Cookie Banners: EDPB Tells Belgian DPA to Stop Dodging Complaints

EDPB Strikes Down Procedural Roadblock

The European Data Protection Board (EDPB) has issued a binding decision that forces the Belgian Data Protection Authority (DPA) to examine a complaint by NOYB (None of Your Business) about cookie banners on its merits. The DPA had previously rejected the complaint as 'abusive' without providing concrete evidence, a move the EDPB deemed unlawful.

Featured Snippet Bait: Can a data protection authority reject a GDPR complaint as abusive without evidence? No, says the EDPB. The right to lodge a complaint under Article 77 GDPR cannot be dismissed on procedural grounds without proof of abuse.

What Happened?

NOYB, the privacy advocacy group led by Max Schrems, filed a complaint against a company using deceptive cookie banners. The Belgian DPA refused to handle it, claiming the complaint was 'abusive' because NOYB had filed similar complaints before. The EDPB disagreed, stating that the DPA must assess each complaint individually and cannot assume abuse without factual basis.

Why This Matters

This decision clarifies that DPAs cannot use procedural excuses to avoid addressing substantive privacy violations. It reinforces the GDPR's promise that individuals and NGOs can effectively challenge unlawful data processing. As the EDPB put it, the right to complain is a cornerstone of the GDPR, not a privilege that can be revoked on a whim.

Think of it this way: if you call the fire department because your neighbor's house is on fire, they can't refuse to come just because you've called them before about other fires. Each complaint deserves a fair assessment.

Impact on Cookie Banners

Cookie banners have long been a nuisance, often designed to trick users into accepting tracking. The EDPB's decision means that DPAs must now seriously investigate complaints about such practices. This could lead to more enforcement actions and, hopefully, less manipulative banners.

For businesses, the message is clear: ensure your cookie banners comply with the GDPR's requirements for valid consent. The EDPB's Guidelines on Consent provide detailed criteria.

What's Next?

The Belgian DPA must now review NOYB's complaint on its merits. If it finds violations, it can impose fines and order changes. This case also sets a precedent for other DPAs across Europe, discouraging them from using similar procedural tactics to avoid handling complaints.

FAQ