A five-year-old cookie complaint gets a second life
On 14 July 2026, the European Data Protection Board published Binding Decision 1/2026, adopted 28 May 2026, ordering Belgium's Data Protection Authority to stop treating a complaint against public broadcaster VRT as procedurally tainted and instead judge it on its substance. The underlying complaint — alleging VRT's cookie banner violated GDPR's lawfulness, consent and transparency requirements (Articles 5(1)(a), 6(1)(a) and 13(1)(c)), plus Article 5(3) of the ePrivacy Directive — was lodged with Austria's regulator on 10 August 2021 and transferred to Belgium in June 2023, per ppc.land's reconstruction of the case file. Belgium's draft decision never reached that substance. It proposed dismissing the complaint outright on the theory that the Austrian NGO noyb, not the individual complainant, was the real party in interest — an abuse of the Article 77 right to complain and the Article 80(1) right to be represented by a mandated organization.
The Austrian DPA objected. The EDPB, resolving the cross-border dispute under Article 65 GDPR, sided with Austria: the Board found neither the objective nor subjective elements of abuse were demonstrated, and that a valid Article 80(1) mandate does not become suspect simply because the representative organization operates at scale. Belgium must now open a full merits investigation into VRT's cookie practices — five years after the complaint was first filed.
The case for gatekeeping
Belgium's underlying instinct deserves a fair hearing before it gets dismissed. Regulators have finite investigative capacity, and GDPR enforcement backlogs across the EU are already a well-documented problem. If a single NGO can generate dozens of near-identical complaints — using standardized templates, recruiting complainants who were never actual users of the target's service, and securing mandates only after campaign targets were already set — that looks less like vindicating individual privacy harms and more like using Article 80(1) as a private enforcement multiplier that regulators are structurally unable to resist. Belgium's DPA made exactly this case months earlier: on 26 June 2025, its Litigation Chamber dismissed 16 separate noyb complaints against Honda Motor Europe, Mastercard Europe, Gannett, VF International and Coca-Cola Services, finding that staff-recruited complainants, pre-set project targets and after-the-fact mandates amounted to manufactured standing rather than genuine grievances (Liedekerke's summary of decisions 106–110/2025). That's a real institutional-design problem, not a fabricated one.
Why the EDPB got it right anyway
But the fix for an institutional-capacity problem is not letting each of 27 national DPAs invent its own abuse-of-rights doctrine to route around a right the legislature wrote into the text. Article 80(1) exists precisely because individual data subjects — especially ordinary users of a public broadcaster's website — rarely have the expertise, time or resources to litigate a cookie-consent violation alone. NGO-organized representation is the mechanism, not a loophole in it. If "the NGO organized the site visits" or "the NGO operates at scale" were sufficient to void a mandate, any well-resourced controller could effectively immunize itself from representative complaints by pointing to the representation itself as evidence of abuse — collapsing Article 80(1) into a right that exists on paper but can be waved away in practice. That is a worse outcome for legal certainty than the alternative: businesses need predictable rules for when a complaint must be heard, not a patchwork where each lead authority sets its own bar for standing.
The EDPB's decision doesn't resolve whether VRT's cookie banner is actually unlawful — that question now goes back to Belgium for a proper merits review, which could still end in dismissal on the facts. What the ruling forecloses is deciding that question by procedural fiat. That's the correct level of proportionality: screen out fabricated harms (which Belgium's own 2025 decisions on Honda, Mastercard and the others suggest DPAs are capable of identifying with proper factual findings), but don't let "this was organized by an advocacy group" alone function as a dismissal button.
What should actually change
Belgium's Litigation Chamber itself flagged the more honest fix in its June 2025 decisions: legislative reform. Article 80(2) GDPR already permits member states to let qualifying NGOs file complaints independently, without needing an individual mandate at all — Belgium simply hasn't adopted that opt-in. If policymakers are worried about industrialized complaint-filing, the answer is Belgium's parliament deciding whether and how to regulate NGO standing directly — with clear, prospective rules — not DPAs retrofitting an abuse-of-rights test onto Article 80(1) complaints that already satisfy its plain terms. For controllers, the practical upshot is narrower than the McCann FitzGerald warning of "floodgates" suggests: representative complaints must now be investigated on the merits, but merits review remains where genuinely manufactured claims get filtered out — just with a paper trail, not a procedural shortcut.