EDPB requires Belgian DPA to handle the merits of NOYB cookie banner complaint
The European Data Protection Board (EDPB) published its binding decision of 28 May 2026 under Article 65(1)(a) GDPR regarding a dispute submitted by the Belgian Data Protection Authority concerning a complaint against Vlaamse Radio-en Televisieomroeporganisatie (VRT). The Austrian NGO Noyb lodged the complaint with the Austrian DPA regarding cookie banners on VRT's website. The Belgian DPA, as Lead Supervisory Authority, had proposed dismissing the complaint on procedural grounds (alleged abuse of Articles 77 and 80(1) GDPR). The Austrian DPA objected, arguing the complaint should be decided on the merits instead. The EDPB agreed with the Austrian DPA's objection and found that the complainant did not abuse their rights under Articles 77 and 80(1) GDPR, thus requiring the Belgian DPA to proceed with substantive examination of the cookie banner complaint.
What changed
- EDPB clarified that procedural dismissals on grounds of alleged abuse of complaint rights must be substantiated by the CJEU test for abuse; complaints cannot be dismissed on procedural grounds without proper assessment of the merits
Who is affected
Data Protection Authorities (particularly the Belgian DPA as Lead Supervisory Authority), organizations receiving GDPR complaints (such as VRT), and individuals or NGOs submitting complaints under GDPR Articles 77 and 80(1)
- Language
- EN