APD/GBA - 19/2020

From GDPRhub
Revision as of 15:11, 18 May 2020 by Maïlys Lemaître (talk | contribs) (Created page with "{{DPAdecisionBOX |Jurisdiction=Belgium |DPA-BG-Color= |DPAlogo=LogoBE.png |DPA_Abbrevation=APD/GBA |DPA_With_Country=APD/GBA (Belgium) |Case_Number_Name=DOS-2018-05421 |ECLI...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
APD/GBA - DOS-2018-05421
Authority: APD/GBA (Belgium)
Jurisdiction: Belgium
Relevant Law: Article 5(1)(b) GDPR
Article 5(1)(f) GDPR
Article 5(2) GDPR
Article 24 GDPR
Article 32 GDPR
Article 17 of the national law organizing the national registry
Article 17 of the law organizing the national registry for natural persons
Type: Complaint
Outcome: Upheld
Decided: 29.04.2020
Fine: None
Parties: n/a
National Case Number/Name: DOS-2018-05421
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): French
Original Source: Official site of the Belgian data protection authority (in FR)
Initial Contributor: Maïlys Lemaître

Belgium's DPA reasserts the principle of accountability of the data processor in accordance article 24 GDPR and the necessity of documenting all processes and procedures resulting thereof.

English Summary


The plaintiff filed a complaint with the Belgian DPA after noticing that their picture in the national registry had been consulted by a city official without indication of a motive, such as required by article 17 of the Belgian law organizing the national registry, and following the inability of the city to justify the consultation or provide a satisfactory response as to the outcome of its internal enquiry on the matter. The city argued in its defence, that there were clear internal procedures for the consultation of the national registry and that it could therefore have reasonably assumed that the data would be processed lawfully.


Is assuming that the data be processed lawfully because of the knowledge of the law and internal procedures by employees sufficient?


The Belgian DPA reminds that accountability in accordance as understood by article 24 GDPR resides not only in ensuring that the law and the internal procedures relating to data processing be known to employees, but also that those be clearly implemented and documented in order to be able to prove the lawful processing of the data. In this instance, the procedure for consultation of the national registry was inadequate because the motive of consultation had not to be provided in writing, although the motive in itself constitutes the decisive element for determining the lawfulness or not of the data processing.


Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.