DPG Media – Order (Belgium, 2025)

On 19 July 2023, data subjects filed complaints again four Belgian news websites. The data subjects had visited the websites and, considering that the cookie banners were not GDPR compliant, filed these complaints, mandating noyb to represent them under article 80(1) GDPR. As these websites belong to the same group, the DPA decided to join the cases. The DPA made a settlement proposal to the controller which ended up being withdrawn after the controller expressed his disagreement with some sections. The controller eventually appealed the withdrawal decision to the Court of Appeal of Brussels (also referred to as Market Court). Upon that court's decision the DPA invited the parties to file submissions limited to the admissibility of the case. The controller mainly argued that the case was inadmissible because the data subjects were volunteers with noyb when they filed their complaints and that they did not sufficiently prove that their data was processed. It considered that the complaints were initiated by noyb, instrumentalising its volunteers in an attempt to abuse the right to file a complaint. The controller concluded that the data subjects had therefore not validly given a mandate to noyb under Article 80(1) GDPR. It added that these complaints also aimed at using the control-mechanism pursuant to Article 80(2) GDPR while this Article had not been implemented in Belgian law. The data subjects argued that they had standing to file complaints under Article 77 GDPR and that their professional situation was not a reason to restrain the application of Article 80(1) GDPR as it does not contain further conditions or formal requirements. The DPA held, that neither the fact that the data subjects visited the websites at issue from noyb's work computers nor that the data subjects were volunteers at noyb at the time or that noyb provided assistance for data subjects to file GDPR complaints shows an artificial creation of violations or an abuse of law. According to the DPA this follows from Article 77 GDPR which allows data subjects to file complaints if they consider that their rights have been violated. Considering that the data subjects present themselves as interested parties who initiated the complaints themselves and the lack of provisions prohibiting employees or trainees to be represented by their respective organisation within the meaning of Article 80(1) GDPR, the DPA declared the complaint admissible. The DPA also stated that it is not even required in all circumstances that the data subject's personal data was processed in order to file a complaint, because under Article 77 GDPR, the fact that the data subjects believe that the processing of the websites at issue infringe on their GDPR rights is sufficient to file a complaint. Therefore the DPA found the data subject's actions admissible opening the procedure to discussing the complaints' merits, meaning the existence of cookie violations on the controller's websites.