Personnal data

(Last updated in July 2024)

We process a number of your personal data to carry out our statutory tasks and to best assist you with your complaint about a Brussels public service or with your public interest disclosure.

We use your personal data in full compliance with The European General Data Protection Regulation (GDPR), the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data and any other relevant provisions relating to the processing of personal data in the context of disclosures, such as Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law (the “Whistleblower” Directive).

1. What data do we process and why?

We only process your personal data if we have a legal basis to do so. In most cases, data are processed in the context of our tasks as defined in the joint decree and ordinance of 16 May 2019 on the Brussels Ombudsman.

1.1. Your request for information or your complaint as a citizen

In the context of your request for information or your complaint as a citizen, we may process the following data:

  • identifying information such as your surname, your first name or your national register number;
  • your contact details such as your telephone number, your e-mail address or your postal address;
  • details about your occupation or your employment;
  • where relevant, we may also process other data, including medical data or data about any criminal offences, if required to deal with your request.

We receive these data from you, your representative and/or the administration. We retain your data for a period of ten years after we have processed your request for information or your complaint.

1.2. Your public interest disclosure and request for protection

As a member of staff (or former member of staff, supplier, subcontractor, job applicant) of a Brussels administration, you can report a breach of professional integrity to Ombuds Brussels or ask us for protection. In that context, we may process the following data:

  • identifying information such as your surname or first name;
  • your contact details such as your telephone number, your e-mail address or your postal address;
  • details about your occupation and your employment;
  • details about your personal file (employment, career, etc.);

where relevant, we may also process other data, including medical data or data about any criminal offences, if required to deal with your disclosure or request for protection.

Potentially other data relating to your disclosure or request for protection, including any medical data or data about any criminal offences. We receive these data from you, your representative and/or the administration. We retain your data for a period of ten years after your disclosure has been processed.

After we have processed your request for protection, we will retain your data for a period of ten years.

1.3. Collaboration with other organisations

In the context of our communications or our collaboration with other organisations (conferences or events), we may also share the following data with the co-organiser:

  • identifying information such as your surname and first name;
  • your contact details such as your email address;
  • details about your occupation and your employment;
  • other information about, for instance, a visit, an event or a collaboration.

We receive these data from you as a visitor or participant to/in an event or a collaboration, and/or from your representative or a contact person. We retain these data for a period of one year after the event, for event follow-up purposes or to send you an invitation to a new event we are organising.

1.4. Rights-related questions or requests (DPO)

As a citizen or a member of staff of a Brussels public service you can contact us if you wish to exercise your statutory data protection rights. In that context, we may process the following data:

  • identifying information such as your surname, your first name;
  • your contact details such as your telephone number or your e-mail address;
  • details about your occupation and your employment;

We receive these data from you, your representative and/or a Brussels public service and will retain your data for a period of one year after we have processed your question or request.

2. How do we use your data and whom do we share them with?

2.1. Data confidentiality

We only collect the data we need to manage your file and treat those data confidentially. We never share your data with third parties unless absolutely necessary for file-processing purposes.

We are bound by professional secrecy as stipulated by article 17 of the joint decree and ordinance on the Brussels Ombudsman.

In the context of a disclosure, this means that we do not disclose any secrets we were entrusted with unless we are summoned to testify in court or to appear before a parliamentary commission of inquiry.

2.2. Sharing of data

While processing your complaint, we may have to share your personal data with one of your representatives (lawyer, agent…) and with the administration or other mediation services.

When we investigate a breach of professional integrity and carry out an investigation, we may have to share your personal data with the head of Brussels public service, subject of the public interest disclosure, or with the responsible minister and/or the public prosecutor.

When you report a breach of professional integrity, your identity remains confidential: we do not reveal it and do not disclose any information that could identify you, unless we are summoned to testify in court or to appear before a parliamentary commission of inquiry.

If you ask us for protection, we may have to share your personal data with the administration that employs you to enable us to process your request.

Lastly, we may share your personal data with any subcontractors we work with and who process personal data on behalf of Ombuds Brussels.

2.3. Data transfers

If we are unable to help you but another mediator or ombudsman can, we are obliged by law to pass on your file, including your personal data, to the mediator or ombudsman in question. This obligation is enshrined in article 9 of the joint decree and ordinance on the Brussels Ombudsman.

If neither we, nor another mediator or ombudsman, are able to deal with your file, we will provide you with the contact details of the complaints department or any other service that will be able to help you. We will only pass on your file and your data to that service at your express request.

If we are unable to deal with your disclosure or your request for protection, but another competent authority can, we will pass on your file, including your personal data, in accordance with article 15/3 § 7 of the law we are governed by.

If neither we, nor another competent authority, are able to deal with your file, we will provide you with the contact details of the department that will be able to help you. We will only pass on your file and your data to that service at your express request.

Sometimes we organise events or conferences in collaboration with other organisations. If you attend, you will need to give us a number of data when you register which may be passed on to the co-organiser. We will always let you know if we do, at the time of registration for instance.

In principle, any data you share with us in the context of a rights-related question or request are not shared with other organisations, unless the Data Protection Authority asks us to.

In a number of exceptional situations we may be required to transfer your data to an authority of a country outside the European Union. This may for instance be the case if a non-European ombudsman has the competence to examine your file or if a complainant is not living within the European Union. In the absence of an adequacy decision or the appropriate guarantees, we will then base ourselves on important public interest grounds, because the transfer of data is required to enable us to carry out our statutory tasks. In all cases, we will ask you for your permission before transferring your file to a country outside the European Union.

2.4. Publications

We never reveal the identity of anyone who asked us for assistance in anything we publish. Our publications contain anonymised statistics on the number of complaints and disclosures we received over the course of the year, their admissibility, their processing time… We never publish any personal data.

Our reports, recommendations and other publications such as brochures for citizens and press releases may contain examples of the complaints or disclosures we received. They illustrate the issues we have been working on and the surnames and first names are always fictitious. In these accounts we also make sure that the people who turned to us cannot be identified.

3. What are your rights and how can you exercise them?

In accordance with the European General Data Protection Regulation (GDPR), you are entitled to consult your personal data, to request a copy of them, to have them corrected, to have their processing restricted, to object to their processing or to have them deleted. In function of the type of processing operation and the legal basis thereof, these rights may either or not apply.

4. How to contact us?

Do you have a question in relation to the processing of your personal data? Do you wish to exercise one of your rights? Contact us at:

dpo@ombuds.brussels
Ombuds Brussels
Place de la Vieille Halle aux Blés 1, 1000 Brussels

If you contact us to exercise one of your rights, we will get back to you within one month of your request having been received. However, sometimes it can take us longer to deal with your request (up to a maximum of 3 months). In that case, we will inform you of the reasons within one month.

Please, state clearly which right you wish to exercise and, if possible, the file and the data concerned. Whether or not you will be able to exercise your rights will depend on the type of data processing operation and the legal basis thereof.

We are determined to provide you with the best possible assistance. However, if you are unhappy with the way we handled your personal data, you are free to lodge a complaint with the Data Protection Authority.