DPA case 22/2020 – Violation Found (Belgium, 2020)

The controller notified a data breach to the DPA after being notified by the CERT and, consequently, the DPA launched an investigation to determine possible violation of Articles 5, 24, 28, 33 and 34 GDPR. The litigation chamber held that the controller demonstrates that, in accordance with Article 24(1), it took necessary appropriate technical and organisational measures and also demonstrated that it had taken such measures at the request of the DPA. Specifically, the controller demonstrated that they: * included in its contracts with the processor the necessary provisions to regulate the processing of personal data by the processor, and more specifically to prohibit the processing of personal data for the purposes of development and testing of software by the latter; * developed and documented necessary internal risk assessment methods, both with regard to data breaches and with regard to the assessment of risks inherent to all processing activities, and submitted this documentation and an example of application of this methodology to the Litigation Chamber; * evaluate the effectiveness of the procedures and measures put in place by means of annual external audits; * as soon as it was informed of the data breach by the CERT, acted transparently both to the DPA and to affected data subjects. The controller submitted a notification form and an additional notification to the DPA in accordance with Article 33. The controller also notified the data subjects of the personal data breach in accordance with Article 34and published a press release; and * formally notified their processor of the prohibited processing and provided evidence thereof. For these reasons, the Chamber of Disputes held that there were no infringement of the GDPR.