DPA case 117/2022 – Order (Belgium, 2022)

The data subject was a former customer of the controller (which remained unknown). The data subject received direct marketing from the controller. The data subject objected to the further processing of its personal data while also requesting access to all personal data processed by the controller and the legal basis used to send the direct marketing. The controller responded within 30 days, confirming that the data subject would no longer receive direct marketing and provided all processed data, including the applicable legal bases. The data subject then submitted a complaint at the DPA stating that the controller cannot rely on legitimate interest for processing its email adress as the data subject was a former, not current customer. The DPA held that a controller is allowed to rely on legitimate interest to send direct marketing, including former customers under certain conditions, pursuant to Recital 47 GDPR and its Guidance 01/2020 on Direct Marketing (nr. 168). In its Guidance, it was stated that when there was no relationship between the controller and data subject, or when it goes back a long time, legitimate interest cannot be invoked, as direct marketing is not part of the data subject's reasonable expectations. The DPA followed that because the relationship between the controller and the data subject ended not that long ago (around two years prior), a contrario, the data subject could reasonably expect that his data would still be used for direct marketing. Hence the controller could use legitimate interest as a legal basis. In addition, the controller confirmed that the processing for direct marketing is only done up to two years after the cancellation of the service. The DPA therefore held that the controller did not breach the GDPR and dismissed the case.