Decision of the Market Court of Brussels The Market Court annulled the decision and fine • The decision underlines the importance of regarding the Ambuce Rescue Team. conducting comprehensive impact assessments (DPIA’s). Data Protection Impact Assessments Our remarks ensure the thorough evaluation of risks of data subjects due to the processing of their data. It • Invoking a legal obligation within the meaning of should be noted that the “large-scale” nature of GDPR, Article 6(1)(c) or public interest within the the processing of special categories of personal meaning of GDPR, Article 9(2) requires the presence data is not solely determined by the number of of legal necessity under national or EU law. The data subjects involved. In this regard, the Ambuce protocol invoked by the airport did not, however, Rescue team pointed out that only eight people directly impose the use of temperature checks on had been subjected to second-line controls, passengers in the opinion of the Belgian DPA. As the arguing that the disputed processing did not fall protocol in question did not constitute a law in a under GDPR, Article 35(3)(b). However, according strict sense, the legal obligations originating from it to the DPIA Guidelines of the Article 29 Working could not be considered clear and precise enough Party, processing activities may also be considered to constitute standards of law within the meaning “large-scale” based on factors such as the of GDPR, Articles 6(1) and 9(2). quantity of personal data involved, the duration • When indicating the legal basis for processing or continuous nature of the processing activity, activities in a privacy policy, general references to and the geographical scope of the processing. “legal obligations and tasks of general interest” will Therefore, in the present case, the data controller not comply with the requirements of transparency should have included the second line of control in under the GDPR. Instead, the policy must clearly its DPIA. indicate which of the cases listed in Articles 6 or 9 are applicable to the disputed processing activities. 75