Consumentenbond – Court Ruling (Netherlands, 2021)

On 26 November 2018, the Consumentenbond (a Dutch non-profit organisation which promotes consumer protection), on behalf of consumer [A], filed [https://www.consumentenbond.nl/nieuws/2018/gezamenlijke-actie-europese-consumentenorganisaties-tegen-google a complaint with the Dutch DPA], the Autoriteit Persoonsgegevens (AP), against Google LLC. The complaint was part of a joint action with other European consumer organisations, such as the umbrella organisation BEUC and the Norwegian, Swedish and Czech consumer associations. The complaint concerned the unlawful tracking of the consumer’s location by the consumer’s Samsung galaxy A3 smartphone, which runs the operating system Android (by Google). According to the complaint, crucial information was hidden and users were guided by dark patterns to consent to share their location, in violation of Article 5 GDPR, Article 6 GDPR, Article 7 GDPR, Article 13 GDPR, and Article 25 GDPR. The DPA, however, claimed that the Irish DPA (the DPC), is the leading supervisory authority pursuant to Article 56(1) GDPR, because the complaint concerns cross-border processing and Google’s European headquarters is located in Ireland. On 5 June 2019 and 2 September 2019, the DPA notified the Consumentenbond and the consumer that the Irish DPA was investigating the complaint and further information would follow. On 26 November 2019, the Consumentenbond and consumer served the DPA with a notice of default for failing to make a timely decision, but the DPA replied on 2 December 2019 that the notice was premature since they had until 2 December 2019 to reply. Moreover, they informed the Consumentenbond and consumer that Google had made changes related to the complaint and additional evidence in relation to the consumer had to be filed before 6 January 2020. The DPA kept informing the Consumentenbond and consumer every three months, on 27 Febryary 2020 and 27 May 2020, of the “progress” by the DPC, stating that an update would follow in three months. Finally, on 30 November 2020, two years after the complaint was filed, [https://www.consumentenbond.nl/nieuws/2020/consumentenbond-naar-rechter-om-google-zaak the Consumentenbond brought the case before Court] because the DPA had still not taken a decision. The Court discussed two matters: (1) whether the Consumentenbond can be regarded as a stakeholder within the meaning of Article 1:2, third paragraph, of the General Administrative Law Act (Awb), and (2) whether the decision by the DPA failed to decide in due time on the enforcement request. The Consumentenbond claimed it is a stakeholder. The DPA, however, claimed this is not the case because “the statutory objectives of the claimant are too general to be able to also protect the interest of the protection of personal data or privacy of third parties in an administrative law procedure.” The Court, however, found that the statutory objectives are not too general, and that the Consumentenbond has shown with their activities to focus on the prevention of abuses in the area of consumer privacy. According to the Court, these privacy interests are so intertwined with the general interest of the Consumentenbond, that this interest is included in the statutory objectives. Hence, the Court concluded that the Consumentenbond is a stakeholder. The Court further examined whether the DPA failed to decide the matter in a timely manner. In this respect, the Dutch DPA considered that, since the Irish DPA is now the leading supervisory authority and is investigating the complaint, it (the Dutch DPA) can no longer investigate the complaint on their own behalf. Moreover, the Court referred to the reasoning of the Court of Midden-Nederland in its judgement of 15 October 2020, regarding the question within which term the DPA must decide on the request for enforcement. The Court found that the decisive factor was that “the complaint has become part of a large and complex investigation into the cross-border processing of personal data”, and the (Dutch) DPA can therefore not determine “the scope and path of the investigation”, or set a date for the decision. Moreover, because the DPA informed the Consumentenbond every three months, it fulfilled its obligations. Hence, the Court concluded that the DPA has not failed to decide in due time on the enforcement request.