McCann FitzGerald warns on cookies ruling
Lawyers at McCann FitzGerald have described a recent decision by Europe’s top data-protection watchdog as “unwelcome news” for businesses subject to the GDPR on data privacy.
A ruling by European Data Protection Board (EDPB) overturned a decision by Belgium’s data-protection authority (DPA) to dismiss a complaint by Vienna-based digital-rights group NOYB.
The complaint, against Flemish public broadcaster VRT, was lodged with Austria’s DPA, which transferred it to the Belgian body in its capacity as lead regulator for VRT.
NOYB cookies project
In an analysis on its website, McCann FitzGerald explains that the complaint was one of hundreds lodged by NOYB, acting as a representative, as part of a project that used automated software to identify allegedly non-compliant cookie banners and generate standardised complaints at scale.
For the purpose of this complaint against VRT, NOYB sourced an individual who could mandate it to lodge a complaint to the Austrian DPA.
The McCann FitzGerald lawyers say that the Belgian DPA took “a dim view” of this arrangement and concluded that NOYB had engaged in an abusive use of the right to lodge complaints, holding that the initiative for the complaints came from NOYB, not from the complainants themselves.
‘Onus on DPA’
The EDPB, however, has now told the Belgian DPA to consider the case on its merits.
Its decision said that, when considering whether such complaints were an abuse of law, DPAs should not distinguish the objective pursued by the data subject from the objective pursued by the representative.
The board added that, where a DPA was considering dismissing a complaint as abusive, the onus was on the watchdog to be able to sufficiently demonstrate the existence of such abuse.
The EDPB also held that there was no concrete evidence to support the view that NOYB’s policy objectives were linked to interests other than those of the individual data subject.
‘Deeply troubling’ model
McCann FitzGerald says that the decision sets “a very high bar” for DPAs to dismiss representative complaints on the basis that they are an abuse of rights.
“This will make it difficult for businesses to persuade DPAs to dismiss complaints brought by representatives against them, even when it is clear that the protagonist in the complaint is the representative, rather than the individual on behalf of whom the complaint ostensibly is made,” the firm's lawyers state.
“This opens the door to a model of enforcement that many businesses will find deeply troubling,” they say, adding that NOYB has been transparent about its approach to the cookie campaign.
The McCann FitzGerald lawyers point out that any activist body can replicate this model at scale to pursue a wide range of potential complaints under the GDPR, with DPAs unable to dismiss such complaints unless they can overcome the burden of proof set out by the EDPB’s decision.
“This will make it harder for businesses to counteract industrialised GDPR complaints led by activist representatives,” the firm’s lawyers conclude.