What is the impact of the WPO on your GDPR compliance? 

Why is the WPO also a GDPR matter?

The law that the WPO replaces dated from 1991, more than twenty years before the GDPR. So it is hardly surprising that the original law was badly outdated and not aligned with current data protection legislation. Closing that gap was one of the aims of the new Act. The WPO therefore explicitly confirms that the GDPR continues to apply in full, except where the Act itself makes use of the room the GDPR leaves to Member States.

That sounds very promising, but in practice it raises almost as many questions as it was meant to answer, if not more. The Data Protection Authority already issued an opinion on the draft WPO in 2020 and raised a series of objections, but this opinion was not followed on the key points.

As a result, the WPO is a law that aims to safeguard the GDPR but runs counter to it in several places. Below, we explain how this can affect your organisation.

What is the impact of the WPO on GDPR compliance within your organisation?

You must appoint a DPO, even if the GDPR does not require one

The WPO requires every private investigation company or internal service to appoint a data protection officer (DPO). Regardless of the size of your organisation, regardless of how many investigations you carry out. Even if you were not required to have one under the GDPR. To find out whether you have such an internal service, take a look at our other blog. The threshold is lower than you think.

Your documentation may need to be (re)assessed

The WPO requires you to draw up and maintain a number of documents. First and foremost, these are:

• The investigation regulations (whether or not you work with an internal service);
• The investigation assignment document, or the assignment register if you, as the client, are the investigator’s employer.

These have more in common with the GDPR and your existing documentation than you might think. After all, carrying out private investigations also involves processing personal data, and you probably already have policies on email monitoring and internet use, for example, which can be directly affected by private investigations. So it is worth (re)assessing these documents too and adjusting them where necessary, as they will need to work together on several levels.

Think, for example, of:

• The information security policy
• The camera policy
• The email or internet policy (e.g. regarding monitoring)
• The geolocation policy
• The record of processing activities (e.g. adding new recipients, because a new controller also means a new recipient)
• The technical and organisational security measures
• The access policy (e.g. restricting access to investigation files)

We regularly see documents that are missing, documents that exist but are not consistent with each other, or, perhaps most often, documents that are a dead letter and not applied in practice.

Take new controllers within your organisation into account

The WPO designates three controllers:

• The internal service, for what it collects and processes;
• The person accepting the assignment, for what they report;
• The client, for what it provides and for what it subsequently does with the report.

For an external private investigation company, this qualification is correct. For an internal service, however, it is less obvious. After all, these people are usually just employees, processing data on their employer’s network and on its explicit instructions. In GDPR terms, they act under the authority of the controller, which does not make them separate controllers. As an employer, you can generally never hide behind your own service or investigators.

The Data Protection Authority was clear about this in its opinion: even when a private investigator is given broad discretion, they cannot be regarded as a joint controller with their employer. It added that it would not consider itself bound by these qualifications when handling a complaint. Following that opinion, the private investigator was removed from the list, but the rest remained.

If you do follow the legal qualification, even though it raises questions, it is advisable to draw up an arrangement between the parties setting out who takes on which GDPR obligation, and to make it transparent to the data subjects. The most practical place for this is your investigation regulations, which have to be drawn up anyway. On top of that comes the usual GDPR housekeeping we mentioned earlier.

Bear in mind, however, that this qualification can significantly increase the obligations of your internal service. That service would then have to fulfil all the other obligations of a controller as well and, on a literal reading, keep its own record of processing activities, inform data subjects of their rights itself, take its own technical and organisational measures, etc. In practice, this hardly seems workable.

You must decide how to handle consent under the WPO

If you monitor your employees’ email or internet use, you are probably not doing so today on the basis of their consent, but simply on the basis of your right of supervision as an employer. It has long been known that consent in an employment relationship can hardly ever be freely given, because the relationship between employer and employee is unequal. The GDPR and collective bargaining agreements, such as CBA No. 81 on email and internet monitoring and CBA No. 68 on camera surveillance, govern that right of supervision.

The WPO, however, specifically requires consent in several places, for example for an interview with an employee as part of an investigation.

Consulting internal files makes things even trickier. The WPO provides that an investigator may not consult personal data from “non-publicly accessible automated files” without the consent of the data subject and of the controller of that processing. However, the WPO does not say what exactly such a file is. The Belgian Data Protection Authority reads it as a “database”. On a broad reading, your company’s IT network, including emails, internet traffic and camera footage, could just as well fall within it.

