The Belgian DPA rules that noyb lacks a structural legal interest in a key complaint

Belgian DPA drops a bomb on a complaint filed by noyb.eu: in Belgium at least, says the BDPA, in order for noyb to have a legal interest in filing a complaint on behalf of data subjects, those data subjects cannot have been working for noyb at the time.

The case in question concerned cookies and was dismissed by the Belgian DPA precisely because of this. I assume that noyb will appeal this, but the reasoning is worth copying over:

(Machine translation)

45. […] the Litigation Chamber considers that the mandate is fictitious, for the reasons set out below:

46. Firstly, the Litigation Chamber notes that the plaintiff was in fact a trainee at the time she visited the defendant’s website and at the time she instructed noyb. More specifically, and in light of the complainant’s statements at the hearing […], it appears that the visit to the defendant’s website took place as part of an assignment entrusted to her by noyb – the association where she completed her internship. This assignment consisted of visiting 5 Belgian websites – including the defendant’s – in order to determine whether there was a cookies banner that did not comply with the GDPR. Consequently, the Litigation Chamber cannot agree with the reasoning of noyb when it states in its conclusions that “the plaintiff selected and consulted the website autonomously and noted and documented the violation”. On the contrary, the complainant herself acknowledged at the hearing that she had not selected the defendant’s website, but that it was one of the 5 files that had been assigned to her and which she had been asked to process […]. As the plaintiff acted in the context of an internship, the Litigation Chamber questions noyb’s aforementioned statement since everything suggests that she acted as a noyb collaborator.
[…]
51. In the present case, the Litigation Chamber notes once again that the defendant was in fact a trainee at noyb at the time the mandate was issued to noyb and the complaint was lodged with the DPA. The Litigation Chamber therefore found that there was a hierarchical link between the plaintiff and noyb at the time of the events. The Litigation Chamber also notes that it was as part of her traineeship that noyb entrusted the complainant with the task of visiting websites to identify possible breaches of the GDPR. And, that it was following these visits ordered – or at least facilitated – by noyb, that the decision to lodge a complaint with the DPA was taken. The Chamber therefore notes that the power of attorney given to noyb is part of a professional context that may have influenced the complainant.

[Rest of key reasoning – including an analogy with freely given consent – in the comments]

Decision (in French): https://lnkd.in/e4K8ygbS

data protection gdpr privacy