Does a settlement with a complainant actually stop a DPA investigation?

In case of a complaint before a supervisory authority, will a settlement to withdraw the complaint stop an investigation? The Belgian Data Protection Authority examined the issue in its newest decision:

1. Context and procedure:

A data subject complaints before the BDPA because a (large) search engine provider (as controller) has rejected a delisting/erasure request regarding two URLs.
Before the first set of written submissions before the BDPA’s Litigation Chamber, the data subject indicates his wish to withdraw the complaint, saying that the URLs have been delisted.

The controller then confirms to the BDPA its acceptance of the complaint withdrawal, and asks that no decision be published, even anonymously, about this case.

The BDPA’s reaction? “Write submissions on your request for non-publication of the decision”.

The controller argues that publication is a sanction as such under the Belgian Act instituting the BDPA, so no publication is warranted, let alone a non-pseudonymised one.

In its submissions, the controller also reveals that there is a confidential settlement with the data subject.

2. Impact of settlement & complaint withdrawal

Echoing now constant case law, the BDPA states that “[t]he mere fact that the complainant withdraws his complaint (or that the infringement has been remedied in the course of the proceedings, for example) does not remove any infringement that may have been committed by the controller, nor does it deprive the competent bodies of the BDPA, including the Litigation Chamber, of the exercise of their respective powers.

Here, the complaint was based on a refusal to accede to a refusal/delisting request, which the Litigation Chamber describes as “intimately linked to the desire of the complainant to exercise his rights”. Therefore, a dismissal makes sense, unless there are “exceptional circumstances” that justify further examination of the case on the merits – none of which appear to exist in this case.

The Litigation Chamber does say that it is “completely unaware of the content of this [settlement] agreement and the conditions under which this withdrawal took place, in particular in return for what possible consideration (financial? production of documents by the plaintiff?)”, and that it “is opposed to any practice of negotiating the withdrawal of a complaint in exchange for financial compensation”.

Conclusion: dismissal.

3. What about publication?
The BDPA concluded that the decision could be published, with the identity of the controller, due to the importance of that search engine for a large number of web users. The BDPA considered that publication would help generate awareness of web users’ rights under the GDPR – even though this case was dismissed.
[This isn’t new but further specifies in which circumstances the controller’s identity may be published.]

Decision (in French): https://lnkd.in/eXRr69p5

gdpr data protection privacy