What the bpost enforcement decision reveals about legitimate interests and DPO roles

Three points of interest (also beyond Belgium) taken from the Belgian data protection authority’s new decision regarding bpost (postal services):
– Legitimate interests can be a valid legal ground for direct marketing (this is already well known throughout the European Union, but it’s worth repeating, considering the opposite view that the Dutch Autoriteit Persoonsgegevens continues to defend)

– Art. 13.1(a) and 14.1(a) GDPR require that data subjects be provided with “the contact details of the controller” and “the contact details of the data protection officer, where applicable”. The Belgian DPA’s Litigation Chamber considered that there was no violation of these provisions by bpost because it “opted for communication via an online contact form and via post” (and thus did not provide an actual e-mail address).

– That contact form does *not* need to be linked to directly from the website’s homepage – it is sufficient if it is linked to in the privacy statement, which itself is accessible. (Yes, the Belgian DPA’s Inspection Service actually demanded that, on the basis of Art. 12.2 GDPR [obligation to facilitate the exercise of data subjects rights])

Link (decision in Dutch): https://lnkd.in/dR6niyzh