of possibility to easily way to exercise the right to object. How clear and transparent must a privacy policy be in order to satisfy the requirements of Article 13 GDPR and Article 13 GDPR? Does continuing to use a website constitutes consent to cookies? = The DPA states that the right to opt-out of direct marketing is absolute. To opt-out for Telenet's services, the opt-out must be sent through every channel of direct marketing communication or, to disable all at once, contact Telenet or go to a physical shop. The DPA finds that the medium of communication made available for exercising the right to object must be proportionate to the means by which the controller communicates with the data subject: if the controller communicates the mandatory information under Article 13 GDPR and Article 14 GDPR via its website and/or if the data subject receives digital marketing messages from the controller, then the right to object must also be capable of being expressed online. The DPA states that this does not facilitate the opt-out in a sufficient manner for the data subject. "A single click should suffice". The DPA links this with Article 7(3) GDPR, opting-in should be as easy as opting-out. = The DPA states that the information structure is hard to navigate because of the overflow of information and repetitiveness. The complainant had to click 14 times to reach the full Privacy Policy. The information in this Policy however, was not sufficiently clear to allow the complainant to exercise its right to be object to direct marketing. Judging the transparency of the website, the DPA states that it is insufficient and that Telenet should facilitate a more clear information structure. The right to object should be easily accessible according to Article 21(2) GDPR. This information should be clear and not mixed with other information. In casu, the information should be accessible through the public part of the website and not just on the user page. Judging the 'layered' information, the DPA states that the first layer may be used to fulfill the information obligation of Article 13 GDPR and Article 14 GDPR if this information is sufficiently clear but not too detailed for the average internet user. The same applies for 'fold-out' layers, they must be clear and accessible. Telenet's privacy policy, however, was found to be insufficiently clear. The first layer was too detailed and an overload of cross-references were present. Instead of providing a direct link to the operational page where the right to object can be exercised, the reader is provided with a descriptive explanation of how to exercise the right to object. This description is not sufficient to facilitate the individual to concretely exercise their right to object. Another example would be capital 8 referring to capital 7 and vice versa (without hyperlinks). This reduces readability and is hardly compatible with Article 12(1) GDPR, Article 12(2) GDPR, Article 13 GDPR and Article 14 GDPR. The DPA recommends to place a link on the public page to exercise the right to object which refers to the user page "Mijn Telent" in which the customer is able to exercise this right, after logging in. = Telenet uses 4 privacy levels, of which "Algemeen" (General) is the first level. Customers might think that this level is the most privacy friendly as this is how it is described on the website and in the privacy-settings. However, the right to object to direct marketing is still possible and because the privacy policy is not sufficiently clear, data subjects can be confused to what the most privacy friendly settings are. The first level "Algemeen" is as such not the most privacy friendly setting. This creates a risk for confusion. Telenet states that the privacy levels do not try to replace the right to object. This reasoning is problematic according to the DPA as the way the information is structured can make it seem like these are the only options (the four levels). The privacy settings are thus a way to activate direct marketing, but not a way to deactivate it and this is not compliant as described earlier (opting-out should be as easy to opt-in). The DPA finds that Telenet's choice to separate the right to object from the privacy settings may lead to confusion among data subjects to the extent that the former (level "Algemeen" General) is described as the "most protective" privacy level. In doing so, the Respondent lacks transparency regarding the existence and exercise of the right to object under Article 21(2) GDPR in conjunction with Article 12(1) GDPR, Article 12(2) GDPR, Article 13 GDPR and Article 14 GDPR. = Telenet asked for permission for cookies by stating that continuing to use the website equals consent for cookies. As explained by the EDPB, the requirement of unambiguous and specific consent means that neither silence nor lack of action/action on the part of the data subject nor the mere use of a service can be considered valid consent. The DPA also points to recital 32 of the AVG, according to which implied consent is out of the question. This is a breach of Article 7 GDPR in conjunction with Article 4(11) GDPR. However, no fine will be given as Telenet has changed its practices after and in line with the Planet49 case of the CJEU.