An investigation can be initiated by a simple complaint from an individual, at the request of a supervisory authority from another state, or at the request of Belgian judicial or administrative bodies. An investigation can also be initiated by the Belgian Data Protection Authority if it suspects that an offence has been committed of the GDPR, which it is responsible to monitor.
The inspection service has extensive powers to carry out its investigations. In particular, it can hold hearings, conduct an on-the-spot examination, identify the persons where the checks are conducted or identify the users of the communications services, investigate the way of consulting or copying information systems where the data are held. The investigators may also test the security systems and even seize property. Permission must be obtained from the investigating judge for the conducting of investigative actions that most encroach on the freedom of the person being investigated.
After completion of the investigation, a procedure could be initiated before the dispute chamber, which will also examine complaints and appeals against certain inspection measures. Cases can also be sent to the national jurisdiction.
If the dispute chamber decides to judge a case on the merits, a proper quasi-judicial procedure must be set up, so that the parties can be heard and can exchange their arguments.
The dispute chamber can dismiss or propose an amicable settlement. Equally, it can impose the following penalties: order that the processing of data be brought into conformity, impose a definitive ban on processing, or even impose penalties and administrative fines. These can amount to EUR 20,000,000 or 4% of the total worldwide annual turnover (this can be doubled in case of multiple offences).
In order to help you be in compliance with the GDPR, our firm has developed a data mapping tool to map your processing of personal data. Our data protection team will be glad to help you in this process and to answer all your questions. You can also visit our GDPR website: www.gdprbelgium.be.
> Action point
Prepare for the entry into force of the GDPR on 25 May 2018 and keep in mind the important powers of the Data Protection Authority, as well as the robust sanctions. More: Data Privacy Regulation –