The Belgian Data Protection Authority ('Belgian DPA') published, on 16 June 2022, its decision in Decision No. 103/2022 in File No. DOS-2020-02998, in which it imposed a fine of €50,000 on SA Rossel & Cie ('Groupe Rossel') , a press group, for violations of Articles 6(1)(a), 4(11), 7(1), 7(3), 12(1), 13, and 14 of the GDPR.
Background to the case
In particular, the Belgian DPA noted that the case concerned the press group's management of non-essential cookies on several of its websites, whereby according to the investigation carried out by the Belgian DPA's Inspection Service, visitors' consent had not been lawfully obtained in connection with the use of such cookies.
Findings of the Belgian DPA
As such, the Belgian DPA imposed a fine of €50,000 on Groupe Rossel for the aforementioned violations, and ordered the publication of the decision on its website. Lastly, the Belgian DPA stated that the decision may be appealed within 30 days of its notification.
UPDATE (21 June 2022)
Belgian DPA responds to media article regarding fine
The Belgian DPA issued, on 21 June 2022, clarifications in response to an article published in Le Soir newspaper on the fine that the Belgian DPA had imposed on Groupe Rossel in the decision. In particular, the Belgian DPA stated that the article included several pieces of information that were either taken out of context or incorrect, which it would like correct. In this regard, the Belgian DPA noted the following:
- the internal Belgian DPA memo, stating that control over Dutch-speaking public media websites is the responsibility of the Flemish supervisory commission, has not been followed and was issued prior to the appointment of the Management Committee, and does not reflect the current position;
- in response to the statement that the Belgian DPA had launched only a few ex officio investigations, the Belgian DPA noted that, in the period from 2018 to 2021, 58 of 450 investigations were launched by the Belgian DPA or the Inspection Service itself; and
- in response to the statement that the Belgian DPA had not acted officially to insist its competence for the supervision of Flemish public bodies, the Belgian DPA stated that it has reminded authorities (particuarly the Flemish and federal authorities) of the obligation for each assembly and government to submit to it, for an opinion, its draft texts relating to the processing of personal data.