Rules on cookies
The Belgian Institute of Postal Services and Telecommunications (“BIPT/IBPT”) monitors compliance by businesses with the Law of 13 June 2005 on electronic communications, together with the Data Protection Authority. The Electronic Communications Act of 13 June was amended in 2012, 2014 and 2017, notably to implement the modified EU regulatory framework for telecommunications.
Accordingly, Article 122, sec. 1 Electronic Communications Act, states that operators must destroy all data traffic from subscribers or final users, or make such data anonymous, as soon as the information is no longer necessary for the transmission of the communication. Thus, the processing of data must be strictly limited to what is necessary for the exercise of these activities. The use of cookies is only authorised if the person has been given clear and precise information concerning the purpose of the processing and his rights, such as the right to withdraw consent at any time, before cookies are set.
Developments
On December 17, 2019, the Belgian Supervisory Authority imposed a fine of €15,000 on a company operating a legal information website with approximately 35,000 unique monthly users for violations regarding the use of cookies.
Notably, the DPA enforced this fine without any actual complaints. The fine was due to insufficient information about cookies deployed on the website, and because the cookie policy was only available in English though targeting Dutch and French-speaking users. Further, the website did not obtain opt-in consent for certain type of cookies used, such as analytics cookies.
Although the website did ask for consent, the consent obtained was not sufficiently explicit. According to the DPA, cookies should be categorised for users to consent autonomously and to be able to choose to consent only to a particular type of cookies. There was no easy way to withdraw consent.
The DPA confirmed that its intent in this action is to set an example for strictly enforcing cookie violations in the future.
