Partnerblog
A hospital decided to proceed with the dismissal of an employee who combined the roles of Chief Information Security Officer (CISO) and Data Protection Officer (DPO). Under the GDPR, a DPO cannot be dismissed or penalised for performing their duties. Although Belgian law and the GDPR do not provide for a specific protection compensation for DPOs, the court awarded a compensation equivalent to three months’ salary.
What is a DPO?
The appointment of a Data Protection Officer (DPO) is mandatory for certain organisations under the GDPR. This is particularly the case for public authorities, organisations that engage in large-scale, regular, and systematic monitoring of individuals, and organisations that process sensitive personal data on a large scale. An important aspect of the DPO’s role is that they cannot be dismissed or penalised for reasons related to the performance of their duties. The GDPR nor the Belgian law provides in a specific sanction mechanism.
Background information
The employee was hired under an indefinite employment contract for the position of ‘specialised advisor (Chief Information Security Officer/Data Privacy Officer)’ at a public sector hospital. After nearly four years of employment, the employer informed the employee of its intention to dismiss the employee due to dissatisfaction with the work performed. The employee refused to accept this and was of the opinion that his dismissal was related to the performance of his duties as a DPO.
A few weeks later, the employer proceeded with the dismissal of the employee, with the payment of a severance compensation equivalent to 13 weeks’ salary. The employee subsequently initiated proceedings before the French-speaking labour court in Brussels.
On the one hand, he filed a claim for compensation for the dismissal as a ‘protected employee’, which he calculated ex aequo et bono at 3 months’ salary, and on the other hand, an additional claim for compensation of 17 weeks’ salary for abusive dismissal. That second claim was rejected by the court.
Compensation for dismissal of DPO
With regard to the claim for compensation as a ‘protected employee’, the employer argued that the dismissal had nothing to do with the essence of the employee’s duties as DPO but related to a lack of clear communication and mutual understanding. According to the employer, the DPO was too theoretical and rigid, making him unable to propose concrete action plans regarding the practical implementation of his recommendations.
The court held that the employer had acknowledged that it placed a priority on the performance of the CISO role and therefore showed minimal interest in how the employee fulfilled his duties as DPO. According to the court’s interpretation, it was precisely due to the inadequate execution of his duties as DPO that the employee was unable to properly perform his CISO role.
The court ruled that the functions of CISO and DPO were in fact intertwined and that the employer could not show that the reason for dismissal was solely related to the performance of the function as CISO.
Neither Belgian law nor the GDPR provides for a compensation in case of the dismissal of a DPO for reasons related to their role. The employee therefore calculated this compensation ex aequo et bono at 3 months’ salary. Referring to case law of the Court of Justice, the court ruled that the Belgian legislation was inadequate in this respect and referred in its assessment to various other legal mechanisms regarding dismissal protection. The court ultimately awarded a compensation equivalent to 3 months’ salary as was claimed by the employee.
Take-away
This is one of the first published cases in Belgium in which a compensation was awarded following the dismissal of an DPO. It shows the importance to clearly distinguish between the different tasks of an employee when they, in addition to their role as DPO, also perform other functions within the same organisation.
Authors
Matthias Vandamme, Attorney – Associate Claeys & Engels
