Belgium: New collaboration agreement between the Belgian Data Protection Authority and DNS Belgium

Authors: Heidi Waem, Frederik Ringoot, Alizée Stappers

On 26 November 2020, the Belgian Data Protection Authority (BDPA) entered into a collaboration agreement with DNS Belgium, an association responsible for the registry of .be domain names. The agreement enables DNS to suspend or even delete .be websites involved in (alleged) data protection infringements, on simple request of the BDPA.

The potential impact on companies running a .be website is considerable, as most websites do not fully comply with cookie legislation (consent mechanisms used), data transfers outside of the EEA (after the Schrems II decision) and transparency obligations.

Who and why?

The BDPA is composed of five directorates. In the context of the cooperation agreement, two directorates were involved, namely the Inspection Service and the Litigation Chamber. The Inspection Service is responsible for examining complaints as well as serious indications of infringements of data protection legislation; whereas the Litigation Chamber, as the contentious body of the BDPA, is competent to order the suspension, restriction or prohibition of the processing of personal data.

Both directorates need to have appropriate means at their disposal in cases where data controllers or data processors do not comply with their injunctions. To that end, the “Notice and Action” procedure has been adopted and formalised in the cooperation agreement with DNS Belgium.

What and how?

The “Notice and Action” procedure is limited to infringements that have the greatest impact on the interests protected under the data protection legislation, and which are committed by organisations or persons who deliberately violate this legislation and continue processing personal data despite a previous order from the Inspection Service or the Litigation Chamber to suspend, limit, (temporarily) freeze or terminate it.

Step 1. On the proposal of the Inspector General or the President of the Litigation Chamber, the President of the BDPA sends a notification to DNS Belgium, mentioning the .be domain name concerned.

Step 2. Upon receipt of this notification, DNS Belgium sends a notification to the domain name holder and informs them that the observed use of the domain name constitutes an infringement of data protection legislation and DNS Belgium’s general terms and conditions.

Step 3. The domain name holder must comply with the rules within 14 days after said notification by DNS Belgium by ceasing the infringements, otherwise DNS Belgium may withdraw the right to use the domain name. Simultaneously to the notification, DNS Belgium will take the necessary technical measures to redirect the domain name indicated to a BDPA warning page, hosted by DNS Belgium.

Step 4. The BDPA assesses whether the domain name holder has complied with the requirements, or taken the necessary measures:

Step 4.1    If the BDPA confirms that the domain name holder did what was required or it does not provide any feedback to DNS Belgium within certain timeframes, DNS Belgium will withdraw the redirection to a warning page, and reintegrate the domain name within the .be registry, meaning the website is live again.

Step 4.2    However, if the domain name holder has not complied and the BDPA has not requested to suspend or stop the procedure for other reasons, DNS Belgium will continue to redirect the domain name to the DPA’s warning page for a further six months.

At the end of these 6 months, DNS Belgium attaches the domain name to one of its temporary accounts and then cancels the domain name. The domain name is then quarantined for 40 days.

At the end of this quarantine period, the domain name is released again and is available for registration on a “first come, first served” basis.

When?

The cooperation agreement entered into force on 1 December 2020, for an indefinite period.

Questions?

Several issues remain unclear at this stage. For instance, (i) how will the content of the warning page be drafted?; (ii) how will the domain name holder be able to defend itself before the BDPA?; and (iii) how could the right to appeal the decision of the BDPA be exercised by the domain name holder? DLA Piper’s team will closely follow any upcoming developments in that regard.