APD/GBA (Belgium) - 48/2022

From GDPRhub
Revision as of 12:54, 6 April 2022 by Robertr (talk | contribs) (Created page with "{{DPAdecisionBOX |Jurisdiction=Belgium |DPA-BG-Color= |DPAlogo=LogoBE.png |DPA_Abbrevation=APD/GBA (Belgium) |DPA_With_Country=APD/GBA (Belgium) |Case_Number_Name=48/2022 |E...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
APD/GBA (Belgium) - 48/2022
LogoBE.png
Authority: APD/GBA (Belgium)
Jurisdiction: Belgium
Relevant Law: Article 5(1)(c) GDPR
Article 6(1)(e) GDPR
Article 9(2)(g) GDPR
Article 12 GDPR
Article 13(1)(c) GDPR
Article 13(2)(e) GDPR
Article 24 GDPR
Article 35(1) GDPR
Article 35(3) GDPR
Article 35(7)(b) GDPR
Type: Investigation
Outcome: Violation Found
Started:
Decided: 04.04.2022
Published: 04.04.2022
Fine: 200000 EUR
Parties: Brussels airport
Ambuce Rescue Team
National Case Number/Name: 48/2022
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): Dutch
Original Source: APD (in NL)
Initial Contributor: n/a

The Belgian DPA has fined Brussels airport (200.000 €) and the medical campany (hired as processor but considered as controller) for carrying out temperature checks with thermal cameras on passengers without legal basis, without adequate information, and without appropriate DPIA.

English Summary

Facts

The inspection service of the BE DPA conducted an inspection on the temperature checks carried out by the Brussels airport, as instructed by the Board of Directors of the BE DPA.

A first line of check was performed with thermal cameras. All passengers whose temprature was measure above 38 degrees were invited to be abalysed by a medical service, acting in second line, to carry out a diagnosis (performed by a doctor and using a form). The information was strored on paper and electronically and potentially shared for contact tracing.

Holding

1. the DPA concluded that the airport was the controller foprp the processing of data in the context of the first line.

The airport and the medical service were considered as joint-controllers for the second linde processing. The DPA considreed that the qualification under the contractual agreement was not bindingi upon the DPA (in accordance with the EDPB guidelines on the same).



Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.