Appointment of the Data Protection Officer
The controller must appoint a DPO if the processing for archival, scientific or historical research purposes may give rise to risks specified in Art. 35 GDPR (Art. 190 of the Belgian Data Protection Act).
Records of processing activities
Pursuant to Art. 191 of the Belgian Data Protection Act, the record of processing activities must contain the following information:
- explanation as to whether the processing takes place with or without pseudonymization of the data
- justification why the exercise of data subjects’ rights would make the achievement of the purpose impossible or be significantly detrimental to it
- if needed, a DPIA, if within the scope of the processing purpose (archive purposes, scientific or historical research purposes) special personal data under Art. 9 section 1 GDPR is processed
Before the data is collected and without prejudice to Art. 24 (responsibility of the data controller) and Art. 30 (record of processing activities) GDPR, the following information is contained in the record of processing activities in case of processing for archival purposes in the public interest (Art. 192 of the Belgian Data Protection Act):
- justification of public interest in the archiving
- justification why the exercise of data subjects’ rights would make the achievement of the purpose impossible or be significantly detrimental to it
Informing duties
In accordance with Art. 193 of the Belgian Data Protection Act, without prejudice to Art. 13, the following information shall be made available to the data subject:
- the fact as to whether the processing takes place with or without pseudonymization of the data
- justification why the exercise of data subjects’ rights would make the achievement of the purpose impossible or be significantly detrimental to it
Agreement with the original controller
If the data is not collected directly from the data subject, the controller concludes a contract with the controller who collected the data (Art. 194 of the Belgian Data Protection Act).
Such contract shall contain:
- the contact details of the original and new controller
- justification why the exercise of data subjects’ rights would make the achievement of the purpose impossible or be significantly detrimental to it.
Furthermore, it shall be attached to the list of processing activities.
Research or statistical purposes
For the purposes of research or statistics, anonymized data shall be used. If this is not possible to reach the purpose, pseudonymized data must be used. If this is not possible, personal data may be used (Art. 197 of the Belgian Data Protection Act).
