As from 25 May 2018, the General Data Protection Legislation (“GDPR”) will apply in European countries, setting out a series of new privacy rules. The GDPR will, among other changes, have a direct effect on the functioning of independent supervisory authorities in EU member states. Belgium’s current supervisory authority is the Commission for the Protection of Privacy (also known as the Belgian Privacy Commission).
The Belgian Council of Ministers recently approved the preliminary draft of the law on the reform of the Belgian privacy authority. According to this draft, the Belgian Privacy Commission will be succeeded by a Belgian supervisory authority for the processing of personal data (the “Supervisory Authority”), an independent administrative authority with legal personality, composed of five different bodies: an executive committee, a general secretariat, a knowledge centre, an inspection body and a dispute chamber.
Whereas the Privacy Commission is currently an administrative body with limited sanctioning powers, the Supervisory Authority will have multiple independent departments, more powers and, most importantly, solid sanctioning powers. These sanctioning powers will be primarily executed by the inspection body and the dispute chamber.
The inspection body will function as the investigating body of the Supervisory Authority with a wide array of investigative powers. This includes the power to interrogate individuals, which must be performed in accordance with article 6 of the European Convention on Human Rights and with the right to a fair trial. The inspection body will be composed of inspectors, all having the capacity of Public Prosecutor.
The dispute chamber will be the Supervisory Authority’s administrative legal body, composed of a president and six judges, the president being a professional judge. The Supervisory Authority’s dispute chamber will be able to impose sanctions on infringing companies of up to EUR 20,000,000.00 or up to 4% of their total worldwide annual turnover. A second important innovation in this regard is that an appeal can be filed against the decision of the dispute chamber in the Brussels Court of Appeal, more specifically in the Market Chamber.
Despite the expansion of the Privacy Commission’s powers, the government has decided not to increase its budget. Therefore, the Supervisory Authority will have to perform more tasks than the Privacy Commission, but with the same resources. Keeping this in mind and given that all changes must be implemented on or before 25 May 2018, the question arises as to whether this timing and the high aspirations are realistic or (too?) optimistic.