What Changed
- The EDPB rejected the Belgian DPA's proposed dismissal of Noyb's cookie banner complaint against VRT under Articles 77 and 80(1) GDPR.
- The EDPB applied the CJEU test and determined that the objective and subjective elements required to prove abuse of rights were not established.
- The EDPB ordered the Belgian DPA to examine the case on its merits and submit a new draft decision to Concerned Supervisory Authorities under Article 60(3) GDPR.
Website operators, public broadcasters, and data protection authorities operating within the European Union must take note of a binding dispute resolution decision published by the European Data Protection Board (EDPB) under Article 65(1)(a) of the General Data Protection Regulation (GDPR). The decision establishes that procedural dismissals based on an alleged abuse of rights cannot be upheld without establishing the required objective and subjective criteria.
The case originated from a complaint lodged with the Austrian Data Protection Authority (DPA) by the Austrian-based non-governmental organization Noyb on behalf of an individual. The complaint challenged the use of cookie banners on the website of Vlaamse Radio-en Televisieomroeporganisatie (VRT), a public broadcasting organisation based in Belgium.
Acting as the Lead Supervisory Authority (LSA), the Belgian DPA submitted a draft decision proposing to dismiss the complaint. The Belgian DPA claimed that the complainant had abused their rights under Article 77 GDPR and Article 80(1) GDPR. However, the Austrian DPA, acting as a Concerned Supervisory Authority (CSA), raised a formal objection. The Austrian DPA argued that the Belgian LSA should not dismiss the complaint on procedural grounds and was instead required to issue a decision on the merits of the case. Because the Belgian DPA chose not to follow this objection, it submitted the case to the EDPB under the dispute resolution mechanism.
In its binding decision dated 28 May 2026, the EDPB determined that the Austrian DPA's objection was relevant and reasoned within the meaning of Article 4(24) GDPR and the corresponding EDPB Guidelines. Evaluating the merits of the objection, the EDPB applied the test established by the Court of Justice of the European Union (CJEU) for alleged abuse of rights. It found that the objective and subjective components required to demonstrate abuse were not established. Consequently, the EDPB instructed the Belgian DPA not to dismiss the complaint, but to evaluate its merits and submit a new draft decision to the CSAs pursuant to Article 60(3) GDPR.
Additionally, the EDPB news release referenced other regulatory developments across the EU, including a 403,000,000 EUR fine by the Irish Data Protection Commission against Google regarding location data processing, a 100,000 EUR fine by the Spanish DPA against Securitas Direct regarding access to data subject rights, and the adoption of final DSA-GDPR guidelines alongside harmonised fining methodologies.
Who May Be Affected
Data controllers using cookie banners, public broadcasting organisations, cross-border privacy NGOs, and EU data protection supervisory authorities.
Cross-Border Context
The matter involves a cross-border dispute resolution mechanism under Article 65(1)(a) GDPR involving supervisory authorities in Belgium (LSA) and Austria (CSA) concerning an Austrian NGO's complaint against a Belgian broadcaster.
What to check next
- Publication of the Belgian DPA's new draft decision to Concerned Supervisory Authorities under Article 60(3) GDPR.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.
Prepared automatically with AI assistance from the official sources linked on this page. Translations and explanations do not replace the official text.