DPA case 19/2020 – Complaint Upheld (Belgium, 2020)

The plaintiff filed a complaint with the Belgian DPA after noticing that their picture in the national registry had been consulted by a city official without indication of a motive, such as required by article 17 of the Belgian law organizing the national registry, and following the inability of the city to justify the consultation or provide a satisfactory response as to the outcome of its internal enquiry on the matter. The city argued in its defence, that there were clear internal procedures for the consultation of the national registry and that it could therefore have reasonably assumed that the data would be processed lawfully. Is assuming that the data be processed lawfully because of the knowledge of the law and internal procedures by employees sufficient? The Belgian DPA reminds that accountability in accordance as understood by article 24 GDPR resides not only in ensuring that the law and the internal procedures relating to data processing be known to employees, but also that those be clearly implemented and documented in order to be able to prove the lawful processing of the data. In this instance, the procedure for consultation of the national registry was inadequate because the motive of consultation had not to be provided in writing, although the motive in itself constitutes the decisive element for determining the lawfulness or not of the data processing.