X (the complainant) v. Y (the defendant)
Case summary
The Belgian DPA held an organization liable for continued direct marketing practices despite objection by the complainant; and for failing to provide clear information about the right to object in the privacy policy.
Our analysis
A former donor of the organization lodged a complaint after receiving promotional materials despite objecting to the processing of his data for direct marketing purposes and requesting the organization to delete his data from its database. The dispute was taken to the litigation chamber, which concluded that the GDPR had been violated. The data controller continued to send direct marketing messages to the complainant despite being repeatedly told not to do so. Additionally, the organization did not have a legitimate basis for direct marketing, and the legitimate interests of the organization were outweighed by the rights of the complainant. The complainant had a reasonable expectation that his data would not be processed seven years after he made a donation. Furthermore, the data controller should have explicitly stated the right to object in clear and unambiguous language, as a mere mention in the privacy policy was deemed insufficient.
Outcome
Due to the organization's limited turnover and the persistence of their practices for over five years, the DPA determined that a fine of 1000 euros was appropriate.
Parties
X (the complainant) and Y (the defendant)