On 12 November 2021, the European Commission (“Commission”) sent a reasoned opinion to Belgium for failing to ensure full independence of its data protection authority (“DPA”).
According to the Commission, Belgium is violating Article 52 of the General Data Protection Regulation (“GDPR”), which states that the data protection supervisory authority shall perform its tasks and exercise its powers with complete independence. This implies that those officials remain free from external influence and shall not engage in any incompatible occupation.
The Commission however considers that some members of the Belgian DPA cannot currently be regarded as free from external influence, because “they either report to a management committee depending on the Belgian government, they have taken part in governmental projects on COVID-19 contact tracing, or they are members of the Information Security Committee”.
This is a second step in the procedure as the Commission already sent a letter of formal notice to Belgium earlier this year (on 9 June 2021), giving it two months to take corrective measures to ensure full independence of its national DPA, but it appears that the officials concerned have remained in their posts.
The Belgium Federal Parliament must now vote on the dismissal of these members, on the basis of two reports that were submitted to it. Belgium’s DPA must be brought into compliance within two months, failing which the case may be referred to the Court of Justice of the European Union.
Please contact Karel Janssens for further information about the above and/or for general legal advice relating to data protection and privacy law.