DPA case 39/2024 – Order (Belgium, 2024)

In 2007, the newspaper “La Dernière Heure Les Sports” (“controller”) published an article on their website on the managing director of a company ("data subject") following the death of one of his employees. This article reported that the data subject was found guilty of manslaughter as well as for contravention of legislation on the use of work equipment and on health and safety at work. Adjustments had been made since the accident, so the court decided to suspend the data subject’s criminal sentencing. He was however declared civilly liable and ordered to pay compensation to the parents of the deceased worker. In 2018 and 2019, the data subject requested the removal of the URL of the article 3 times, using the standard form made available online by the controller for the dereferencing of results. The second and third requests were made by a French e-reputation consultancy company on behalf of the data subject. An e-reputation consultancy company takes care of people's reputation online, in particular by asking the removal of URLs linked to them. The controller indicated that after considering the balance of interests and rights, they decided not to block the URL. On 18 June 2020, the e-reputation consultancy company lodged a complaint with the Belgian DPA (“APD”) on behalf of the data subject. The company also attached a mandate received from the data subject which says the following: “I, the undersigned X [read data subject] (...) declare and certify that company X1 [read e-consultancy company] (...) is authorised to represent me on an exclusive basis in relation to publishers and hosts of Internet sites, in order to carry out the assignment entrusted to it”. The controller asked that the APD consider the complaint inadmissible as it was brought by a company incorporated by French law, thus breaching Article 80(1) GDPR. Article 80(1) GDPR states that the data subject has the right to mandate (i) a non-for-profit body, organization or association (ii) which