European data protection authorities ask the Belgian DPA to investigate a complaint lodged by NGO NOYB

---

Background to the complaint

The organisation NOYB lodged a complaint with the Austrian data protection authority concerning the cookie banners on the website of the Belgian public broadcasting company VRT. The NGO is acting on behalf of a complainant, whom it represents in the proceedings. As the complaint concerns a Belgian website, it was transferred to the Belgian DPA. In its draft decision submitted to the other supervisory authorities concerned within the cooperation mechanism, the Belgian DPA proposed to dismiss the complaint. This proposal was on the basis of elements suggesting that NOYB had played the leading role in the filing of the complaint, therefore instructing the complainant how to file the complaint instead of the other way around, which would constitute an abuse of right (to lodge a complaint). Notably, the complainant was a trainee at NOYB at the time the project for the complaint was initiated.

This reasoning is based on the case law of the Market Court of Brussels (Court of Appeal), which had previously found an abuse of rights in the context of other complaints lodged by NOYB (against the company Mediahuis). The Market Court had then annulled the Belgian DPA’s decision on the merits (113/2024 concerning Mediahuis’s cookie banners).

The Austrian authority, as concerned supervisory authority, objected to the complaint being dismissed. Given the existing case law in Belgium on this matter, the Belgian DPA was obliged not to follow this objection. Similarly, the Austrian Authority could not accept the dismissal of the complaint due to its own local case law that refuted arguments that similar complaints were filed unduly. The case was therefore referred to the EDPB.

Cross-border decisions and dispute resolution

European law (GDPR) provides that when a data protection authority (known as the ‘lead supervisory authority’ or LSA) takes a decision that affects other authorities (for example, because the complainant originally lodged a complaint in another country), it must submit its draft decision to those concerned authorities (“CSAs”) so that they may raise any “relevant and reasoned” objection that they might have. If the LSA refuses to amend its decision in light of the objection raised, a dispute resolution mechanism is triggered: all EU data protection authorities, represented within the EDPB, take a decision on the case. The LSA (in this instance, the Belgian DPA) must then comply with this “binding decision”.

EDPB Binding decision in the case of NOYB v VRT

The EDPB found that, based on the information available and in line with the Court of Justice of the European Union’s test for alleged abuse, the complainant did not abuse their rights to lodge a complaint (Art. 77 GDPR) and to seek representation with an organisation (Art. 80.1 GDPR). Indeed, according to the EDPB, the elements (objective and subjective) needed to prove such abuse were not demonstrated.

Consequently, the EDPB instructed the Belgian DPA not to dismiss the complaint, but instead to assess the complaint on its merits and to submit a new draft decision to the CSAs when the complaint has been processed.

The Belgian DPA welcomes the conclusion of this procedure and the opportunity to hear the opinions of its counterparts. This binding decision provides legal certainty for the different parties concerned. The dispute resolution procedure provided for in the GDPR is an important instrument to ensure consistency in the application of the GDPR across Europe.

Background and timeline: NOYB complaints regarding ‘cookie banners’

2021

• The NGO NOYB lodged hundreds of complaints with data protection authorities throughout Europe against the cookie banners on popular websites. The Belgian DPA received a few dozen of these complaints.

2022

• A second wave of similar complaints related to cookie banners were filed. 

2023

• The Austrian authority transfers the complaint against VRT in question (which was filed in the context of the “cookie banner project”) to the Belgian DPA via the EDPB’s online cooperation platform 

2024

• The Belgian  DPA dismissed two complaints lodged by NOYB on the basis of an abuse of law. One of this complaints was filed in the context of the “cookie banner project”. Neither the complainants nor NOYB appealed against these dismissals. 
• The Belgian DPA examined on the merits complaints filed by NOYB with regard to cookie banners on the Mediahuis news websites (which were not part of one of the two waves of the “cookie banner project”). The manner in which the complaints were filed was different, which is why they were not dismissed. The Belgian DPA issued Decision 113/2024 in which they order Mediahuis to make adjustments to their cookie banners.
• Mediahuis lodged an appeal against this decision with the Market Court of Brussels (Court of Appeal).

2025

• The Market Court found that NOYB had abused its right to lodge a complaint and annulled the Belgian DPA’s Decision 113/2024 (known as the ‘Mediahuis’ decision) for procedural reasons (read the judgment - in Dutch- here).
• The Belgian DPA dismissed 16 other complaints (part of the “cookie banner project”), partly in line with the Market Court’s case law, and partly because evidence in these complaints suggested that the leading actor in the coordinated filing of the complaints was NOYB. For the sake of transparency, the Belgian DPA explains its reasoning here. No appeal was lodged against the dismissal of these 16 complaints. 
• The Belgian DPA has forwarded a draft decision to dismiss three other cookie banner cases (including the VRT case) in which the Austrian authority is a CSA. 
• The Austrian authority has raised relevant and reasoned objections in relation to the three cases.
• In two of these three cases, the complaints were withdrawn by the complainant during the process of the hearing of parties in the lead-up to the procedure before the EDPB. Only the objection to the decision to dismiss the complaint against the VRT website was maintained. 
• The Belgian DPA could not amend its decision due to the case law of the Belgian Court of Appeal. The Austrian Authority could not accept this dismissal of the complaint due to its own local case law. A dispute resolution mechanism was therefore initiated.

2026

• 28 May 2026: the EDPB adopts a binding decision: the Belgian DPA must examine the NOYB  v VRT case on its merits. 
• 19 June 2026: after the translation of the binding decision into German and Dutch, the binding decision was notified to the LSA and CSAs by the EDPB Chair.
• 9 July 2026: the Belgian DPA formally decided to examine the case on its merits and notified VRT of this annexing the EDPB’s binding decision, translated into their language.
• The Austrian DPA also informed NOYB of the outcome annexing the EDPB’s binding decision.