Data protection litigation: preparing to defend yourself – or attack
If people were to look, they would probably conclude that you do not fully comply with data protection rules. Top of the line security always fails somewhere, typically at the human level, and the same reasoning applies to data protection compliance: even if you build your processes, systems and procedures with data protection rules in mind, you cannot prevent every mistake.
However mature your organisation may be in data protection terms, there is always a weakness – and non-compliance is then a likely consequence.
This provides regulators, competitors and data subjects with opportunities to attack you. Conversely, there may be cases where you wish to use weaknesses of a competitor or adversary against them.
Either way, you need to give careful thought to data protection litigation, both as a risk you have to manage and as an opportunity on which you can capitalise.
We will examine below practical considerations based on our own experience in cases before the Belgian Data Protection Authority (BDPA), the case law of the BDPA’s Litigation Chamber (and appeals before the Market Court) and commercial disputes in which the General Data Protection Regulation (GDPR) and other data protection rules come into play.