Privacy & Information Security Law Blog

On April 25, 2019, the Belgian Data Protection Authority (the “Belgian DPA”) published its Annual Activity Report for 2018 (the “Annual Report”), highlighting the main developments and accomplishments of the past year.

New Authority

On May 25, 2018, the Belgian Privacy Commission became the Belgian DPA. The Belgian DPA is now composed of an Executive Committee and five bodies: the Knowledge Center, the Litigation Chamber, the Investigation Service, the General Secretariat and the Front Office.

Two new laws came into effect to create and reinforce the powers of the Belgian DPA as an investigation and sanctioning body: the Law of 3 December 2017, creating the Data Protection Authority, and the Law of 30 July 2018 on the Protection of Natural Persons with regard to the Processing of Personal Data, adapting the Belgian legal framework to the EU General Data Protection Regulation (the “GDPR”).

2018 in Numbers

As in 2017, the number of files the Belgian DPA received in 2018 increased greatly. In total, 7,182 cases were processed by the Belgian DPA (a 46% increase from 2017), including 6,224 requests for information, 295 requests for mediation, 218 requests for investigation and 445 personal data breach notifications. The Belgian DPA also processed 215 requests for opinion in 2018, compared with 90 in 2017. The most common topics of information requests relate to the GDPR, data subjects’ rights, CCTV, direct marketing, notifications and the right to one’s image. The Annual Report notes that, generally, the data breaches reported to the Belgian DPA were caused by human error (28.09%), hacking, phishing and malware (22.70%), theft of materials (12.81%), system failure (10.56%) and improper use of access right (5.17%). The Annual Report also states that the Belgian DPA was notified of 3,666 data protection officers in 2018.

Relevant Initiatives and Focus Topics for 2018

Among other topics, the Belgian DPA focused on the following in 2018:

• Opinions. The Belgian DPA issued opinions on various topics including the collection of digital fingerprints on ID card chips, the creation of an e-Box network and an e-Deposit system for lawyers and the creation of an e-Health platform.
• Cooperation. The Belgian DPA cooperated closely with the European Data Protection Board (the “EDPB”) to coordinate efforts regarding accreditation and certification at the EU level.
• Codes of Conduct. The Belgian DPA is currently reviewing two national codes of conduct and one cross-border code of conduct.
• “Je décide/Ik beslis.” The Belgian DPA worked on new initiatives to raise awareness, particularly for children and young adults, about the protection of personal data.
• Facebook case. On February 16, 2018, the Brussels Court of First Instance (the “Court”), siding with arguments set forth by the Belgian DPA, ordered Facebook to delete personal data that had been unlawfully collected via the use of cookies, social plug-ins and pixels. The Court also banned Facebook from collecting personal data via the use of certain cookies. Facebook immediately lodged an appeal of the decision with the Court of Appeal. That decision is expected in the coming days.