Belgian Data Protection Authority Fines Bank For DPO's Conflicting Roles

In a decision of December 16, 2021, the Belgian Data Protection Authority ("DPA") imposed a EUR 75,000 administrative fine on a bank located in Belgium for failure to comply with the requirement in Article 38.6 of the General Data Protection Regulation ("GDPR") that the tasks and duties of the Data Protection Officer ("DPO") must not result in a conflict of interest.

The DPA opened an investigation into the bank's compliance with the GDPR, which was initially centered on the question whether or not the bank's information systems allowed data subjects to effectively exercise their GDPR rights, in particular the right to rectification. However, in the course of the investigation the DPA also decided to focus on the position of the bank's DPO.