Roularta Media Group fined for unlawful use of cookies Summary Roularta Media Group, a Belgian media company, was • Due to the publication of a disclaimer on the among the subjects of a broad investigation carried websites in question, claiming that Roularta Group out by the Belgian Data Protection Authority (DPA) was not responsible for the placement of third- regarding the placement of cookies on the most widely party cookies on users’ devices (GDPR, Articles 5(2) consulted Belgian online news media. The case was and 24). examined together with the case about SA Rossel & Cie, • Failing to provide information to data subjects in a which is described above. The DPA inspected several transparent, understandable, and easily accessible websites administered by Roularta Media Group, form (GDPR, Articles 12(1), 13, and 14). focusing on the management of non-essential cookies • Non-compliance with the principle of storage and whether visitors’ consent had been obtained in limitation (GDPR, Articles 5(1)(e)). accordance with the GDPR. The DPA found that Roularta Media Group had used • Failing to ensure that withdrawing consent to the non-essential cookies without first obtaining valid placement of cookies is as easy as providing it consent from website users. (GDPR, Article 7(3)). Furthermore, Roularta Media Group had obtained user Appeal to the Belgian Market Court consent to the placement of third-party cookies in an ambiguous manner, contrary to the GDPR requirements, According to Belgian law, when the Belgian DPA by presenting users with pre-ticked boxes. Additionally, initiates a case on its own initiative, it must be based it was more difficult for users to withdraw consent to the on a referral. The referral must be made by the placement of cookies than it was for them to provide it. management board of the DPA and provide ”serious Finally, the DPA noted that the cookie policy of Roularta indications” of a potential violation of the fundamental Media Group on the relevant websites did not provide principles of personal data protection. adequate details regarding the use of cookies, and that However, in the referral for this particular case, no cookies were being retained for unjustified periods of serious indications were mentioned or proven. Even time. The company did not fulfill its obligation to enable though the investigation service (not the management users to revoke their consent. board) created a handwritten note listing various reasons for initiating the investigation, the Market Court The decision was later appealed. found that there was no official referral which made the investigation irregular and suggested that the The decision of the Belgian DPA investigation service was improperly involved or seized The Belgian DPA imposed a fine of 50,000 EUR on in an irregular manner. Therefore, the Market Court Roularta Media Group for the following violations: made the case invalid. • Placing non-essential cookies before obtaining user Decision of the Belgian Market Court consent, including cookies placed by third parties The Court invalidated the decision by the Belgian DPA, (GDPR, Article 6(1)(a) and Article 129(2)) of the as the referral on which the investigation was based Belgian Electronic Communications Act). was insufficient. • Non-compliance with the conditions for obtaining valid consent from users, namely by presenting users with pre-checked boxes on two websites, with partner companies’ cookies marked as ‘active’ by default (GDPR, Articles 4(11), 6(1)(a) and 7(1)). Published: 22-02-2023 Journal number: 2022/AR/953 Tags: 01 Legal basis and principles of processing 81