EDPB requires Belgian DPA to assess cookie banner complaint on merits instead of dismissing

Original title: EDPB requires Belgian DPA to handle the merits of NOYB cookie banner complaint

The EDPB issued a binding decision requiring the Belgian DPA to assess a complaint about VRT's cookie banners on its substantive merits instead of dismissing it on procedural grounds. The complaint, filed by Austrian NGO NOYB with the Austrian DPA, alleged abuse of rights under GDPR Articles 77 and 80(1), but the EDPB found no evidence of such abuse based on objective and subjective criteria established by CJEU case law. Organizations must now understand that procedural dismissals based on alleged complainant abuse require robust evidence and that cookie banner practices may face substantive scrutiny under GDPR rules.

What changed

• EDPB rejected the Belgian DPA's attempt to dismiss the NOYB complaint on procedural grounds of alleged abuse of rights under Articles 77 and 80(1) GDPR, overriding the LSA's decision not to follow the Austrian DPA's (CSA) objection.
• EDPB instructed the Belgian DPA (LSA) to conduct a substantive assessment of the VRT cookie banner complaint and submit a new draft decision to the Concerned Supervisory Authority under Article 60(3) GDPR.
• EDPB confirmed that the complainant did not abuse their rights, as neither the objective nor subjective components necessary to prove abuse were demonstrated according to CJEU standards.

Who is affected

Public and private sector organizations operating websites with cookie banners in the EU (particularly Belgium); NGOs and individuals seeking to file GDPR complaints; Austrian, Belgian, and other European Data Protection Authorities involved in cross-border complaint procedures.