On 10 January 2018, the Act on the creation of the Data Protection Authority (the "Act") was published in the Belgian State Gazette. Further to our previous newsletter on the composition and powers of the Data Protection Authority (the "Authority"), this newsletter provides more information about proceedings before the Authority, in particular the filing of complaints and applications. The provisions relating to proceedings will enter into force on 25 May 2018.
1. Admissibility of a Complaint or Application
Anyone can file a complaint or application with the Authority. In order to be valid, the complaint or application should be in writing, dated and signed by the complainant or applicant. Filing a complaint or application is free of charge.
The Authority will establish a specific form to be used for this end.
Once a complaint or application has been filed, the Front-line Service Centre examines the admissibility of the complaint or application on the basis of the following criteria.
Admissibility Criteria for a Complaint
Admissibility Criteria for an Application
Prepared in an official language of Belgium (Dutch, French or German)
Prepared in an official language of Belgium (Dutch, French or German)
Subject-matter falls within the powers of the Authority
Subject-matter falls within the powers of the Authority
Includes facts and indications necessary to identify the data processing activity in question
NA
The Front-line Service Centre may ask the complainant or applicant to provide more information about the complaint or application, as the case may be.
1.1 The complaint or application is deemed inadmissible
The complainant or applicant will be informed of the Front-line Service Centre's decision, which must be substantiated.
1.2 The complaint or application is deemed admissible
If a complaint is found to be admissible, it will be transferred to the Dispute Resolution Body.
If an application is found to be admissible, the Front-line Service Centre will launch a mediation procedure. If the parties are able to reach an agreement, the Front-line Service Centre will draw up a report setting out the details of the agreement and certifying its compliance with the data protection legislation.
If no agreement can be reached, the request will be considered a complaint and will be passed on to the Dispute Resolution Body (i) provided the applicant consents or (ii) without the applicant's consent if the First-line Service Centre establishes that there are serious indications of a violation of the data protection legislation.
2. Merits of the Case
The Dispute Resolution Body can decide to handle a complaint right away or ask the Inspectorate to conduct an investigation, in the latter case within 30 days from the date the complaint is brought before the Dispute Resolution Body.
2.1 Investigation by the Inspectorate
The Inspectorate can take the following actions:
- order the temporary suspension, limitation or freezing of data processing;
- identify persons;
- conduct hearings;
- request information;
- conduct on-site inspections;
- consult and copy IT systems and the data they contain;
- access information by electronic means;
- seize or place under seal assets or IT systems; and
- order a telecommunications operator to identify a given user.
Upon termination of the investigation, the Inspectorate draws up a report and refers the matter (back) to the Dispute Resolution Body.
2.2 Proceedings prior to a decision on the merits
The Dispute Resolution Body renders a decision on the matter and has the power to:
- decide that the file is ready for a decision on the merits;
- propose a settlement;
- close the case with no further action;
- issue a warning or reprimand;
- order compliance with the data subjects' rights;
- order that the data subjects concerned be notified of the security issue;
- refer the matter to the public prosecutor; and
- post the decision on the Authority's website.
2.3 Decision on the merits
Once a file is ready for a decision on the merits, the Dispute Resolution Body notifies the parties concerned of the fact that there is a case pending, the content of the complaint and their right to access the file. The parties can submit observations in their defence and add documents to the file which they deem useful.
After having examined the substance of the case, the Dispute Resolution Body will take one of the following actions:
- close the case with no further action;
- refrain from prosecuting;
- order suspension of the decision;
- propose a settlement;
- issue a warning or reprimand;
- order compliance with the data subjects' rights;
- order that the data subjects concerned be notified of the security issue;
- order a temporary or permanent freeze, limitation or prohibition on data processing;
- order legitimate data processing;
- order the withdrawal of accreditation by certification bodies;
- impose penalty payments;
- impose administrative fines;
- order the suspension of cross-border data transfers;
- order rectification or deletion of or, a limitation on the data;
- refer the matter to the public prosecutor; or
- post the decision on the Authority's website.
Decisions of the Dispute Resolution Body must be substantiated.
The Act does not further elaborate on the applicable conditions for the imposition of administrative fines and simply refers to the general conditions of the General Data Protection Regulation. In this regard, please see the Guidelines issued by the Article 29 Working Party for further information on the application and setting of administrative fines.
If there are multiple infringements, the total administrative fines for all infringements may not exceed twice the highest fine.
3. Appeal
3.1 Appeal against certain decisions taken by the Inspectorate
The parties may appeal to the Dispute Resolution Body a decision by the Inspectorate to suspend, limit or freeze data processing or to seize or place under seal assets or IT systems.
If the parties do not agree with the Dispute Resolution Body's decision, the matter shall be referred to the Marktenhof/Cour des marchés (the former 18th Chamber of the Brussels Court of Appeal).
3.2 Appeal against the Dispute Resolution Body's decision
The parties may appeal the decision of the Dispute Resolution Body to the Marktenhof/Cour des marchés within 30 days from being notified thereof.
