217. PROBLEM STATEMENT – Article 4(7) GDPR defines a controller as being a “natural person, legal person, public authority, agency or other body”. The definition thus refers to a broad range of subjects, ranging from natural to legal persons and including any “other body”. In practice, the question may arise whether an individual within an organisation should be considered as the “controller”, or whether instead this role should be attributed to the organisation of which he or she is a part. According to the Article 29 Working Party,

218. RELATIONSHIP WITH OTHER AREAS OF LAW – In Opinion 1/2010, the Working Party emphasizes that it is important to stick as closely as possible to the rules established by other areas of law, such as civil, administrative and criminal law. These rules indicate to what extent individuals, organisations or other bodies may be held responsible and will in principle help to determine which actor should be labelled as the “controller”. The following paragraphs will briefly look at the civil and criminal liability of organisations – and the individuals working on their behalf – from the perspective of Belgian law.

219. LIABILITY FOR AUXILIARIES AND AGENTS – Article 1384, subsection 3 of the Belgian Civil Code (C.C.) provides that masters and principals are liable for damage caused by their servants and appointees (“auxiliaries”). For Article 1384, subs. 3 to apply, the following three conditions must be met:

Article 1384, subs. 3 C.C. is generally applied to hold employers (and legal persons more generally) vicariously liable for actions of their employees and other subordinates.