Belgian Order of Pharmacists

Opis

The Belgian DPA has imposed a fine of EUR 30,000 on the Belgian Order of Pharmacists. The controller had conducted disciplinary proceedings against the data subject (pharmacist). As part of the disciplinary proceedings, the controller had collected personal data from the data subject in their personnel file. During its investigation, the DPA found that the controller had violated principles of data processing according to the GDPR in this context. For example, the DPA found that storing information on disciplinary actions without distinguishing the severity of the action for the period of the entire career seemde excessive and was therefore unlawful. The DPA also found that the controller had not adequately defined the associated storage purposes when storing the data.