Freedelity – Violation Found (Belgium, 2024)

After a Belgian journal published an article on the data sharing from Freedelity to other brands, the Belgian DPA started an investigation. Freedelity, the controller, is a company offering technological means to simplify the shopping experience of consumers, by collecting and storing the personal data present in Belgian electronic ID cards. This allows to centralise the commercial information and offers from different brands to consumers, such as loyalty cards and background log information of previous purchases. The data processed is stored in a central filing system, accessible to other brands other than only the controller. Three main points were raised in the investigation. First, the collection of personal data, more specifically identification data and contact data. Second, the sharing of such personal data. Third, the transfer of personal data stored in the central filing system to third parties. The DPA started its decision by explaining which type of data processing happened. First, there was a collection of personal data, not only directly from the clients through the scanning of their electronic ID, but also by the controller, both through its application and website, including its cookies, and by subscriptions to the central filing system. Second, there has been sharing of personal data between the controller and other companies, where the controller shared and updated all personal data of customers subscribed to the controller´s service, in exchange for advertisement of the controller´s website. The court found that the data collection and sharing are two inextricably linked practices as the purpose of data collection from electronic IDs is to allow the constant growth of the central filing system. Therefore, the DPA considered it appropriate to examine whether or not the controller and the companies providing the other brands acted as joint controllers in the context of this decision. The DPA considered the determination of, first, the purposes of processing; and, second, of the means of processing. The purpose was found to be the data collection and processing, which is shared between the controller and the other brands. Similarly, the means are shared, with the controller collecting personal data from their website and app, and the other brands advertising this service. In light of this, the controller and the other brands were considered joint controllers as per Article 26 GDPR. Violation of Articles 5(2) and 7 GDPR With regards to the lawfulness of the legal basis, the DPA found that a violation of Article 5(2) and 7 GDPR existed as the consent collected by the joint controllers was not “collected for specified, explicit and legitimate purposes”. Violation of Articles 5(2), 7(3), 24 and 25 GDPR Additionally, the DPA considers that the joint controllers did not respect the documentation requirements and liability arising from Articles 24 and 5(2) GDPR in matter of withdrawal of consent, as current mechanisms do not allow for a withdrawal of consent that is both simple and direct as required by Article 7(3) GDPR, in accordance with the principle of data protection by design under Article 25 GDPR. Violation of Articles 5(1)(c) and 25(1) GDPR A violation of the principle of data minimization under Article 5(1)(c) GDPR and of data protection by default under Article 25(1) GDPR was found as data concerning the municipality of issue of the identity card, the date of validity of the identity card and the history of this data has been collected, even if the DPA finds that it has no relevance in the framework of the processing carried out by the joint controllers. Violation of Articles 5(1)(e), 5(2), 24 and 25(1) GDPR Finally, the DPA found that a violation of Article 5(1)(e) GDPR, namely the storage limitation principle, as it established a data storage period of 8 years, which is too long, and also does not have in place a good storage system to keep the data subject´s data safe from third party interventions. Reprimand In the case at hand, as per [https://etaamb.openjustice.be/fr/loi-du-03-decembre-2017_n2017031916.html Article 100 of the Belgian LCA], the DPA considered it sufficient to reprimand the controller, but also imposed a deadline of four months to correct these GDPR violations. After those 4 months, a €5,000 daily fine will be imposed. Among the available corrective measures, the DPA required Freedelity, (a) to put into place mechanisms so that the data collection is based on freely-given, specific, univocal consent, (b) implement simple, accessible and direct technical and organisational measures to permit data subjects to give their consent, (c) to properly document the data collection process and (d) to stop the collection and processing of personal data from electronic ID cards, except in the context of processing made with the objective of having access to a classic fidelity program.