Is your DPO overworked? Why missing authority requests risks a heavy fine

Is your DPO overworked? Do certain requests from authorities fall through the cracks? You could be in breach of the GDPR, says the Belgian DPA in its newest decision.

In this particular case, a DPO was working three days per week, and was the only person to have access to a particular e-mail address to which requests had been sent by the Belgian DPA.

Among many other criticisms (the decision is actually about failure to erase data & take into account an objection to direct marketing), the Belgian DPA looks at whose responsibility it is:

Para 83: “the Litigation Chamber emphasises the fact that the defendant�
is obliged to cooperate with all the services of the DPA. Failure to respond to a letter sent by one of the Belgian DPA’s departments, in this case an invitation to cooperate in a mediation by the First-Line Service, could be interpreted as a refusal to cooperate and potentially be considered a breach of Article 31 of the GDPR.

Para 84: “The Litigation Chamber observes that the defendant attempts to avoid liability by attributing the negligence of not responding to communications from the First-Line Service, the Inspection Service, the Litigation Chamber and the complainant to its former DPO. The defendant maintains that it was not aware of the excessive workload of the latter, which would have hindered its ability to respond favourably to the requests of the Belgian DPA and the plaintiff.
[…]
If the controller appoints a DPO for its legal department or uses a generic e-mail address such as �privacy@Y.be� to respond to requests from data subjects, it is the controller’s responsibility to ensure that e-mails sent to this address are regularly consulted and processed, even if a person who has worked in the department in question and/or the DPO resigns, or if the DPO’s workload becomes excessive. On this last point, the Litigation Chamber would point out that it is up to the data controller to comply with the provisions of article 38 of the GDPR.

Conclusion here? A fine (about 170k EUR, reduced after taking economic circumstances of the company into account)

Decision (in French): https://lnkd.in/espPSvs5

data protection privacy