The Belgian Data Protection Authority dismissed a complaint regarding the management of cookies, as the initial facts were time-barred. However, it took this decision as an opportunity to recall the validity requirements for consent, notably the obligation to offer a "reject" button at the same level as the "accept" button.

Facts and context

The Belgian Data Protection Authority (DPA) published a decision to dismiss a complaint against Y for past breaches related to the management of cookies on its website.

The case originated from a complaint filed on May 11, 2020, reproaching the data controller for not allowing the refusal of cookies and considering continued browsing as valid consent.

Reasons for the decision

The Dispute Chamber first noted that the initial facts of the complaint, prior to September 7, 2020, were time-barred under Article 105 of the Organic Law, as the five-year period had elapsed. However, during the investigation, it identified a distinct breach concerning the new banner subsequently implemented, although this breach was not subject to corrective action due to its later regularization by the company.

• Obligation to obtain free consent (Article 7 of the GDPR): The authority noted that the cookie banner, after a first modification on September 7, 2020, only offered an "accept all" button at the first level of information, without an equivalent option to refuse. For the authority, this asymmetry undermines the free nature of consent required by Articles 4(11), 6(1)(a), and 7 of the GDPR, as it is not as easy to refuse as to accept. It referred to the European Data Protection Board (EDPB) working group's report on cookie banners and its Guidelines 05/2020 on consent to support its analysis, specifying that the absence of a reject button at the first level is a non-compliant practice.

Authority's decision

Consequently, the authority decided to dismiss the case. This decision is based on the statute of limitations of the initial facts and on the fact that the breach identified later (the absence of a reject button) had been corrected by the data controller before the final decision, making corrective action unnecessary.

Lessons learned

This decision recalls that:

• The absence of a button allowing refusal of cookies at the same level and with the same ease as the acceptance button vitiates consent, which is then not considered "free".
• The voluntary compliance of a data controller during the procedure, even for a breach identified by the authority itself, can lead to dismissal of the case.
• The facts constituting a GDPR infringement are subject to a statute of limitations (five years in Belgium), beyond which the supervisory authority can no longer impose sanctions.