In a previous article (available here), we have highlighted the decision of the Belgian Data Protection Authority (hereafter: “BDPA”) of 14 July 2020 where it imposed a fine of 600k to Google Belgium SA. The case was interesting for its private international law aspects. The BDPA had decided to fine the Belgian subsidiary of Google instead of Google LLC, the mother company established in California.
At the time of writing our first article, an appeal against the decision was pending before the Brussels Court of Appeal, section Market Court (hereafter: “Market Court”). Almost a year later, on 30 June 2021, the Market Court annulled the decision of the BDPA (available here). In essence, the Market Court finds that the BDPA had insufficiently motivated why it could impose a fine on the Belgian subsidiary, Google Belgium SA, who was not at all involved with deciding the means and purposes for the data processing in question.
Reasoning of the Market Court
In its judgement of 30 June 2021, the Market Court found that the BDPA violated the law of 29 July 1991 on the explicit motivation of administrative decisions (hereafter: “Law of 29 July 1991”) by imposing a fine on Google Belgium SA.
The reasoning of the Market Court applying principles of administrative law is based on two observations:
- First, the Market Court notes that Google Belgium SA is a distinct company from Google LLC and merely handles the marketing side of the Google business in Belgium. It was not established that Google Belgium SA in any shape or form was involved with determining the means and purposes of the data processing through the Google search engine. It was even explicitly acknowledged by the BDPA in its decision that only Google LLC can be seen as the data controller.
- Secondly, the Market Court notes that the General Data Protection Regulation (hereafter: “GDPR”) only contains obligations for data controllers and data processors, but not their subsidiaries or local establishments who are charged with other activities. The Market Court finds that the BDPA had not examined and concretely motivated that the activities of Google Belgium SA are in an indissociable manner linked to the processing of personal data for the purposes of the operation of the Google search engine. This could not be simply presumed. Therefore, Google Belgium SA could not simply be equated with Google LLC and could not be imposed a fine.
To understand the outcome, it should be observed that the Market Court has been attributed specific judicial review powers regarding decisions of the BDPA. Although it is a chamber within the Brussels Court of Appeal, it does not function as a normal appellate body. The Market Court limits its examination to a legal review, notably the questions whether:
1. the contested decision violates the law sensu lato,
2. the facts have been presented correctly and there has been no manifest error of appreciation in the matter, and
3. the legal qualification of the facts is correct.
To put it differently, it will examine whether the interpretation that the BDPA gives to the law sensu lato, to the factual elements of the file and to the documents of the file can indeed be derived from these elements and/or documents.
The obligation to adequately motivate an administrative decision, laid down in the Law of 29 July 1991, comes into play here. An adequate motivation of the administrative decision is required for the Market Court to carry out its review. Key component of the obligation to adequately motivate an administrative decision is the requirement that the reasoning should be based on clear and concrete elements and that these have to be more concrete and precise when the administrative authority wants to dismiss an argumentation or a position of a party. The same applies when the administrative authority has broad discretionary power in the matter (as is the case when the BDPA imposes coercive measures in the sense of article 100 of the law of 3 December 2017 on the establishment of the Data Protection Authority). This necessitates a more precise motivation by the administrative authority.
The simple references to the case law of the European Court of Justice (judgement of May 13, 2014, C-131/12, Google Spain / AEPD; judgement of June 5, 2018, CJEU, C-2010/16, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein / Wirtschaftsakademie Schleswig-Holstein GmbH; judgement of September 24, 2019, C-507/17, Google LLC / CNIL; judgement of September 24, 2019, C-136/17, GC / CNIL) and to national decisions from other countries could not, in view of the Market Court, suffice under the Belgian requirement of adequately motivating an administrative decision in light of the coercive measures imposed.
Consequence
Given the peculiar nature of its functioning, the Market Court only annulled the contested decision and referred the case back to the BDPA to make another decision. The Market Court did not substitute its judgement with that of the BDPA. It is only when certain conditions are met that the Market Court can exceptionally directly make a decision in place of the BDPA. However, this was not the case here as the decision to be made related to a discretionary power of the BDPA.
The BDPA now has to take a new decision (ab ovo) in a chamber with a completely different composition (assuming that there is still a valid complaint pending).
With its new decision, the BDPA could in theory impose a new fine on Google Belgium SA, this time with a more adequately motivated decision. It could also decide to target other members of the Google group like Google LLC or Google Ireland Ltd.
Takeaway
The Market Court has not given a judgement on the merits. The decision of the BDPA was annulled for inadequate motivation. Nevertheless, the judgement of the Market Court still remains important because it has effectively set the bar for the BDPA in pursuing transnational companies in data protection matters. It has established that the Belgian law on the motivation of administrative decisions requires the BDPA to do more than simply referring to case law of the European Court of Justice or of other countries. To pursue subsidiaries or local establishments, the BDPA will have to provide clear and concrete elements in its decision that that entity is in an indissociable manner linked to the imputed processing of personal data.
***
For any questions or assistance please contact the author.
Eric De Gryse
edg@simontbraun.eu | +32 2 533 17 52
This article is not legal advice or opinion. You should seek advice from a legal counsel of your choice before acting upon any of the information in this article.
