Our remarks However, in the referral for this case, no serious • For cookie placement to be lawful, user consent indications were mentioned or proven. Even though must be obtained prior to the placement of cookies, the investigation service (not the management board) and continued browsing may not be considered a created a handwritten note listing various reasons legal form of consent under GDPR. Rather, consent for initiating the investigation, the Market Court should be considered valid only if it results from a found that there was no official referral which made clear and sufficiently specific active action from the investigation irregular and suggested that the the user. Finally, if users withdraw their consent, investigation service was improperly involved or seized this withdrawal must be effective and prevent the in an irregular manner. Therefore, the Market Court placement of further cookies. made the case invalid. • Article 129 of the Belgian Electronic Final decision of the Belgian Market Court Communications Act contains two exceptions regarding user consent and cookie placement. The Court invalidated the decision by the Belgian DPA, As a main rule, the consent of data subjects must as the referral on which the investigation was based be obtained prior to the placement of cookies on was insufficient. their devices. This, however, is not required in the following two situations: ° When the cookie is only intended to carry out the transmission of a communication over an electronic communications network, or ° When the cookie is strictly necessary for the provision of a service explicitly requested by the subscriber or end user (such as cookies allowing the storage of items in an online shopping cart or ensuring the security of a banking application). • All other cookie placements or installations of other tracking measures require the prior consent of the data subject. • Data protection authorities must oblige to procedural rules. Even though their assessment of the processing in question is correct, the case or decision can be invalidated if procedural rules are not followed. • As the invalidation only happened due to the missing justification in the referral, the DPA’s assessment of the cookie solution is still relevant as a takeaway for other data controllers. 80