Belgium

Belgian Order of Pharmacists

30,000 €

GDPR enforcement action by Belgian Data Protection Authority (APD) on 2023-06-16.

Rank · Sector

#87

of 356 in Public Sector and Education

Rank · Belgium

#17

of 50

Rank · All fines

#903

of 3,042

Case details

Authority: Belgian Data Protection Authority (APD)
Date: 2023-06-16
Controller / Processor: Belgian Order of Pharmacists
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) a), b), c), d), e) GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Belgian DPA has imposed a fine of EUR 30,000 on the Belgian Order of Pharmacists. The controller had conducted disciplinary proceedings against the data subject (pharmacist). As part of the disciplinary proceedings, the controller had collected personal data from the data subject in their personnel file. During its investigation, the DPA found that the controller had violated principles of data processing according to the GDPR in this context. For example, the DPA found that storing information on disciplinary actions without distinguishing the severity of the action for the period of the entire career seemde excessive and was therefore unlawful. The DPA also found that the controller had not adequately defined the associated storage purposes when storing the data.

Open original source Links to the regulator's original publication or another source.