On April 25, 2019, the Belgian Data Protection Authority (the "Belgian DPA") published its Annual Activity Report for 2018 (the "Annual Report"), highlighting the main developments and accomplishments of the past year.
On May 25, 2018, the Belgian Privacy Commission became the Belgian DPA. The Belgian DPA is now composed of an Executive Committee and five bodies: the Knowledge Center, the Litigation Chamber, the Investigation Service, the General Secretariat and the Front Office.
Two new laws came into effect to create and reinforce the powers of the Belgian DPA as an investigation and sanctioning body: the Law of 3 December 2017, creating the Data Protection Authority, and the Law of 30 July 2018 on the Protection of Natural Persons with regard to the Processing of Personal Data, adapting the Belgian legal framework to the EU General Data Protection Regulation (the "GDPR").
2018 in Numbers
As in 2017, the number of files the Belgian DPA received in 2018 increased greatly. In total, 7,182 cases were processed by the Belgian DPA (a 46% increase from 2017), including 6,224 requests for information, 295 requests for mediation, 218 requests for investigation and 445 personal data breach notifications. The Belgian DPA also processed 215 requests for opinion in 2018, compared with 90 in 2017. The most common topics of information requests relate to the GDPR, data subjects' rights, CCTV, direct marketing, notifications and the right to one's image. The Annual Report notes that, generally, the data breaches reported to the Belgian DPA were caused by human error (28.09%), hacking, phishing and malware (22.70%), theft of materials (12.81%), system failure (10.56%) and improper use of access right (5.17%). The Annual Report also states that the Belgian DPA was notified of 3,666 data protection...