The Law of 3 December 2017 setting up the new national authority for data protection has been published on 10 January 2018. As of 25 May 2018, the current Belgian Privacy Commission will be replaced by the new Data Protection Authority (“DPA”) (in French “Autorité de protection des données” and in Dutch “Gegevensbeschermingsautoriteit”).
Whereas the Belgian Privacy Commission had a purely consultative role, the new DPA has been entrusted with new prerogatives and is expected to assume a more active role in the control and protection of personal data, as provided by the GDPR.
The DPA will be composed of six bodies amongst which an Inspection Service and a Litigation Chamber.
Through its Inspection Service, the DPA will have intrusive powers to investigate alleged breaches of data protection law. Its investigative skills include, inter alia, the possibility to impose provisional measures such as the suspension, limitation or temporary freezing of the processing of personal data. It may also audition people, consult IT systems and copy the data contained therein, seize objects, documents or IT systems and investigate on the premises.
The Litigation Chamber of the DPA will henceforth have the power to impose restrictive measures and inflict sanctions. It will be able, amongst other things, to initiate a settlement procedure, formulate warnings or impose corrective measures, such as the suspension of cross-border transfers. As provided by the GDPR, the Litigation Chamber will also have the power to impose administrative fines up to 20 million EUR, or in the case of an undertaking, up to 4% of its total worldwide annual turnover, whichever is higher. An appeal may be lodged before the Market Court against the decisions adopted by the Litigation Chamber.
It remains to be seen whether the financial and human resources provided will be sufficient in order for our new guardian to deploy its full effectiveness as of 25 May 2018.
For further information on this law and/or for general legal advice relating to GDPR compliance, please contact Karel Janssens.