A sound privacy policy is much more than a standard text at the bottom of a website. It must make clear which personal data an organisation processes, why that is done and which rights customers, employees, applicants, suppliers and other data subjects have. Under Belgian law, the GDPR forms the principal framework, supplemented by Belgian data protection legislation.
What must a privacy policy make clear?
A correct privacy policy must explain in understandable language which personal data are collected, for which purposes they are used and on which legal basis the processing relies. It must also be clear how long the data are retained, to whom they may be disclosed and whether data are processed outside the European Economic Area. The identity and contact details of the controller must also be stated. If a data protection officer has been appointed, that person’s contact details must also be available.
What rights do data subjects have?
The GDPR grants data subjects various rights. A privacy policy must inform them of those rights clearly. Depending on the situation, this includes among other things the right of access, rectification, erasure, restriction of processing, data portability and objection.
Where processing is based on consent, it must also be explained that that consent may be withdrawn again. It must furthermore be stated that data subjects may lodge a complaint with the Data Protection Authority.
How long may personal data be retained?
Personal data may not be retained indefinitely. An organisation must therefore indicate in its privacy policy which retention periods apply, or at least according to which criteria those periods are determined. Those periods must be aligned with the purpose for which the data are processed, statutory obligations and the organisation’s actual needs.
The privacy policy must correspond to practice
A text can sound legally sound, but that is not sufficient. The privacy policy must correspond to the actual processing of data within the organisation. What is communicated externally must match internal processes, retention periods, security measures and procedures. The policy must therefore also be consistent with internal compliance and, where relevant, with a DPA or processor agreement.
Additional attention for certain organisations
A municipality, hospital or organisation within the public sector often processes large volumes of personal data or sensitive data. That may entail additional obligations, such as the appointment of a data protection officer, stricter security measures or a data protection impact assessment for high-risk processing. Particularly in the case of health data, large-scale processing or public service delivery, a standard privacy statement is therefore often insufficient.
A sound privacy policy reduces legal risks
A correct privacy policy helps organisations not only to meet their information obligation. It also makes clear which choices have been made internally and reduces the risk of complaints, disputes and sanctions. What remains most important is that the policy is not only drafted in a legally correct manner, but also corresponds to what the organisation actually does with personal data.
