DPA case 161/2022 – Order (Belgium, 2022)

The data subject received marketing e-mails twice from a controller in the United Stated (US). This controller had the goal of creating a platform for discussing the challenges and triumphs of Jewish Women by offering writing-workshops and selling a book, which was only available in English. The controller did not accept the Euro as currency for payments. The book could only be delivered to addresses in the US, Canada, and Israel. The data subject claimed it never had any contact with the controller. The controller also failed to respond to an erasure request from the data subject within one month. (Article 17 GDPR).   The Belgian DPA issued a technical dismissal because the DPA was not authorized to handle the case due to a lack of GDPR applicability. The DPA held that Article 3(1) GDPR was not applicable, because the controller was established in the US and had no establishment in the European Economic Area (EEA). The DPA also determined that Article 3(2) GDPR did not apply. First, the DPA noted that it was not clear from the complaint whether or not the data subject was located in the EEA when he received the e-mails. Second, the DPA determined that there was no ‘offering of goods and services’ specifically to data subjects in the EEA (Article 3(2)(a) GPDR). The DPA stated that this ‘offering of goods and services’ had to be understood as an offering specifically - and not "incidentally" ([https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en_1.pdf EDPB guidelines 03/2018]) - aimed at data subjects in the EEA. The DPA named several examples which could indicate such specific offering, such as using one of the languages used in the EEA or the possibility to pay in Euro for the products and services. However, in the present case, the only available language for the book and workshops was English, the book could only be delivered in the US, Canada and Israel and the fact that it was only