Proximus (Belgium): Can the DPO Also Run Audit, Risk and Compliance?
No. The Belgian authority’s Litigation Chamber found that combining the DPO role with directing audit, risk and compliance created a conflict of interest under Article 38(6), and fined Proximus €50.000.
Case Summary
| Authority | Litigation Chamber, Belgian Data Protection Authority (APD) |
|---|---|
| Decision | Decision 18/2020, file AH-2019-0013, 28 April 2020 |
| Fine | €50.000 |
| Provisions | Art. 38(1) and 38(6) |
| Assessment | No intentional infringement, but serious negligence on Proximus’s part |
Background
Proximus, Belgium’s largest telecoms operator, self-reported a data breach. The inspection that followed looked at its organisational measures and uncovered the DPO set-up. The breach itself was not sanctioned (EDPO translation of Decision 18/2020).
Why It Breached GDPR
The DPO was also director of audit, risk and compliance, which the authority found created a conflict of interest. It also found the DPO was not sufficiently involved in discussions on personal data breaches, contrary to Art. 38(1) (Cleary Gottlieb analysis).
Timeline
Amber marks the decisive decision or ruling.
| Date | Event |
|---|---|
| GDPR applies, including the Art. 38(6) conflict-of-interest rule | |
| The Litigation Chamber issues Decision 18/2020 | |
| Proximus announces it will not appeal to the Market Court and will reform the DPO position |
The date of the breach notification that triggered the inspection is not public, so it is not plotted.
What Happened Next
Proximus announced it would not appeal to the Market Court and would comply with the decision by reforming its DPO position (& De Bandt; Cleary Cybersecurity and Privacy Watch).
Keep the DPO separate from functions that set or own processing decisions, and bring the DPO into breach handling from the start. The WP29 guidelines list heads of department and senior management roles as typical conflicts.
Frequently Asked Questions
Why was Proximus’s DPO set-up a conflict of interest?
The DPO was also director of audit, risk and compliance. The Belgian authority found that combination incompatible with Article 38(6).
Was Proximus fined for the data breach itself?
No. Proximus self-reported the breach, and the inspection that followed uncovered the DPO set-up. The breach itself was not sanctioned.
Did the authority find the infringement intentional?
No. It found no intentional infringement, but serious negligence on Proximus’s part.
Is your DPO wearing a second hat? An independent review spots the conflict before an inspection does.
Sources
- EDPO, translation of Belgian APD Decision 18/2020
- Cleary Gottlieb, The dilemma of the part-time DPO: lessons learned from the Proximus decision
- CMS Enforcement Tracker, ETid-272
- & De Bandt, The Belgian DPA imposes a fine of EUR 50,000 on Proximus