The Belgian Data Protection Authority has approved an amicable procedure with an entertainment sector company, including the payment of €5,000, following a complaint regarding unsolicited direct marketing mailings. The decision addresses breaches related to transparency of information, exercise of the right to object, and limitation of data retention.

Facts and context

The Data Protection Authority (DPA) today published a decision on an amicable settlement against an entertainment sector company, including the payment of €5,000, for breaches related to direct marketing, transparency, and data retention.

The case originated from a complaint by an individual who received several unsolicited direct marketing emails after purchasing a ticket from the data controller.

Reasons for the decision

Within the framework of the amicable settlement procedure, the following breaches were acknowledged by the data controller:

• Obligation of fairness and transparency (Article 5(1)(a) of the GDPR): The authority noted that the data controller's website stated that ticket sales were exclusively online, whereas purchases were also possible on site. This incorrect information was considered a breach of the transparency principle, as it misled data subjects about the methods of collecting their data.
• Obligation to guarantee a simple and effective right to object: The decision highlighted shortcomings in how individuals could object to direct marketing, violating Article XII.13 of the Belgian Code of Economic Law transposing the Privacy and Electronic Communications Directive. The amicable settlement requires the data controller to provide proof of implementing a corrective measure within 30 days.
• Obligation of lawfulness of processing and limitation of retention (Article 6 and Article 5(1)(e) of the GDPR): The authority examined the lawfulness of profiling carried out for marketing purposes based on historical purchase data, relying on contractual necessity (Article 6(1)(b)) and legitimate interest (Article 6(1)(f)). In connection with this processing, the data controller committed to reducing the retention period for inactive customers from five to three years to comply with the data retention limitation principle.

Authority's decision

Consequently, the authority approved the amicable settlement providing for the payment of €5,000 by the data controller.

Furthermore, the authority ordered the data controller to implement several corrective measures under the agreement, notably: bringing its objection mechanism for direct marketing into compliance within 30 days, and applying its new data retention policy, including deletion or anonymization of excess data, within four months.

Lessons learned

This decision reminds that:

• Any information communicated to data subjects, including on data collection channels, must be scrupulously accurate and complete to respect the transparency principle.
• The mechanism allowing objection to direct marketing must be not only available but also simple and effective for the user, without requiring complex procedures.
• The data retention period must be proportionate to the purpose of processing, and a differentiated retention policy, for example for active and inactive customers, constitutes good practice to respect the data retention limitation principle.
• The amicable settlement procedure can be an effective resolution path for supervisory authorities, combining financial compensation and binding, swift corrective measures.