APD/GBA (Belgium) - 141/2021
| APD/GBA (Belgium) - 141-2021 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 38(6) GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | |
| Published: | 16.12.2021 |
| Fine: | 75000 EUR |
| Parties: | n/a |
| National Case Number/Name: | 141-2021 |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | Dutch |
| Original Source: | Beslissing ten gronde 141/2021 van 16 december 2021 (in NL) |
| Initial Contributor: | Enzo Marquet |
The Belgian DPA fined a bank €75,000 because its DPO was also the head of three departments with decision-making powers over processing of personal data, which resulted in a conflict of interest in breach of Article 38(6) GDPR.
English Summary
Facts
The data subject filed complaint regarding a violation to their right to rectification against a bank. The DPA launched an investigation which over time broadened its scope towards the role of the bank's DPO. The investigation revealed that there might be a conflict of interest since the DPO held a number of other functions, including leading the bank's Operational Risk Management, the Information Risk Management department and Special Investigation Unit. The bank argued that the head of these services did not have decision-making power to determine the purposes and means of processing of personal data, but a purely advisory and supervisory role.
Holding
The Belgian DPA refuted the bank's argument, stating that the role was not 'purely advisory and supervisory'. Particularly, the DPA held that the DPO could still determine the means and purposes of processing of personal data. This was further proven by the bank's Record of Processing Activities, which listed a substantial number of categories of personal data which are processed by these departments. Because the DPO held the final responsibility over the referenced departments, a conflict of interest arose, in breach of Article 38(6) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
