Roularta Media Group N.V. – Dismissed (Belgium, 2024)

A data subject visited website flair.be, operated by Roularta Media Group N.V. The Google Analytics HTML code was embedded within the website. Because of that, the personal data concerning the data subject were processed, including its transfer to the USA. The data subject, represented by noyb under Article 80(1) GDPR, filed a complaint with the Belgian DPA (ADP/GBA). During the investigation, the DPA questioned the existence data subject’s interest to initiate the proceedings, in particular, due to the fact the data subject was an trainee at noyb by that time. The DPA rejected the complaint. The violation of the GDPR at hand was “artificial”. If it wasn’t for noyb’s project, the data subject wouldn’t found the website concern nor the alleged violation. There was not evidence that the data subject visited the website concerned regularly. For the DPA it meant the visit on the website was done only to allow the violations of the GDPR occur. The data subject didn’t determine the details necessary to bring a case before the DPA on their own as the details were “predetermined” by noyb. Hence, the data subject didn’t enjoy their own “litigation interest”. Moreover, according to the DPA the abuse of rights took place in the case at hand. The Belgian law didn’t implement Article 80(2) GDPR. Therefore, noyb tried to pursue their own interest, under the cover of the data subject one. Besides, the data subject didn’t act at their discretion, being a trainee interested in satisfying their employer (noyb). Since the data subject was instructed on the details of the case to lodge the complaint as a part of noyb project, not their own interest, the DPA found noyb abused the right to complaint under Article 80(1) GDPR. For the subject matter of the case, the DPA referred to the report prepared by its investigatory body. The DPA advised the website operator to implement appropriate technical and organisational measures.