The data protection officer in a private investigation

Article 20 of the Law of 18 May 2024 regulating private investigation requires every company and every internal private investigation service to employ that officer, or to conclude an agreement with an external one. The law leaves you the choice between your own employee and an outside appointment. It does not leave you the choice of having none.

Article 2, 17°, defines it as any service a company organises for its own needs in order to carry out private investigation activities on a structural basis, or which presents itself as such.

A personnel department that investigates an incident itself falls under a narrow exception. Article 43, fourth paragraph, exempts its members from the identification card when they carry out an incident investigation against the workers of their own employer. The fifth paragraph states that they still carry out their investigation activities in accordance with the provisions of the law. The substantive rules keep applying.

The supervisory authority imposes that fine, not the sanctioning official of the Belgian Home Affairs administration. Article 151, § 2, refers breaches of articles 20, 56 to 62 and 71 to 73 to article 221 of the Law on the processing of personal data. Those articles concern the officer, the consent requirement, the prohibited fields of investigation and the use of the investigation report.

Other breaches of the private investigation law follow a different route. Article 151, § 1, allows an administrative fine of 100 to 25,000 euro there, according to the ranges in the schedule of fines annexed to the law. Article 152 makes the fine compulsory on a repeat within three years.

The sanction of nullity works separately. Article 101, fourth paragraph, prescribes ten articles on pain of nullity: articles 7, 8, 57, 58, 62, 65, 81, 87, 96 and 109. Article 20 is not on that list, article 65 is. Article 65 allows an assignment against a worker of the client only where the authorisation and the rules for private investigations in the workplace stand expressly and transparently in a set of internal rules.

Article 55 appoints three: the company or the internal service, the party carrying out the assignment and the party ordering it. Each of them is the controller for the part of the data it processes. As the party ordering the work, you therefore do not pass that capacity on to the firm you engage.

That capacity brings the duties of the GDPR with it for the data you process yourself. Article 30 of the GDPR requires every controller to keep a record of processing activities. That record holds the contact details, the purposes of the processing, the categories of data subjects and of personal data, the categories of recipients, the transfers to third countries, the envisaged erasure periods and a general description of the security measures.

Article 30(3) asks for a written form, including an electronic one. Article 30(4) requires you to make the record available to the supervisory authority on request. Article 30(5) exempts companies with fewer than 250 persons, but that exemption falls away as soon as the processing is likely to result in a risk to the rights and freedoms of data subjects, as soon as it is not occasional, or as soon as it covers data referred to in article 9 or article 10 of the GDPR.

Settle the legal basis, the purpose and the retention period before the first data arrive, and enter the investigation in the record of processing activities. Write down who gets access to the file as well. That last step is a legal duty of its own.

Article 10 of the GDPR allows the processing of data relating to criminal convictions and offences only under the control of official authority, or where the law of a Member State authorises it with appropriate safeguards. Article 10, § 1, 1°, of the Belgian Law of 30 July 2018 grants that authorisation to legal persons governed by private law, in so far as the processing is necessary for the management of their own disputes.

Two conditions come with that authorisation. Article 10, § 2, requires the controller to draw up a list of the categories of persons who have access to those data. The same paragraph requires the controller to bind those persons to confidentiality, by contract or by law.

The Belgian Data Protection Authority does not accept the worker’s consent as a legal basis for electronic monitoring by the employer. It notes that the worker is necessarily in a subordinate position.

It points the employer to the legal right to exercise authority, strictly bound by the principles of purpose limitation, proportionality and transparency. It recommends writing the rules for electronic monitoring into the work regulations, with due regard for social dialogue. It also states that the collection should in principle stay global and that individualisation is in principle not allowed.

We go through these questions with you before anything is fixed. Our private investigation support runs from the first decision onwards. A fraud assessment maps out what you may investigate, and a corporate fraud audit carries a suspicion through to a report. On the work beforehand, see our page on fraud prevention, and on the investigation itself the page on fraud investigation.

Article 20 of the Law of 18 May 2024 regulating private investigation requires one from every company and every internal private investigation service. You choose between an employee of your own and an agreement with an external appointee. The law does not leave you the choice of having none. Article 151, § 2, places a breach of article 20 under the sanction regime of article 221 of the Belgian Law on the processing of personal data.

The supervisory authority, and not the sanctioning official of the Belgian Home Affairs administration. Article 151, § 2, refers breaches of articles 20, 56 to 62 and 71 to 73 to article 221 of the Law on the processing of personal data. For other breaches of the private investigation law, article 151, § 1, provides for an administrative fine of 100 to 25,000 euro according to the schedule of fines annexed to the law.

Article 55 of the private investigation law appoints three: the company or the internal service, the party carrying out the assignment and the party ordering it. Each of them is the controller for the part of the data it processes. As the party ordering the work, you do not pass that capacity on to the firm you engage. You carry the duties of the GDPR yourself for the data you process.

Yes, as soon as one of the conditions in article 30(5) of the GDPR is met. That provision exempts companies with fewer than 250 persons, but the exemption falls away as soon as the processing is likely to result in a risk to the rights and freedoms of data subjects, as soon as it is not occasional, or as soon as it covers data referred to in article 9 or article 10 of the GDPR. An investigation that processes data on offences falls under article 10.

No, the Belgian Data Protection Authority does not accept that consent as a legal basis for electronic monitoring by the employer. It notes that the worker is necessarily in a subordinate position. It points the employer to the legal right to exercise authority, strictly bound by the principles of purpose limitation, proportionality and transparency. It recommends writing those rules into the work regulations.