Proximus N.V. – Court Ruling (Belgium, 2021)

In this case Proximus had failed to grant a woman's right of erasure of her personal data and had passed the data on to other telephone directories and directory enquiry services even after receiving several complaints and correspondence from the data subject. On request of the data subject, Proximus had changed the code linked to the data subject's data from 'visible' to 'confidential'. After adjusting the code regarding publication, Proximus received new contact details of the person concerned from her operator, as a result of which the data in the underlying database was automatically overwritten with the new data from the operator. The Belgian DPA imposed a fine of €20,000 on the defendant defendant for infringement of Articles 6, 7 and 12 of the GDPR. In the contested decision, the Belgian DPA found the infringement of Article 6, 7, 12, 13 and 24 GDPR sufficiently proven. In addition, the DPA ordered the defendant to cease any further disclosure of personal data of subscribers to third parties of telephone directory or inquiry services when Proximus acquired these data only as a provider of telephone directories and directory enquiry services, taking into account a transition period in order to give Proximus (and the telecommunications sector in a broader context) the opportunity to develop a new privacy compliant system. With regard to the question of whether consent is required to be included in telephone directories or not and what scope of this consent is, the Court of Appeal also considered that: 1° In situations where the e-Privacy Directive specifies the rules laid down in the GDPR, these specific provisions of the e-Privacy Directive as lex specialis prevail over the more general provisions of the GDPR. (principle of Lex specialis derogate legi generali) 2° Article 12(1) and recital 38 of the ePrivacy Directive refer to the requirement of informed consent within the meaning of Directive 95/46/EG of subscribers for being included in public directories. Following article 94 GDPR that states that all references to 95/46/EG should be considered as references to GDPR, the abovementioned articles thus refer to ‘consent’ in the light of GDPR and thus the condition for a valid consent (Article 7 GDPR) must be met. 3° This consent relates to the purpose of publication of the personal data in the directories, but not to the identity of the directory provider. Consequently, the court states that the consent given will also be valid for subsequent processing of the personal data by other directory providers, provided that this processing serves the same purpose Given the fact that this is a complex matter which raises some questions that are not yet tackled by the legislator, the Brussels Court of Appeal stayed the proceedings to request the Court of Justice for a preliminary ruling regarding following questions: 1° Should Article 72.2 of the e-Privacy Directive 2002/58/EC, read in conjunction with Article 2(f) of that directive and with Article 95 of the General Data Protection Regulation to be interpreted as allowing a national supervisory to be interpreted as permitting a national supervisory authority to require the 'consent' of a subscriber within the meaning of the General Data Protection Regulation as the basis for the publication of the subscriber's personal data in public directories and directory enquiry services, both those published by the operator itself and by thirdproviders, providers, in the absence of national legislation to the contrary? 2° Should the right of erasure contained in Article 17 of the General Data Protection Regulation be interpreted as precluding a national supervisory authority from considering a request by an individual for removalfrom public directories and directory enquiry services as a request for erasure within the meaning of Article 17 of the General Data Protection Regulation? 3° Must Article 24 and Article 5(2) of the General Data Protection Regulation be interpreted as precluding a national supervisory authority from concluding from the accountability obligation contained therein that the controller must take appropriate technical and organisational measures to inform third-party controllers, namely the telephone service provider and, inter alia, providers of telephone directories and directory enquiry services who have received data from that controller, of any withdrawal of consent by the data subject in accordance with Article 6 juncto Article 7 of the Regulation? 4° Must Article 17.2 of the General Data Protection Regulation be interpreted as precluding a national supervisory authority from ordering a provider of public directories and directory enquiry services who is requested to cease disclosing data relating to an individual to take reasonable steps to inform search engines of that request for deletion of data?