In practice, however, email and internet monitoring is already governed by CBA No. 81, which we mentioned above.

Handling consent under the WPO therefore calls for a pragmatic approach, which we briefly explain below.

You must inform data subjects of their GDPR rights before you can act on the investigation report

As mentioned in our other blog, a final report is drawn up after the internal investigation, after which you have 30 days to decide whether to act on it.

If you decide to act on it, the WPO prohibits you from using the information in the investigation report until the data subjects have been able to exercise their rights, such as the right to access, complete or rectify their data. For data subjects to be able to exercise those rights at all, they must first be informed in writing.

This is the point that regularly raises questions in practice, especially if you wish to dismiss the person under investigation for serious cause. In our other blog we discuss how this interacts with the three working days for a dismissal for serious cause.

You must delete the information from an investigation report you do not act on

If you do not act on the investigation report mentioned above, you may no longer use the information. This means the reports must be destroyed and nothing is communicated to the person under investigation.

Deleting this information may be feasible in practice, but from a GDPR perspective it is also somewhat surprising, as significant processing of personal data may have taken place without the data subject ever knowing about it.

This has concrete consequences for your GDPR retention policy, because you end up with three retention periods in a single file. The investigation file must be kept for three years and then destroyed by the private investigation company or internal service. The register of investigation assignments must be kept for five years by the private investigator. And for the company itself, as the client, the retention period is as long as necessary for its legitimate interest or to comply with a legal retention obligation. The Data Protection Authority had recommended five years for the investigation file, because breaches of data protection rules only become time-barred after five years, meaning you could still face a complaint after your file has already been destroyed. This advice, too, was not followed by the legislator.

How do you take a pragmatic approach to the consent required under the WPO?

How do you ask for consent for an interview with an employee?

For interviews with employees, it is best to work with well-developed investigation regulations and an information and consent form.

Among other things, you must communicate in advance:

• that the person concerned does not have to answer,
• that they may reread and correct the record of the interview,
• that they do not have to sign it,
• that they can end the interview at any time, and
• that they may be assisted by a person of their choice.

State explicitly that refusing has no adverse consequences, to keep that consent as free as possible.

How do you ask for consent to review emails, internet traffic and camera footage?

For email and internet monitoring, the answer is less obvious.

There is a defensible reading that you can simply continue to work under the existing applicable CBA. It is based first and foremost on an exception in the provision itself: the data subject’s consent is not required for data processed for the same purpose as the private investigation, or obtained on the basis of other legislation, provided that the controller of that processing agrees.

The preparatory works confirm this reading. Where another law already allows the client to use certain means, the investigator may do so too.

In our view, the defensible conclusion is therefore that monitoring email and internet traffic is still possible, provided you comply with the applicable CBA and the GDPR. That is precisely why your email or internet policy and your camera policy can no longer be viewed separately from your investigation regulations.

The National Labour Council had in fact explicitly asked for the Act to state that monitoring governed by national CBAs would continue to follow the rules of those CBAs. That did not happen.

On a strict reading of the Act, however, one could argue that you need consent for such monitoring from the moment a conflict arises.

What can you do now?

• Appoint a DPO if you have an internal investigation service, and keep them away from the investigations they have to monitor.
• Update your record of processing activities with the internal investigations and the new recipients.
• Align your camera policy, email policy, geolocation policy and any other policies with your investigation regulations.
• Build the duty to inform into your interview form, and make sure it is reflected in the record of the interview.
• Align your retention periods: three years for the investigation file, five years for the assignment register, and your own period as the client.

Conclusion

The WPO set out not only to bring internal investigations out of a legal vacuum, but also to bring them more into line with the GDPR. As you can read in both our blogs, that ambition has only been half achieved. In the division of responsibility, the role of consent in an employment relationship, the relationship with existing CBAs and the retention periods, the Act clashes with the logic of the very rules it set out to safeguard.

As we also wrote in our other blog, however, this does not change your task. The obligations already apply, and the regulator has made it clear that it will not be bound by the qualifications in this Act when handling a complaint. So do not look at your internal investigations separately from the GDPR, because the two interact more closely than you think.