DPG Media – Order (Belgium, 2025)

On 19 July 2023, data subjects filed complaints again four Belgian news websites. The data subjects had visited the websites and, considering that the cookie banners were not GDPR compliant, filed these complaints, mandating noyb to represent them under article 80(1) GDPR. As these websites belong to the same group, the DPA decided to join the cases. The DPA made a settlement proposal to the controller which ended up being withdrawn after the controller expressed his disagreement with some sections. The controller eventually appealed the withdrawal decision to the Court of Appeal of Brussels (also referred to as Market Court). Upon that court's decision the DPA invited the parties to file submissions limited to the admissibility of the case. The controller mainly argued that the case was inadmissible because the data subjects were volunteers with noyb when they filed their complaints and that they did not sufficiently prove that their data was processed. It considered that the complaints were initiated by noyb, instrumentalising its volunteers in an attempt to abuse the right to file a complaint. The controller concluded that the data subjects had therefore not validly given a mandate to noyb under Article 80(1) GDPR. It added that these complaints also aimed at using the control-mechanism pursuant to Article 80(2) GDPR while this Article had not been implemented in Belgian law. The data subjects argued that they had standing to file complaints under Article 77 GDPR and that their professional situation was not a reason to restrain the application of Article 80(1) GDPR as it does not contain further conditions or formal requirements. The DPA held, that neither the fact that the data subjects visited the websites at issue from noyb's work computers nor that the data subjects were volunteers at noyb at the time or that noyb provided assistance for data subjects to file GDPR complaints shows an artificial creation of violations or an abuse of law. According to the DP