Three key compliance takeaways from the newest Belgian DPA enforcement decision

New Belgian DPA decision, interesting on 3 points:
1. Confirmation of BDPA’s approach re “legal obligation” and “public interest” legal grounds
2. Re retention: the need to assess recidivism does not justify unlimited processing
3. Reference to EDPB’s newly updated GDPR fining guidelines (re factors affecting the amount of the fine)

1. The Order of Pharmacists maintains a register of disciplinary cases in relation to its members (and its decisions, including sanctions).
The Order invoked “legal obligation” as a legal ground for the maintaining of this register + disciplinary case files (for disciplinary case management purposes). It referred to a Royal Decree requiring the maintaining of a register of cases to help adapt the rules of the Order’s code of ethics (rules that all pharmacists must comply with).

The BDPA confirmed its own case law (+ the GDPR and CJEU case law): “legal obligation” only works if the statutory provision in question defines the essential characteristics of the data processing (incl. purposes of the processing) and is sufficiently clear and precise, such that its application will be foreseeable for data subjects.
In this case, the provisions in question did not concern the maintaining of a disciplinary case file or the assessment of recidivism, and *could not* be used to justify disciplinary case management.

The BDPA examined further whether “public interest” could be invoked as a legal ground instead for some aspects. “Public interest” covers “not only the processing activities necessary to the performance of the task in the public interest within the strictest sense, but also processing activities necessary to the carrying out of tasks directly linked to that public interest task, including processing activities necessary to the management and functioning of bodies entrusted with that public interest task”.
In this case, the management of disciplinary cases by certain councils of the Order could be justified based on those councils’ public interest tasks; everything beyond could not be based on public interest as a legal ground either.

2. If disciplinary case management can be based on “public interest”, the provisions in question do not define a retention period. But “it would be erroneous to interpret the silence of a legislative text as permitting data processing for an unlimited period of time”. Even recidivism is time-dependent.
So: define your retention period!

3. Re fines, the decision refers to the EDPB’s new fining guidelines to determine which mitigating and aggravating factors come into play, and it uses them. However, it does not apply their fine calculation methodology (the calculation took place before adoption of that final version of the guidelines).
[+ No published budget / turnover of the Order, so it’s difficult to tell whether the (drumroll) 30k EUR fine is large or small.]

Link (FR): https://lnkd.in/et9HyTuF
privacy data protection