DPA case 137/2023 – Complaint Upheld (Belgium, 2023)

On 20 May 2020 the data subject received a parking fine from a municipality, the controller, for a parking violation. On 6 July 2020, the data subject requested evidence of the parking violation in question and received several photographs of their vehicle. They also sought information on how their personal data was being processed and wanted to obtain the agreement concluded between the municipality (the controller) and a third-party service (the processor) used in the establishment and collection of the fee requested from them. Following their request, the data subject found that there was no data processing agreement in place at the time of the events. On 4 September 2020, the data subject submitted a complaint against both controller and processor for violation of Article 28(3) GDPR, which obliges controllers to implement a data processing agreement. On 20 November 2020, the DPA opened an investigation and transmitted the case to the Inspection Service (SI). On 11 May 2021, the SI's investigation was closed, and the case was transferred back to the DPA. The SI found that the processing contract between the controller and the processor was only entered into on 27 July 2020. The investigation found that at the time of processing of the data subject's data, no contract existed. However, the contract of 27 July 2020 included a retroactivity clause. The Belgian DPA found a violation of Articles 28, 14 and 12 GDPR. The Belgian DPA noted that Article 28(1) GDPR mandates a processor to provide sufficient guarantees to protect the rights of data subjects. Article 28(3) GDPR obliges controllers to implement a data processing agreement. The DPA held that including a retro-activity clause in the agreement does not remedy the absence of the contract at the time of the event. Such an admission would allow for the circumvention of the application of the obligations of Article 28(3) GDPR which aims to ensure the protection of the rights and freedoms of the data